net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42 #include "aosp.h"
  43
  44 #define MGMT_VERSION    1
  45 #define MGMT_REVISION   22
  46
  47 static const u16 mgmt_commands[] = {
  48         MGMT_OP_READ_INDEX_LIST,
  49         MGMT_OP_READ_INFO,
  50         MGMT_OP_SET_POWERED,
  51         MGMT_OP_SET_DISCOVERABLE,
  52         MGMT_OP_SET_CONNECTABLE,
  53         MGMT_OP_SET_FAST_CONNECTABLE,
  54         MGMT_OP_SET_BONDABLE,
  55         MGMT_OP_SET_LINK_SECURITY,
  56         MGMT_OP_SET_SSP,
  57         MGMT_OP_SET_HS,
  58         MGMT_OP_SET_LE,
  59         MGMT_OP_SET_DEV_CLASS,
  60         MGMT_OP_SET_LOCAL_NAME,
  61         MGMT_OP_ADD_UUID,
  62         MGMT_OP_REMOVE_UUID,
  63         MGMT_OP_LOAD_LINK_KEYS,
  64         MGMT_OP_LOAD_LONG_TERM_KEYS,
  65         MGMT_OP_DISCONNECT,
  66         MGMT_OP_GET_CONNECTIONS,
  67         MGMT_OP_PIN_CODE_REPLY,
  68         MGMT_OP_PIN_CODE_NEG_REPLY,
  69         MGMT_OP_SET_IO_CAPABILITY,
  70         MGMT_OP_PAIR_DEVICE,
  71         MGMT_OP_CANCEL_PAIR_DEVICE,
  72         MGMT_OP_UNPAIR_DEVICE,
  73         MGMT_OP_USER_CONFIRM_REPLY,
  74         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  75         MGMT_OP_USER_PASSKEY_REPLY,
  76         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  77         MGMT_OP_READ_LOCAL_OOB_DATA,
  78         MGMT_OP_ADD_REMOTE_OOB_DATA,
  79         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  80         MGMT_OP_START_DISCOVERY,
  81         MGMT_OP_STOP_DISCOVERY,
  82         MGMT_OP_CONFIRM_NAME,
  83         MGMT_OP_BLOCK_DEVICE,
  84         MGMT_OP_UNBLOCK_DEVICE,
  85         MGMT_OP_SET_DEVICE_ID,
  86         MGMT_OP_SET_ADVERTISING,
  87         MGMT_OP_SET_BREDR,
  88         MGMT_OP_SET_STATIC_ADDRESS,
  89         MGMT_OP_SET_SCAN_PARAMS,
  90         MGMT_OP_SET_SECURE_CONN,
  91         MGMT_OP_SET_DEBUG_KEYS,
  92         MGMT_OP_SET_PRIVACY,
  93         MGMT_OP_LOAD_IRKS,
  94         MGMT_OP_GET_CONN_INFO,
  95         MGMT_OP_GET_CLOCK_INFO,
  96         MGMT_OP_ADD_DEVICE,
  97         MGMT_OP_REMOVE_DEVICE,
  98         MGMT_OP_LOAD_CONN_PARAM,
  99         MGMT_OP_READ_UNCONF_INDEX_LIST,
 100         MGMT_OP_READ_CONFIG_INFO,
 101         MGMT_OP_SET_EXTERNAL_CONFIG,
 102         MGMT_OP_SET_PUBLIC_ADDRESS,
 103         MGMT_OP_START_SERVICE_DISCOVERY,
 104         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 105         MGMT_OP_READ_EXT_INDEX_LIST,
 106         MGMT_OP_READ_ADV_FEATURES,
 107         MGMT_OP_ADD_ADVERTISING,
 108         MGMT_OP_REMOVE_ADVERTISING,
 109         MGMT_OP_GET_ADV_SIZE_INFO,
 110         MGMT_OP_START_LIMITED_DISCOVERY,
 111         MGMT_OP_READ_EXT_INFO,
 112         MGMT_OP_SET_APPEARANCE,
 113         MGMT_OP_GET_PHY_CONFIGURATION,
 114         MGMT_OP_SET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_BLOCKED_KEYS,
 116         MGMT_OP_SET_WIDEBAND_SPEECH,
 117         MGMT_OP_READ_CONTROLLER_CAP,
 118         MGMT_OP_READ_EXP_FEATURES_INFO,
 119         MGMT_OP_SET_EXP_FEATURE,
 120         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_GET_DEVICE_FLAGS,
 125         MGMT_OP_SET_DEVICE_FLAGS,
 126         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 127         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 128         MGMT_OP_REMOVE_ADV_MONITOR,
 129         MGMT_OP_ADD_EXT_ADV_PARAMS,
 130         MGMT_OP_ADD_EXT_ADV_DATA,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 132 };
 133
 134 static const u16 mgmt_events[] = {
 135         MGMT_EV_CONTROLLER_ERROR,
 136         MGMT_EV_INDEX_ADDED,
 137         MGMT_EV_INDEX_REMOVED,
 138         MGMT_EV_NEW_SETTINGS,
 139         MGMT_EV_CLASS_OF_DEV_CHANGED,
 140         MGMT_EV_LOCAL_NAME_CHANGED,
 141         MGMT_EV_NEW_LINK_KEY,
 142         MGMT_EV_NEW_LONG_TERM_KEY,
 143         MGMT_EV_DEVICE_CONNECTED,
 144         MGMT_EV_DEVICE_DISCONNECTED,
 145         MGMT_EV_CONNECT_FAILED,
 146         MGMT_EV_PIN_CODE_REQUEST,
 147         MGMT_EV_USER_CONFIRM_REQUEST,
 148         MGMT_EV_USER_PASSKEY_REQUEST,
 149         MGMT_EV_AUTH_FAILED,
 150         MGMT_EV_DEVICE_FOUND,
 151         MGMT_EV_DISCOVERING,
 152         MGMT_EV_DEVICE_BLOCKED,
 153         MGMT_EV_DEVICE_UNBLOCKED,
 154         MGMT_EV_DEVICE_UNPAIRED,
 155         MGMT_EV_PASSKEY_NOTIFY,
 156         MGMT_EV_NEW_IRK,
 157         MGMT_EV_NEW_CSRK,
 158         MGMT_EV_DEVICE_ADDED,
 159         MGMT_EV_DEVICE_REMOVED,
 160         MGMT_EV_NEW_CONN_PARAM,
 161         MGMT_EV_UNCONF_INDEX_ADDED,
 162         MGMT_EV_UNCONF_INDEX_REMOVED,
 163         MGMT_EV_NEW_CONFIG_OPTIONS,
 164         MGMT_EV_EXT_INDEX_ADDED,
 165         MGMT_EV_EXT_INDEX_REMOVED,
 166         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 167         MGMT_EV_ADVERTISING_ADDED,
 168         MGMT_EV_ADVERTISING_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 171         MGMT_EV_EXP_FEATURE_CHANGED,
 172         MGMT_EV_DEVICE_FLAGS_CHANGED,
 173         MGMT_EV_ADV_MONITOR_ADDED,
 174         MGMT_EV_ADV_MONITOR_REMOVED,
 175         MGMT_EV_CONTROLLER_SUSPEND,
 176         MGMT_EV_CONTROLLER_RESUME,
 177         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 178         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_errno_status(int err)
 283 {
 284         switch (err) {
 285         case 0:
 286                 return MGMT_STATUS_SUCCESS;
 287         case -EPERM:
 288                 return MGMT_STATUS_REJECTED;
 289         case -EINVAL:
 290                 return MGMT_STATUS_INVALID_PARAMS;
 291         case -EOPNOTSUPP:
 292                 return MGMT_STATUS_NOT_SUPPORTED;
 293         case -EBUSY:
 294                 return MGMT_STATUS_BUSY;
 295         case -ETIMEDOUT:
 296                 return MGMT_STATUS_AUTH_FAILED;
 297         case -ENOMEM:
 298                 return MGMT_STATUS_NO_RESOURCES;
 299         case -EISCONN:
 300                 return MGMT_STATUS_ALREADY_CONNECTED;
 301         case -ENOTCONN:
 302                 return MGMT_STATUS_DISCONNECTED;
 303         }
 304
 305         return MGMT_STATUS_FAILED;
 306 }
 307
 308 static u8 mgmt_status(int err)
 309 {
 310         if (err < 0)
 311                 return mgmt_errno_status(err);
 312
 313         if (err < ARRAY_SIZE(mgmt_status_table))
 314                 return mgmt_status_table[err];
 315
 316         return MGMT_STATUS_FAILED;
 317 }
 318
 319 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 320                             u16 len, int flag)
 321 {
 322         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 323                                flag, NULL);
 324 }
 325
 326 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 327                               u16 len, int flag, struct sock *skip_sk)
 328 {
 329         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 330                                flag, skip_sk);
 331 }
 332
 333 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 334                       struct sock *skip_sk)
 335 {
 336         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 337                                HCI_SOCK_TRUSTED, skip_sk);
 338 }
 339
 340 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 341 {
 342         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 343                                    skip_sk);
 344 }
 345
 346 static u8 le_addr_type(u8 mgmt_addr_type)
 347 {
 348         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 349                 return ADDR_LE_DEV_PUBLIC;
 350         else
 351                 return ADDR_LE_DEV_RANDOM;
 352 }
 353
 354 void mgmt_fill_version_info(void *ver)
 355 {
 356         struct mgmt_rp_read_version *rp = ver;
 357
 358         rp->version = MGMT_VERSION;
 359         rp->revision = cpu_to_le16(MGMT_REVISION);
 360 }
 361
 362 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 363                         u16 data_len)
 364 {
 365         struct mgmt_rp_read_version rp;
 366
 367         bt_dev_dbg(hdev, "sock %p", sk);
 368
 369         mgmt_fill_version_info(&rp);
 370
 371         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 372                                  &rp, sizeof(rp));
 373 }
 374
 375 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 376                          u16 data_len)
 377 {
 378         struct mgmt_rp_read_commands *rp;
 379         u16 num_commands, num_events;
 380         size_t rp_size;
 381         int i, err;
 382
 383         bt_dev_dbg(hdev, "sock %p", sk);
 384
 385         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 386                 num_commands = ARRAY_SIZE(mgmt_commands);
 387                 num_events = ARRAY_SIZE(mgmt_events);
 388         } else {
 389                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 390                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 391         }
 392
 393         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 394
 395         rp = kmalloc(rp_size, GFP_KERNEL);
 396         if (!rp)
 397                 return -ENOMEM;
 398
 399         rp->num_commands = cpu_to_le16(num_commands);
 400         rp->num_events = cpu_to_le16(num_events);
 401
 402         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 403                 __le16 *opcode = rp->opcodes;
 404
 405                 for (i = 0; i < num_commands; i++, opcode++)
 406                         put_unaligned_le16(mgmt_commands[i], opcode);
 407
 408                 for (i = 0; i < num_events; i++, opcode++)
 409                         put_unaligned_le16(mgmt_events[i], opcode);
 410         } else {
 411                 __le16 *opcode = rp->opcodes;
 412
 413                 for (i = 0; i < num_commands; i++, opcode++)
 414                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 415
 416                 for (i = 0; i < num_events; i++, opcode++)
 417                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 418         }
 419
 420         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 421                                 rp, rp_size);
 422         kfree(rp);
 423
 424         return err;
 425 }
 426
 427 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 428                            u16 data_len)
 429 {
 430         struct mgmt_rp_read_index_list *rp;
 431         struct hci_dev *d;
 432         size_t rp_len;
 433         u16 count;
 434         int err;
 435
 436         bt_dev_dbg(hdev, "sock %p", sk);
 437
 438         read_lock(&hci_dev_list_lock);
 439
 440         count = 0;
 441         list_for_each_entry(d, &hci_dev_list, list) {
 442                 if (d->dev_type == HCI_PRIMARY &&
 443                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 444                         count++;
 445         }
 446
 447         rp_len = sizeof(*rp) + (2 * count);
 448         rp = kmalloc(rp_len, GFP_ATOMIC);
 449         if (!rp) {
 450                 read_unlock(&hci_dev_list_lock);
 451                 return -ENOMEM;
 452         }
 453
 454         count = 0;
 455         list_for_each_entry(d, &hci_dev_list, list) {
 456                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 457                     hci_dev_test_flag(d, HCI_CONFIG) ||
 458                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 459                         continue;
 460
 461                 /* Devices marked as raw-only are neither configured
 462                  * nor unconfigured controllers.
 463                  */
 464                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 465                         continue;
 466
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 469                         rp->index[count++] = cpu_to_le16(d->id);
 470                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 471                 }
 472         }
 473
 474         rp->num_controllers = cpu_to_le16(count);
 475         rp_len = sizeof(*rp) + (2 * count);
 476
 477         read_unlock(&hci_dev_list_lock);
 478
 479         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 480                                 0, rp, rp_len);
 481
 482         kfree(rp);
 483
 484         return err;
 485 }
 486
 487 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 488                                   void *data, u16 data_len)
 489 {
 490         struct mgmt_rp_read_unconf_index_list *rp;
 491         struct hci_dev *d;
 492         size_t rp_len;
 493         u16 count;
 494         int err;
 495
 496         bt_dev_dbg(hdev, "sock %p", sk);
 497
 498         read_lock(&hci_dev_list_lock);
 499
 500         count = 0;
 501         list_for_each_entry(d, &hci_dev_list, list) {
 502                 if (d->dev_type == HCI_PRIMARY &&
 503                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 504                         count++;
 505         }
 506
 507         rp_len = sizeof(*rp) + (2 * count);
 508         rp = kmalloc(rp_len, GFP_ATOMIC);
 509         if (!rp) {
 510                 read_unlock(&hci_dev_list_lock);
 511                 return -ENOMEM;
 512         }
 513
 514         count = 0;
 515         list_for_each_entry(d, &hci_dev_list, list) {
 516                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 517                     hci_dev_test_flag(d, HCI_CONFIG) ||
 518                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 519                         continue;
 520
 521                 /* Devices marked as raw-only are neither configured
 522                  * nor unconfigured controllers.
 523                  */
 524                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 525                         continue;
 526
 527                 if (d->dev_type == HCI_PRIMARY &&
 528                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 529                         rp->index[count++] = cpu_to_le16(d->id);
 530                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 531                 }
 532         }
 533
 534         rp->num_controllers = cpu_to_le16(count);
 535         rp_len = sizeof(*rp) + (2 * count);
 536
 537         read_unlock(&hci_dev_list_lock);
 538
 539         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 540                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 541
 542         kfree(rp);
 543
 544         return err;
 545 }
 546
 547 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 548                                void *data, u16 data_len)
 549 {
 550         struct mgmt_rp_read_ext_index_list *rp;
 551         struct hci_dev *d;
 552         u16 count;
 553         int err;
 554
 555         bt_dev_dbg(hdev, "sock %p", sk);
 556
 557         read_lock(&hci_dev_list_lock);
 558
 559         count = 0;
 560         list_for_each_entry(d, &hci_dev_list, list) {
 561                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 562                         count++;
 563         }
 564
 565         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 566         if (!rp) {
 567                 read_unlock(&hci_dev_list_lock);
 568                 return -ENOMEM;
 569         }
 570
 571         count = 0;
 572         list_for_each_entry(d, &hci_dev_list, list) {
 573                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 574                     hci_dev_test_flag(d, HCI_CONFIG) ||
 575                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 576                         continue;
 577
 578                 /* Devices marked as raw-only are neither configured
 579                  * nor unconfigured controllers.
 580                  */
 581                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 582                         continue;
 583
 584                 if (d->dev_type == HCI_PRIMARY) {
 585                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 586                                 rp->entry[count].type = 0x01;
 587                         else
 588                                 rp->entry[count].type = 0x00;
 589                 } else if (d->dev_type == HCI_AMP) {
 590                         rp->entry[count].type = 0x02;
 591                 } else {
 592                         continue;
 593                 }
 594
 595                 rp->entry[count].bus = d->bus;
 596                 rp->entry[count++].index = cpu_to_le16(d->id);
 597                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 598         }
 599
 600         rp->num_controllers = cpu_to_le16(count);
 601
 602         read_unlock(&hci_dev_list_lock);
 603
 604         /* If this command is called at least once, then all the
 605          * default index and unconfigured index events are disabled
 606          * and from now on only extended index events are used.
 607          */
 608         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 609         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 610         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 611
 612         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 613                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 614                                 struct_size(rp, entry, count));
 615
 616         kfree(rp);
 617
 618         return err;
 619 }
 620
 621 static bool is_configured(struct hci_dev *hdev)
 622 {
 623         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 624             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 625                 return false;
 626
 627         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 628              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 629             !bacmp(&hdev->public_addr, BDADDR_ANY))
 630                 return false;
 631
 632         return true;
 633 }
 634
 635 static __le32 get_missing_options(struct hci_dev *hdev)
 636 {
 637         u32 options = 0;
 638
 639         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 640             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 641                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 642
 643         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 644              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 645             !bacmp(&hdev->public_addr, BDADDR_ANY))
 646                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 647
 648         return cpu_to_le32(options);
 649 }
 650
 651 static int new_options(struct hci_dev *hdev, struct sock *skip)
 652 {
 653         __le32 options = get_missing_options(hdev);
 654
 655         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 656                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 657 }
 658
 659 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 660 {
 661         __le32 options = get_missing_options(hdev);
 662
 663         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 664                                  sizeof(options));
 665 }
 666
 667 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 668                             void *data, u16 data_len)
 669 {
 670         struct mgmt_rp_read_config_info rp;
 671         u32 options = 0;
 672
 673         bt_dev_dbg(hdev, "sock %p", sk);
 674
 675         hci_dev_lock(hdev);
 676
 677         memset(&rp, 0, sizeof(rp));
 678         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 679
 680         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 681                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 682
 683         if (hdev->set_bdaddr)
 684                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 685
 686         rp.supported_options = cpu_to_le32(options);
 687         rp.missing_options = get_missing_options(hdev);
 688
 689         hci_dev_unlock(hdev);
 690
 691         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 692                                  &rp, sizeof(rp));
 693 }
 694
 695 static u32 get_supported_phys(struct hci_dev *hdev)
 696 {
 697         u32 supported_phys = 0;
 698
 699         if (lmp_bredr_capable(hdev)) {
 700                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 701
 702                 if (hdev->features[0][0] & LMP_3SLOT)
 703                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 704
 705                 if (hdev->features[0][0] & LMP_5SLOT)
 706                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 707
 708                 if (lmp_edr_2m_capable(hdev)) {
 709                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 710
 711                         if (lmp_edr_3slot_capable(hdev))
 712                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 713
 714                         if (lmp_edr_5slot_capable(hdev))
 715                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 716
 717                         if (lmp_edr_3m_capable(hdev)) {
 718                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 719
 720                                 if (lmp_edr_3slot_capable(hdev))
 721                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 722
 723                                 if (lmp_edr_5slot_capable(hdev))
 724                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 725                         }
 726                 }
 727         }
 728
 729         if (lmp_le_capable(hdev)) {
 730                 supported_phys |= MGMT_PHY_LE_1M_TX;
 731                 supported_phys |= MGMT_PHY_LE_1M_RX;
 732
 733                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 734                         supported_phys |= MGMT_PHY_LE_2M_TX;
 735                         supported_phys |= MGMT_PHY_LE_2M_RX;
 736                 }
 737
 738                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 739                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 740                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 741                 }
 742         }
 743
 744         return supported_phys;
 745 }
 746
 747 static u32 get_selected_phys(struct hci_dev *hdev)
 748 {
 749         u32 selected_phys = 0;
 750
 751         if (lmp_bredr_capable(hdev)) {
 752                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 753
 754                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 755                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 756
 757                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 758                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 759
 760                 if (lmp_edr_2m_capable(hdev)) {
 761                         if (!(hdev->pkt_type & HCI_2DH1))
 762                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 763
 764                         if (lmp_edr_3slot_capable(hdev) &&
 765                             !(hdev->pkt_type & HCI_2DH3))
 766                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 767
 768                         if (lmp_edr_5slot_capable(hdev) &&
 769                             !(hdev->pkt_type & HCI_2DH5))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 771
 772                         if (lmp_edr_3m_capable(hdev)) {
 773                                 if (!(hdev->pkt_type & HCI_3DH1))
 774                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 775
 776                                 if (lmp_edr_3slot_capable(hdev) &&
 777                                     !(hdev->pkt_type & HCI_3DH3))
 778                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 779
 780                                 if (lmp_edr_5slot_capable(hdev) &&
 781                                     !(hdev->pkt_type & HCI_3DH5))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 783                         }
 784                 }
 785         }
 786
 787         if (lmp_le_capable(hdev)) {
 788                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 789                         selected_phys |= MGMT_PHY_LE_1M_TX;
 790
 791                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 792                         selected_phys |= MGMT_PHY_LE_1M_RX;
 793
 794                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 795                         selected_phys |= MGMT_PHY_LE_2M_TX;
 796
 797                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 798                         selected_phys |= MGMT_PHY_LE_2M_RX;
 799
 800                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 801                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 802
 803                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 804                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 805         }
 806
 807         return selected_phys;
 808 }
 809
 810 static u32 get_configurable_phys(struct hci_dev *hdev)
 811 {
 812         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 813                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 814 }
 815
 816 static u32 get_supported_settings(struct hci_dev *hdev)
 817 {
 818         u32 settings = 0;
 819
 820         settings |= MGMT_SETTING_POWERED;
 821         settings |= MGMT_SETTING_BONDABLE;
 822         settings |= MGMT_SETTING_DEBUG_KEYS;
 823         settings |= MGMT_SETTING_CONNECTABLE;
 824         settings |= MGMT_SETTING_DISCOVERABLE;
 825
 826         if (lmp_bredr_capable(hdev)) {
 827                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 828                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 829                 settings |= MGMT_SETTING_BREDR;
 830                 settings |= MGMT_SETTING_LINK_SECURITY;
 831
 832                 if (lmp_ssp_capable(hdev)) {
 833                         settings |= MGMT_SETTING_SSP;
 834                         if (IS_ENABLED(CONFIG_BT_HS))
 835                                 settings |= MGMT_SETTING_HS;
 836                 }
 837
 838                 if (lmp_sc_capable(hdev))
 839                         settings |= MGMT_SETTING_SECURE_CONN;
 840
 841                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 842                              &hdev->quirks))
 843                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 844         }
 845
 846         if (lmp_le_capable(hdev)) {
 847                 settings |= MGMT_SETTING_LE;
 848                 settings |= MGMT_SETTING_SECURE_CONN;
 849                 settings |= MGMT_SETTING_PRIVACY;
 850                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 851                 settings |= MGMT_SETTING_ADVERTISING;
 852         }
 853
 854         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 855             hdev->set_bdaddr)
 856                 settings |= MGMT_SETTING_CONFIGURATION;
 857
 858         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 859
 860         return settings;
 861 }
 862
 863 static u32 get_current_settings(struct hci_dev *hdev)
 864 {
 865         u32 settings = 0;
 866
 867         if (hdev_is_powered(hdev))
 868                 settings |= MGMT_SETTING_POWERED;
 869
 870         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 871                 settings |= MGMT_SETTING_CONNECTABLE;
 872
 873         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 874                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 875
 876         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 877                 settings |= MGMT_SETTING_DISCOVERABLE;
 878
 879         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 880                 settings |= MGMT_SETTING_BONDABLE;
 881
 882         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 883                 settings |= MGMT_SETTING_BREDR;
 884
 885         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 886                 settings |= MGMT_SETTING_LE;
 887
 888         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 889                 settings |= MGMT_SETTING_LINK_SECURITY;
 890
 891         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 892                 settings |= MGMT_SETTING_SSP;
 893
 894         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 895                 settings |= MGMT_SETTING_HS;
 896
 897         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 898                 settings |= MGMT_SETTING_ADVERTISING;
 899
 900         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 901                 settings |= MGMT_SETTING_SECURE_CONN;
 902
 903         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 904                 settings |= MGMT_SETTING_DEBUG_KEYS;
 905
 906         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 907                 settings |= MGMT_SETTING_PRIVACY;
 908
 909         /* The current setting for static address has two purposes. The
 910          * first is to indicate if the static address will be used and
 911          * the second is to indicate if it is actually set.
 912          *
 913          * This means if the static address is not configured, this flag
 914          * will never be set. If the address is configured, then if the
 915          * address is actually used decides if the flag is set or not.
 916          *
 917          * For single mode LE only controllers and dual-mode controllers
 918          * with BR/EDR disabled, the existence of the static address will
 919          * be evaluated.
 920          */
 921         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 922             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 923             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 924                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 925                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 926         }
 927
 928         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 929                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 930
 931         return settings;
 932 }
 933
 934 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 935 {
 936         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 937 }
 938
 939 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 940 {
 941         struct mgmt_pending_cmd *cmd;
 942
 943         /* If there's a pending mgmt command the flags will not yet have
 944          * their final values, so check for this first.
 945          */
 946         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 947         if (cmd) {
 948                 struct mgmt_mode *cp = cmd->param;
 949                 if (cp->val == 0x01)
 950                         return LE_AD_GENERAL;
 951                 else if (cp->val == 0x02)
 952                         return LE_AD_LIMITED;
 953         } else {
 954                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 955                         return LE_AD_LIMITED;
 956                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 957                         return LE_AD_GENERAL;
 958         }
 959
 960         return 0;
 961 }
 962
 963 bool mgmt_get_connectable(struct hci_dev *hdev)
 964 {
 965         struct mgmt_pending_cmd *cmd;
 966
 967         /* If there's a pending mgmt command the flag will not yet have
 968          * it's final value, so check for this first.
 969          */
 970         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 971         if (cmd) {
 972                 struct mgmt_mode *cp = cmd->param;
 973
 974                 return cp->val;
 975         }
 976
 977         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 978 }
 979
 980 static int service_cache_sync(struct hci_dev *hdev, void *data)
 981 {
 982         hci_update_eir_sync(hdev);
 983         hci_update_class_sync(hdev);
 984
 985         return 0;
 986 }
 987
 988 static void service_cache_off(struct work_struct *work)
 989 {
 990         struct hci_dev *hdev = container_of(work, struct hci_dev,
 991                                             service_cache.work);
 992
 993         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 994                 return;
 995
 996         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
 997 }
 998
 999 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1000 {
1001         /* The generation of a new RPA and programming it into the
1002          * controller happens in the hci_req_enable_advertising()
1003          * function.
1004          */
1005         if (ext_adv_capable(hdev))
1006                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1007         else
1008                 return hci_enable_advertising_sync(hdev);
1009 }
1010
1011 static void rpa_expired(struct work_struct *work)
1012 {
1013         struct hci_dev *hdev = container_of(work, struct hci_dev,
1014                                             rpa_expired.work);
1015
1016         bt_dev_dbg(hdev, "");
1017
1018         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1019
1020         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1021                 return;
1022
1023         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1024 }
1025
1026 static void discov_off(struct work_struct *work)
1027 {
1028         struct hci_dev *hdev = container_of(work, struct hci_dev,
1029                                             discov_off.work);
1030
1031         bt_dev_dbg(hdev, "");
1032
1033         hci_dev_lock(hdev);
1034
1035         /* When discoverable timeout triggers, then just make sure
1036          * the limited discoverable flag is cleared. Even in the case
1037          * of a timeout triggered from general discoverable, it is
1038          * safe to unconditionally clear the flag.
1039          */
1040         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1041         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1042         hdev->discov_timeout = 0;
1043
1044         hci_update_discoverable(hdev);
1045
1046         mgmt_new_settings(hdev);
1047
1048         hci_dev_unlock(hdev);
1049 }
1050
1051 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1052 {
1053         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1054                 return;
1055
1056         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1057
1058         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1059         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1060         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1061
1062         /* Non-mgmt controlled devices get this bit set
1063          * implicitly so that pairing works for them, however
1064          * for mgmt we require user-space to explicitly enable
1065          * it
1066          */
1067         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1068 }
1069
1070 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1071                                 void *data, u16 data_len)
1072 {
1073         struct mgmt_rp_read_info rp;
1074
1075         bt_dev_dbg(hdev, "sock %p", sk);
1076
1077         hci_dev_lock(hdev);
1078
1079         memset(&rp, 0, sizeof(rp));
1080
1081         bacpy(&rp.bdaddr, &hdev->bdaddr);
1082
1083         rp.version = hdev->hci_ver;
1084         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1085
1086         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1087         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1088
1089         memcpy(rp.dev_class, hdev->dev_class, 3);
1090
1091         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1092         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1093
1094         hci_dev_unlock(hdev);
1095
1096         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1097                                  sizeof(rp));
1098 }
1099
1100 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1101 {
1102         u16 eir_len = 0;
1103         size_t name_len;
1104
1105         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1106                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1107                                           hdev->dev_class, 3);
1108
1109         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1110                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1111                                           hdev->appearance);
1112
1113         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1114         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1115                                   hdev->dev_name, name_len);
1116
1117         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1118         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1119                                   hdev->short_name, name_len);
1120
1121         return eir_len;
1122 }
1123
1124 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1125                                     void *data, u16 data_len)
1126 {
1127         char buf[512];
1128         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1129         u16 eir_len;
1130
1131         bt_dev_dbg(hdev, "sock %p", sk);
1132
1133         memset(&buf, 0, sizeof(buf));
1134
1135         hci_dev_lock(hdev);
1136
1137         bacpy(&rp->bdaddr, &hdev->bdaddr);
1138
1139         rp->version = hdev->hci_ver;
1140         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1141
1142         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1143         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1144
1145
1146         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1147         rp->eir_len = cpu_to_le16(eir_len);
1148
1149         hci_dev_unlock(hdev);
1150
1151         /* If this command is called at least once, then the events
1152          * for class of device and local name changes are disabled
1153          * and only the new extended controller information event
1154          * is used.
1155          */
1156         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1157         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1158         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1159
1160         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1161                                  sizeof(*rp) + eir_len);
1162 }
1163
1164 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1165 {
1166         char buf[512];
1167         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1168         u16 eir_len;
1169
1170         memset(buf, 0, sizeof(buf));
1171
1172         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1173         ev->eir_len = cpu_to_le16(eir_len);
1174
1175         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1176                                   sizeof(*ev) + eir_len,
1177                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1178 }
1179
1180 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1181 {
1182         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1183
1184         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1185                                  sizeof(settings));
1186 }
1187
1188 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1189 {
1190         struct mgmt_ev_advertising_added ev;
1191
1192         ev.instance = instance;
1193
1194         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1195 }
1196
1197 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1198                               u8 instance)
1199 {
1200         struct mgmt_ev_advertising_removed ev;
1201
1202         ev.instance = instance;
1203
1204         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1205 }
1206
1207 static void cancel_adv_timeout(struct hci_dev *hdev)
1208 {
1209         if (hdev->adv_instance_timeout) {
1210                 hdev->adv_instance_timeout = 0;
1211                 cancel_delayed_work(&hdev->adv_instance_expire);
1212         }
1213 }
1214
1215 /* This function requires the caller holds hdev->lock */
1216 static void restart_le_actions(struct hci_dev *hdev)
1217 {
1218         struct hci_conn_params *p;
1219
1220         list_for_each_entry(p, &hdev->le_conn_params, list) {
1221                 /* Needed for AUTO_OFF case where might not "really"
1222                  * have been powered off.
1223                  */
1224                 list_del_init(&p->action);
1225
1226                 switch (p->auto_connect) {
1227                 case HCI_AUTO_CONN_DIRECT:
1228                 case HCI_AUTO_CONN_ALWAYS:
1229                         list_add(&p->action, &hdev->pend_le_conns);
1230                         break;
1231                 case HCI_AUTO_CONN_REPORT:
1232                         list_add(&p->action, &hdev->pend_le_reports);
1233                         break;
1234                 default:
1235                         break;
1236                 }
1237         }
1238 }
1239
1240 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1241 {
1242         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1243
1244         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1245                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1246 }
1247
1248 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1249 {
1250         struct mgmt_pending_cmd *cmd = data;
1251         struct mgmt_mode *cp;
1252
1253         /* Make sure cmd still outstanding. */
1254         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1255                 return;
1256
1257         cp = cmd->param;
1258
1259         bt_dev_dbg(hdev, "err %d", err);
1260
1261         if (!err) {
1262                 if (cp->val) {
1263                         hci_dev_lock(hdev);
1264                         restart_le_actions(hdev);
1265                         hci_update_passive_scan(hdev);
1266                         hci_dev_unlock(hdev);
1267                 }
1268
1269                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1270
1271                 /* Only call new_setting for power on as power off is deferred
1272                  * to hdev->power_off work which does call hci_dev_do_close.
1273                  */
1274                 if (cp->val)
1275                         new_settings(hdev, cmd->sk);
1276         } else {
1277                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1278                                 mgmt_status(err));
1279         }
1280
1281         mgmt_pending_remove(cmd);
1282 }
1283
1284 static int set_powered_sync(struct hci_dev *hdev, void *data)
1285 {
1286         struct mgmt_pending_cmd *cmd = data;
1287         struct mgmt_mode *cp = cmd->param;
1288
1289         BT_DBG("%s", hdev->name);
1290
1291         return hci_set_powered_sync(hdev, cp->val);
1292 }
1293
1294 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1295                        u16 len)
1296 {
1297         struct mgmt_mode *cp = data;
1298         struct mgmt_pending_cmd *cmd;
1299         int err;
1300
1301         bt_dev_dbg(hdev, "sock %p", sk);
1302
1303         if (cp->val != 0x00 && cp->val != 0x01)
1304                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1305                                        MGMT_STATUS_INVALID_PARAMS);
1306
1307         hci_dev_lock(hdev);
1308
1309         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1310                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1311                                       MGMT_STATUS_BUSY);
1312                 goto failed;
1313         }
1314
1315         if (!!cp->val == hdev_is_powered(hdev)) {
1316                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1317                 goto failed;
1318         }
1319
1320         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1321         if (!cmd) {
1322                 err = -ENOMEM;
1323                 goto failed;
1324         }
1325
1326         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1327                                  mgmt_set_powered_complete);
1328
1329         if (err < 0)
1330                 mgmt_pending_remove(cmd);
1331
1332 failed:
1333         hci_dev_unlock(hdev);
1334         return err;
1335 }
1336
1337 int mgmt_new_settings(struct hci_dev *hdev)
1338 {
1339         return new_settings(hdev, NULL);
1340 }
1341
1342 struct cmd_lookup {
1343         struct sock *sk;
1344         struct hci_dev *hdev;
1345         u8 mgmt_status;
1346 };
1347
1348 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1349 {
1350         struct cmd_lookup *match = data;
1351
1352         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1353
1354         list_del(&cmd->list);
1355
1356         if (match->sk == NULL) {
1357                 match->sk = cmd->sk;
1358                 sock_hold(match->sk);
1359         }
1360
1361         mgmt_pending_free(cmd);
1362 }
1363
1364 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1365 {
1366         u8 *status = data;
1367
1368         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1369         mgmt_pending_remove(cmd);
1370 }
1371
1372 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1373 {
1374         if (cmd->cmd_complete) {
1375                 u8 *status = data;
1376
1377                 cmd->cmd_complete(cmd, *status);
1378                 mgmt_pending_remove(cmd);
1379
1380                 return;
1381         }
1382
1383         cmd_status_rsp(cmd, data);
1384 }
1385
1386 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1387 {
1388         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1389                                  cmd->param, cmd->param_len);
1390 }
1391
1392 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1393 {
1394         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1395                                  cmd->param, sizeof(struct mgmt_addr_info));
1396 }
1397
1398 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1399 {
1400         if (!lmp_bredr_capable(hdev))
1401                 return MGMT_STATUS_NOT_SUPPORTED;
1402         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1403                 return MGMT_STATUS_REJECTED;
1404         else
1405                 return MGMT_STATUS_SUCCESS;
1406 }
1407
1408 static u8 mgmt_le_support(struct hci_dev *hdev)
1409 {
1410         if (!lmp_le_capable(hdev))
1411                 return MGMT_STATUS_NOT_SUPPORTED;
1412         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1413                 return MGMT_STATUS_REJECTED;
1414         else
1415                 return MGMT_STATUS_SUCCESS;
1416 }
1417
1418 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1419                                            int err)
1420 {
1421         struct mgmt_pending_cmd *cmd = data;
1422
1423         bt_dev_dbg(hdev, "err %d", err);
1424
1425         /* Make sure cmd still outstanding. */
1426         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1427                 return;
1428
1429         hci_dev_lock(hdev);
1430
1431         if (err) {
1432                 u8 mgmt_err = mgmt_status(err);
1433                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1434                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1435                 goto done;
1436         }
1437
1438         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1439             hdev->discov_timeout > 0) {
1440                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1441                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1442         }
1443
1444         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1445         new_settings(hdev, cmd->sk);
1446
1447 done:
1448         mgmt_pending_remove(cmd);
1449         hci_dev_unlock(hdev);
1450 }
1451
1452 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1453 {
1454         BT_DBG("%s", hdev->name);
1455
1456         return hci_update_discoverable_sync(hdev);
1457 }
1458
1459 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1460                             u16 len)
1461 {
1462         struct mgmt_cp_set_discoverable *cp = data;
1463         struct mgmt_pending_cmd *cmd;
1464         u16 timeout;
1465         int err;
1466
1467         bt_dev_dbg(hdev, "sock %p", sk);
1468
1469         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1470             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1472                                        MGMT_STATUS_REJECTED);
1473
1474         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1475                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1476                                        MGMT_STATUS_INVALID_PARAMS);
1477
1478         timeout = __le16_to_cpu(cp->timeout);
1479
1480         /* Disabling discoverable requires that no timeout is set,
1481          * and enabling limited discoverable requires a timeout.
1482          */
1483         if ((cp->val == 0x00 && timeout > 0) ||
1484             (cp->val == 0x02 && timeout == 0))
1485                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1486                                        MGMT_STATUS_INVALID_PARAMS);
1487
1488         hci_dev_lock(hdev);
1489
1490         if (!hdev_is_powered(hdev) && timeout > 0) {
1491                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1492                                       MGMT_STATUS_NOT_POWERED);
1493                 goto failed;
1494         }
1495
1496         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1497             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1498                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1499                                       MGMT_STATUS_BUSY);
1500                 goto failed;
1501         }
1502
1503         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1504                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1505                                       MGMT_STATUS_REJECTED);
1506                 goto failed;
1507         }
1508
1509         if (hdev->advertising_paused) {
1510                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1511                                       MGMT_STATUS_BUSY);
1512                 goto failed;
1513         }
1514
1515         if (!hdev_is_powered(hdev)) {
1516                 bool changed = false;
1517
1518                 /* Setting limited discoverable when powered off is
1519                  * not a valid operation since it requires a timeout
1520                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1521                  */
1522                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1523                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1524                         changed = true;
1525                 }
1526
1527                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1528                 if (err < 0)
1529                         goto failed;
1530
1531                 if (changed)
1532                         err = new_settings(hdev, sk);
1533
1534                 goto failed;
1535         }
1536
1537         /* If the current mode is the same, then just update the timeout
1538          * value with the new value. And if only the timeout gets updated,
1539          * then no need for any HCI transactions.
1540          */
1541         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1542             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1543                                                    HCI_LIMITED_DISCOVERABLE)) {
1544                 cancel_delayed_work(&hdev->discov_off);
1545                 hdev->discov_timeout = timeout;
1546
1547                 if (cp->val && hdev->discov_timeout > 0) {
1548                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1549                         queue_delayed_work(hdev->req_workqueue,
1550                                            &hdev->discov_off, to);
1551                 }
1552
1553                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1554                 goto failed;
1555         }
1556
1557         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1558         if (!cmd) {
1559                 err = -ENOMEM;
1560                 goto failed;
1561         }
1562
1563         /* Cancel any potential discoverable timeout that might be
1564          * still active and store new timeout value. The arming of
1565          * the timeout happens in the complete handler.
1566          */
1567         cancel_delayed_work(&hdev->discov_off);
1568         hdev->discov_timeout = timeout;
1569
1570         if (cp->val)
1571                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1572         else
1573                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1574
1575         /* Limited discoverable mode */
1576         if (cp->val == 0x02)
1577                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1578         else
1579                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1580
1581         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1582                                  mgmt_set_discoverable_complete);
1583
1584         if (err < 0)
1585                 mgmt_pending_remove(cmd);
1586
1587 failed:
1588         hci_dev_unlock(hdev);
1589         return err;
1590 }
1591
1592 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1593                                           int err)
1594 {
1595         struct mgmt_pending_cmd *cmd = data;
1596
1597         bt_dev_dbg(hdev, "err %d", err);
1598
1599         /* Make sure cmd still outstanding. */
1600         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1601                 return;
1602
1603         hci_dev_lock(hdev);
1604
1605         if (err) {
1606                 u8 mgmt_err = mgmt_status(err);
1607                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1608                 goto done;
1609         }
1610
1611         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1612         new_settings(hdev, cmd->sk);
1613
1614 done:
1615         if (cmd)
1616                 mgmt_pending_remove(cmd);
1617
1618         hci_dev_unlock(hdev);
1619 }
1620
1621 static int set_connectable_update_settings(struct hci_dev *hdev,
1622                                            struct sock *sk, u8 val)
1623 {
1624         bool changed = false;
1625         int err;
1626
1627         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1628                 changed = true;
1629
1630         if (val) {
1631                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1632         } else {
1633                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1634                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1635         }
1636
1637         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1638         if (err < 0)
1639                 return err;
1640
1641         if (changed) {
1642                 hci_update_scan(hdev);
1643                 hci_update_passive_scan(hdev);
1644                 return new_settings(hdev, sk);
1645         }
1646
1647         return 0;
1648 }
1649
1650 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1651 {
1652         BT_DBG("%s", hdev->name);
1653
1654         return hci_update_connectable_sync(hdev);
1655 }
1656
1657 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1658                            u16 len)
1659 {
1660         struct mgmt_mode *cp = data;
1661         struct mgmt_pending_cmd *cmd;
1662         int err;
1663
1664         bt_dev_dbg(hdev, "sock %p", sk);
1665
1666         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1667             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1668                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1669                                        MGMT_STATUS_REJECTED);
1670
1671         if (cp->val != 0x00 && cp->val != 0x01)
1672                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1673                                        MGMT_STATUS_INVALID_PARAMS);
1674
1675         hci_dev_lock(hdev);
1676
1677         if (!hdev_is_powered(hdev)) {
1678                 err = set_connectable_update_settings(hdev, sk, cp->val);
1679                 goto failed;
1680         }
1681
1682         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1683             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1684                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1685                                       MGMT_STATUS_BUSY);
1686                 goto failed;
1687         }
1688
1689         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1690         if (!cmd) {
1691                 err = -ENOMEM;
1692                 goto failed;
1693         }
1694
1695         if (cp->val) {
1696                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1697         } else {
1698                 if (hdev->discov_timeout > 0)
1699                         cancel_delayed_work(&hdev->discov_off);
1700
1701                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1702                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1703                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1704         }
1705
1706         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1707                                  mgmt_set_connectable_complete);
1708
1709         if (err < 0)
1710                 mgmt_pending_remove(cmd);
1711
1712 failed:
1713         hci_dev_unlock(hdev);
1714         return err;
1715 }
1716
1717 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1718                         u16 len)
1719 {
1720         struct mgmt_mode *cp = data;
1721         bool changed;
1722         int err;
1723
1724         bt_dev_dbg(hdev, "sock %p", sk);
1725
1726         if (cp->val != 0x00 && cp->val != 0x01)
1727                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1728                                        MGMT_STATUS_INVALID_PARAMS);
1729
1730         hci_dev_lock(hdev);
1731
1732         if (cp->val)
1733                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1734         else
1735                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1736
1737         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1738         if (err < 0)
1739                 goto unlock;
1740
1741         if (changed) {
1742                 /* In limited privacy mode the change of bondable mode
1743                  * may affect the local advertising address.
1744                  */
1745                 hci_update_discoverable(hdev);
1746
1747                 err = new_settings(hdev, sk);
1748         }
1749
1750 unlock:
1751         hci_dev_unlock(hdev);
1752         return err;
1753 }
1754
1755 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1756                              u16 len)
1757 {
1758         struct mgmt_mode *cp = data;
1759         struct mgmt_pending_cmd *cmd;
1760         u8 val, status;
1761         int err;
1762
1763         bt_dev_dbg(hdev, "sock %p", sk);
1764
1765         status = mgmt_bredr_support(hdev);
1766         if (status)
1767                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1768                                        status);
1769
1770         if (cp->val != 0x00 && cp->val != 0x01)
1771                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1772                                        MGMT_STATUS_INVALID_PARAMS);
1773
1774         hci_dev_lock(hdev);
1775
1776         if (!hdev_is_powered(hdev)) {
1777                 bool changed = false;
1778
1779                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1780                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1781                         changed = true;
1782                 }
1783
1784                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1785                 if (err < 0)
1786                         goto failed;
1787
1788                 if (changed)
1789                         err = new_settings(hdev, sk);
1790
1791                 goto failed;
1792         }
1793
1794         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1795                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1796                                       MGMT_STATUS_BUSY);
1797                 goto failed;
1798         }
1799
1800         val = !!cp->val;
1801
1802         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1803                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1804                 goto failed;
1805         }
1806
1807         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1808         if (!cmd) {
1809                 err = -ENOMEM;
1810                 goto failed;
1811         }
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1825 {
1826         struct cmd_lookup match = { NULL, hdev };
1827         struct mgmt_pending_cmd *cmd = data;
1828         struct mgmt_mode *cp = cmd->param;
1829         u8 enable = cp->val;
1830         bool changed;
1831
1832         /* Make sure cmd still outstanding. */
1833         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1834                 return;
1835
1836         if (err) {
1837                 u8 mgmt_err = mgmt_status(err);
1838
1839                 if (enable && hci_dev_test_and_clear_flag(hdev,
1840                                                           HCI_SSP_ENABLED)) {
1841                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1842                         new_settings(hdev, NULL);
1843                 }
1844
1845                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1846                                      &mgmt_err);
1847                 return;
1848         }
1849
1850         if (enable) {
1851                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1852         } else {
1853                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1854
1855                 if (!changed)
1856                         changed = hci_dev_test_and_clear_flag(hdev,
1857                                                               HCI_HS_ENABLED);
1858                 else
1859                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1860         }
1861
1862         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1863
1864         if (changed)
1865                 new_settings(hdev, match.sk);
1866
1867         if (match.sk)
1868                 sock_put(match.sk);
1869
1870         hci_update_eir_sync(hdev);
1871 }
1872
1873 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1874 {
1875         struct mgmt_pending_cmd *cmd = data;
1876         struct mgmt_mode *cp = cmd->param;
1877         bool changed = false;
1878         int err;
1879
1880         if (cp->val)
1881                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1882
1883         err = hci_write_ssp_mode_sync(hdev, cp->val);
1884
1885         if (!err && changed)
1886                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1887
1888         return err;
1889 }
1890
1891 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1892 {
1893         struct mgmt_mode *cp = data;
1894         struct mgmt_pending_cmd *cmd;
1895         u8 status;
1896         int err;
1897
1898         bt_dev_dbg(hdev, "sock %p", sk);
1899
1900         status = mgmt_bredr_support(hdev);
1901         if (status)
1902                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1903
1904         if (!lmp_ssp_capable(hdev))
1905                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1906                                        MGMT_STATUS_NOT_SUPPORTED);
1907
1908         if (cp->val != 0x00 && cp->val != 0x01)
1909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1910                                        MGMT_STATUS_INVALID_PARAMS);
1911
1912         hci_dev_lock(hdev);
1913
1914         if (!hdev_is_powered(hdev)) {
1915                 bool changed;
1916
1917                 if (cp->val) {
1918                         changed = !hci_dev_test_and_set_flag(hdev,
1919                                                              HCI_SSP_ENABLED);
1920                 } else {
1921                         changed = hci_dev_test_and_clear_flag(hdev,
1922                                                               HCI_SSP_ENABLED);
1923                         if (!changed)
1924                                 changed = hci_dev_test_and_clear_flag(hdev,
1925                                                                       HCI_HS_ENABLED);
1926                         else
1927                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1928                 }
1929
1930                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1931                 if (err < 0)
1932                         goto failed;
1933
1934                 if (changed)
1935                         err = new_settings(hdev, sk);
1936
1937                 goto failed;
1938         }
1939
1940         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1941                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1942                                       MGMT_STATUS_BUSY);
1943                 goto failed;
1944         }
1945
1946         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1947                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1948                 goto failed;
1949         }
1950
1951         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1952         if (!cmd)
1953                 err = -ENOMEM;
1954         else
1955                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
1956                                          set_ssp_complete);
1957
1958         if (err < 0) {
1959                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1960                                       MGMT_STATUS_FAILED);
1961
1962                 if (cmd)
1963                         mgmt_pending_remove(cmd);
1964         }
1965
1966 failed:
1967         hci_dev_unlock(hdev);
1968         return err;
1969 }
1970
1971 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1972 {
1973         struct mgmt_mode *cp = data;
1974         bool changed;
1975         u8 status;
1976         int err;
1977
1978         bt_dev_dbg(hdev, "sock %p", sk);
1979
1980         if (!IS_ENABLED(CONFIG_BT_HS))
1981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1982                                        MGMT_STATUS_NOT_SUPPORTED);
1983
1984         status = mgmt_bredr_support(hdev);
1985         if (status)
1986                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1987
1988         if (!lmp_ssp_capable(hdev))
1989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1990                                        MGMT_STATUS_NOT_SUPPORTED);
1991
1992         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1993                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1994                                        MGMT_STATUS_REJECTED);
1995
1996         if (cp->val != 0x00 && cp->val != 0x01)
1997                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1998                                        MGMT_STATUS_INVALID_PARAMS);
1999
2000         hci_dev_lock(hdev);
2001
2002         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2003                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2004                                       MGMT_STATUS_BUSY);
2005                 goto unlock;
2006         }
2007
2008         if (cp->val) {
2009                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2010         } else {
2011                 if (hdev_is_powered(hdev)) {
2012                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2013                                               MGMT_STATUS_REJECTED);
2014                         goto unlock;
2015                 }
2016
2017                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2018         }
2019
2020         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2021         if (err < 0)
2022                 goto unlock;
2023
2024         if (changed)
2025                 err = new_settings(hdev, sk);
2026
2027 unlock:
2028         hci_dev_unlock(hdev);
2029         return err;
2030 }
2031
2032 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2033 {
2034         struct cmd_lookup match = { NULL, hdev };
2035         u8 status = mgmt_status(err);
2036
2037         bt_dev_dbg(hdev, "err %d", err);
2038
2039         if (status) {
2040                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2041                                                         &status);
2042                 return;
2043         }
2044
2045         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2046
2047         new_settings(hdev, match.sk);
2048
2049         if (match.sk)
2050                 sock_put(match.sk);
2051 }
2052
2053 static int set_le_sync(struct hci_dev *hdev, void *data)
2054 {
2055         struct mgmt_pending_cmd *cmd = data;
2056         struct mgmt_mode *cp = cmd->param;
2057         u8 val = !!cp->val;
2058         int err;
2059
2060         if (!val) {
2061                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2062                         hci_disable_advertising_sync(hdev);
2063
2064                 if (ext_adv_capable(hdev))
2065                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2066         } else {
2067                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2068         }
2069
2070         err = hci_write_le_host_supported_sync(hdev, val, 0);
2071
2072         /* Make sure the controller has a good default for
2073          * advertising data. Restrict the update to when LE
2074          * has actually been enabled. During power on, the
2075          * update in powered_update_hci will take care of it.
2076          */
2077         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2078                 if (ext_adv_capable(hdev)) {
2079                         int status;
2080
2081                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2082                         if (!status)
2083                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2084                 } else {
2085                         hci_update_adv_data_sync(hdev, 0x00);
2086                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2087                 }
2088
2089                 hci_update_passive_scan(hdev);
2090         }
2091
2092         return err;
2093 }
2094
2095 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2096 {
2097         struct mgmt_mode *cp = data;
2098         struct mgmt_pending_cmd *cmd;
2099         int err;
2100         u8 val, enabled;
2101
2102         bt_dev_dbg(hdev, "sock %p", sk);
2103
2104         if (!lmp_le_capable(hdev))
2105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2106                                        MGMT_STATUS_NOT_SUPPORTED);
2107
2108         if (cp->val != 0x00 && cp->val != 0x01)
2109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2110                                        MGMT_STATUS_INVALID_PARAMS);
2111
2112         /* Bluetooth single mode LE only controllers or dual-mode
2113          * controllers configured as LE only devices, do not allow
2114          * switching LE off. These have either LE enabled explicitly
2115          * or BR/EDR has been previously switched off.
2116          *
2117          * When trying to enable an already enabled LE, then gracefully
2118          * send a positive response. Trying to disable it however will
2119          * result into rejection.
2120          */
2121         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2122                 if (cp->val == 0x01)
2123                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2124
2125                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2126                                        MGMT_STATUS_REJECTED);
2127         }
2128
2129         hci_dev_lock(hdev);
2130
2131         val = !!cp->val;
2132         enabled = lmp_host_le_capable(hdev);
2133
2134         if (!val)
2135                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
2136
2137         if (!hdev_is_powered(hdev) || val == enabled) {
2138                 bool changed = false;
2139
2140                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2141                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2142                         changed = true;
2143                 }
2144
2145                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2146                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2147                         changed = true;
2148                 }
2149
2150                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2151                 if (err < 0)
2152                         goto unlock;
2153
2154                 if (changed)
2155                         err = new_settings(hdev, sk);
2156
2157                 goto unlock;
2158         }
2159
2160         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2161             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2162                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2163                                       MGMT_STATUS_BUSY);
2164                 goto unlock;
2165         }
2166
2167         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2168         if (!cmd)
2169                 err = -ENOMEM;
2170         else
2171                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2172                                          set_le_complete);
2173
2174         if (err < 0) {
2175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2176                                       MGMT_STATUS_FAILED);
2177
2178                 if (cmd)
2179                         mgmt_pending_remove(cmd);
2180         }
2181
2182 unlock:
2183         hci_dev_unlock(hdev);
2184         return err;
2185 }
2186
2187 /* This is a helper function to test for pending mgmt commands that can
2188  * cause CoD or EIR HCI commands. We can only allow one such pending
2189  * mgmt command at a time since otherwise we cannot easily track what
2190  * the current values are, will be, and based on that calculate if a new
2191  * HCI command needs to be sent and if yes with what value.
2192  */
2193 static bool pending_eir_or_class(struct hci_dev *hdev)
2194 {
2195         struct mgmt_pending_cmd *cmd;
2196
2197         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2198                 switch (cmd->opcode) {
2199                 case MGMT_OP_ADD_UUID:
2200                 case MGMT_OP_REMOVE_UUID:
2201                 case MGMT_OP_SET_DEV_CLASS:
2202                 case MGMT_OP_SET_POWERED:
2203                         return true;
2204                 }
2205         }
2206
2207         return false;
2208 }
2209
2210 static const u8 bluetooth_base_uuid[] = {
2211                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2212                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2213 };
2214
2215 static u8 get_uuid_size(const u8 *uuid)
2216 {
2217         u32 val;
2218
2219         if (memcmp(uuid, bluetooth_base_uuid, 12))
2220                 return 128;
2221
2222         val = get_unaligned_le32(&uuid[12]);
2223         if (val > 0xffff)
2224                 return 32;
2225
2226         return 16;
2227 }
2228
2229 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2230 {
2231         struct mgmt_pending_cmd *cmd = data;
2232
2233         bt_dev_dbg(hdev, "err %d", err);
2234
2235         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2236                           mgmt_status(err), hdev->dev_class, 3);
2237
2238         mgmt_pending_free(cmd);
2239 }
2240
2241 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2242 {
2243         int err;
2244
2245         err = hci_update_class_sync(hdev);
2246         if (err)
2247                 return err;
2248
2249         return hci_update_eir_sync(hdev);
2250 }
2251
2252 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2253 {
2254         struct mgmt_cp_add_uuid *cp = data;
2255         struct mgmt_pending_cmd *cmd;
2256         struct bt_uuid *uuid;
2257         int err;
2258
2259         bt_dev_dbg(hdev, "sock %p", sk);
2260
2261         hci_dev_lock(hdev);
2262
2263         if (pending_eir_or_class(hdev)) {
2264                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2265                                       MGMT_STATUS_BUSY);
2266                 goto failed;
2267         }
2268
2269         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2270         if (!uuid) {
2271                 err = -ENOMEM;
2272                 goto failed;
2273         }
2274
2275         memcpy(uuid->uuid, cp->uuid, 16);
2276         uuid->svc_hint = cp->svc_hint;
2277         uuid->size = get_uuid_size(cp->uuid);
2278
2279         list_add_tail(&uuid->list, &hdev->uuids);
2280
2281         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2282         if (!cmd) {
2283                 err = -ENOMEM;
2284                 goto failed;
2285         }
2286
2287         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2288         if (err < 0) {
2289                 mgmt_pending_free(cmd);
2290                 goto failed;
2291         }
2292
2293 failed:
2294         hci_dev_unlock(hdev);
2295         return err;
2296 }
2297
2298 static bool enable_service_cache(struct hci_dev *hdev)
2299 {
2300         if (!hdev_is_powered(hdev))
2301                 return false;
2302
2303         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2304                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2305                                    CACHE_TIMEOUT);
2306                 return true;
2307         }
2308
2309         return false;
2310 }
2311
2312 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2313 {
2314         int err;
2315
2316         err = hci_update_class_sync(hdev);
2317         if (err)
2318                 return err;
2319
2320         return hci_update_eir_sync(hdev);
2321 }
2322
2323 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2324                        u16 len)
2325 {
2326         struct mgmt_cp_remove_uuid *cp = data;
2327         struct mgmt_pending_cmd *cmd;
2328         struct bt_uuid *match, *tmp;
2329         static const u8 bt_uuid_any[] = {
2330                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2331         };
2332         int err, found;
2333
2334         bt_dev_dbg(hdev, "sock %p", sk);
2335
2336         hci_dev_lock(hdev);
2337
2338         if (pending_eir_or_class(hdev)) {
2339                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2340                                       MGMT_STATUS_BUSY);
2341                 goto unlock;
2342         }
2343
2344         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2345                 hci_uuids_clear(hdev);
2346
2347                 if (enable_service_cache(hdev)) {
2348                         err = mgmt_cmd_complete(sk, hdev->id,
2349                                                 MGMT_OP_REMOVE_UUID,
2350                                                 0, hdev->dev_class, 3);
2351                         goto unlock;
2352                 }
2353
2354                 goto update_class;
2355         }
2356
2357         found = 0;
2358
2359         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2360                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2361                         continue;
2362
2363                 list_del(&match->list);
2364                 kfree(match);
2365                 found++;
2366         }
2367
2368         if (found == 0) {
2369                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2370                                       MGMT_STATUS_INVALID_PARAMS);
2371                 goto unlock;
2372         }
2373
2374 update_class:
2375         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2376         if (!cmd) {
2377                 err = -ENOMEM;
2378                 goto unlock;
2379         }
2380
2381         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2382                                  mgmt_class_complete);
2383         if (err < 0)
2384                 mgmt_pending_free(cmd);
2385
2386 unlock:
2387         hci_dev_unlock(hdev);
2388         return err;
2389 }
2390
2391 static int set_class_sync(struct hci_dev *hdev, void *data)
2392 {
2393         int err = 0;
2394
2395         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2396                 cancel_delayed_work_sync(&hdev->service_cache);
2397                 err = hci_update_eir_sync(hdev);
2398         }
2399
2400         if (err)
2401                 return err;
2402
2403         return hci_update_class_sync(hdev);
2404 }
2405
2406 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2407                          u16 len)
2408 {
2409         struct mgmt_cp_set_dev_class *cp = data;
2410         struct mgmt_pending_cmd *cmd;
2411         int err;
2412
2413         bt_dev_dbg(hdev, "sock %p", sk);
2414
2415         if (!lmp_bredr_capable(hdev))
2416                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2417                                        MGMT_STATUS_NOT_SUPPORTED);
2418
2419         hci_dev_lock(hdev);
2420
2421         if (pending_eir_or_class(hdev)) {
2422                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2423                                       MGMT_STATUS_BUSY);
2424                 goto unlock;
2425         }
2426
2427         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2428                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2429                                       MGMT_STATUS_INVALID_PARAMS);
2430                 goto unlock;
2431         }
2432
2433         hdev->major_class = cp->major;
2434         hdev->minor_class = cp->minor;
2435
2436         if (!hdev_is_powered(hdev)) {
2437                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2438                                         hdev->dev_class, 3);
2439                 goto unlock;
2440         }
2441
2442         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2443         if (!cmd) {
2444                 err = -ENOMEM;
2445                 goto unlock;
2446         }
2447
2448         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2449                                  mgmt_class_complete);
2450         if (err < 0)
2451                 mgmt_pending_free(cmd);
2452
2453 unlock:
2454         hci_dev_unlock(hdev);
2455         return err;
2456 }
2457
2458 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2459                           u16 len)
2460 {
2461         struct mgmt_cp_load_link_keys *cp = data;
2462         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2463                                    sizeof(struct mgmt_link_key_info));
2464         u16 key_count, expected_len;
2465         bool changed;
2466         int i;
2467
2468         bt_dev_dbg(hdev, "sock %p", sk);
2469
2470         if (!lmp_bredr_capable(hdev))
2471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2472                                        MGMT_STATUS_NOT_SUPPORTED);
2473
2474         key_count = __le16_to_cpu(cp->key_count);
2475         if (key_count > max_key_count) {
2476                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2477                            key_count);
2478                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2479                                        MGMT_STATUS_INVALID_PARAMS);
2480         }
2481
2482         expected_len = struct_size(cp, keys, key_count);
2483         if (expected_len != len) {
2484                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2485                            expected_len, len);
2486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2487                                        MGMT_STATUS_INVALID_PARAMS);
2488         }
2489
2490         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2492                                        MGMT_STATUS_INVALID_PARAMS);
2493
2494         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2495                    key_count);
2496
2497         for (i = 0; i < key_count; i++) {
2498                 struct mgmt_link_key_info *key = &cp->keys[i];
2499
2500                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2501                         return mgmt_cmd_status(sk, hdev->id,
2502                                                MGMT_OP_LOAD_LINK_KEYS,
2503                                                MGMT_STATUS_INVALID_PARAMS);
2504         }
2505
2506         hci_dev_lock(hdev);
2507
2508         hci_link_keys_clear(hdev);
2509
2510         if (cp->debug_keys)
2511                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2512         else
2513                 changed = hci_dev_test_and_clear_flag(hdev,
2514                                                       HCI_KEEP_DEBUG_KEYS);
2515
2516         if (changed)
2517                 new_settings(hdev, NULL);
2518
2519         for (i = 0; i < key_count; i++) {
2520                 struct mgmt_link_key_info *key = &cp->keys[i];
2521
2522                 if (hci_is_blocked_key(hdev,
2523                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2524                                        key->val)) {
2525                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2526                                     &key->addr.bdaddr);
2527                         continue;
2528                 }
2529
2530                 /* Always ignore debug keys and require a new pairing if
2531                  * the user wants to use them.
2532                  */
2533                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2534                         continue;
2535
2536                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2537                                  key->type, key->pin_len, NULL);
2538         }
2539
2540         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2541
2542         hci_dev_unlock(hdev);
2543
2544         return 0;
2545 }
2546
2547 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2548                            u8 addr_type, struct sock *skip_sk)
2549 {
2550         struct mgmt_ev_device_unpaired ev;
2551
2552         bacpy(&ev.addr.bdaddr, bdaddr);
2553         ev.addr.type = addr_type;
2554
2555         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2556                           skip_sk);
2557 }
2558
2559 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2560 {
2561         struct mgmt_pending_cmd *cmd = data;
2562         struct mgmt_cp_unpair_device *cp = cmd->param;
2563
2564         if (!err)
2565                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2566
2567         cmd->cmd_complete(cmd, err);
2568         mgmt_pending_free(cmd);
2569 }
2570
2571 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2572 {
2573         struct mgmt_pending_cmd *cmd = data;
2574         struct mgmt_cp_unpair_device *cp = cmd->param;
2575         struct hci_conn *conn;
2576
2577         if (cp->addr.type == BDADDR_BREDR)
2578                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2579                                                &cp->addr.bdaddr);
2580         else
2581                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2582                                                le_addr_type(cp->addr.type));
2583
2584         if (!conn)
2585                 return 0;
2586
2587         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2588 }
2589
2590 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2591                          u16 len)
2592 {
2593         struct mgmt_cp_unpair_device *cp = data;
2594         struct mgmt_rp_unpair_device rp;
2595         struct hci_conn_params *params;
2596         struct mgmt_pending_cmd *cmd;
2597         struct hci_conn *conn;
2598         u8 addr_type;
2599         int err;
2600
2601         memset(&rp, 0, sizeof(rp));
2602         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2603         rp.addr.type = cp->addr.type;
2604
2605         if (!bdaddr_type_is_valid(cp->addr.type))
2606                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2607                                          MGMT_STATUS_INVALID_PARAMS,
2608                                          &rp, sizeof(rp));
2609
2610         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2611                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2612                                          MGMT_STATUS_INVALID_PARAMS,
2613                                          &rp, sizeof(rp));
2614
2615         hci_dev_lock(hdev);
2616
2617         if (!hdev_is_powered(hdev)) {
2618                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2619                                         MGMT_STATUS_NOT_POWERED, &rp,
2620                                         sizeof(rp));
2621                 goto unlock;
2622         }
2623
2624         if (cp->addr.type == BDADDR_BREDR) {
2625                 /* If disconnection is requested, then look up the
2626                  * connection. If the remote device is connected, it
2627                  * will be later used to terminate the link.
2628                  *
2629                  * Setting it to NULL explicitly will cause no
2630                  * termination of the link.
2631                  */
2632                 if (cp->disconnect)
2633                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2634                                                        &cp->addr.bdaddr);
2635                 else
2636                         conn = NULL;
2637
2638                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2639                 if (err < 0) {
2640                         err = mgmt_cmd_complete(sk, hdev->id,
2641                                                 MGMT_OP_UNPAIR_DEVICE,
2642                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2643                                                 sizeof(rp));
2644                         goto unlock;
2645                 }
2646
2647                 goto done;
2648         }
2649
2650         /* LE address type */
2651         addr_type = le_addr_type(cp->addr.type);
2652
2653         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2654         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2655         if (err < 0) {
2656                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2657                                         MGMT_STATUS_NOT_PAIRED, &rp,
2658                                         sizeof(rp));
2659                 goto unlock;
2660         }
2661
2662         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2663         if (!conn) {
2664                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2665                 goto done;
2666         }
2667
2668
2669         /* Defer clearing up the connection parameters until closing to
2670          * give a chance of keeping them if a repairing happens.
2671          */
2672         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2673
2674         /* Disable auto-connection parameters if present */
2675         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2676         if (params) {
2677                 if (params->explicit_connect)
2678                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2679                 else
2680                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2681         }
2682
2683         /* If disconnection is not requested, then clear the connection
2684          * variable so that the link is not terminated.
2685          */
2686         if (!cp->disconnect)
2687                 conn = NULL;
2688
2689 done:
2690         /* If the connection variable is set, then termination of the
2691          * link is requested.
2692          */
2693         if (!conn) {
2694                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2695                                         &rp, sizeof(rp));
2696                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2697                 goto unlock;
2698         }
2699
2700         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2701                                sizeof(*cp));
2702         if (!cmd) {
2703                 err = -ENOMEM;
2704                 goto unlock;
2705         }
2706
2707         cmd->cmd_complete = addr_cmd_complete;
2708
2709         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
2710                                  unpair_device_complete);
2711         if (err < 0)
2712                 mgmt_pending_free(cmd);
2713
2714 unlock:
2715         hci_dev_unlock(hdev);
2716         return err;
2717 }
2718
2719 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2720                       u16 len)
2721 {
2722         struct mgmt_cp_disconnect *cp = data;
2723         struct mgmt_rp_disconnect rp;
2724         struct mgmt_pending_cmd *cmd;
2725         struct hci_conn *conn;
2726         int err;
2727
2728         bt_dev_dbg(hdev, "sock %p", sk);
2729
2730         memset(&rp, 0, sizeof(rp));
2731         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2732         rp.addr.type = cp->addr.type;
2733
2734         if (!bdaddr_type_is_valid(cp->addr.type))
2735                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2736                                          MGMT_STATUS_INVALID_PARAMS,
2737                                          &rp, sizeof(rp));
2738
2739         hci_dev_lock(hdev);
2740
2741         if (!test_bit(HCI_UP, &hdev->flags)) {
2742                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2743                                         MGMT_STATUS_NOT_POWERED, &rp,
2744                                         sizeof(rp));
2745                 goto failed;
2746         }
2747
2748         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2749                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2750                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2751                 goto failed;
2752         }
2753
2754         if (cp->addr.type == BDADDR_BREDR)
2755                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2756                                                &cp->addr.bdaddr);
2757         else
2758                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2759                                                le_addr_type(cp->addr.type));
2760
2761         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2762                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2763                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2764                                         sizeof(rp));
2765                 goto failed;
2766         }
2767
2768         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2769         if (!cmd) {
2770                 err = -ENOMEM;
2771                 goto failed;
2772         }
2773
2774         cmd->cmd_complete = generic_cmd_complete;
2775
2776         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2777         if (err < 0)
2778                 mgmt_pending_remove(cmd);
2779
2780 failed:
2781         hci_dev_unlock(hdev);
2782         return err;
2783 }
2784
2785 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2786 {
2787         switch (link_type) {
2788         case LE_LINK:
2789                 switch (addr_type) {
2790                 case ADDR_LE_DEV_PUBLIC:
2791                         return BDADDR_LE_PUBLIC;
2792
2793                 default:
2794                         /* Fallback to LE Random address type */
2795                         return BDADDR_LE_RANDOM;
2796                 }
2797
2798         default:
2799                 /* Fallback to BR/EDR type */
2800                 return BDADDR_BREDR;
2801         }
2802 }
2803
2804 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2805                            u16 data_len)
2806 {
2807         struct mgmt_rp_get_connections *rp;
2808         struct hci_conn *c;
2809         int err;
2810         u16 i;
2811
2812         bt_dev_dbg(hdev, "sock %p", sk);
2813
2814         hci_dev_lock(hdev);
2815
2816         if (!hdev_is_powered(hdev)) {
2817                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2818                                       MGMT_STATUS_NOT_POWERED);
2819                 goto unlock;
2820         }
2821
2822         i = 0;
2823         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2824                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2825                         i++;
2826         }
2827
2828         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2829         if (!rp) {
2830                 err = -ENOMEM;
2831                 goto unlock;
2832         }
2833
2834         i = 0;
2835         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2836                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2837                         continue;
2838                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2839                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2840                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2841                         continue;
2842                 i++;
2843         }
2844
2845         rp->conn_count = cpu_to_le16(i);
2846
2847         /* Recalculate length in case of filtered SCO connections, etc */
2848         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2849                                 struct_size(rp, addr, i));
2850
2851         kfree(rp);
2852
2853 unlock:
2854         hci_dev_unlock(hdev);
2855         return err;
2856 }
2857
2858 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2859                                    struct mgmt_cp_pin_code_neg_reply *cp)
2860 {
2861         struct mgmt_pending_cmd *cmd;
2862         int err;
2863
2864         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2865                                sizeof(*cp));
2866         if (!cmd)
2867                 return -ENOMEM;
2868
2869         cmd->cmd_complete = addr_cmd_complete;
2870
2871         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2872                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2873         if (err < 0)
2874                 mgmt_pending_remove(cmd);
2875
2876         return err;
2877 }
2878
2879 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2880                           u16 len)
2881 {
2882         struct hci_conn *conn;
2883         struct mgmt_cp_pin_code_reply *cp = data;
2884         struct hci_cp_pin_code_reply reply;
2885         struct mgmt_pending_cmd *cmd;
2886         int err;
2887
2888         bt_dev_dbg(hdev, "sock %p", sk);
2889
2890         hci_dev_lock(hdev);
2891
2892         if (!hdev_is_powered(hdev)) {
2893                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2894                                       MGMT_STATUS_NOT_POWERED);
2895                 goto failed;
2896         }
2897
2898         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2899         if (!conn) {
2900                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2901                                       MGMT_STATUS_NOT_CONNECTED);
2902                 goto failed;
2903         }
2904
2905         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2906                 struct mgmt_cp_pin_code_neg_reply ncp;
2907
2908                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2909
2910                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2911
2912                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2913                 if (err >= 0)
2914                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2915                                               MGMT_STATUS_INVALID_PARAMS);
2916
2917                 goto failed;
2918         }
2919
2920         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2921         if (!cmd) {
2922                 err = -ENOMEM;
2923                 goto failed;
2924         }
2925
2926         cmd->cmd_complete = addr_cmd_complete;
2927
2928         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2929         reply.pin_len = cp->pin_len;
2930         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2931
2932         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2933         if (err < 0)
2934                 mgmt_pending_remove(cmd);
2935
2936 failed:
2937         hci_dev_unlock(hdev);
2938         return err;
2939 }
2940
2941 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2942                              u16 len)
2943 {
2944         struct mgmt_cp_set_io_capability *cp = data;
2945
2946         bt_dev_dbg(hdev, "sock %p", sk);
2947
2948         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2950                                        MGMT_STATUS_INVALID_PARAMS);
2951
2952         hci_dev_lock(hdev);
2953
2954         hdev->io_capability = cp->io_capability;
2955
2956         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2957
2958         hci_dev_unlock(hdev);
2959
2960         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2961                                  NULL, 0);
2962 }
2963
2964 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2965 {
2966         struct hci_dev *hdev = conn->hdev;
2967         struct mgmt_pending_cmd *cmd;
2968
2969         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2970                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2971                         continue;
2972
2973                 if (cmd->user_data != conn)
2974                         continue;
2975
2976                 return cmd;
2977         }
2978
2979         return NULL;
2980 }
2981
2982 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2983 {
2984         struct mgmt_rp_pair_device rp;
2985         struct hci_conn *conn = cmd->user_data;
2986         int err;
2987
2988         bacpy(&rp.addr.bdaddr, &conn->dst);
2989         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2990
2991         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2992                                 status, &rp, sizeof(rp));
2993
2994         /* So we don't get further callbacks for this connection */
2995         conn->connect_cfm_cb = NULL;
2996         conn->security_cfm_cb = NULL;
2997         conn->disconn_cfm_cb = NULL;
2998
2999         hci_conn_drop(conn);
3000
3001         /* The device is paired so there is no need to remove
3002          * its connection parameters anymore.
3003          */
3004         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3005
3006         hci_conn_put(conn);
3007
3008         return err;
3009 }
3010
3011 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3012 {
3013         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3014         struct mgmt_pending_cmd *cmd;
3015
3016         cmd = find_pairing(conn);
3017         if (cmd) {
3018                 cmd->cmd_complete(cmd, status);
3019                 mgmt_pending_remove(cmd);
3020         }
3021 }
3022
3023 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3024 {
3025         struct mgmt_pending_cmd *cmd;
3026
3027         BT_DBG("status %u", status);
3028
3029         cmd = find_pairing(conn);
3030         if (!cmd) {
3031                 BT_DBG("Unable to find a pending command");
3032                 return;
3033         }
3034
3035         cmd->cmd_complete(cmd, mgmt_status(status));
3036         mgmt_pending_remove(cmd);
3037 }
3038
3039 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3040 {
3041         struct mgmt_pending_cmd *cmd;
3042
3043         BT_DBG("status %u", status);
3044
3045         if (!status)
3046                 return;
3047
3048         cmd = find_pairing(conn);
3049         if (!cmd) {
3050                 BT_DBG("Unable to find a pending command");
3051                 return;
3052         }
3053
3054         cmd->cmd_complete(cmd, mgmt_status(status));
3055         mgmt_pending_remove(cmd);
3056 }
3057
3058 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3059                        u16 len)
3060 {
3061         struct mgmt_cp_pair_device *cp = data;
3062         struct mgmt_rp_pair_device rp;
3063         struct mgmt_pending_cmd *cmd;
3064         u8 sec_level, auth_type;
3065         struct hci_conn *conn;
3066         int err;
3067
3068         bt_dev_dbg(hdev, "sock %p", sk);
3069
3070         memset(&rp, 0, sizeof(rp));
3071         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3072         rp.addr.type = cp->addr.type;
3073
3074         if (!bdaddr_type_is_valid(cp->addr.type))
3075                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3076                                          MGMT_STATUS_INVALID_PARAMS,
3077                                          &rp, sizeof(rp));
3078
3079         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3080                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3081                                          MGMT_STATUS_INVALID_PARAMS,
3082                                          &rp, sizeof(rp));
3083
3084         hci_dev_lock(hdev);
3085
3086         if (!hdev_is_powered(hdev)) {
3087                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3088                                         MGMT_STATUS_NOT_POWERED, &rp,
3089                                         sizeof(rp));
3090                 goto unlock;
3091         }
3092
3093         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3094                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3095                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3096                                         sizeof(rp));
3097                 goto unlock;
3098         }
3099
3100         sec_level = BT_SECURITY_MEDIUM;
3101         auth_type = HCI_AT_DEDICATED_BONDING;
3102
3103         if (cp->addr.type == BDADDR_BREDR) {
3104                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3105                                        auth_type, CONN_REASON_PAIR_DEVICE);
3106         } else {
3107                 u8 addr_type = le_addr_type(cp->addr.type);
3108                 struct hci_conn_params *p;
3109
3110                 /* When pairing a new device, it is expected to remember
3111                  * this device for future connections. Adding the connection
3112                  * parameter information ahead of time allows tracking
3113                  * of the peripheral preferred values and will speed up any
3114                  * further connection establishment.
3115                  *
3116                  * If connection parameters already exist, then they
3117                  * will be kept and this function does nothing.
3118                  */
3119                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3120
3121                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3122                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3123
3124                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3125                                            sec_level, HCI_LE_CONN_TIMEOUT,
3126                                            CONN_REASON_PAIR_DEVICE);
3127         }
3128
3129         if (IS_ERR(conn)) {
3130                 int status;
3131
3132                 if (PTR_ERR(conn) == -EBUSY)
3133                         status = MGMT_STATUS_BUSY;
3134                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3135                         status = MGMT_STATUS_NOT_SUPPORTED;
3136                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3137                         status = MGMT_STATUS_REJECTED;
3138                 else
3139                         status = MGMT_STATUS_CONNECT_FAILED;
3140
3141                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3142                                         status, &rp, sizeof(rp));
3143                 goto unlock;
3144         }
3145
3146         if (conn->connect_cfm_cb) {
3147                 hci_conn_drop(conn);
3148                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3149                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3150                 goto unlock;
3151         }
3152
3153         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3154         if (!cmd) {
3155                 err = -ENOMEM;
3156                 hci_conn_drop(conn);
3157                 goto unlock;
3158         }
3159
3160         cmd->cmd_complete = pairing_complete;
3161
3162         /* For LE, just connecting isn't a proof that the pairing finished */
3163         if (cp->addr.type == BDADDR_BREDR) {
3164                 conn->connect_cfm_cb = pairing_complete_cb;
3165                 conn->security_cfm_cb = pairing_complete_cb;
3166                 conn->disconn_cfm_cb = pairing_complete_cb;
3167         } else {
3168                 conn->connect_cfm_cb = le_pairing_complete_cb;
3169                 conn->security_cfm_cb = le_pairing_complete_cb;
3170                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3171         }
3172
3173         conn->io_capability = cp->io_cap;
3174         cmd->user_data = hci_conn_get(conn);
3175
3176         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3177             hci_conn_security(conn, sec_level, auth_type, true)) {
3178                 cmd->cmd_complete(cmd, 0);
3179                 mgmt_pending_remove(cmd);
3180         }
3181
3182         err = 0;
3183
3184 unlock:
3185         hci_dev_unlock(hdev);
3186         return err;
3187 }
3188
3189 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3190                               u16 len)
3191 {
3192         struct mgmt_addr_info *addr = data;
3193         struct mgmt_pending_cmd *cmd;
3194         struct hci_conn *conn;
3195         int err;
3196
3197         bt_dev_dbg(hdev, "sock %p", sk);
3198
3199         hci_dev_lock(hdev);
3200
3201         if (!hdev_is_powered(hdev)) {
3202                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3203                                       MGMT_STATUS_NOT_POWERED);
3204                 goto unlock;
3205         }
3206
3207         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3208         if (!cmd) {
3209                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3210                                       MGMT_STATUS_INVALID_PARAMS);
3211                 goto unlock;
3212         }
3213
3214         conn = cmd->user_data;
3215
3216         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3217                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3218                                       MGMT_STATUS_INVALID_PARAMS);
3219                 goto unlock;
3220         }
3221
3222         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3223         mgmt_pending_remove(cmd);
3224
3225         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3226                                 addr, sizeof(*addr));
3227
3228         /* Since user doesn't want to proceed with the connection, abort any
3229          * ongoing pairing and then terminate the link if it was created
3230          * because of the pair device action.
3231          */
3232         if (addr->type == BDADDR_BREDR)
3233                 hci_remove_link_key(hdev, &addr->bdaddr);
3234         else
3235                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3236                                               le_addr_type(addr->type));
3237
3238         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3239                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3240
3241 unlock:
3242         hci_dev_unlock(hdev);
3243         return err;
3244 }
3245
3246 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3247                              struct mgmt_addr_info *addr, u16 mgmt_op,
3248                              u16 hci_op, __le32 passkey)
3249 {
3250         struct mgmt_pending_cmd *cmd;
3251         struct hci_conn *conn;
3252         int err;
3253
3254         hci_dev_lock(hdev);
3255
3256         if (!hdev_is_powered(hdev)) {
3257                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3258                                         MGMT_STATUS_NOT_POWERED, addr,
3259                                         sizeof(*addr));
3260                 goto done;
3261         }
3262
3263         if (addr->type == BDADDR_BREDR)
3264                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3265         else
3266                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3267                                                le_addr_type(addr->type));
3268
3269         if (!conn) {
3270                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3271                                         MGMT_STATUS_NOT_CONNECTED, addr,
3272                                         sizeof(*addr));
3273                 goto done;
3274         }
3275
3276         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3277                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3278                 if (!err)
3279                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3280                                                 MGMT_STATUS_SUCCESS, addr,
3281                                                 sizeof(*addr));
3282                 else
3283                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3284                                                 MGMT_STATUS_FAILED, addr,
3285                                                 sizeof(*addr));
3286
3287                 goto done;
3288         }
3289
3290         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3291         if (!cmd) {
3292                 err = -ENOMEM;
3293                 goto done;
3294         }
3295
3296         cmd->cmd_complete = addr_cmd_complete;
3297
3298         /* Continue with pairing via HCI */
3299         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3300                 struct hci_cp_user_passkey_reply cp;
3301
3302                 bacpy(&cp.bdaddr, &addr->bdaddr);
3303                 cp.passkey = passkey;
3304                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3305         } else
3306                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3307                                    &addr->bdaddr);
3308
3309         if (err < 0)
3310                 mgmt_pending_remove(cmd);
3311
3312 done:
3313         hci_dev_unlock(hdev);
3314         return err;
3315 }
3316
3317 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3318                               void *data, u16 len)
3319 {
3320         struct mgmt_cp_pin_code_neg_reply *cp = data;
3321
3322         bt_dev_dbg(hdev, "sock %p", sk);
3323
3324         return user_pairing_resp(sk, hdev, &cp->addr,
3325                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3326                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3327 }
3328
3329 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3330                               u16 len)
3331 {
3332         struct mgmt_cp_user_confirm_reply *cp = data;
3333
3334         bt_dev_dbg(hdev, "sock %p", sk);
3335
3336         if (len != sizeof(*cp))
3337                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3338                                        MGMT_STATUS_INVALID_PARAMS);
3339
3340         return user_pairing_resp(sk, hdev, &cp->addr,
3341                                  MGMT_OP_USER_CONFIRM_REPLY,
3342                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3343 }
3344
3345 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3346                                   void *data, u16 len)
3347 {
3348         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3349
3350         bt_dev_dbg(hdev, "sock %p", sk);
3351
3352         return user_pairing_resp(sk, hdev, &cp->addr,
3353                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3354                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3355 }
3356
3357 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3358                               u16 len)
3359 {
3360         struct mgmt_cp_user_passkey_reply *cp = data;
3361
3362         bt_dev_dbg(hdev, "sock %p", sk);
3363
3364         return user_pairing_resp(sk, hdev, &cp->addr,
3365                                  MGMT_OP_USER_PASSKEY_REPLY,
3366                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3367 }
3368
3369 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3370                                   void *data, u16 len)
3371 {
3372         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3373
3374         bt_dev_dbg(hdev, "sock %p", sk);
3375
3376         return user_pairing_resp(sk, hdev, &cp->addr,
3377                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3378                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3379 }
3380
3381 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3382 {
3383         struct adv_info *adv_instance;
3384
3385         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3386         if (!adv_instance)
3387                 return 0;
3388
3389         /* stop if current instance doesn't need to be changed */
3390         if (!(adv_instance->flags & flags))
3391                 return 0;
3392
3393         cancel_adv_timeout(hdev);
3394
3395         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3396         if (!adv_instance)
3397                 return 0;
3398
3399         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3400
3401         return 0;
3402 }
3403
3404 static int name_changed_sync(struct hci_dev *hdev, void *data)
3405 {
3406         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3407 }
3408
3409 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3410 {
3411         struct mgmt_pending_cmd *cmd = data;
3412         struct mgmt_cp_set_local_name *cp = cmd->param;
3413         u8 status = mgmt_status(err);
3414
3415         bt_dev_dbg(hdev, "err %d", err);
3416
3417         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3418                 return;
3419
3420         if (status) {
3421                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3422                                 status);
3423         } else {
3424                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3425                                   cp, sizeof(*cp));
3426
3427                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3428                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3429         }
3430
3431         mgmt_pending_remove(cmd);
3432 }
3433
3434 static int set_name_sync(struct hci_dev *hdev, void *data)
3435 {
3436         if (lmp_bredr_capable(hdev)) {
3437                 hci_update_name_sync(hdev);
3438                 hci_update_eir_sync(hdev);
3439         }
3440
3441         /* The name is stored in the scan response data and so
3442          * no need to update the advertising data here.
3443          */
3444         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3445                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3446
3447         return 0;
3448 }
3449
3450 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3451                           u16 len)
3452 {
3453         struct mgmt_cp_set_local_name *cp = data;
3454         struct mgmt_pending_cmd *cmd;
3455         int err;
3456
3457         bt_dev_dbg(hdev, "sock %p", sk);
3458
3459         hci_dev_lock(hdev);
3460
3461         /* If the old values are the same as the new ones just return a
3462          * direct command complete event.
3463          */
3464         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3465             !memcmp(hdev->short_name, cp->short_name,
3466                     sizeof(hdev->short_name))) {
3467                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3468                                         data, len);
3469                 goto failed;
3470         }
3471
3472         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3473
3474         if (!hdev_is_powered(hdev)) {
3475                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3476
3477                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3478                                         data, len);
3479                 if (err < 0)
3480                         goto failed;
3481
3482                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3483                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3484                 ext_info_changed(hdev, sk);
3485
3486                 goto failed;
3487         }
3488
3489         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3490         if (!cmd)
3491                 err = -ENOMEM;
3492         else
3493                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3494                                          set_name_complete);
3495
3496         if (err < 0) {
3497                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3498                                       MGMT_STATUS_FAILED);
3499
3500                 if (cmd)
3501                         mgmt_pending_remove(cmd);
3502
3503                 goto failed;
3504         }
3505
3506         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3507
3508 failed:
3509         hci_dev_unlock(hdev);
3510         return err;
3511 }
3512
3513 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3514 {
3515         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3516 }
3517
3518 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3519                           u16 len)
3520 {
3521         struct mgmt_cp_set_appearance *cp = data;
3522         u16 appearance;
3523         int err;
3524
3525         bt_dev_dbg(hdev, "sock %p", sk);
3526
3527         if (!lmp_le_capable(hdev))
3528                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3529                                        MGMT_STATUS_NOT_SUPPORTED);
3530
3531         appearance = le16_to_cpu(cp->appearance);
3532
3533         hci_dev_lock(hdev);
3534
3535         if (hdev->appearance != appearance) {
3536                 hdev->appearance = appearance;
3537
3538                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3539                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3540                                            NULL);
3541
3542                 ext_info_changed(hdev, sk);
3543         }
3544
3545         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3546                                 0);
3547
3548         hci_dev_unlock(hdev);
3549
3550         return err;
3551 }
3552
3553 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3554                                  void *data, u16 len)
3555 {
3556         struct mgmt_rp_get_phy_configuration rp;
3557
3558         bt_dev_dbg(hdev, "sock %p", sk);
3559
3560         hci_dev_lock(hdev);
3561
3562         memset(&rp, 0, sizeof(rp));
3563
3564         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3565         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3566         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3567
3568         hci_dev_unlock(hdev);
3569
3570         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3571                                  &rp, sizeof(rp));
3572 }
3573
3574 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3575 {
3576         struct mgmt_ev_phy_configuration_changed ev;
3577
3578         memset(&ev, 0, sizeof(ev));
3579
3580         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3581
3582         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3583                           sizeof(ev), skip);
3584 }
3585
3586 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3587 {
3588         struct mgmt_pending_cmd *cmd = data;
3589         struct sk_buff *skb = cmd->skb;
3590         u8 status = mgmt_status(err);
3591
3592         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3593                 return;
3594
3595         if (!status) {
3596                 if (!skb)
3597                         status = MGMT_STATUS_FAILED;
3598                 else if (IS_ERR(skb))
3599                         status = mgmt_status(PTR_ERR(skb));
3600                 else
3601                         status = mgmt_status(skb->data[0]);
3602         }
3603
3604         bt_dev_dbg(hdev, "status %d", status);
3605
3606         if (status) {
3607                 mgmt_cmd_status(cmd->sk, hdev->id,
3608                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3609         } else {
3610                 mgmt_cmd_complete(cmd->sk, hdev->id,
3611                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3612                                   NULL, 0);
3613
3614                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3615         }
3616
3617         if (skb && !IS_ERR(skb))
3618                 kfree_skb(skb);
3619
3620         mgmt_pending_remove(cmd);
3621 }
3622
3623 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
3624 {
3625         struct mgmt_pending_cmd *cmd = data;
3626         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
3627         struct hci_cp_le_set_default_phy cp_phy;
3628         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
3629
3630         memset(&cp_phy, 0, sizeof(cp_phy));
3631
3632         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3633                 cp_phy.all_phys |= 0x01;
3634
3635         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3636                 cp_phy.all_phys |= 0x02;
3637
3638         if (selected_phys & MGMT_PHY_LE_1M_TX)
3639                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3640
3641         if (selected_phys & MGMT_PHY_LE_2M_TX)
3642                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3643
3644         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3645                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3646
3647         if (selected_phys & MGMT_PHY_LE_1M_RX)
3648                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3649
3650         if (selected_phys & MGMT_PHY_LE_2M_RX)
3651                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3652
3653         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3654                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3655
3656         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
3657                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
3658
3659         return 0;
3660 }
3661
3662 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3663                                  void *data, u16 len)
3664 {
3665         struct mgmt_cp_set_phy_configuration *cp = data;
3666         struct mgmt_pending_cmd *cmd;
3667         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3668         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3669         bool changed = false;
3670         int err;
3671
3672         bt_dev_dbg(hdev, "sock %p", sk);
3673
3674         configurable_phys = get_configurable_phys(hdev);
3675         supported_phys = get_supported_phys(hdev);
3676         selected_phys = __le32_to_cpu(cp->selected_phys);
3677
3678         if (selected_phys & ~supported_phys)
3679                 return mgmt_cmd_status(sk, hdev->id,
3680                                        MGMT_OP_SET_PHY_CONFIGURATION,
3681                                        MGMT_STATUS_INVALID_PARAMS);
3682
3683         unconfigure_phys = supported_phys & ~configurable_phys;
3684
3685         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3686                 return mgmt_cmd_status(sk, hdev->id,
3687                                        MGMT_OP_SET_PHY_CONFIGURATION,
3688                                        MGMT_STATUS_INVALID_PARAMS);
3689
3690         if (selected_phys == get_selected_phys(hdev))
3691                 return mgmt_cmd_complete(sk, hdev->id,
3692                                          MGMT_OP_SET_PHY_CONFIGURATION,
3693                                          0, NULL, 0);
3694
3695         hci_dev_lock(hdev);
3696
3697         if (!hdev_is_powered(hdev)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_PHY_CONFIGURATION,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3705                 err = mgmt_cmd_status(sk, hdev->id,
3706                                       MGMT_OP_SET_PHY_CONFIGURATION,
3707                                       MGMT_STATUS_BUSY);
3708                 goto unlock;
3709         }
3710
3711         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3712                 pkt_type |= (HCI_DH3 | HCI_DM3);
3713         else
3714                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3715
3716         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3717                 pkt_type |= (HCI_DH5 | HCI_DM5);
3718         else
3719                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3720
3721         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3722                 pkt_type &= ~HCI_2DH1;
3723         else
3724                 pkt_type |= HCI_2DH1;
3725
3726         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3727                 pkt_type &= ~HCI_2DH3;
3728         else
3729                 pkt_type |= HCI_2DH3;
3730
3731         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3732                 pkt_type &= ~HCI_2DH5;
3733         else
3734                 pkt_type |= HCI_2DH5;
3735
3736         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3737                 pkt_type &= ~HCI_3DH1;
3738         else
3739                 pkt_type |= HCI_3DH1;
3740
3741         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3742                 pkt_type &= ~HCI_3DH3;
3743         else
3744                 pkt_type |= HCI_3DH3;
3745
3746         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3747                 pkt_type &= ~HCI_3DH5;
3748         else
3749                 pkt_type |= HCI_3DH5;
3750
3751         if (pkt_type != hdev->pkt_type) {
3752                 hdev->pkt_type = pkt_type;
3753                 changed = true;
3754         }
3755
3756         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3757             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3758                 if (changed)
3759                         mgmt_phy_configuration_changed(hdev, sk);
3760
3761                 err = mgmt_cmd_complete(sk, hdev->id,
3762                                         MGMT_OP_SET_PHY_CONFIGURATION,
3763                                         0, NULL, 0);
3764
3765                 goto unlock;
3766         }
3767
3768         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3769                                len);
3770         if (!cmd)
3771                 err = -ENOMEM;
3772         else
3773                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
3774                                          set_default_phy_complete);
3775
3776         if (err < 0) {
3777                 err = mgmt_cmd_status(sk, hdev->id,
3778                                       MGMT_OP_SET_PHY_CONFIGURATION,
3779                                       MGMT_STATUS_FAILED);
3780
3781                 if (cmd)
3782                         mgmt_pending_remove(cmd);
3783         }
3784
3785 unlock:
3786         hci_dev_unlock(hdev);
3787
3788         return err;
3789 }
3790
3791 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3792                             u16 len)
3793 {
3794         int err = MGMT_STATUS_SUCCESS;
3795         struct mgmt_cp_set_blocked_keys *keys = data;
3796         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3797                                    sizeof(struct mgmt_blocked_key_info));
3798         u16 key_count, expected_len;
3799         int i;
3800
3801         bt_dev_dbg(hdev, "sock %p", sk);
3802
3803         key_count = __le16_to_cpu(keys->key_count);
3804         if (key_count > max_key_count) {
3805                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3807                                        MGMT_STATUS_INVALID_PARAMS);
3808         }
3809
3810         expected_len = struct_size(keys, keys, key_count);
3811         if (expected_len != len) {
3812                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3813                            expected_len, len);
3814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3815                                        MGMT_STATUS_INVALID_PARAMS);
3816         }
3817
3818         hci_dev_lock(hdev);
3819
3820         hci_blocked_keys_clear(hdev);
3821
3822         for (i = 0; i < key_count; ++i) {
3823                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3824
3825                 if (!b) {
3826                         err = MGMT_STATUS_NO_RESOURCES;
3827                         break;
3828                 }
3829
3830                 b->type = keys->keys[i].type;
3831                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3832                 list_add_rcu(&b->list, &hdev->blocked_keys);
3833         }
3834         hci_dev_unlock(hdev);
3835
3836         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3837                                 err, NULL, 0);
3838 }
3839
3840 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3841                                void *data, u16 len)
3842 {
3843         struct mgmt_mode *cp = data;
3844         int err;
3845         bool changed = false;
3846
3847         bt_dev_dbg(hdev, "sock %p", sk);
3848
3849         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3850                 return mgmt_cmd_status(sk, hdev->id,
3851                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3852                                        MGMT_STATUS_NOT_SUPPORTED);
3853
3854         if (cp->val != 0x00 && cp->val != 0x01)
3855                 return mgmt_cmd_status(sk, hdev->id,
3856                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3857                                        MGMT_STATUS_INVALID_PARAMS);
3858
3859         hci_dev_lock(hdev);
3860
3861         if (hdev_is_powered(hdev) &&
3862             !!cp->val != hci_dev_test_flag(hdev,
3863                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3864                 err = mgmt_cmd_status(sk, hdev->id,
3865                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3866                                       MGMT_STATUS_REJECTED);
3867                 goto unlock;
3868         }
3869
3870         if (cp->val)
3871                 changed = !hci_dev_test_and_set_flag(hdev,
3872                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3873         else
3874                 changed = hci_dev_test_and_clear_flag(hdev,
3875                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3876
3877         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3878         if (err < 0)
3879                 goto unlock;
3880
3881         if (changed)
3882                 err = new_settings(hdev, sk);
3883
3884 unlock:
3885         hci_dev_unlock(hdev);
3886         return err;
3887 }
3888
3889 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3890                                void *data, u16 data_len)
3891 {
3892         char buf[20];
3893         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3894         u16 cap_len = 0;
3895         u8 flags = 0;
3896         u8 tx_power_range[2];
3897
3898         bt_dev_dbg(hdev, "sock %p", sk);
3899
3900         memset(&buf, 0, sizeof(buf));
3901
3902         hci_dev_lock(hdev);
3903
3904         /* When the Read Simple Pairing Options command is supported, then
3905          * the remote public key validation is supported.
3906          *
3907          * Alternatively, when Microsoft extensions are available, they can
3908          * indicate support for public key validation as well.
3909          */
3910         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3911                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3912
3913         flags |= 0x02;          /* Remote public key validation (LE) */
3914
3915         /* When the Read Encryption Key Size command is supported, then the
3916          * encryption key size is enforced.
3917          */
3918         if (hdev->commands[20] & 0x10)
3919                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3920
3921         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3922
3923         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3924                                   &flags, 1);
3925
3926         /* When the Read Simple Pairing Options command is supported, then
3927          * also max encryption key size information is provided.
3928          */
3929         if (hdev->commands[41] & 0x08)
3930                 cap_len = eir_append_le16(rp->cap, cap_len,
3931                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3932                                           hdev->max_enc_key_size);
3933
3934         cap_len = eir_append_le16(rp->cap, cap_len,
3935                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3936                                   SMP_MAX_ENC_KEY_SIZE);
3937
3938         /* Append the min/max LE tx power parameters if we were able to fetch
3939          * it from the controller
3940          */
3941         if (hdev->commands[38] & 0x80) {
3942                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3943                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3944                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3945                                           tx_power_range, 2);
3946         }
3947
3948         rp->cap_len = cpu_to_le16(cap_len);
3949
3950         hci_dev_unlock(hdev);
3951
3952         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3953                                  rp, sizeof(*rp) + cap_len);
3954 }
3955
3956 #ifdef CONFIG_BT_FEATURE_DEBUG
3957 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3958 static const u8 debug_uuid[16] = {
3959         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3960         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3961 };
3962 #endif
3963
3964 /* 330859bc-7506-492d-9370-9a6f0614037f */
3965 static const u8 quality_report_uuid[16] = {
3966         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
3967         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
3968 };
3969
3970 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
3971 static const u8 offload_codecs_uuid[16] = {
3972         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
3973         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
3974 };
3975
3976 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3977 static const u8 le_simultaneous_roles_uuid[16] = {
3978         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3979         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3980 };
3981
3982 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3983 static const u8 rpa_resolution_uuid[16] = {
3984         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3985         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3986 };
3987
3988 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
3989 static const u8 iso_socket_uuid[16] = {
3990         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
3991         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
3992 };
3993
3994 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3995                                   void *data, u16 data_len)
3996 {
3997         char buf[122];   /* Enough space for 6 features: 2 + 20 * 6 */
3998         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3999         u16 idx = 0;
4000         u32 flags;
4001
4002         bt_dev_dbg(hdev, "sock %p", sk);
4003
4004         memset(&buf, 0, sizeof(buf));
4005
4006 #ifdef CONFIG_BT_FEATURE_DEBUG
4007         if (!hdev) {
4008                 flags = bt_dbg_get() ? BIT(0) : 0;
4009
4010                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4011                 rp->features[idx].flags = cpu_to_le32(flags);
4012                 idx++;
4013         }
4014 #endif
4015
4016         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4017                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4018                         flags = BIT(0);
4019                 else
4020                         flags = 0;
4021
4022                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4023                 rp->features[idx].flags = cpu_to_le32(flags);
4024                 idx++;
4025         }
4026
4027         if (hdev && ll_privacy_capable(hdev)) {
4028                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4029                         flags = BIT(0) | BIT(1);
4030                 else
4031                         flags = BIT(1);
4032
4033                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4034                 rp->features[idx].flags = cpu_to_le32(flags);
4035                 idx++;
4036         }
4037
4038         if (hdev && (aosp_has_quality_report(hdev) ||
4039                      hdev->set_quality_report)) {
4040                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4041                         flags = BIT(0);
4042                 else
4043                         flags = 0;
4044
4045                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4046                 rp->features[idx].flags = cpu_to_le32(flags);
4047                 idx++;
4048         }
4049
4050         if (hdev && hdev->get_data_path_id) {
4051                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4052                         flags = BIT(0);
4053                 else
4054                         flags = 0;
4055
4056                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4057                 rp->features[idx].flags = cpu_to_le32(flags);
4058                 idx++;
4059         }
4060
4061         if (IS_ENABLED(CONFIG_BT_LE)) {
4062                 flags = iso_enabled() ? BIT(0) : 0;
4063                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4064                 rp->features[idx].flags = cpu_to_le32(flags);
4065                 idx++;
4066         }
4067
4068         rp->feature_count = cpu_to_le16(idx);
4069
4070         /* After reading the experimental features information, enable
4071          * the events to update client on any future change.
4072          */
4073         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4074
4075         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4076                                  MGMT_OP_READ_EXP_FEATURES_INFO,
4077                                  0, rp, sizeof(*rp) + (20 * idx));
4078 }
4079
4080 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4081                                           struct sock *skip)
4082 {
4083         struct mgmt_ev_exp_feature_changed ev;
4084
4085         memset(&ev, 0, sizeof(ev));
4086         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4087         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4088
4089         // Do we need to be atomic with the conn_flags?
4090         if (enabled && privacy_mode_capable(hdev))
4091                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4092         else
4093                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4094
4095         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4096                                   &ev, sizeof(ev),
4097                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4098
4099 }
4100
4101 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4102                                bool enabled, struct sock *skip)
4103 {
4104         struct mgmt_ev_exp_feature_changed ev;
4105
4106         memset(&ev, 0, sizeof(ev));
4107         memcpy(ev.uuid, uuid, 16);
4108         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4109
4110         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4111                                   &ev, sizeof(ev),
4112                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4113 }
4114
4115 #define EXP_FEAT(_uuid, _set_func)      \
4116 {                                       \
4117         .uuid = _uuid,                  \
4118         .set_func = _set_func,          \
4119 }
4120
4121 /* The zero key uuid is special. Multiple exp features are set through it. */
4122 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4123                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4124 {
4125         struct mgmt_rp_set_exp_feature rp;
4126
4127         memset(rp.uuid, 0, 16);
4128         rp.flags = cpu_to_le32(0);
4129
4130 #ifdef CONFIG_BT_FEATURE_DEBUG
4131         if (!hdev) {
4132                 bool changed = bt_dbg_get();
4133
4134                 bt_dbg_set(false);
4135
4136                 if (changed)
4137                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4138         }
4139 #endif
4140
4141         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4142                 bool changed;
4143
4144                 changed = hci_dev_test_and_clear_flag(hdev,
4145                                                       HCI_ENABLE_LL_PRIVACY);
4146                 if (changed)
4147                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4148                                             sk);
4149         }
4150
4151         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4152
4153         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4154                                  MGMT_OP_SET_EXP_FEATURE, 0,
4155                                  &rp, sizeof(rp));
4156 }
4157
4158 #ifdef CONFIG_BT_FEATURE_DEBUG
4159 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4160                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4161 {
4162         struct mgmt_rp_set_exp_feature rp;
4163
4164         bool val, changed;
4165         int err;
4166
4167         /* Command requires to use the non-controller index */
4168         if (hdev)
4169                 return mgmt_cmd_status(sk, hdev->id,
4170                                        MGMT_OP_SET_EXP_FEATURE,
4171                                        MGMT_STATUS_INVALID_INDEX);
4172
4173         /* Parameters are limited to a single octet */
4174         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4175                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4176                                        MGMT_OP_SET_EXP_FEATURE,
4177                                        MGMT_STATUS_INVALID_PARAMS);
4178
4179         /* Only boolean on/off is supported */
4180         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4181                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4182                                        MGMT_OP_SET_EXP_FEATURE,
4183                                        MGMT_STATUS_INVALID_PARAMS);
4184
4185         val = !!cp->param[0];
4186         changed = val ? !bt_dbg_get() : bt_dbg_get();
4187         bt_dbg_set(val);
4188
4189         memcpy(rp.uuid, debug_uuid, 16);
4190         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4191
4192         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4193
4194         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4195                                 MGMT_OP_SET_EXP_FEATURE, 0,
4196                                 &rp, sizeof(rp));
4197
4198         if (changed)
4199                 exp_feature_changed(hdev, debug_uuid, val, sk);
4200
4201         return err;
4202 }
4203 #endif
4204
4205 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4206                                    struct mgmt_cp_set_exp_feature *cp,
4207                                    u16 data_len)
4208 {
4209         struct mgmt_rp_set_exp_feature rp;
4210         bool val, changed;
4211         int err;
4212         u32 flags;
4213
4214         /* Command requires to use the controller index */
4215         if (!hdev)
4216                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4217                                        MGMT_OP_SET_EXP_FEATURE,
4218                                        MGMT_STATUS_INVALID_INDEX);
4219
4220         /* Changes can only be made when controller is powered down */
4221         if (hdev_is_powered(hdev))
4222                 return mgmt_cmd_status(sk, hdev->id,
4223                                        MGMT_OP_SET_EXP_FEATURE,
4224                                        MGMT_STATUS_REJECTED);
4225
4226         /* Parameters are limited to a single octet */
4227         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4228                 return mgmt_cmd_status(sk, hdev->id,
4229                                        MGMT_OP_SET_EXP_FEATURE,
4230                                        MGMT_STATUS_INVALID_PARAMS);
4231
4232         /* Only boolean on/off is supported */
4233         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4234                 return mgmt_cmd_status(sk, hdev->id,
4235                                        MGMT_OP_SET_EXP_FEATURE,
4236                                        MGMT_STATUS_INVALID_PARAMS);
4237
4238         val = !!cp->param[0];
4239
4240         if (val) {
4241                 changed = !hci_dev_test_and_set_flag(hdev,
4242                                                      HCI_ENABLE_LL_PRIVACY);
4243                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4244
4245                 /* Enable LL privacy + supported settings changed */
4246                 flags = BIT(0) | BIT(1);
4247         } else {
4248                 changed = hci_dev_test_and_clear_flag(hdev,
4249                                                       HCI_ENABLE_LL_PRIVACY);
4250
4251                 /* Disable LL privacy + supported settings changed */
4252                 flags = BIT(1);
4253         }
4254
4255         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4256         rp.flags = cpu_to_le32(flags);
4257
4258         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4259
4260         err = mgmt_cmd_complete(sk, hdev->id,
4261                                 MGMT_OP_SET_EXP_FEATURE, 0,
4262                                 &rp, sizeof(rp));
4263
4264         if (changed)
4265                 exp_ll_privacy_feature_changed(val, hdev, sk);
4266
4267         return err;
4268 }
4269
4270 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4271                                    struct mgmt_cp_set_exp_feature *cp,
4272                                    u16 data_len)
4273 {
4274         struct mgmt_rp_set_exp_feature rp;
4275         bool val, changed;
4276         int err;
4277
4278         /* Command requires to use a valid controller index */
4279         if (!hdev)
4280                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4281                                        MGMT_OP_SET_EXP_FEATURE,
4282                                        MGMT_STATUS_INVALID_INDEX);
4283
4284         /* Parameters are limited to a single octet */
4285         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4286                 return mgmt_cmd_status(sk, hdev->id,
4287                                        MGMT_OP_SET_EXP_FEATURE,
4288                                        MGMT_STATUS_INVALID_PARAMS);
4289
4290         /* Only boolean on/off is supported */
4291         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4292                 return mgmt_cmd_status(sk, hdev->id,
4293                                        MGMT_OP_SET_EXP_FEATURE,
4294                                        MGMT_STATUS_INVALID_PARAMS);
4295
4296         hci_req_sync_lock(hdev);
4297
4298         val = !!cp->param[0];
4299         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4300
4301         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4302                 err = mgmt_cmd_status(sk, hdev->id,
4303                                       MGMT_OP_SET_EXP_FEATURE,
4304                                       MGMT_STATUS_NOT_SUPPORTED);
4305                 goto unlock_quality_report;
4306         }
4307
4308         if (changed) {
4309                 if (hdev->set_quality_report)
4310                         err = hdev->set_quality_report(hdev, val);
4311                 else
4312                         err = aosp_set_quality_report(hdev, val);
4313
4314                 if (err) {
4315                         err = mgmt_cmd_status(sk, hdev->id,
4316                                               MGMT_OP_SET_EXP_FEATURE,
4317                                               MGMT_STATUS_FAILED);
4318                         goto unlock_quality_report;
4319                 }
4320
4321                 if (val)
4322                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4323                 else
4324                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4325         }
4326
4327         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4328
4329         memcpy(rp.uuid, quality_report_uuid, 16);
4330         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4331         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4332
4333         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4334                                 &rp, sizeof(rp));
4335
4336         if (changed)
4337                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4338
4339 unlock_quality_report:
4340         hci_req_sync_unlock(hdev);
4341         return err;
4342 }
4343
4344 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4345                                   struct mgmt_cp_set_exp_feature *cp,
4346                                   u16 data_len)
4347 {
4348         bool val, changed;
4349         int err;
4350         struct mgmt_rp_set_exp_feature rp;
4351
4352         /* Command requires to use a valid controller index */
4353         if (!hdev)
4354                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4355                                        MGMT_OP_SET_EXP_FEATURE,
4356                                        MGMT_STATUS_INVALID_INDEX);
4357
4358         /* Parameters are limited to a single octet */
4359         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4360                 return mgmt_cmd_status(sk, hdev->id,
4361                                        MGMT_OP_SET_EXP_FEATURE,
4362                                        MGMT_STATUS_INVALID_PARAMS);
4363
4364         /* Only boolean on/off is supported */
4365         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4366                 return mgmt_cmd_status(sk, hdev->id,
4367                                        MGMT_OP_SET_EXP_FEATURE,
4368                                        MGMT_STATUS_INVALID_PARAMS);
4369
4370         val = !!cp->param[0];
4371         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4372
4373         if (!hdev->get_data_path_id) {
4374                 return mgmt_cmd_status(sk, hdev->id,
4375                                        MGMT_OP_SET_EXP_FEATURE,
4376                                        MGMT_STATUS_NOT_SUPPORTED);
4377         }
4378
4379         if (changed) {
4380                 if (val)
4381                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4382                 else
4383                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4384         }
4385
4386         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4387                     val, changed);
4388
4389         memcpy(rp.uuid, offload_codecs_uuid, 16);
4390         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4391         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4392         err = mgmt_cmd_complete(sk, hdev->id,
4393                                 MGMT_OP_SET_EXP_FEATURE, 0,
4394                                 &rp, sizeof(rp));
4395
4396         if (changed)
4397                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4398
4399         return err;
4400 }
4401
4402 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4403                                           struct mgmt_cp_set_exp_feature *cp,
4404                                           u16 data_len)
4405 {
4406         bool val, changed;
4407         int err;
4408         struct mgmt_rp_set_exp_feature rp;
4409
4410         /* Command requires to use a valid controller index */
4411         if (!hdev)
4412                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4413                                        MGMT_OP_SET_EXP_FEATURE,
4414                                        MGMT_STATUS_INVALID_INDEX);
4415
4416         /* Parameters are limited to a single octet */
4417         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4418                 return mgmt_cmd_status(sk, hdev->id,
4419                                        MGMT_OP_SET_EXP_FEATURE,
4420                                        MGMT_STATUS_INVALID_PARAMS);
4421
4422         /* Only boolean on/off is supported */
4423         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4424                 return mgmt_cmd_status(sk, hdev->id,
4425                                        MGMT_OP_SET_EXP_FEATURE,
4426                                        MGMT_STATUS_INVALID_PARAMS);
4427
4428         val = !!cp->param[0];
4429         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4430
4431         if (!hci_dev_le_state_simultaneous(hdev)) {
4432                 return mgmt_cmd_status(sk, hdev->id,
4433                                        MGMT_OP_SET_EXP_FEATURE,
4434                                        MGMT_STATUS_NOT_SUPPORTED);
4435         }
4436
4437         if (changed) {
4438                 if (val)
4439                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4440                 else
4441                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4442         }
4443
4444         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4445                     val, changed);
4446
4447         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4448         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4449         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4450         err = mgmt_cmd_complete(sk, hdev->id,
4451                                 MGMT_OP_SET_EXP_FEATURE, 0,
4452                                 &rp, sizeof(rp));
4453
4454         if (changed)
4455                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4456
4457         return err;
4458 }
4459
4460 #ifdef CONFIG_BT_LE
4461 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4462                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4463 {
4464         struct mgmt_rp_set_exp_feature rp;
4465         bool val, changed = false;
4466         int err;
4467
4468         /* Command requires to use the non-controller index */
4469         if (hdev)
4470                 return mgmt_cmd_status(sk, hdev->id,
4471                                        MGMT_OP_SET_EXP_FEATURE,
4472                                        MGMT_STATUS_INVALID_INDEX);
4473
4474         /* Parameters are limited to a single octet */
4475         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4476                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4477                                        MGMT_OP_SET_EXP_FEATURE,
4478                                        MGMT_STATUS_INVALID_PARAMS);
4479
4480         /* Only boolean on/off is supported */
4481         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4482                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4483                                        MGMT_OP_SET_EXP_FEATURE,
4484                                        MGMT_STATUS_INVALID_PARAMS);
4485
4486         val = cp->param[0] ? true : false;
4487         if (val)
4488                 err = iso_init();
4489         else
4490                 err = iso_exit();
4491
4492         if (!err)
4493                 changed = true;
4494
4495         memcpy(rp.uuid, iso_socket_uuid, 16);
4496         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4497
4498         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4499
4500         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4501                                 MGMT_OP_SET_EXP_FEATURE, 0,
4502                                 &rp, sizeof(rp));
4503
4504         if (changed)
4505                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4506
4507         return err;
4508 }
4509 #endif
4510
4511 static const struct mgmt_exp_feature {
4512         const u8 *uuid;
4513         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4514                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4515 } exp_features[] = {
4516         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4517 #ifdef CONFIG_BT_FEATURE_DEBUG
4518         EXP_FEAT(debug_uuid, set_debug_func),
4519 #endif
4520         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4521         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4522         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4523         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4524 #ifdef CONFIG_BT_LE
4525         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4526 #endif
4527
4528         /* end with a null feature */
4529         EXP_FEAT(NULL, NULL)
4530 };
4531
4532 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4533                            void *data, u16 data_len)
4534 {
4535         struct mgmt_cp_set_exp_feature *cp = data;
4536         size_t i = 0;
4537
4538         bt_dev_dbg(hdev, "sock %p", sk);
4539
4540         for (i = 0; exp_features[i].uuid; i++) {
4541                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4542                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4543         }
4544
4545         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4546                                MGMT_OP_SET_EXP_FEATURE,
4547                                MGMT_STATUS_NOT_SUPPORTED);
4548 }
4549
4550 static u32 get_params_flags(struct hci_dev *hdev,
4551                             struct hci_conn_params *params)
4552 {
4553         u32 flags = hdev->conn_flags;
4554
4555         /* Devices using RPAs can only be programmed in the acceptlist if
4556          * LL Privacy has been enable otherwise they cannot mark
4557          * HCI_CONN_FLAG_REMOTE_WAKEUP.
4558          */
4559         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
4560             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
4561                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
4562
4563         return flags;
4564 }
4565
4566 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4567                             u16 data_len)
4568 {
4569         struct mgmt_cp_get_device_flags *cp = data;
4570         struct mgmt_rp_get_device_flags rp;
4571         struct bdaddr_list_with_flags *br_params;
4572         struct hci_conn_params *params;
4573         u32 supported_flags;
4574         u32 current_flags = 0;
4575         u8 status = MGMT_STATUS_INVALID_PARAMS;
4576
4577         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4578                    &cp->addr.bdaddr, cp->addr.type);
4579
4580         hci_dev_lock(hdev);
4581
4582         supported_flags = hdev->conn_flags;
4583
4584         memset(&rp, 0, sizeof(rp));
4585
4586         if (cp->addr.type == BDADDR_BREDR) {
4587                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4588                                                               &cp->addr.bdaddr,
4589                                                               cp->addr.type);
4590                 if (!br_params)
4591                         goto done;
4592
4593                 current_flags = br_params->flags;
4594         } else {
4595                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4596                                                 le_addr_type(cp->addr.type));
4597                 if (!params)
4598                         goto done;
4599
4600                 supported_flags = get_params_flags(hdev, params);
4601                 current_flags = params->flags;
4602         }
4603
4604         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4605         rp.addr.type = cp->addr.type;
4606         rp.supported_flags = cpu_to_le32(supported_flags);
4607         rp.current_flags = cpu_to_le32(current_flags);
4608
4609         status = MGMT_STATUS_SUCCESS;
4610
4611 done:
4612         hci_dev_unlock(hdev);
4613
4614         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4615                                 &rp, sizeof(rp));
4616 }
4617
4618 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4619                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4620                                  u32 supported_flags, u32 current_flags)
4621 {
4622         struct mgmt_ev_device_flags_changed ev;
4623
4624         bacpy(&ev.addr.bdaddr, bdaddr);
4625         ev.addr.type = bdaddr_type;
4626         ev.supported_flags = cpu_to_le32(supported_flags);
4627         ev.current_flags = cpu_to_le32(current_flags);
4628
4629         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4630 }
4631
4632 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4633                             u16 len)
4634 {
4635         struct mgmt_cp_set_device_flags *cp = data;
4636         struct bdaddr_list_with_flags *br_params;
4637         struct hci_conn_params *params;
4638         u8 status = MGMT_STATUS_INVALID_PARAMS;
4639         u32 supported_flags;
4640         u32 current_flags = __le32_to_cpu(cp->current_flags);
4641
4642         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4643                    &cp->addr.bdaddr, cp->addr.type, current_flags);
4644
4645         // We should take hci_dev_lock() early, I think.. conn_flags can change
4646         supported_flags = hdev->conn_flags;
4647
4648         if ((supported_flags | current_flags) != supported_flags) {
4649                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4650                             current_flags, supported_flags);
4651                 goto done;
4652         }
4653
4654         hci_dev_lock(hdev);
4655
4656         if (cp->addr.type == BDADDR_BREDR) {
4657                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4658                                                               &cp->addr.bdaddr,
4659                                                               cp->addr.type);
4660
4661                 if (br_params) {
4662                         br_params->flags = current_flags;
4663                         status = MGMT_STATUS_SUCCESS;
4664                 } else {
4665                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4666                                     &cp->addr.bdaddr, cp->addr.type);
4667                 }
4668
4669                 goto unlock;
4670         }
4671
4672         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4673                                         le_addr_type(cp->addr.type));
4674         if (!params) {
4675                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4676                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
4677                 goto unlock;
4678         }
4679
4680         supported_flags = get_params_flags(hdev, params);
4681
4682         if ((supported_flags | current_flags) != supported_flags) {
4683                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4684                             current_flags, supported_flags);
4685                 goto unlock;
4686         }
4687
4688         params->flags = current_flags;
4689         status = MGMT_STATUS_SUCCESS;
4690
4691         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
4692          * has been set.
4693          */
4694         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
4695                 hci_update_passive_scan(hdev);
4696
4697 unlock:
4698         hci_dev_unlock(hdev);
4699
4700 done:
4701         if (status == MGMT_STATUS_SUCCESS)
4702                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4703                                      supported_flags, current_flags);
4704
4705         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4706                                  &cp->addr, sizeof(cp->addr));
4707 }
4708
4709 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4710                                    u16 handle)
4711 {
4712         struct mgmt_ev_adv_monitor_added ev;
4713
4714         ev.monitor_handle = cpu_to_le16(handle);
4715
4716         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4717 }
4718
4719 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4720 {
4721         struct mgmt_ev_adv_monitor_removed ev;
4722         struct mgmt_pending_cmd *cmd;
4723         struct sock *sk_skip = NULL;
4724         struct mgmt_cp_remove_adv_monitor *cp;
4725
4726         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4727         if (cmd) {
4728                 cp = cmd->param;
4729
4730                 if (cp->monitor_handle)
4731                         sk_skip = cmd->sk;
4732         }
4733
4734         ev.monitor_handle = cpu_to_le16(handle);
4735
4736         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4737 }
4738
4739 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4740                                  void *data, u16 len)
4741 {
4742         struct adv_monitor *monitor = NULL;
4743         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4744         int handle, err;
4745         size_t rp_size = 0;
4746         __u32 supported = 0;
4747         __u32 enabled = 0;
4748         __u16 num_handles = 0;
4749         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4750
4751         BT_DBG("request for %s", hdev->name);
4752
4753         hci_dev_lock(hdev);
4754
4755         if (msft_monitor_supported(hdev))
4756                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4757
4758         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4759                 handles[num_handles++] = monitor->handle;
4760
4761         hci_dev_unlock(hdev);
4762
4763         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4764         rp = kmalloc(rp_size, GFP_KERNEL);
4765         if (!rp)
4766                 return -ENOMEM;
4767
4768         /* All supported features are currently enabled */
4769         enabled = supported;
4770
4771         rp->supported_features = cpu_to_le32(supported);
4772         rp->enabled_features = cpu_to_le32(enabled);
4773         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4774         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4775         rp->num_handles = cpu_to_le16(num_handles);
4776         if (num_handles)
4777                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4778
4779         err = mgmt_cmd_complete(sk, hdev->id,
4780                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4781                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4782
4783         kfree(rp);
4784
4785         return err;
4786 }
4787
4788 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
4789                                                    void *data, int status)
4790 {
4791         struct mgmt_rp_add_adv_patterns_monitor rp;
4792         struct mgmt_pending_cmd *cmd = data;
4793         struct adv_monitor *monitor = cmd->user_data;
4794
4795         hci_dev_lock(hdev);
4796
4797         rp.monitor_handle = cpu_to_le16(monitor->handle);
4798
4799         if (!status) {
4800                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4801                 hdev->adv_monitors_cnt++;
4802                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4803                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4804                 hci_update_passive_scan(hdev);
4805         }
4806
4807         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4808                           mgmt_status(status), &rp, sizeof(rp));
4809         mgmt_pending_remove(cmd);
4810
4811         hci_dev_unlock(hdev);
4812         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
4813                    rp.monitor_handle, status);
4814 }
4815
4816 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
4817 {
4818         struct mgmt_pending_cmd *cmd = data;
4819         struct adv_monitor *monitor = cmd->user_data;
4820
4821         return hci_add_adv_monitor(hdev, monitor);
4822 }
4823
4824 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4825                                       struct adv_monitor *m, u8 status,
4826                                       void *data, u16 len, u16 op)
4827 {
4828         struct mgmt_pending_cmd *cmd;
4829         int err;
4830
4831         hci_dev_lock(hdev);
4832
4833         if (status)
4834                 goto unlock;
4835
4836         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4837             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4838             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4839             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4840                 status = MGMT_STATUS_BUSY;
4841                 goto unlock;
4842         }
4843
4844         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4845         if (!cmd) {
4846                 status = MGMT_STATUS_NO_RESOURCES;
4847                 goto unlock;
4848         }
4849
4850         cmd->user_data = m;
4851         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
4852                                  mgmt_add_adv_patterns_monitor_complete);
4853         if (err) {
4854                 if (err == -ENOMEM)
4855                         status = MGMT_STATUS_NO_RESOURCES;
4856                 else
4857                         status = MGMT_STATUS_FAILED;
4858
4859                 goto unlock;
4860         }
4861
4862         hci_dev_unlock(hdev);
4863
4864         return 0;
4865
4866 unlock:
4867         hci_free_adv_monitor(hdev, m);
4868         hci_dev_unlock(hdev);
4869         return mgmt_cmd_status(sk, hdev->id, op, status);
4870 }
4871
4872 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4873                                    struct mgmt_adv_rssi_thresholds *rssi)
4874 {
4875         if (rssi) {
4876                 m->rssi.low_threshold = rssi->low_threshold;
4877                 m->rssi.low_threshold_timeout =
4878                     __le16_to_cpu(rssi->low_threshold_timeout);
4879                 m->rssi.high_threshold = rssi->high_threshold;
4880                 m->rssi.high_threshold_timeout =
4881                     __le16_to_cpu(rssi->high_threshold_timeout);
4882                 m->rssi.sampling_period = rssi->sampling_period;
4883         } else {
4884                 /* Default values. These numbers are the least constricting
4885                  * parameters for MSFT API to work, so it behaves as if there
4886                  * are no rssi parameter to consider. May need to be changed
4887                  * if other API are to be supported.
4888                  */
4889                 m->rssi.low_threshold = -127;
4890                 m->rssi.low_threshold_timeout = 60;
4891                 m->rssi.high_threshold = -127;
4892                 m->rssi.high_threshold_timeout = 0;
4893                 m->rssi.sampling_period = 0;
4894         }
4895 }
4896
4897 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4898                                     struct mgmt_adv_pattern *patterns)
4899 {
4900         u8 offset = 0, length = 0;
4901         struct adv_pattern *p = NULL;
4902         int i;
4903
4904         for (i = 0; i < pattern_count; i++) {
4905                 offset = patterns[i].offset;
4906                 length = patterns[i].length;
4907                 if (offset >= HCI_MAX_AD_LENGTH ||
4908                     length > HCI_MAX_AD_LENGTH ||
4909                     (offset + length) > HCI_MAX_AD_LENGTH)
4910                         return MGMT_STATUS_INVALID_PARAMS;
4911
4912                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4913                 if (!p)
4914                         return MGMT_STATUS_NO_RESOURCES;
4915
4916                 p->ad_type = patterns[i].ad_type;
4917                 p->offset = patterns[i].offset;
4918                 p->length = patterns[i].length;
4919                 memcpy(p->value, patterns[i].value, p->length);
4920
4921                 INIT_LIST_HEAD(&p->list);
4922                 list_add(&p->list, &m->patterns);
4923         }
4924
4925         return MGMT_STATUS_SUCCESS;
4926 }
4927
4928 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4929                                     void *data, u16 len)
4930 {
4931         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4932         struct adv_monitor *m = NULL;
4933         u8 status = MGMT_STATUS_SUCCESS;
4934         size_t expected_size = sizeof(*cp);
4935
4936         BT_DBG("request for %s", hdev->name);
4937
4938         if (len <= sizeof(*cp)) {
4939                 status = MGMT_STATUS_INVALID_PARAMS;
4940                 goto done;
4941         }
4942
4943         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4944         if (len != expected_size) {
4945                 status = MGMT_STATUS_INVALID_PARAMS;
4946                 goto done;
4947         }
4948
4949         m = kzalloc(sizeof(*m), GFP_KERNEL);
4950         if (!m) {
4951                 status = MGMT_STATUS_NO_RESOURCES;
4952                 goto done;
4953         }
4954
4955         INIT_LIST_HEAD(&m->patterns);
4956
4957         parse_adv_monitor_rssi(m, NULL);
4958         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4959
4960 done:
4961         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4962                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4963 }
4964
4965 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4966                                          void *data, u16 len)
4967 {
4968         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4969         struct adv_monitor *m = NULL;
4970         u8 status = MGMT_STATUS_SUCCESS;
4971         size_t expected_size = sizeof(*cp);
4972
4973         BT_DBG("request for %s", hdev->name);
4974
4975         if (len <= sizeof(*cp)) {
4976                 status = MGMT_STATUS_INVALID_PARAMS;
4977                 goto done;
4978         }
4979
4980         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4981         if (len != expected_size) {
4982                 status = MGMT_STATUS_INVALID_PARAMS;
4983                 goto done;
4984         }
4985
4986         m = kzalloc(sizeof(*m), GFP_KERNEL);
4987         if (!m) {
4988                 status = MGMT_STATUS_NO_RESOURCES;
4989                 goto done;
4990         }
4991
4992         INIT_LIST_HEAD(&m->patterns);
4993
4994         parse_adv_monitor_rssi(m, &cp->rssi);
4995         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4996
4997 done:
4998         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4999                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5000 }
5001
5002 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5003                                              void *data, int status)
5004 {
5005         struct mgmt_rp_remove_adv_monitor rp;
5006         struct mgmt_pending_cmd *cmd = data;
5007         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5008
5009         hci_dev_lock(hdev);
5010
5011         rp.monitor_handle = cp->monitor_handle;
5012
5013         if (!status)
5014                 hci_update_passive_scan(hdev);
5015
5016         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5017                           mgmt_status(status), &rp, sizeof(rp));
5018         mgmt_pending_remove(cmd);
5019
5020         hci_dev_unlock(hdev);
5021         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5022                    rp.monitor_handle, status);
5023 }
5024
5025 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5026 {
5027         struct mgmt_pending_cmd *cmd = data;
5028         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5029         u16 handle = __le16_to_cpu(cp->monitor_handle);
5030
5031         if (!handle)
5032                 return hci_remove_all_adv_monitor(hdev);
5033
5034         return hci_remove_single_adv_monitor(hdev, handle);
5035 }
5036
5037 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5038                               void *data, u16 len)
5039 {
5040         struct mgmt_pending_cmd *cmd;
5041         int err, status;
5042
5043         hci_dev_lock(hdev);
5044
5045         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5046             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5047             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5048             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5049                 status = MGMT_STATUS_BUSY;
5050                 goto unlock;
5051         }
5052
5053         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5054         if (!cmd) {
5055                 status = MGMT_STATUS_NO_RESOURCES;
5056                 goto unlock;
5057         }
5058
5059         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5060                                  mgmt_remove_adv_monitor_complete);
5061
5062         if (err) {
5063                 mgmt_pending_remove(cmd);
5064
5065                 if (err == -ENOMEM)
5066                         status = MGMT_STATUS_NO_RESOURCES;
5067                 else
5068                         status = MGMT_STATUS_FAILED;
5069
5070                 goto unlock;
5071         }
5072
5073         hci_dev_unlock(hdev);
5074
5075         return 0;
5076
5077 unlock:
5078         hci_dev_unlock(hdev);
5079         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5080                                status);
5081 }
5082
5083 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5084 {
5085         struct mgmt_rp_read_local_oob_data mgmt_rp;
5086         size_t rp_size = sizeof(mgmt_rp);
5087         struct mgmt_pending_cmd *cmd = data;
5088         struct sk_buff *skb = cmd->skb;
5089         u8 status = mgmt_status(err);
5090
5091         if (!status) {
5092                 if (!skb)
5093                         status = MGMT_STATUS_FAILED;
5094                 else if (IS_ERR(skb))
5095                         status = mgmt_status(PTR_ERR(skb));
5096                 else
5097                         status = mgmt_status(skb->data[0]);
5098         }
5099
5100         bt_dev_dbg(hdev, "status %d", status);
5101
5102         if (status) {
5103                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5104                 goto remove;
5105         }
5106
5107         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5108
5109         if (!bredr_sc_enabled(hdev)) {
5110                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5111
5112                 if (skb->len < sizeof(*rp)) {
5113                         mgmt_cmd_status(cmd->sk, hdev->id,
5114                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5115                                         MGMT_STATUS_FAILED);
5116                         goto remove;
5117                 }
5118
5119                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5120                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5121
5122                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5123         } else {
5124                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5125
5126                 if (skb->len < sizeof(*rp)) {
5127                         mgmt_cmd_status(cmd->sk, hdev->id,
5128                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5129                                         MGMT_STATUS_FAILED);
5130                         goto remove;
5131                 }
5132
5133                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5134                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5135
5136                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5137                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5138         }
5139
5140         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5141                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5142
5143 remove:
5144         if (skb && !IS_ERR(skb))
5145                 kfree_skb(skb);
5146
5147         mgmt_pending_free(cmd);
5148 }
5149
5150 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5151 {
5152         struct mgmt_pending_cmd *cmd = data;
5153
5154         if (bredr_sc_enabled(hdev))
5155                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5156         else
5157                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5158
5159         if (IS_ERR(cmd->skb))
5160                 return PTR_ERR(cmd->skb);
5161         else
5162                 return 0;
5163 }
5164
5165 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5166                                void *data, u16 data_len)
5167 {
5168         struct mgmt_pending_cmd *cmd;
5169         int err;
5170
5171         bt_dev_dbg(hdev, "sock %p", sk);
5172
5173         hci_dev_lock(hdev);
5174
5175         if (!hdev_is_powered(hdev)) {
5176                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5177                                       MGMT_STATUS_NOT_POWERED);
5178                 goto unlock;
5179         }
5180
5181         if (!lmp_ssp_capable(hdev)) {
5182                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5183                                       MGMT_STATUS_NOT_SUPPORTED);
5184                 goto unlock;
5185         }
5186
5187         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5188         if (!cmd)
5189                 err = -ENOMEM;
5190         else
5191                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5192                                          read_local_oob_data_complete);
5193
5194         if (err < 0) {
5195                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5196                                       MGMT_STATUS_FAILED);
5197
5198                 if (cmd)
5199                         mgmt_pending_free(cmd);
5200         }
5201
5202 unlock:
5203         hci_dev_unlock(hdev);
5204         return err;
5205 }
5206
5207 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5208                                void *data, u16 len)
5209 {
5210         struct mgmt_addr_info *addr = data;
5211         int err;
5212
5213         bt_dev_dbg(hdev, "sock %p", sk);
5214
5215         if (!bdaddr_type_is_valid(addr->type))
5216                 return mgmt_cmd_complete(sk, hdev->id,
5217                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5218                                          MGMT_STATUS_INVALID_PARAMS,
5219                                          addr, sizeof(*addr));
5220
5221         hci_dev_lock(hdev);
5222
5223         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5224                 struct mgmt_cp_add_remote_oob_data *cp = data;
5225                 u8 status;
5226
5227                 if (cp->addr.type != BDADDR_BREDR) {
5228                         err = mgmt_cmd_complete(sk, hdev->id,
5229                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5230                                                 MGMT_STATUS_INVALID_PARAMS,
5231                                                 &cp->addr, sizeof(cp->addr));
5232                         goto unlock;
5233                 }
5234
5235                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5236                                               cp->addr.type, cp->hash,
5237                                               cp->rand, NULL, NULL);
5238                 if (err < 0)
5239                         status = MGMT_STATUS_FAILED;
5240                 else
5241                         status = MGMT_STATUS_SUCCESS;
5242
5243                 err = mgmt_cmd_complete(sk, hdev->id,
5244                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5245                                         &cp->addr, sizeof(cp->addr));
5246         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5247                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5248                 u8 *rand192, *hash192, *rand256, *hash256;
5249                 u8 status;
5250
5251                 if (bdaddr_type_is_le(cp->addr.type)) {
5252                         /* Enforce zero-valued 192-bit parameters as
5253                          * long as legacy SMP OOB isn't implemented.
5254                          */
5255                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5256                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5257                                 err = mgmt_cmd_complete(sk, hdev->id,
5258                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5259                                                         MGMT_STATUS_INVALID_PARAMS,
5260                                                         addr, sizeof(*addr));
5261                                 goto unlock;
5262                         }
5263
5264                         rand192 = NULL;
5265                         hash192 = NULL;
5266                 } else {
5267                         /* In case one of the P-192 values is set to zero,
5268                          * then just disable OOB data for P-192.
5269                          */
5270                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5271                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5272                                 rand192 = NULL;
5273                                 hash192 = NULL;
5274                         } else {
5275                                 rand192 = cp->rand192;
5276                                 hash192 = cp->hash192;
5277                         }
5278                 }
5279
5280                 /* In case one of the P-256 values is set to zero, then just
5281                  * disable OOB data for P-256.
5282                  */
5283                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5284                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5285                         rand256 = NULL;
5286                         hash256 = NULL;
5287                 } else {
5288                         rand256 = cp->rand256;
5289                         hash256 = cp->hash256;
5290                 }
5291
5292                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5293                                               cp->addr.type, hash192, rand192,
5294                                               hash256, rand256);
5295                 if (err < 0)
5296                         status = MGMT_STATUS_FAILED;
5297                 else
5298                         status = MGMT_STATUS_SUCCESS;
5299
5300                 err = mgmt_cmd_complete(sk, hdev->id,
5301                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5302                                         status, &cp->addr, sizeof(cp->addr));
5303         } else {
5304                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5305                            len);
5306                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5307                                       MGMT_STATUS_INVALID_PARAMS);
5308         }
5309
5310 unlock:
5311         hci_dev_unlock(hdev);
5312         return err;
5313 }
5314
5315 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5316                                   void *data, u16 len)
5317 {
5318         struct mgmt_cp_remove_remote_oob_data *cp = data;
5319         u8 status;
5320         int err;
5321
5322         bt_dev_dbg(hdev, "sock %p", sk);
5323
5324         if (cp->addr.type != BDADDR_BREDR)
5325                 return mgmt_cmd_complete(sk, hdev->id,
5326                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5327                                          MGMT_STATUS_INVALID_PARAMS,
5328                                          &cp->addr, sizeof(cp->addr));
5329
5330         hci_dev_lock(hdev);
5331
5332         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5333                 hci_remote_oob_data_clear(hdev);
5334                 status = MGMT_STATUS_SUCCESS;
5335                 goto done;
5336         }
5337
5338         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5339         if (err < 0)
5340                 status = MGMT_STATUS_INVALID_PARAMS;
5341         else
5342                 status = MGMT_STATUS_SUCCESS;
5343
5344 done:
5345         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5346                                 status, &cp->addr, sizeof(cp->addr));
5347
5348         hci_dev_unlock(hdev);
5349         return err;
5350 }
5351
5352 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5353 {
5354         struct mgmt_pending_cmd *cmd;
5355
5356         bt_dev_dbg(hdev, "status %u", status);
5357
5358         hci_dev_lock(hdev);
5359
5360         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5361         if (!cmd)
5362                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5363
5364         if (!cmd)
5365                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5366
5367         if (cmd) {
5368                 cmd->cmd_complete(cmd, mgmt_status(status));
5369                 mgmt_pending_remove(cmd);
5370         }
5371
5372         hci_dev_unlock(hdev);
5373 }
5374
5375 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5376                                     uint8_t *mgmt_status)
5377 {
5378         switch (type) {
5379         case DISCOV_TYPE_LE:
5380                 *mgmt_status = mgmt_le_support(hdev);
5381                 if (*mgmt_status)
5382                         return false;
5383                 break;
5384         case DISCOV_TYPE_INTERLEAVED:
5385                 *mgmt_status = mgmt_le_support(hdev);
5386                 if (*mgmt_status)
5387                         return false;
5388                 fallthrough;
5389         case DISCOV_TYPE_BREDR:
5390                 *mgmt_status = mgmt_bredr_support(hdev);
5391                 if (*mgmt_status)
5392                         return false;
5393                 break;
5394         default:
5395                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5396                 return false;
5397         }
5398
5399         return true;
5400 }
5401
5402 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5403 {
5404         struct mgmt_pending_cmd *cmd = data;
5405
5406         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5407             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5408             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5409                 return;
5410
5411         bt_dev_dbg(hdev, "err %d", err);
5412
5413         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5414                           cmd->param, 1);
5415         mgmt_pending_remove(cmd);
5416
5417         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5418                                 DISCOVERY_FINDING);
5419 }
5420
5421 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5422 {
5423         return hci_start_discovery_sync(hdev);
5424 }
5425
5426 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5427                                     u16 op, void *data, u16 len)
5428 {
5429         struct mgmt_cp_start_discovery *cp = data;
5430         struct mgmt_pending_cmd *cmd;
5431         u8 status;
5432         int err;
5433
5434         bt_dev_dbg(hdev, "sock %p", sk);
5435
5436         hci_dev_lock(hdev);
5437
5438         if (!hdev_is_powered(hdev)) {
5439                 err = mgmt_cmd_complete(sk, hdev->id, op,
5440                                         MGMT_STATUS_NOT_POWERED,
5441                                         &cp->type, sizeof(cp->type));
5442                 goto failed;
5443         }
5444
5445         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5446             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5447                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5448                                         &cp->type, sizeof(cp->type));
5449                 goto failed;
5450         }
5451
5452         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5453                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5454                                         &cp->type, sizeof(cp->type));
5455                 goto failed;
5456         }
5457
5458         /* Can't start discovery when it is paused */
5459         if (hdev->discovery_paused) {
5460                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5461                                         &cp->type, sizeof(cp->type));
5462                 goto failed;
5463         }
5464
5465         /* Clear the discovery filter first to free any previously
5466          * allocated memory for the UUID list.
5467          */
5468         hci_discovery_filter_clear(hdev);
5469
5470         hdev->discovery.type = cp->type;
5471         hdev->discovery.report_invalid_rssi = false;
5472         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5473                 hdev->discovery.limited = true;
5474         else
5475                 hdev->discovery.limited = false;
5476
5477         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5478         if (!cmd) {
5479                 err = -ENOMEM;
5480                 goto failed;
5481         }
5482
5483         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5484                                  start_discovery_complete);
5485         if (err < 0) {
5486                 mgmt_pending_remove(cmd);
5487                 goto failed;
5488         }
5489
5490         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5491
5492 failed:
5493         hci_dev_unlock(hdev);
5494         return err;
5495 }
5496
5497 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5498                            void *data, u16 len)
5499 {
5500         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5501                                         data, len);
5502 }
5503
5504 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5505                                    void *data, u16 len)
5506 {
5507         return start_discovery_internal(sk, hdev,
5508                                         MGMT_OP_START_LIMITED_DISCOVERY,
5509                                         data, len);
5510 }
5511
5512 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5513                                    void *data, u16 len)
5514 {
5515         struct mgmt_cp_start_service_discovery *cp = data;
5516         struct mgmt_pending_cmd *cmd;
5517         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5518         u16 uuid_count, expected_len;
5519         u8 status;
5520         int err;
5521
5522         bt_dev_dbg(hdev, "sock %p", sk);
5523
5524         hci_dev_lock(hdev);
5525
5526         if (!hdev_is_powered(hdev)) {
5527                 err = mgmt_cmd_complete(sk, hdev->id,
5528                                         MGMT_OP_START_SERVICE_DISCOVERY,
5529                                         MGMT_STATUS_NOT_POWERED,
5530                                         &cp->type, sizeof(cp->type));
5531                 goto failed;
5532         }
5533
5534         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5535             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5536                 err = mgmt_cmd_complete(sk, hdev->id,
5537                                         MGMT_OP_START_SERVICE_DISCOVERY,
5538                                         MGMT_STATUS_BUSY, &cp->type,
5539                                         sizeof(cp->type));
5540                 goto failed;
5541         }
5542
5543         if (hdev->discovery_paused) {
5544                 err = mgmt_cmd_complete(sk, hdev->id,
5545                                         MGMT_OP_START_SERVICE_DISCOVERY,
5546                                         MGMT_STATUS_BUSY, &cp->type,
5547                                         sizeof(cp->type));
5548                 goto failed;
5549         }
5550
5551         uuid_count = __le16_to_cpu(cp->uuid_count);
5552         if (uuid_count > max_uuid_count) {
5553                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5554                            uuid_count);
5555                 err = mgmt_cmd_complete(sk, hdev->id,
5556                                         MGMT_OP_START_SERVICE_DISCOVERY,
5557                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5558                                         sizeof(cp->type));
5559                 goto failed;
5560         }
5561
5562         expected_len = sizeof(*cp) + uuid_count * 16;
5563         if (expected_len != len) {
5564                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5565                            expected_len, len);
5566                 err = mgmt_cmd_complete(sk, hdev->id,
5567                                         MGMT_OP_START_SERVICE_DISCOVERY,
5568                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5569                                         sizeof(cp->type));
5570                 goto failed;
5571         }
5572
5573         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5574                 err = mgmt_cmd_complete(sk, hdev->id,
5575                                         MGMT_OP_START_SERVICE_DISCOVERY,
5576                                         status, &cp->type, sizeof(cp->type));
5577                 goto failed;
5578         }
5579
5580         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5581                                hdev, data, len);
5582         if (!cmd) {
5583                 err = -ENOMEM;
5584                 goto failed;
5585         }
5586
5587         /* Clear the discovery filter first to free any previously
5588          * allocated memory for the UUID list.
5589          */
5590         hci_discovery_filter_clear(hdev);
5591
5592         hdev->discovery.result_filtering = true;
5593         hdev->discovery.type = cp->type;
5594         hdev->discovery.rssi = cp->rssi;
5595         hdev->discovery.uuid_count = uuid_count;
5596
5597         if (uuid_count > 0) {
5598                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5599                                                 GFP_KERNEL);
5600                 if (!hdev->discovery.uuids) {
5601                         err = mgmt_cmd_complete(sk, hdev->id,
5602                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5603                                                 MGMT_STATUS_FAILED,
5604                                                 &cp->type, sizeof(cp->type));
5605                         mgmt_pending_remove(cmd);
5606                         goto failed;
5607                 }
5608         }
5609
5610         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5611                                  start_discovery_complete);
5612         if (err < 0) {
5613                 mgmt_pending_remove(cmd);
5614                 goto failed;
5615         }
5616
5617         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5618
5619 failed:
5620         hci_dev_unlock(hdev);
5621         return err;
5622 }
5623
5624 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5625 {
5626         struct mgmt_pending_cmd *cmd;
5627
5628         bt_dev_dbg(hdev, "status %u", status);
5629
5630         hci_dev_lock(hdev);
5631
5632         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5633         if (cmd) {
5634                 cmd->cmd_complete(cmd, mgmt_status(status));
5635                 mgmt_pending_remove(cmd);
5636         }
5637
5638         hci_dev_unlock(hdev);
5639 }
5640
5641 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
5642 {
5643         struct mgmt_pending_cmd *cmd = data;
5644
5645         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
5646                 return;
5647
5648         bt_dev_dbg(hdev, "err %d", err);
5649
5650         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5651                           cmd->param, 1);
5652         mgmt_pending_remove(cmd);
5653
5654         if (!err)
5655                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
5656 }
5657
5658 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
5659 {
5660         return hci_stop_discovery_sync(hdev);
5661 }
5662
5663 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5664                           u16 len)
5665 {
5666         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5667         struct mgmt_pending_cmd *cmd;
5668         int err;
5669
5670         bt_dev_dbg(hdev, "sock %p", sk);
5671
5672         hci_dev_lock(hdev);
5673
5674         if (!hci_discovery_active(hdev)) {
5675                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5676                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5677                                         sizeof(mgmt_cp->type));
5678                 goto unlock;
5679         }
5680
5681         if (hdev->discovery.type != mgmt_cp->type) {
5682                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5683                                         MGMT_STATUS_INVALID_PARAMS,
5684                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5685                 goto unlock;
5686         }
5687
5688         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5689         if (!cmd) {
5690                 err = -ENOMEM;
5691                 goto unlock;
5692         }
5693
5694         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
5695                                  stop_discovery_complete);
5696         if (err < 0) {
5697                 mgmt_pending_remove(cmd);
5698                 goto unlock;
5699         }
5700
5701         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5702
5703 unlock:
5704         hci_dev_unlock(hdev);
5705         return err;
5706 }
5707
5708 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5709                         u16 len)
5710 {
5711         struct mgmt_cp_confirm_name *cp = data;
5712         struct inquiry_entry *e;
5713         int err;
5714
5715         bt_dev_dbg(hdev, "sock %p", sk);
5716
5717         hci_dev_lock(hdev);
5718
5719         if (!hci_discovery_active(hdev)) {
5720                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5721                                         MGMT_STATUS_FAILED, &cp->addr,
5722                                         sizeof(cp->addr));
5723                 goto failed;
5724         }
5725
5726         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5727         if (!e) {
5728                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5729                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5730                                         sizeof(cp->addr));
5731                 goto failed;
5732         }
5733
5734         if (cp->name_known) {
5735                 e->name_state = NAME_KNOWN;
5736                 list_del(&e->list);
5737         } else {
5738                 e->name_state = NAME_NEEDED;
5739                 hci_inquiry_cache_update_resolve(hdev, e);
5740         }
5741
5742         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5743                                 &cp->addr, sizeof(cp->addr));
5744
5745 failed:
5746         hci_dev_unlock(hdev);
5747         return err;
5748 }
5749
5750 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5751                         u16 len)
5752 {
5753         struct mgmt_cp_block_device *cp = data;
5754         u8 status;
5755         int err;
5756
5757         bt_dev_dbg(hdev, "sock %p", sk);
5758
5759         if (!bdaddr_type_is_valid(cp->addr.type))
5760                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5761                                          MGMT_STATUS_INVALID_PARAMS,
5762                                          &cp->addr, sizeof(cp->addr));
5763
5764         hci_dev_lock(hdev);
5765
5766         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5767                                   cp->addr.type);
5768         if (err < 0) {
5769                 status = MGMT_STATUS_FAILED;
5770                 goto done;
5771         }
5772
5773         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5774                    sk);
5775         status = MGMT_STATUS_SUCCESS;
5776
5777 done:
5778         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5779                                 &cp->addr, sizeof(cp->addr));
5780
5781         hci_dev_unlock(hdev);
5782
5783         return err;
5784 }
5785
5786 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5787                           u16 len)
5788 {
5789         struct mgmt_cp_unblock_device *cp = data;
5790         u8 status;
5791         int err;
5792
5793         bt_dev_dbg(hdev, "sock %p", sk);
5794
5795         if (!bdaddr_type_is_valid(cp->addr.type))
5796                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5797                                          MGMT_STATUS_INVALID_PARAMS,
5798                                          &cp->addr, sizeof(cp->addr));
5799
5800         hci_dev_lock(hdev);
5801
5802         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5803                                   cp->addr.type);
5804         if (err < 0) {
5805                 status = MGMT_STATUS_INVALID_PARAMS;
5806                 goto done;
5807         }
5808
5809         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5810                    sk);
5811         status = MGMT_STATUS_SUCCESS;
5812
5813 done:
5814         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5815                                 &cp->addr, sizeof(cp->addr));
5816
5817         hci_dev_unlock(hdev);
5818
5819         return err;
5820 }
5821
5822 static int set_device_id_sync(struct hci_dev *hdev, void *data)
5823 {
5824         return hci_update_eir_sync(hdev);
5825 }
5826
5827 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5828                          u16 len)
5829 {
5830         struct mgmt_cp_set_device_id *cp = data;
5831         int err;
5832         __u16 source;
5833
5834         bt_dev_dbg(hdev, "sock %p", sk);
5835
5836         source = __le16_to_cpu(cp->source);
5837
5838         if (source > 0x0002)
5839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5840                                        MGMT_STATUS_INVALID_PARAMS);
5841
5842         hci_dev_lock(hdev);
5843
5844         hdev->devid_source = source;
5845         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5846         hdev->devid_product = __le16_to_cpu(cp->product);
5847         hdev->devid_version = __le16_to_cpu(cp->version);
5848
5849         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5850                                 NULL, 0);
5851
5852         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
5853
5854         hci_dev_unlock(hdev);
5855
5856         return err;
5857 }
5858
5859 static void enable_advertising_instance(struct hci_dev *hdev, int err)
5860 {
5861         if (err)
5862                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
5863         else
5864                 bt_dev_dbg(hdev, "status %d", err);
5865 }
5866
5867 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
5868 {
5869         struct cmd_lookup match = { NULL, hdev };
5870         u8 instance;
5871         struct adv_info *adv_instance;
5872         u8 status = mgmt_status(err);
5873
5874         if (status) {
5875                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5876                                      cmd_status_rsp, &status);
5877                 return;
5878         }
5879
5880         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5881                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5882         else
5883                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5884
5885         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5886                              &match);
5887
5888         new_settings(hdev, match.sk);
5889
5890         if (match.sk)
5891                 sock_put(match.sk);
5892
5893         /* If "Set Advertising" was just disabled and instance advertising was
5894          * set up earlier, then re-enable multi-instance advertising.
5895          */
5896         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5897             list_empty(&hdev->adv_instances))
5898                 return;
5899
5900         instance = hdev->cur_adv_instance;
5901         if (!instance) {
5902                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5903                                                         struct adv_info, list);
5904                 if (!adv_instance)
5905                         return;
5906
5907                 instance = adv_instance->instance;
5908         }
5909
5910         err = hci_schedule_adv_instance_sync(hdev, instance, true);
5911
5912         enable_advertising_instance(hdev, err);
5913 }
5914
5915 static int set_adv_sync(struct hci_dev *hdev, void *data)
5916 {
5917         struct mgmt_pending_cmd *cmd = data;
5918         struct mgmt_mode *cp = cmd->param;
5919         u8 val = !!cp->val;
5920
5921         if (cp->val == 0x02)
5922                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5923         else
5924                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5925
5926         cancel_adv_timeout(hdev);
5927
5928         if (val) {
5929                 /* Switch to instance "0" for the Set Advertising setting.
5930                  * We cannot use update_[adv|scan_rsp]_data() here as the
5931                  * HCI_ADVERTISING flag is not yet set.
5932                  */
5933                 hdev->cur_adv_instance = 0x00;
5934
5935                 if (ext_adv_capable(hdev)) {
5936                         hci_start_ext_adv_sync(hdev, 0x00);
5937                 } else {
5938                         hci_update_adv_data_sync(hdev, 0x00);
5939                         hci_update_scan_rsp_data_sync(hdev, 0x00);
5940                         hci_enable_advertising_sync(hdev);
5941                 }
5942         } else {
5943                 hci_disable_advertising_sync(hdev);
5944         }
5945
5946         return 0;
5947 }
5948
5949 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5950                            u16 len)
5951 {
5952         struct mgmt_mode *cp = data;
5953         struct mgmt_pending_cmd *cmd;
5954         u8 val, status;
5955         int err;
5956
5957         bt_dev_dbg(hdev, "sock %p", sk);
5958
5959         status = mgmt_le_support(hdev);
5960         if (status)
5961                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5962                                        status);
5963
5964         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5965                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5966                                        MGMT_STATUS_INVALID_PARAMS);
5967
5968         if (hdev->advertising_paused)
5969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5970                                        MGMT_STATUS_BUSY);
5971
5972         hci_dev_lock(hdev);
5973
5974         val = !!cp->val;
5975
5976         /* The following conditions are ones which mean that we should
5977          * not do any HCI communication but directly send a mgmt
5978          * response to user space (after toggling the flag if
5979          * necessary).
5980          */
5981         if (!hdev_is_powered(hdev) ||
5982             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5983              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5984             hci_conn_num(hdev, LE_LINK) > 0 ||
5985             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5986              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5987                 bool changed;
5988
5989                 if (cp->val) {
5990                         hdev->cur_adv_instance = 0x00;
5991                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5992                         if (cp->val == 0x02)
5993                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5994                         else
5995                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5996                 } else {
5997                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5998                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5999                 }
6000
6001                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6002                 if (err < 0)
6003                         goto unlock;
6004
6005                 if (changed)
6006                         err = new_settings(hdev, sk);
6007
6008                 goto unlock;
6009         }
6010
6011         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6012             pending_find(MGMT_OP_SET_LE, hdev)) {
6013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6014                                       MGMT_STATUS_BUSY);
6015                 goto unlock;
6016         }
6017
6018         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6019         if (!cmd)
6020                 err = -ENOMEM;
6021         else
6022                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6023                                          set_advertising_complete);
6024
6025         if (err < 0 && cmd)
6026                 mgmt_pending_remove(cmd);
6027
6028 unlock:
6029         hci_dev_unlock(hdev);
6030         return err;
6031 }
6032
6033 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6034                               void *data, u16 len)
6035 {
6036         struct mgmt_cp_set_static_address *cp = data;
6037         int err;
6038
6039         bt_dev_dbg(hdev, "sock %p", sk);
6040
6041         if (!lmp_le_capable(hdev))
6042                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6043                                        MGMT_STATUS_NOT_SUPPORTED);
6044
6045         if (hdev_is_powered(hdev))
6046                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6047                                        MGMT_STATUS_REJECTED);
6048
6049         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6050                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6051                         return mgmt_cmd_status(sk, hdev->id,
6052                                                MGMT_OP_SET_STATIC_ADDRESS,
6053                                                MGMT_STATUS_INVALID_PARAMS);
6054
6055                 /* Two most significant bits shall be set */
6056                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6057                         return mgmt_cmd_status(sk, hdev->id,
6058                                                MGMT_OP_SET_STATIC_ADDRESS,
6059                                                MGMT_STATUS_INVALID_PARAMS);
6060         }
6061
6062         hci_dev_lock(hdev);
6063
6064         bacpy(&hdev->static_addr, &cp->bdaddr);
6065
6066         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6067         if (err < 0)
6068                 goto unlock;
6069
6070         err = new_settings(hdev, sk);
6071
6072 unlock:
6073         hci_dev_unlock(hdev);
6074         return err;
6075 }
6076
6077 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6078                            void *data, u16 len)
6079 {
6080         struct mgmt_cp_set_scan_params *cp = data;
6081         __u16 interval, window;
6082         int err;
6083
6084         bt_dev_dbg(hdev, "sock %p", sk);
6085
6086         if (!lmp_le_capable(hdev))
6087                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6088                                        MGMT_STATUS_NOT_SUPPORTED);
6089
6090         interval = __le16_to_cpu(cp->interval);
6091
6092         if (interval < 0x0004 || interval > 0x4000)
6093                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6094                                        MGMT_STATUS_INVALID_PARAMS);
6095
6096         window = __le16_to_cpu(cp->window);
6097
6098         if (window < 0x0004 || window > 0x4000)
6099                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6100                                        MGMT_STATUS_INVALID_PARAMS);
6101
6102         if (window > interval)
6103                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6104                                        MGMT_STATUS_INVALID_PARAMS);
6105
6106         hci_dev_lock(hdev);
6107
6108         hdev->le_scan_interval = interval;
6109         hdev->le_scan_window = window;
6110
6111         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6112                                 NULL, 0);
6113
6114         /* If background scan is running, restart it so new parameters are
6115          * loaded.
6116          */
6117         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6118             hdev->discovery.state == DISCOVERY_STOPPED)
6119                 hci_update_passive_scan(hdev);
6120
6121         hci_dev_unlock(hdev);
6122
6123         return err;
6124 }
6125
6126 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6127 {
6128         struct mgmt_pending_cmd *cmd = data;
6129
6130         bt_dev_dbg(hdev, "err %d", err);
6131
6132         if (err) {
6133                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6134                                 mgmt_status(err));
6135         } else {
6136                 struct mgmt_mode *cp = cmd->param;
6137
6138                 if (cp->val)
6139                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6140                 else
6141                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6142
6143                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6144                 new_settings(hdev, cmd->sk);
6145         }
6146
6147         mgmt_pending_free(cmd);
6148 }
6149
6150 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6151 {
6152         struct mgmt_pending_cmd *cmd = data;
6153         struct mgmt_mode *cp = cmd->param;
6154
6155         return hci_write_fast_connectable_sync(hdev, cp->val);
6156 }
6157
6158 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6159                                 void *data, u16 len)
6160 {
6161         struct mgmt_mode *cp = data;
6162         struct mgmt_pending_cmd *cmd;
6163         int err;
6164
6165         bt_dev_dbg(hdev, "sock %p", sk);
6166
6167         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6168             hdev->hci_ver < BLUETOOTH_VER_1_2)
6169                 return mgmt_cmd_status(sk, hdev->id,
6170                                        MGMT_OP_SET_FAST_CONNECTABLE,
6171                                        MGMT_STATUS_NOT_SUPPORTED);
6172
6173         if (cp->val != 0x00 && cp->val != 0x01)
6174                 return mgmt_cmd_status(sk, hdev->id,
6175                                        MGMT_OP_SET_FAST_CONNECTABLE,
6176                                        MGMT_STATUS_INVALID_PARAMS);
6177
6178         hci_dev_lock(hdev);
6179
6180         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6181                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6182                 goto unlock;
6183         }
6184
6185         if (!hdev_is_powered(hdev)) {
6186                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6187                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6188                 new_settings(hdev, sk);
6189                 goto unlock;
6190         }
6191
6192         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6193                                len);
6194         if (!cmd)
6195                 err = -ENOMEM;
6196         else
6197                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6198                                          fast_connectable_complete);
6199
6200         if (err < 0) {
6201                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6202                                 MGMT_STATUS_FAILED);
6203
6204                 if (cmd)
6205                         mgmt_pending_free(cmd);
6206         }
6207
6208 unlock:
6209         hci_dev_unlock(hdev);
6210
6211         return err;
6212 }
6213
6214 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6215 {
6216         struct mgmt_pending_cmd *cmd = data;
6217
6218         bt_dev_dbg(hdev, "err %d", err);
6219
6220         if (err) {
6221                 u8 mgmt_err = mgmt_status(err);
6222
6223                 /* We need to restore the flag if related HCI commands
6224                  * failed.
6225                  */
6226                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6227
6228                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6229         } else {
6230                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6231                 new_settings(hdev, cmd->sk);
6232         }
6233
6234         mgmt_pending_free(cmd);
6235 }
6236
6237 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6238 {
6239         int status;
6240
6241         status = hci_write_fast_connectable_sync(hdev, false);
6242
6243         if (!status)
6244                 status = hci_update_scan_sync(hdev);
6245
6246         /* Since only the advertising data flags will change, there
6247          * is no need to update the scan response data.
6248          */
6249         if (!status)
6250                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6251
6252         return status;
6253 }
6254
6255 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6256 {
6257         struct mgmt_mode *cp = data;
6258         struct mgmt_pending_cmd *cmd;
6259         int err;
6260
6261         bt_dev_dbg(hdev, "sock %p", sk);
6262
6263         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6264                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6265                                        MGMT_STATUS_NOT_SUPPORTED);
6266
6267         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6268                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6269                                        MGMT_STATUS_REJECTED);
6270
6271         if (cp->val != 0x00 && cp->val != 0x01)
6272                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6273                                        MGMT_STATUS_INVALID_PARAMS);
6274
6275         hci_dev_lock(hdev);
6276
6277         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6278                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6279                 goto unlock;
6280         }
6281
6282         if (!hdev_is_powered(hdev)) {
6283                 if (!cp->val) {
6284                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6285                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6286                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6287                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6288                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6289                 }
6290
6291                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6292
6293                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6294                 if (err < 0)
6295                         goto unlock;
6296
6297                 err = new_settings(hdev, sk);
6298                 goto unlock;
6299         }
6300
6301         /* Reject disabling when powered on */
6302         if (!cp->val) {
6303                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6304                                       MGMT_STATUS_REJECTED);
6305                 goto unlock;
6306         } else {
6307                 /* When configuring a dual-mode controller to operate
6308                  * with LE only and using a static address, then switching
6309                  * BR/EDR back on is not allowed.
6310                  *
6311                  * Dual-mode controllers shall operate with the public
6312                  * address as its identity address for BR/EDR and LE. So
6313                  * reject the attempt to create an invalid configuration.
6314                  *
6315                  * The same restrictions applies when secure connections
6316                  * has been enabled. For BR/EDR this is a controller feature
6317                  * while for LE it is a host stack feature. This means that
6318                  * switching BR/EDR back on when secure connections has been
6319                  * enabled is not a supported transaction.
6320                  */
6321                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6322                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6323                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6324                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6325                                               MGMT_STATUS_REJECTED);
6326                         goto unlock;
6327                 }
6328         }
6329
6330         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6331         if (!cmd)
6332                 err = -ENOMEM;
6333         else
6334                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6335                                          set_bredr_complete);
6336
6337         if (err < 0) {
6338                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6339                                 MGMT_STATUS_FAILED);
6340                 if (cmd)
6341                         mgmt_pending_free(cmd);
6342
6343                 goto unlock;
6344         }
6345
6346         /* We need to flip the bit already here so that
6347          * hci_req_update_adv_data generates the correct flags.
6348          */
6349         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6350
6351 unlock:
6352         hci_dev_unlock(hdev);
6353         return err;
6354 }
6355
6356 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6357 {
6358         struct mgmt_pending_cmd *cmd = data;
6359         struct mgmt_mode *cp;
6360
6361         bt_dev_dbg(hdev, "err %d", err);
6362
6363         if (err) {
6364                 u8 mgmt_err = mgmt_status(err);
6365
6366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6367                 goto done;
6368         }
6369
6370         cp = cmd->param;
6371
6372         switch (cp->val) {
6373         case 0x00:
6374                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6375                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6376                 break;
6377         case 0x01:
6378                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6379                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6380                 break;
6381         case 0x02:
6382                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6383                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6384                 break;
6385         }
6386
6387         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6388         new_settings(hdev, cmd->sk);
6389
6390 done:
6391         mgmt_pending_free(cmd);
6392 }
6393
6394 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6395 {
6396         struct mgmt_pending_cmd *cmd = data;
6397         struct mgmt_mode *cp = cmd->param;
6398         u8 val = !!cp->val;
6399
6400         /* Force write of val */
6401         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6402
6403         return hci_write_sc_support_sync(hdev, val);
6404 }
6405
6406 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6407                            void *data, u16 len)
6408 {
6409         struct mgmt_mode *cp = data;
6410         struct mgmt_pending_cmd *cmd;
6411         u8 val;
6412         int err;
6413
6414         bt_dev_dbg(hdev, "sock %p", sk);
6415
6416         if (!lmp_sc_capable(hdev) &&
6417             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6418                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6419                                        MGMT_STATUS_NOT_SUPPORTED);
6420
6421         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6422             lmp_sc_capable(hdev) &&
6423             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6425                                        MGMT_STATUS_REJECTED);
6426
6427         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6428                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6429                                        MGMT_STATUS_INVALID_PARAMS);
6430
6431         hci_dev_lock(hdev);
6432
6433         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6434             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6435                 bool changed;
6436
6437                 if (cp->val) {
6438                         changed = !hci_dev_test_and_set_flag(hdev,
6439                                                              HCI_SC_ENABLED);
6440                         if (cp->val == 0x02)
6441                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6442                         else
6443                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6444                 } else {
6445                         changed = hci_dev_test_and_clear_flag(hdev,
6446                                                               HCI_SC_ENABLED);
6447                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6448                 }
6449
6450                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6451                 if (err < 0)
6452                         goto failed;
6453
6454                 if (changed)
6455                         err = new_settings(hdev, sk);
6456
6457                 goto failed;
6458         }
6459
6460         val = !!cp->val;
6461
6462         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6463             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6464                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6465                 goto failed;
6466         }
6467
6468         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6469         if (!cmd)
6470                 err = -ENOMEM;
6471         else
6472                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6473                                          set_secure_conn_complete);
6474
6475         if (err < 0) {
6476                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6477                                 MGMT_STATUS_FAILED);
6478                 if (cmd)
6479                         mgmt_pending_free(cmd);
6480         }
6481
6482 failed:
6483         hci_dev_unlock(hdev);
6484         return err;
6485 }
6486
6487 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6488                           void *data, u16 len)
6489 {
6490         struct mgmt_mode *cp = data;
6491         bool changed, use_changed;
6492         int err;
6493
6494         bt_dev_dbg(hdev, "sock %p", sk);
6495
6496         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6498                                        MGMT_STATUS_INVALID_PARAMS);
6499
6500         hci_dev_lock(hdev);
6501
6502         if (cp->val)
6503                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6504         else
6505                 changed = hci_dev_test_and_clear_flag(hdev,
6506                                                       HCI_KEEP_DEBUG_KEYS);
6507
6508         if (cp->val == 0x02)
6509                 use_changed = !hci_dev_test_and_set_flag(hdev,
6510                                                          HCI_USE_DEBUG_KEYS);
6511         else
6512                 use_changed = hci_dev_test_and_clear_flag(hdev,
6513                                                           HCI_USE_DEBUG_KEYS);
6514
6515         if (hdev_is_powered(hdev) && use_changed &&
6516             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6517                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6518                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6519                              sizeof(mode), &mode);
6520         }
6521
6522         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6523         if (err < 0)
6524                 goto unlock;
6525
6526         if (changed)
6527                 err = new_settings(hdev, sk);
6528
6529 unlock:
6530         hci_dev_unlock(hdev);
6531         return err;
6532 }
6533
6534 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6535                        u16 len)
6536 {
6537         struct mgmt_cp_set_privacy *cp = cp_data;
6538         bool changed;
6539         int err;
6540
6541         bt_dev_dbg(hdev, "sock %p", sk);
6542
6543         if (!lmp_le_capable(hdev))
6544                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6545                                        MGMT_STATUS_NOT_SUPPORTED);
6546
6547         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6548                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6549                                        MGMT_STATUS_INVALID_PARAMS);
6550
6551         if (hdev_is_powered(hdev))
6552                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6553                                        MGMT_STATUS_REJECTED);
6554
6555         hci_dev_lock(hdev);
6556
6557         /* If user space supports this command it is also expected to
6558          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6559          */
6560         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6561
6562         if (cp->privacy) {
6563                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6564                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6565                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6566                 hci_adv_instances_set_rpa_expired(hdev, true);
6567                 if (cp->privacy == 0x02)
6568                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6569                 else
6570                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6571         } else {
6572                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6573                 memset(hdev->irk, 0, sizeof(hdev->irk));
6574                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6575                 hci_adv_instances_set_rpa_expired(hdev, false);
6576                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6577         }
6578
6579         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6580         if (err < 0)
6581                 goto unlock;
6582
6583         if (changed)
6584                 err = new_settings(hdev, sk);
6585
6586 unlock:
6587         hci_dev_unlock(hdev);
6588         return err;
6589 }
6590
6591 static bool irk_is_valid(struct mgmt_irk_info *irk)
6592 {
6593         switch (irk->addr.type) {
6594         case BDADDR_LE_PUBLIC:
6595                 return true;
6596
6597         case BDADDR_LE_RANDOM:
6598                 /* Two most significant bits shall be set */
6599                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6600                         return false;
6601                 return true;
6602         }
6603
6604         return false;
6605 }
6606
6607 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6608                      u16 len)
6609 {
6610         struct mgmt_cp_load_irks *cp = cp_data;
6611         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6612                                    sizeof(struct mgmt_irk_info));
6613         u16 irk_count, expected_len;
6614         int i, err;
6615
6616         bt_dev_dbg(hdev, "sock %p", sk);
6617
6618         if (!lmp_le_capable(hdev))
6619                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6620                                        MGMT_STATUS_NOT_SUPPORTED);
6621
6622         irk_count = __le16_to_cpu(cp->irk_count);
6623         if (irk_count > max_irk_count) {
6624                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6625                            irk_count);
6626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6627                                        MGMT_STATUS_INVALID_PARAMS);
6628         }
6629
6630         expected_len = struct_size(cp, irks, irk_count);
6631         if (expected_len != len) {
6632                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6633                            expected_len, len);
6634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6635                                        MGMT_STATUS_INVALID_PARAMS);
6636         }
6637
6638         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6639
6640         for (i = 0; i < irk_count; i++) {
6641                 struct mgmt_irk_info *key = &cp->irks[i];
6642
6643                 if (!irk_is_valid(key))
6644                         return mgmt_cmd_status(sk, hdev->id,
6645                                                MGMT_OP_LOAD_IRKS,
6646                                                MGMT_STATUS_INVALID_PARAMS);
6647         }
6648
6649         hci_dev_lock(hdev);
6650
6651         hci_smp_irks_clear(hdev);
6652
6653         for (i = 0; i < irk_count; i++) {
6654                 struct mgmt_irk_info *irk = &cp->irks[i];
6655
6656                 if (hci_is_blocked_key(hdev,
6657                                        HCI_BLOCKED_KEY_TYPE_IRK,
6658                                        irk->val)) {
6659                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6660                                     &irk->addr.bdaddr);
6661                         continue;
6662                 }
6663
6664                 hci_add_irk(hdev, &irk->addr.bdaddr,
6665                             le_addr_type(irk->addr.type), irk->val,
6666                             BDADDR_ANY);
6667         }
6668
6669         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6670
6671         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6672
6673         hci_dev_unlock(hdev);
6674
6675         return err;
6676 }
6677
6678 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6679 {
6680         if (key->initiator != 0x00 && key->initiator != 0x01)
6681                 return false;
6682
6683         switch (key->addr.type) {
6684         case BDADDR_LE_PUBLIC:
6685                 return true;
6686
6687         case BDADDR_LE_RANDOM:
6688                 /* Two most significant bits shall be set */
6689                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6690                         return false;
6691                 return true;
6692         }
6693
6694         return false;
6695 }
6696
6697 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6698                                void *cp_data, u16 len)
6699 {
6700         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6701         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6702                                    sizeof(struct mgmt_ltk_info));
6703         u16 key_count, expected_len;
6704         int i, err;
6705
6706         bt_dev_dbg(hdev, "sock %p", sk);
6707
6708         if (!lmp_le_capable(hdev))
6709                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6710                                        MGMT_STATUS_NOT_SUPPORTED);
6711
6712         key_count = __le16_to_cpu(cp->key_count);
6713         if (key_count > max_key_count) {
6714                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6715                            key_count);
6716                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6717                                        MGMT_STATUS_INVALID_PARAMS);
6718         }
6719
6720         expected_len = struct_size(cp, keys, key_count);
6721         if (expected_len != len) {
6722                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6723                            expected_len, len);
6724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6725                                        MGMT_STATUS_INVALID_PARAMS);
6726         }
6727
6728         bt_dev_dbg(hdev, "key_count %u", key_count);
6729
6730         for (i = 0; i < key_count; i++) {
6731                 struct mgmt_ltk_info *key = &cp->keys[i];
6732
6733                 if (!ltk_is_valid(key))
6734                         return mgmt_cmd_status(sk, hdev->id,
6735                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6736                                                MGMT_STATUS_INVALID_PARAMS);
6737         }
6738
6739         hci_dev_lock(hdev);
6740
6741         hci_smp_ltks_clear(hdev);
6742
6743         for (i = 0; i < key_count; i++) {
6744                 struct mgmt_ltk_info *key = &cp->keys[i];
6745                 u8 type, authenticated;
6746
6747                 if (hci_is_blocked_key(hdev,
6748                                        HCI_BLOCKED_KEY_TYPE_LTK,
6749                                        key->val)) {
6750                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6751                                     &key->addr.bdaddr);
6752                         continue;
6753                 }
6754
6755                 switch (key->type) {
6756                 case MGMT_LTK_UNAUTHENTICATED:
6757                         authenticated = 0x00;
6758                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6759                         break;
6760                 case MGMT_LTK_AUTHENTICATED:
6761                         authenticated = 0x01;
6762                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6763                         break;
6764                 case MGMT_LTK_P256_UNAUTH:
6765                         authenticated = 0x00;
6766                         type = SMP_LTK_P256;
6767                         break;
6768                 case MGMT_LTK_P256_AUTH:
6769                         authenticated = 0x01;
6770                         type = SMP_LTK_P256;
6771                         break;
6772                 case MGMT_LTK_P256_DEBUG:
6773                         authenticated = 0x00;
6774                         type = SMP_LTK_P256_DEBUG;
6775                         fallthrough;
6776                 default:
6777                         continue;
6778                 }
6779
6780                 hci_add_ltk(hdev, &key->addr.bdaddr,
6781                             le_addr_type(key->addr.type), type, authenticated,
6782                             key->val, key->enc_size, key->ediv, key->rand);
6783         }
6784
6785         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6786                            NULL, 0);
6787
6788         hci_dev_unlock(hdev);
6789
6790         return err;
6791 }
6792
6793 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
6794 {
6795         struct mgmt_pending_cmd *cmd = data;
6796         struct hci_conn *conn = cmd->user_data;
6797         struct mgmt_cp_get_conn_info *cp = cmd->param;
6798         struct mgmt_rp_get_conn_info rp;
6799         u8 status;
6800
6801         bt_dev_dbg(hdev, "err %d", err);
6802
6803         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
6804
6805         status = mgmt_status(err);
6806         if (status == MGMT_STATUS_SUCCESS) {
6807                 rp.rssi = conn->rssi;
6808                 rp.tx_power = conn->tx_power;
6809                 rp.max_tx_power = conn->max_tx_power;
6810         } else {
6811                 rp.rssi = HCI_RSSI_INVALID;
6812                 rp.tx_power = HCI_TX_POWER_INVALID;
6813                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6814         }
6815
6816         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
6817                           &rp, sizeof(rp));
6818
6819         mgmt_pending_free(cmd);
6820 }
6821
6822 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
6823 {
6824         struct mgmt_pending_cmd *cmd = data;
6825         struct mgmt_cp_get_conn_info *cp = cmd->param;
6826         struct hci_conn *conn;
6827         int err;
6828         __le16   handle;
6829
6830         /* Make sure we are still connected */
6831         if (cp->addr.type == BDADDR_BREDR)
6832                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6833                                                &cp->addr.bdaddr);
6834         else
6835                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6836
6837         if (!conn || conn->state != BT_CONNECTED)
6838                 return MGMT_STATUS_NOT_CONNECTED;
6839
6840         cmd->user_data = conn;
6841         handle = cpu_to_le16(conn->handle);
6842
6843         /* Refresh RSSI each time */
6844         err = hci_read_rssi_sync(hdev, handle);
6845
6846         /* For LE links TX power does not change thus we don't need to
6847          * query for it once value is known.
6848          */
6849         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
6850                      conn->tx_power == HCI_TX_POWER_INVALID))
6851                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
6852
6853         /* Max TX power needs to be read only once per connection */
6854         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
6855                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
6856
6857         return err;
6858 }
6859
6860 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6861                          u16 len)
6862 {
6863         struct mgmt_cp_get_conn_info *cp = data;
6864         struct mgmt_rp_get_conn_info rp;
6865         struct hci_conn *conn;
6866         unsigned long conn_info_age;
6867         int err = 0;
6868
6869         bt_dev_dbg(hdev, "sock %p", sk);
6870
6871         memset(&rp, 0, sizeof(rp));
6872         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6873         rp.addr.type = cp->addr.type;
6874
6875         if (!bdaddr_type_is_valid(cp->addr.type))
6876                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6877                                          MGMT_STATUS_INVALID_PARAMS,
6878                                          &rp, sizeof(rp));
6879
6880         hci_dev_lock(hdev);
6881
6882         if (!hdev_is_powered(hdev)) {
6883                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6884                                         MGMT_STATUS_NOT_POWERED, &rp,
6885                                         sizeof(rp));
6886                 goto unlock;
6887         }
6888
6889         if (cp->addr.type == BDADDR_BREDR)
6890                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6891                                                &cp->addr.bdaddr);
6892         else
6893                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6894
6895         if (!conn || conn->state != BT_CONNECTED) {
6896                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6897                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6898                                         sizeof(rp));
6899                 goto unlock;
6900         }
6901
6902         /* To avoid client trying to guess when to poll again for information we
6903          * calculate conn info age as random value between min/max set in hdev.
6904          */
6905         conn_info_age = hdev->conn_info_min_age +
6906                         prandom_u32_max(hdev->conn_info_max_age -
6907                                         hdev->conn_info_min_age);
6908
6909         /* Query controller to refresh cached values if they are too old or were
6910          * never read.
6911          */
6912         if (time_after(jiffies, conn->conn_info_timestamp +
6913                        msecs_to_jiffies(conn_info_age)) ||
6914             !conn->conn_info_timestamp) {
6915                 struct mgmt_pending_cmd *cmd;
6916
6917                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
6918                                        len);
6919                 if (!cmd) {
6920                         err = -ENOMEM;
6921                 } else {
6922                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
6923                                                  cmd, get_conn_info_complete);
6924                 }
6925
6926                 if (err < 0) {
6927                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6928                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
6929
6930                         if (cmd)
6931                                 mgmt_pending_free(cmd);
6932
6933                         goto unlock;
6934                 }
6935
6936                 conn->conn_info_timestamp = jiffies;
6937         } else {
6938                 /* Cache is valid, just reply with values cached in hci_conn */
6939                 rp.rssi = conn->rssi;
6940                 rp.tx_power = conn->tx_power;
6941                 rp.max_tx_power = conn->max_tx_power;
6942
6943                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6944                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6945         }
6946
6947 unlock:
6948         hci_dev_unlock(hdev);
6949         return err;
6950 }
6951
6952 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
6953 {
6954         struct mgmt_pending_cmd *cmd = data;
6955         struct mgmt_cp_get_clock_info *cp = cmd->param;
6956         struct mgmt_rp_get_clock_info rp;
6957         struct hci_conn *conn = cmd->user_data;
6958         u8 status = mgmt_status(err);
6959
6960         bt_dev_dbg(hdev, "err %d", err);
6961
6962         memset(&rp, 0, sizeof(rp));
6963         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6964         rp.addr.type = cp->addr.type;
6965
6966         if (err)
6967                 goto complete;
6968
6969         rp.local_clock = cpu_to_le32(hdev->clock);
6970
6971         if (conn) {
6972                 rp.piconet_clock = cpu_to_le32(conn->clock);
6973                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6974         }
6975
6976 complete:
6977         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6978                           sizeof(rp));
6979
6980         mgmt_pending_free(cmd);
6981 }
6982
6983 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
6984 {
6985         struct mgmt_pending_cmd *cmd = data;
6986         struct mgmt_cp_get_clock_info *cp = cmd->param;
6987         struct hci_cp_read_clock hci_cp;
6988         struct hci_conn *conn;
6989
6990         memset(&hci_cp, 0, sizeof(hci_cp));
6991         hci_read_clock_sync(hdev, &hci_cp);
6992
6993         /* Make sure connection still exists */
6994         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
6995         if (!conn || conn->state != BT_CONNECTED)
6996                 return MGMT_STATUS_NOT_CONNECTED;
6997
6998         cmd->user_data = conn;
6999         hci_cp.handle = cpu_to_le16(conn->handle);
7000         hci_cp.which = 0x01; /* Piconet clock */
7001
7002         return hci_read_clock_sync(hdev, &hci_cp);
7003 }
7004
7005 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7006                                                                 u16 len)
7007 {
7008         struct mgmt_cp_get_clock_info *cp = data;
7009         struct mgmt_rp_get_clock_info rp;
7010         struct mgmt_pending_cmd *cmd;
7011         struct hci_conn *conn;
7012         int err;
7013
7014         bt_dev_dbg(hdev, "sock %p", sk);
7015
7016         memset(&rp, 0, sizeof(rp));
7017         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7018         rp.addr.type = cp->addr.type;
7019
7020         if (cp->addr.type != BDADDR_BREDR)
7021                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7022                                          MGMT_STATUS_INVALID_PARAMS,
7023                                          &rp, sizeof(rp));
7024
7025         hci_dev_lock(hdev);
7026
7027         if (!hdev_is_powered(hdev)) {
7028                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7029                                         MGMT_STATUS_NOT_POWERED, &rp,
7030                                         sizeof(rp));
7031                 goto unlock;
7032         }
7033
7034         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7035                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7036                                                &cp->addr.bdaddr);
7037                 if (!conn || conn->state != BT_CONNECTED) {
7038                         err = mgmt_cmd_complete(sk, hdev->id,
7039                                                 MGMT_OP_GET_CLOCK_INFO,
7040                                                 MGMT_STATUS_NOT_CONNECTED,
7041                                                 &rp, sizeof(rp));
7042                         goto unlock;
7043                 }
7044         } else {
7045                 conn = NULL;
7046         }
7047
7048         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7049         if (!cmd)
7050                 err = -ENOMEM;
7051         else
7052                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7053                                          get_clock_info_complete);
7054
7055         if (err < 0) {
7056                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7057                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
7058
7059                 if (cmd)
7060                         mgmt_pending_free(cmd);
7061         }
7062
7063
7064 unlock:
7065         hci_dev_unlock(hdev);
7066         return err;
7067 }
7068
7069 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7070 {
7071         struct hci_conn *conn;
7072
7073         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7074         if (!conn)
7075                 return false;
7076
7077         if (conn->dst_type != type)
7078                 return false;
7079
7080         if (conn->state != BT_CONNECTED)
7081                 return false;
7082
7083         return true;
7084 }
7085
7086 /* This function requires the caller holds hdev->lock */
7087 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7088                                u8 addr_type, u8 auto_connect)
7089 {
7090         struct hci_conn_params *params;
7091
7092         params = hci_conn_params_add(hdev, addr, addr_type);
7093         if (!params)
7094                 return -EIO;
7095
7096         if (params->auto_connect == auto_connect)
7097                 return 0;
7098
7099         list_del_init(&params->action);
7100
7101         switch (auto_connect) {
7102         case HCI_AUTO_CONN_DISABLED:
7103         case HCI_AUTO_CONN_LINK_LOSS:
7104                 /* If auto connect is being disabled when we're trying to
7105                  * connect to device, keep connecting.
7106                  */
7107                 if (params->explicit_connect)
7108                         list_add(&params->action, &hdev->pend_le_conns);
7109                 break;
7110         case HCI_AUTO_CONN_REPORT:
7111                 if (params->explicit_connect)
7112                         list_add(&params->action, &hdev->pend_le_conns);
7113                 else
7114                         list_add(&params->action, &hdev->pend_le_reports);
7115                 break;
7116         case HCI_AUTO_CONN_DIRECT:
7117         case HCI_AUTO_CONN_ALWAYS:
7118                 if (!is_connected(hdev, addr, addr_type))
7119                         list_add(&params->action, &hdev->pend_le_conns);
7120                 break;
7121         }
7122
7123         params->auto_connect = auto_connect;
7124
7125         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7126                    addr, addr_type, auto_connect);
7127
7128         return 0;
7129 }
7130
7131 static void device_added(struct sock *sk, struct hci_dev *hdev,
7132                          bdaddr_t *bdaddr, u8 type, u8 action)
7133 {
7134         struct mgmt_ev_device_added ev;
7135
7136         bacpy(&ev.addr.bdaddr, bdaddr);
7137         ev.addr.type = type;
7138         ev.action = action;
7139
7140         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7141 }
7142
7143 static int add_device_sync(struct hci_dev *hdev, void *data)
7144 {
7145         return hci_update_passive_scan_sync(hdev);
7146 }
7147
7148 static int add_device(struct sock *sk, struct hci_dev *hdev,
7149                       void *data, u16 len)
7150 {
7151         struct mgmt_cp_add_device *cp = data;
7152         u8 auto_conn, addr_type;
7153         struct hci_conn_params *params;
7154         int err;
7155         u32 current_flags = 0;
7156         u32 supported_flags;
7157
7158         bt_dev_dbg(hdev, "sock %p", sk);
7159
7160         if (!bdaddr_type_is_valid(cp->addr.type) ||
7161             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7162                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7163                                          MGMT_STATUS_INVALID_PARAMS,
7164                                          &cp->addr, sizeof(cp->addr));
7165
7166         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7167                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7168                                          MGMT_STATUS_INVALID_PARAMS,
7169                                          &cp->addr, sizeof(cp->addr));
7170
7171         hci_dev_lock(hdev);
7172
7173         if (cp->addr.type == BDADDR_BREDR) {
7174                 /* Only incoming connections action is supported for now */
7175                 if (cp->action != 0x01) {
7176                         err = mgmt_cmd_complete(sk, hdev->id,
7177                                                 MGMT_OP_ADD_DEVICE,
7178                                                 MGMT_STATUS_INVALID_PARAMS,
7179                                                 &cp->addr, sizeof(cp->addr));
7180                         goto unlock;
7181                 }
7182
7183                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7184                                                      &cp->addr.bdaddr,
7185                                                      cp->addr.type, 0);
7186                 if (err)
7187                         goto unlock;
7188
7189                 hci_update_scan(hdev);
7190
7191                 goto added;
7192         }
7193
7194         addr_type = le_addr_type(cp->addr.type);
7195
7196         if (cp->action == 0x02)
7197                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7198         else if (cp->action == 0x01)
7199                 auto_conn = HCI_AUTO_CONN_DIRECT;
7200         else
7201                 auto_conn = HCI_AUTO_CONN_REPORT;
7202
7203         /* Kernel internally uses conn_params with resolvable private
7204          * address, but Add Device allows only identity addresses.
7205          * Make sure it is enforced before calling
7206          * hci_conn_params_lookup.
7207          */
7208         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7209                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7210                                         MGMT_STATUS_INVALID_PARAMS,
7211                                         &cp->addr, sizeof(cp->addr));
7212                 goto unlock;
7213         }
7214
7215         /* If the connection parameters don't exist for this device,
7216          * they will be created and configured with defaults.
7217          */
7218         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7219                                 auto_conn) < 0) {
7220                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7221                                         MGMT_STATUS_FAILED, &cp->addr,
7222                                         sizeof(cp->addr));
7223                 goto unlock;
7224         } else {
7225                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7226                                                 addr_type);
7227                 if (params)
7228                         current_flags = params->flags;
7229         }
7230
7231         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7232         if (err < 0)
7233                 goto unlock;
7234
7235 added:
7236         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7237         supported_flags = hdev->conn_flags;
7238         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7239                              supported_flags, current_flags);
7240
7241         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7242                                 MGMT_STATUS_SUCCESS, &cp->addr,
7243                                 sizeof(cp->addr));
7244
7245 unlock:
7246         hci_dev_unlock(hdev);
7247         return err;
7248 }
7249
7250 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7251                            bdaddr_t *bdaddr, u8 type)
7252 {
7253         struct mgmt_ev_device_removed ev;
7254
7255         bacpy(&ev.addr.bdaddr, bdaddr);
7256         ev.addr.type = type;
7257
7258         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7259 }
7260
7261 static int remove_device_sync(struct hci_dev *hdev, void *data)
7262 {
7263         return hci_update_passive_scan_sync(hdev);
7264 }
7265
7266 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7267                          void *data, u16 len)
7268 {
7269         struct mgmt_cp_remove_device *cp = data;
7270         int err;
7271
7272         bt_dev_dbg(hdev, "sock %p", sk);
7273
7274         hci_dev_lock(hdev);
7275
7276         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7277                 struct hci_conn_params *params;
7278                 u8 addr_type;
7279
7280                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7281                         err = mgmt_cmd_complete(sk, hdev->id,
7282                                                 MGMT_OP_REMOVE_DEVICE,
7283                                                 MGMT_STATUS_INVALID_PARAMS,
7284                                                 &cp->addr, sizeof(cp->addr));
7285                         goto unlock;
7286                 }
7287
7288                 if (cp->addr.type == BDADDR_BREDR) {
7289                         err = hci_bdaddr_list_del(&hdev->accept_list,
7290                                                   &cp->addr.bdaddr,
7291                                                   cp->addr.type);
7292                         if (err) {
7293                                 err = mgmt_cmd_complete(sk, hdev->id,
7294                                                         MGMT_OP_REMOVE_DEVICE,
7295                                                         MGMT_STATUS_INVALID_PARAMS,
7296                                                         &cp->addr,
7297                                                         sizeof(cp->addr));
7298                                 goto unlock;
7299                         }
7300
7301                         hci_update_scan(hdev);
7302
7303                         device_removed(sk, hdev, &cp->addr.bdaddr,
7304                                        cp->addr.type);
7305                         goto complete;
7306                 }
7307
7308                 addr_type = le_addr_type(cp->addr.type);
7309
7310                 /* Kernel internally uses conn_params with resolvable private
7311                  * address, but Remove Device allows only identity addresses.
7312                  * Make sure it is enforced before calling
7313                  * hci_conn_params_lookup.
7314                  */
7315                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7316                         err = mgmt_cmd_complete(sk, hdev->id,
7317                                                 MGMT_OP_REMOVE_DEVICE,
7318                                                 MGMT_STATUS_INVALID_PARAMS,
7319                                                 &cp->addr, sizeof(cp->addr));
7320                         goto unlock;
7321                 }
7322
7323                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7324                                                 addr_type);
7325                 if (!params) {
7326                         err = mgmt_cmd_complete(sk, hdev->id,
7327                                                 MGMT_OP_REMOVE_DEVICE,
7328                                                 MGMT_STATUS_INVALID_PARAMS,
7329                                                 &cp->addr, sizeof(cp->addr));
7330                         goto unlock;
7331                 }
7332
7333                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7334                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7335                         err = mgmt_cmd_complete(sk, hdev->id,
7336                                                 MGMT_OP_REMOVE_DEVICE,
7337                                                 MGMT_STATUS_INVALID_PARAMS,
7338                                                 &cp->addr, sizeof(cp->addr));
7339                         goto unlock;
7340                 }
7341
7342                 list_del(&params->action);
7343                 list_del(&params->list);
7344                 kfree(params);
7345
7346                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7347         } else {
7348                 struct hci_conn_params *p, *tmp;
7349                 struct bdaddr_list *b, *btmp;
7350
7351                 if (cp->addr.type) {
7352                         err = mgmt_cmd_complete(sk, hdev->id,
7353                                                 MGMT_OP_REMOVE_DEVICE,
7354                                                 MGMT_STATUS_INVALID_PARAMS,
7355                                                 &cp->addr, sizeof(cp->addr));
7356                         goto unlock;
7357                 }
7358
7359                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7360                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7361                         list_del(&b->list);
7362                         kfree(b);
7363                 }
7364
7365                 hci_update_scan(hdev);
7366
7367                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7368                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7369                                 continue;
7370                         device_removed(sk, hdev, &p->addr, p->addr_type);
7371                         if (p->explicit_connect) {
7372                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7373                                 continue;
7374                         }
7375                         list_del(&p->action);
7376                         list_del(&p->list);
7377                         kfree(p);
7378                 }
7379
7380                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
7381         }
7382
7383         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7384
7385 complete:
7386         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7387                                 MGMT_STATUS_SUCCESS, &cp->addr,
7388                                 sizeof(cp->addr));
7389 unlock:
7390         hci_dev_unlock(hdev);
7391         return err;
7392 }
7393
7394 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7395                            u16 len)
7396 {
7397         struct mgmt_cp_load_conn_param *cp = data;
7398         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7399                                      sizeof(struct mgmt_conn_param));
7400         u16 param_count, expected_len;
7401         int i;
7402
7403         if (!lmp_le_capable(hdev))
7404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7405                                        MGMT_STATUS_NOT_SUPPORTED);
7406
7407         param_count = __le16_to_cpu(cp->param_count);
7408         if (param_count > max_param_count) {
7409                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7410                            param_count);
7411                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7412                                        MGMT_STATUS_INVALID_PARAMS);
7413         }
7414
7415         expected_len = struct_size(cp, params, param_count);
7416         if (expected_len != len) {
7417                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7418                            expected_len, len);
7419                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7420                                        MGMT_STATUS_INVALID_PARAMS);
7421         }
7422
7423         bt_dev_dbg(hdev, "param_count %u", param_count);
7424
7425         hci_dev_lock(hdev);
7426
7427         hci_conn_params_clear_disabled(hdev);
7428
7429         for (i = 0; i < param_count; i++) {
7430                 struct mgmt_conn_param *param = &cp->params[i];
7431                 struct hci_conn_params *hci_param;
7432                 u16 min, max, latency, timeout;
7433                 u8 addr_type;
7434
7435                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7436                            param->addr.type);
7437
7438                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7439                         addr_type = ADDR_LE_DEV_PUBLIC;
7440                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7441                         addr_type = ADDR_LE_DEV_RANDOM;
7442                 } else {
7443                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7444                         continue;
7445                 }
7446
7447                 min = le16_to_cpu(param->min_interval);
7448                 max = le16_to_cpu(param->max_interval);
7449                 latency = le16_to_cpu(param->latency);
7450                 timeout = le16_to_cpu(param->timeout);
7451
7452                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7453                            min, max, latency, timeout);
7454
7455                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7456                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7457                         continue;
7458                 }
7459
7460                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7461                                                 addr_type);
7462                 if (!hci_param) {
7463                         bt_dev_err(hdev, "failed to add connection parameters");
7464                         continue;
7465                 }
7466
7467                 hci_param->conn_min_interval = min;
7468                 hci_param->conn_max_interval = max;
7469                 hci_param->conn_latency = latency;
7470                 hci_param->supervision_timeout = timeout;
7471         }
7472
7473         hci_dev_unlock(hdev);
7474
7475         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7476                                  NULL, 0);
7477 }
7478
7479 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7480                                void *data, u16 len)
7481 {
7482         struct mgmt_cp_set_external_config *cp = data;
7483         bool changed;
7484         int err;
7485
7486         bt_dev_dbg(hdev, "sock %p", sk);
7487
7488         if (hdev_is_powered(hdev))
7489                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7490                                        MGMT_STATUS_REJECTED);
7491
7492         if (cp->config != 0x00 && cp->config != 0x01)
7493                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7494                                          MGMT_STATUS_INVALID_PARAMS);
7495
7496         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7498                                        MGMT_STATUS_NOT_SUPPORTED);
7499
7500         hci_dev_lock(hdev);
7501
7502         if (cp->config)
7503                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7504         else
7505                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7506
7507         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7508         if (err < 0)
7509                 goto unlock;
7510
7511         if (!changed)
7512                 goto unlock;
7513
7514         err = new_options(hdev, sk);
7515
7516         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7517                 mgmt_index_removed(hdev);
7518
7519                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7520                         hci_dev_set_flag(hdev, HCI_CONFIG);
7521                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7522
7523                         queue_work(hdev->req_workqueue, &hdev->power_on);
7524                 } else {
7525                         set_bit(HCI_RAW, &hdev->flags);
7526                         mgmt_index_added(hdev);
7527                 }
7528         }
7529
7530 unlock:
7531         hci_dev_unlock(hdev);
7532         return err;
7533 }
7534
7535 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7536                               void *data, u16 len)
7537 {
7538         struct mgmt_cp_set_public_address *cp = data;
7539         bool changed;
7540         int err;
7541
7542         bt_dev_dbg(hdev, "sock %p", sk);
7543
7544         if (hdev_is_powered(hdev))
7545                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7546                                        MGMT_STATUS_REJECTED);
7547
7548         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7550                                        MGMT_STATUS_INVALID_PARAMS);
7551
7552         if (!hdev->set_bdaddr)
7553                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7554                                        MGMT_STATUS_NOT_SUPPORTED);
7555
7556         hci_dev_lock(hdev);
7557
7558         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7559         bacpy(&hdev->public_addr, &cp->bdaddr);
7560
7561         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7562         if (err < 0)
7563                 goto unlock;
7564
7565         if (!changed)
7566                 goto unlock;
7567
7568         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7569                 err = new_options(hdev, sk);
7570
7571         if (is_configured(hdev)) {
7572                 mgmt_index_removed(hdev);
7573
7574                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7575
7576                 hci_dev_set_flag(hdev, HCI_CONFIG);
7577                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7578
7579                 queue_work(hdev->req_workqueue, &hdev->power_on);
7580         }
7581
7582 unlock:
7583         hci_dev_unlock(hdev);
7584         return err;
7585 }
7586
7587 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
7588                                              int err)
7589 {
7590         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7591         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7592         u8 *h192, *r192, *h256, *r256;
7593         struct mgmt_pending_cmd *cmd = data;
7594         struct sk_buff *skb = cmd->skb;
7595         u8 status = mgmt_status(err);
7596         u16 eir_len;
7597
7598         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
7599                 return;
7600
7601         if (!status) {
7602                 if (!skb)
7603                         status = MGMT_STATUS_FAILED;
7604                 else if (IS_ERR(skb))
7605                         status = mgmt_status(PTR_ERR(skb));
7606                 else
7607                         status = mgmt_status(skb->data[0]);
7608         }
7609
7610         bt_dev_dbg(hdev, "status %u", status);
7611
7612         mgmt_cp = cmd->param;
7613
7614         if (status) {
7615                 status = mgmt_status(status);
7616                 eir_len = 0;
7617
7618                 h192 = NULL;
7619                 r192 = NULL;
7620                 h256 = NULL;
7621                 r256 = NULL;
7622         } else if (!bredr_sc_enabled(hdev)) {
7623                 struct hci_rp_read_local_oob_data *rp;
7624
7625                 if (skb->len != sizeof(*rp)) {
7626                         status = MGMT_STATUS_FAILED;
7627                         eir_len = 0;
7628                 } else {
7629                         status = MGMT_STATUS_SUCCESS;
7630                         rp = (void *)skb->data;
7631
7632                         eir_len = 5 + 18 + 18;
7633                         h192 = rp->hash;
7634                         r192 = rp->rand;
7635                         h256 = NULL;
7636                         r256 = NULL;
7637                 }
7638         } else {
7639                 struct hci_rp_read_local_oob_ext_data *rp;
7640
7641                 if (skb->len != sizeof(*rp)) {
7642                         status = MGMT_STATUS_FAILED;
7643                         eir_len = 0;
7644                 } else {
7645                         status = MGMT_STATUS_SUCCESS;
7646                         rp = (void *)skb->data;
7647
7648                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7649                                 eir_len = 5 + 18 + 18;
7650                                 h192 = NULL;
7651                                 r192 = NULL;
7652                         } else {
7653                                 eir_len = 5 + 18 + 18 + 18 + 18;
7654                                 h192 = rp->hash192;
7655                                 r192 = rp->rand192;
7656                         }
7657
7658                         h256 = rp->hash256;
7659                         r256 = rp->rand256;
7660                 }
7661         }
7662
7663         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7664         if (!mgmt_rp)
7665                 goto done;
7666
7667         if (eir_len == 0)
7668                 goto send_rsp;
7669
7670         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7671                                   hdev->dev_class, 3);
7672
7673         if (h192 && r192) {
7674                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7675                                           EIR_SSP_HASH_C192, h192, 16);
7676                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7677                                           EIR_SSP_RAND_R192, r192, 16);
7678         }
7679
7680         if (h256 && r256) {
7681                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7682                                           EIR_SSP_HASH_C256, h256, 16);
7683                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7684                                           EIR_SSP_RAND_R256, r256, 16);
7685         }
7686
7687 send_rsp:
7688         mgmt_rp->type = mgmt_cp->type;
7689         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7690
7691         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7692                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7693                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7694         if (err < 0 || status)
7695                 goto done;
7696
7697         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7698
7699         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7700                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7701                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7702 done:
7703         if (skb && !IS_ERR(skb))
7704                 kfree_skb(skb);
7705
7706         kfree(mgmt_rp);
7707         mgmt_pending_remove(cmd);
7708 }
7709
7710 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7711                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7712 {
7713         struct mgmt_pending_cmd *cmd;
7714         int err;
7715
7716         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7717                                cp, sizeof(*cp));
7718         if (!cmd)
7719                 return -ENOMEM;
7720
7721         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
7722                                  read_local_oob_ext_data_complete);
7723
7724         if (err < 0) {
7725                 mgmt_pending_remove(cmd);
7726                 return err;
7727         }
7728
7729         return 0;
7730 }
7731
7732 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7733                                    void *data, u16 data_len)
7734 {
7735         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7736         struct mgmt_rp_read_local_oob_ext_data *rp;
7737         size_t rp_len;
7738         u16 eir_len;
7739         u8 status, flags, role, addr[7], hash[16], rand[16];
7740         int err;
7741
7742         bt_dev_dbg(hdev, "sock %p", sk);
7743
7744         if (hdev_is_powered(hdev)) {
7745                 switch (cp->type) {
7746                 case BIT(BDADDR_BREDR):
7747                         status = mgmt_bredr_support(hdev);
7748                         if (status)
7749                                 eir_len = 0;
7750                         else
7751                                 eir_len = 5;
7752                         break;
7753                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7754                         status = mgmt_le_support(hdev);
7755                         if (status)
7756                                 eir_len = 0;
7757                         else
7758                                 eir_len = 9 + 3 + 18 + 18 + 3;
7759                         break;
7760                 default:
7761                         status = MGMT_STATUS_INVALID_PARAMS;
7762                         eir_len = 0;
7763                         break;
7764                 }
7765         } else {
7766                 status = MGMT_STATUS_NOT_POWERED;
7767                 eir_len = 0;
7768         }
7769
7770         rp_len = sizeof(*rp) + eir_len;
7771         rp = kmalloc(rp_len, GFP_ATOMIC);
7772         if (!rp)
7773                 return -ENOMEM;
7774
7775         if (!status && !lmp_ssp_capable(hdev)) {
7776                 status = MGMT_STATUS_NOT_SUPPORTED;
7777                 eir_len = 0;
7778         }
7779
7780         if (status)
7781                 goto complete;
7782
7783         hci_dev_lock(hdev);
7784
7785         eir_len = 0;
7786         switch (cp->type) {
7787         case BIT(BDADDR_BREDR):
7788                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7789                         err = read_local_ssp_oob_req(hdev, sk, cp);
7790                         hci_dev_unlock(hdev);
7791                         if (!err)
7792                                 goto done;
7793
7794                         status = MGMT_STATUS_FAILED;
7795                         goto complete;
7796                 } else {
7797                         eir_len = eir_append_data(rp->eir, eir_len,
7798                                                   EIR_CLASS_OF_DEV,
7799                                                   hdev->dev_class, 3);
7800                 }
7801                 break;
7802         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7803                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7804                     smp_generate_oob(hdev, hash, rand) < 0) {
7805                         hci_dev_unlock(hdev);
7806                         status = MGMT_STATUS_FAILED;
7807                         goto complete;
7808                 }
7809
7810                 /* This should return the active RPA, but since the RPA
7811                  * is only programmed on demand, it is really hard to fill
7812                  * this in at the moment. For now disallow retrieving
7813                  * local out-of-band data when privacy is in use.
7814                  *
7815                  * Returning the identity address will not help here since
7816                  * pairing happens before the identity resolving key is
7817                  * known and thus the connection establishment happens
7818                  * based on the RPA and not the identity address.
7819                  */
7820                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7821                         hci_dev_unlock(hdev);
7822                         status = MGMT_STATUS_REJECTED;
7823                         goto complete;
7824                 }
7825
7826                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7827                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7828                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7829                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7830                         memcpy(addr, &hdev->static_addr, 6);
7831                         addr[6] = 0x01;
7832                 } else {
7833                         memcpy(addr, &hdev->bdaddr, 6);
7834                         addr[6] = 0x00;
7835                 }
7836
7837                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7838                                           addr, sizeof(addr));
7839
7840                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7841                         role = 0x02;
7842                 else
7843                         role = 0x01;
7844
7845                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7846                                           &role, sizeof(role));
7847
7848                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7849                         eir_len = eir_append_data(rp->eir, eir_len,
7850                                                   EIR_LE_SC_CONFIRM,
7851                                                   hash, sizeof(hash));
7852
7853                         eir_len = eir_append_data(rp->eir, eir_len,
7854                                                   EIR_LE_SC_RANDOM,
7855                                                   rand, sizeof(rand));
7856                 }
7857
7858                 flags = mgmt_get_adv_discov_flags(hdev);
7859
7860                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7861                         flags |= LE_AD_NO_BREDR;
7862
7863                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7864                                           &flags, sizeof(flags));
7865                 break;
7866         }
7867
7868         hci_dev_unlock(hdev);
7869
7870         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7871
7872         status = MGMT_STATUS_SUCCESS;
7873
7874 complete:
7875         rp->type = cp->type;
7876         rp->eir_len = cpu_to_le16(eir_len);
7877
7878         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7879                                 status, rp, sizeof(*rp) + eir_len);
7880         if (err < 0 || status)
7881                 goto done;
7882
7883         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7884                                  rp, sizeof(*rp) + eir_len,
7885                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7886
7887 done:
7888         kfree(rp);
7889
7890         return err;
7891 }
7892
7893 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7894 {
7895         u32 flags = 0;
7896
7897         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7898         flags |= MGMT_ADV_FLAG_DISCOV;
7899         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7900         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7901         flags |= MGMT_ADV_FLAG_APPEARANCE;
7902         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7903         flags |= MGMT_ADV_PARAM_DURATION;
7904         flags |= MGMT_ADV_PARAM_TIMEOUT;
7905         flags |= MGMT_ADV_PARAM_INTERVALS;
7906         flags |= MGMT_ADV_PARAM_TX_POWER;
7907         flags |= MGMT_ADV_PARAM_SCAN_RSP;
7908
7909         /* In extended adv TX_POWER returned from Set Adv Param
7910          * will be always valid.
7911          */
7912         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7913             ext_adv_capable(hdev))
7914                 flags |= MGMT_ADV_FLAG_TX_POWER;
7915
7916         if (ext_adv_capable(hdev)) {
7917                 flags |= MGMT_ADV_FLAG_SEC_1M;
7918                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7919                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7920
7921                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7922                         flags |= MGMT_ADV_FLAG_SEC_2M;
7923
7924                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7925                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7926         }
7927
7928         return flags;
7929 }
7930
7931 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7932                              void *data, u16 data_len)
7933 {
7934         struct mgmt_rp_read_adv_features *rp;
7935         size_t rp_len;
7936         int err;
7937         struct adv_info *adv_instance;
7938         u32 supported_flags;
7939         u8 *instance;
7940
7941         bt_dev_dbg(hdev, "sock %p", sk);
7942
7943         if (!lmp_le_capable(hdev))
7944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7945                                        MGMT_STATUS_REJECTED);
7946
7947         hci_dev_lock(hdev);
7948
7949         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7950         rp = kmalloc(rp_len, GFP_ATOMIC);
7951         if (!rp) {
7952                 hci_dev_unlock(hdev);
7953                 return -ENOMEM;
7954         }
7955
7956         supported_flags = get_supported_adv_flags(hdev);
7957
7958         rp->supported_flags = cpu_to_le32(supported_flags);
7959         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7960         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7961         rp->max_instances = hdev->le_num_of_adv_sets;
7962         rp->num_instances = hdev->adv_instance_cnt;
7963
7964         instance = rp->instance;
7965         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7966                 *instance = adv_instance->instance;
7967                 instance++;
7968         }
7969
7970         hci_dev_unlock(hdev);
7971
7972         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7973                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7974
7975         kfree(rp);
7976
7977         return err;
7978 }
7979
7980 static u8 calculate_name_len(struct hci_dev *hdev)
7981 {
7982         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7983
7984         return eir_append_local_name(hdev, buf, 0);
7985 }
7986
7987 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7988                            bool is_adv_data)
7989 {
7990         u8 max_len = HCI_MAX_AD_LENGTH;
7991
7992         if (is_adv_data) {
7993                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7994                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7995                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7996                         max_len -= 3;
7997
7998                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7999                         max_len -= 3;
8000         } else {
8001                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8002                         max_len -= calculate_name_len(hdev);
8003
8004                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8005                         max_len -= 4;
8006         }
8007
8008         return max_len;
8009 }
8010
8011 static bool flags_managed(u32 adv_flags)
8012 {
8013         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8014                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8015                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8016 }
8017
8018 static bool tx_power_managed(u32 adv_flags)
8019 {
8020         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8021 }
8022
8023 static bool name_managed(u32 adv_flags)
8024 {
8025         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8026 }
8027
8028 static bool appearance_managed(u32 adv_flags)
8029 {
8030         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8031 }
8032
8033 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8034                               u8 len, bool is_adv_data)
8035 {
8036         int i, cur_len;
8037         u8 max_len;
8038
8039         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8040
8041         if (len > max_len)
8042                 return false;
8043
8044         /* Make sure that the data is correctly formatted. */
8045         for (i = 0; i < len; i += (cur_len + 1)) {
8046                 cur_len = data[i];
8047
8048                 if (!cur_len)
8049                         continue;
8050
8051                 if (data[i + 1] == EIR_FLAGS &&
8052                     (!is_adv_data || flags_managed(adv_flags)))
8053                         return false;
8054
8055                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8056                         return false;
8057
8058                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8059                         return false;
8060
8061                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8062                         return false;
8063
8064                 if (data[i + 1] == EIR_APPEARANCE &&
8065                     appearance_managed(adv_flags))
8066                         return false;
8067
8068                 /* If the current field length would exceed the total data
8069                  * length, then it's invalid.
8070                  */
8071                 if (i + cur_len >= len)
8072                         return false;
8073         }
8074
8075         return true;
8076 }
8077
8078 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8079 {
8080         u32 supported_flags, phy_flags;
8081
8082         /* The current implementation only supports a subset of the specified
8083          * flags. Also need to check mutual exclusiveness of sec flags.
8084          */
8085         supported_flags = get_supported_adv_flags(hdev);
8086         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8087         if (adv_flags & ~supported_flags ||
8088             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8089                 return false;
8090
8091         return true;
8092 }
8093
8094 static bool adv_busy(struct hci_dev *hdev)
8095 {
8096         return pending_find(MGMT_OP_SET_LE, hdev);
8097 }
8098
8099 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8100                              int err)
8101 {
8102         struct adv_info *adv, *n;
8103
8104         bt_dev_dbg(hdev, "err %d", err);
8105
8106         hci_dev_lock(hdev);
8107
8108         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8109                 u8 instance;
8110
8111                 if (!adv->pending)
8112                         continue;
8113
8114                 if (!err) {
8115                         adv->pending = false;
8116                         continue;
8117                 }
8118
8119                 instance = adv->instance;
8120
8121                 if (hdev->cur_adv_instance == instance)
8122                         cancel_adv_timeout(hdev);
8123
8124                 hci_remove_adv_instance(hdev, instance);
8125                 mgmt_advertising_removed(sk, hdev, instance);
8126         }
8127
8128         hci_dev_unlock(hdev);
8129 }
8130
8131 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8132 {
8133         struct mgmt_pending_cmd *cmd = data;
8134         struct mgmt_cp_add_advertising *cp = cmd->param;
8135         struct mgmt_rp_add_advertising rp;
8136
8137         memset(&rp, 0, sizeof(rp));
8138
8139         rp.instance = cp->instance;
8140
8141         if (err)
8142                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8143                                 mgmt_status(err));
8144         else
8145                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8146                                   mgmt_status(err), &rp, sizeof(rp));
8147
8148         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8149
8150         mgmt_pending_free(cmd);
8151 }
8152
8153 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8154 {
8155         struct mgmt_pending_cmd *cmd = data;
8156         struct mgmt_cp_add_advertising *cp = cmd->param;
8157
8158         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8159 }
8160
8161 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8162                            void *data, u16 data_len)
8163 {
8164         struct mgmt_cp_add_advertising *cp = data;
8165         struct mgmt_rp_add_advertising rp;
8166         u32 flags;
8167         u8 status;
8168         u16 timeout, duration;
8169         unsigned int prev_instance_cnt;
8170         u8 schedule_instance = 0;
8171         struct adv_info *adv, *next_instance;
8172         int err;
8173         struct mgmt_pending_cmd *cmd;
8174
8175         bt_dev_dbg(hdev, "sock %p", sk);
8176
8177         status = mgmt_le_support(hdev);
8178         if (status)
8179                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8180                                        status);
8181
8182         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8184                                        MGMT_STATUS_INVALID_PARAMS);
8185
8186         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8187                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8188                                        MGMT_STATUS_INVALID_PARAMS);
8189
8190         flags = __le32_to_cpu(cp->flags);
8191         timeout = __le16_to_cpu(cp->timeout);
8192         duration = __le16_to_cpu(cp->duration);
8193
8194         if (!requested_adv_flags_are_valid(hdev, flags))
8195                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8196                                        MGMT_STATUS_INVALID_PARAMS);
8197
8198         hci_dev_lock(hdev);
8199
8200         if (timeout && !hdev_is_powered(hdev)) {
8201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8202                                       MGMT_STATUS_REJECTED);
8203                 goto unlock;
8204         }
8205
8206         if (adv_busy(hdev)) {
8207                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8208                                       MGMT_STATUS_BUSY);
8209                 goto unlock;
8210         }
8211
8212         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8213             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8214                                cp->scan_rsp_len, false)) {
8215                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8216                                       MGMT_STATUS_INVALID_PARAMS);
8217                 goto unlock;
8218         }
8219
8220         prev_instance_cnt = hdev->adv_instance_cnt;
8221
8222         adv = hci_add_adv_instance(hdev, cp->instance, flags,
8223                                    cp->adv_data_len, cp->data,
8224                                    cp->scan_rsp_len,
8225                                    cp->data + cp->adv_data_len,
8226                                    timeout, duration,
8227                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8228                                    hdev->le_adv_min_interval,
8229                                    hdev->le_adv_max_interval);
8230         if (IS_ERR(adv)) {
8231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8232                                       MGMT_STATUS_FAILED);
8233                 goto unlock;
8234         }
8235
8236         /* Only trigger an advertising added event if a new instance was
8237          * actually added.
8238          */
8239         if (hdev->adv_instance_cnt > prev_instance_cnt)
8240                 mgmt_advertising_added(sk, hdev, cp->instance);
8241
8242         if (hdev->cur_adv_instance == cp->instance) {
8243                 /* If the currently advertised instance is being changed then
8244                  * cancel the current advertising and schedule the next
8245                  * instance. If there is only one instance then the overridden
8246                  * advertising data will be visible right away.
8247                  */
8248                 cancel_adv_timeout(hdev);
8249
8250                 next_instance = hci_get_next_instance(hdev, cp->instance);
8251                 if (next_instance)
8252                         schedule_instance = next_instance->instance;
8253         } else if (!hdev->adv_instance_timeout) {
8254                 /* Immediately advertise the new instance if no other
8255                  * instance is currently being advertised.
8256                  */
8257                 schedule_instance = cp->instance;
8258         }
8259
8260         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8261          * there is no instance to be advertised then we have no HCI
8262          * communication to make. Simply return.
8263          */
8264         if (!hdev_is_powered(hdev) ||
8265             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8266             !schedule_instance) {
8267                 rp.instance = cp->instance;
8268                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8269                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8270                 goto unlock;
8271         }
8272
8273         /* We're good to go, update advertising data, parameters, and start
8274          * advertising.
8275          */
8276         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8277                                data_len);
8278         if (!cmd) {
8279                 err = -ENOMEM;
8280                 goto unlock;
8281         }
8282
8283         cp->instance = schedule_instance;
8284
8285         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8286                                  add_advertising_complete);
8287         if (err < 0)
8288                 mgmt_pending_free(cmd);
8289
8290 unlock:
8291         hci_dev_unlock(hdev);
8292
8293         return err;
8294 }
8295
8296 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8297                                         int err)
8298 {
8299         struct mgmt_pending_cmd *cmd = data;
8300         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8301         struct mgmt_rp_add_ext_adv_params rp;
8302         struct adv_info *adv;
8303         u32 flags;
8304
8305         BT_DBG("%s", hdev->name);
8306
8307         hci_dev_lock(hdev);
8308
8309         adv = hci_find_adv_instance(hdev, cp->instance);
8310         if (!adv)
8311                 goto unlock;
8312
8313         rp.instance = cp->instance;
8314         rp.tx_power = adv->tx_power;
8315
8316         /* While we're at it, inform userspace of the available space for this
8317          * advertisement, given the flags that will be used.
8318          */
8319         flags = __le32_to_cpu(cp->flags);
8320         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8321         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8322
8323         if (err) {
8324                 /* If this advertisement was previously advertising and we
8325                  * failed to update it, we signal that it has been removed and
8326                  * delete its structure
8327                  */
8328                 if (!adv->pending)
8329                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8330
8331                 hci_remove_adv_instance(hdev, cp->instance);
8332
8333                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8334                                 mgmt_status(err));
8335         } else {
8336                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8337                                   mgmt_status(err), &rp, sizeof(rp));
8338         }
8339
8340 unlock:
8341         if (cmd)
8342                 mgmt_pending_free(cmd);
8343
8344         hci_dev_unlock(hdev);
8345 }
8346
8347 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8348 {
8349         struct mgmt_pending_cmd *cmd = data;
8350         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8351
8352         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8353 }
8354
8355 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8356                               void *data, u16 data_len)
8357 {
8358         struct mgmt_cp_add_ext_adv_params *cp = data;
8359         struct mgmt_rp_add_ext_adv_params rp;
8360         struct mgmt_pending_cmd *cmd = NULL;
8361         struct adv_info *adv;
8362         u32 flags, min_interval, max_interval;
8363         u16 timeout, duration;
8364         u8 status;
8365         s8 tx_power;
8366         int err;
8367
8368         BT_DBG("%s", hdev->name);
8369
8370         status = mgmt_le_support(hdev);
8371         if (status)
8372                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8373                                        status);
8374
8375         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8377                                        MGMT_STATUS_INVALID_PARAMS);
8378
8379         /* The purpose of breaking add_advertising into two separate MGMT calls
8380          * for params and data is to allow more parameters to be added to this
8381          * structure in the future. For this reason, we verify that we have the
8382          * bare minimum structure we know of when the interface was defined. Any
8383          * extra parameters we don't know about will be ignored in this request.
8384          */
8385         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8386                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8387                                        MGMT_STATUS_INVALID_PARAMS);
8388
8389         flags = __le32_to_cpu(cp->flags);
8390
8391         if (!requested_adv_flags_are_valid(hdev, flags))
8392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8393                                        MGMT_STATUS_INVALID_PARAMS);
8394
8395         hci_dev_lock(hdev);
8396
8397         /* In new interface, we require that we are powered to register */
8398         if (!hdev_is_powered(hdev)) {
8399                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8400                                       MGMT_STATUS_REJECTED);
8401                 goto unlock;
8402         }
8403
8404         if (adv_busy(hdev)) {
8405                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8406                                       MGMT_STATUS_BUSY);
8407                 goto unlock;
8408         }
8409
8410         /* Parse defined parameters from request, use defaults otherwise */
8411         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8412                   __le16_to_cpu(cp->timeout) : 0;
8413
8414         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8415                    __le16_to_cpu(cp->duration) :
8416                    hdev->def_multi_adv_rotation_duration;
8417
8418         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8419                        __le32_to_cpu(cp->min_interval) :
8420                        hdev->le_adv_min_interval;
8421
8422         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8423                        __le32_to_cpu(cp->max_interval) :
8424                        hdev->le_adv_max_interval;
8425
8426         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8427                    cp->tx_power :
8428                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8429
8430         /* Create advertising instance with no advertising or response data */
8431         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8432                                    timeout, duration, tx_power, min_interval,
8433                                    max_interval);
8434
8435         if (IS_ERR(adv)) {
8436                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8437                                       MGMT_STATUS_FAILED);
8438                 goto unlock;
8439         }
8440
8441         /* Submit request for advertising params if ext adv available */
8442         if (ext_adv_capable(hdev)) {
8443                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8444                                        data, data_len);
8445                 if (!cmd) {
8446                         err = -ENOMEM;
8447                         hci_remove_adv_instance(hdev, cp->instance);
8448                         goto unlock;
8449                 }
8450
8451                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8452                                          add_ext_adv_params_complete);
8453                 if (err < 0)
8454                         mgmt_pending_free(cmd);
8455         } else {
8456                 rp.instance = cp->instance;
8457                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8458                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8459                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8460                 err = mgmt_cmd_complete(sk, hdev->id,
8461                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8462                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8463         }
8464
8465 unlock:
8466         hci_dev_unlock(hdev);
8467
8468         return err;
8469 }
8470
8471 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8472 {
8473         struct mgmt_pending_cmd *cmd = data;
8474         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8475         struct mgmt_rp_add_advertising rp;
8476
8477         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8478
8479         memset(&rp, 0, sizeof(rp));
8480
8481         rp.instance = cp->instance;
8482
8483         if (err)
8484                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8485                                 mgmt_status(err));
8486         else
8487                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8488                                   mgmt_status(err), &rp, sizeof(rp));
8489
8490         mgmt_pending_free(cmd);
8491 }
8492
8493 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8494 {
8495         struct mgmt_pending_cmd *cmd = data;
8496         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8497         int err;
8498
8499         if (ext_adv_capable(hdev)) {
8500                 err = hci_update_adv_data_sync(hdev, cp->instance);
8501                 if (err)
8502                         return err;
8503
8504                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8505                 if (err)
8506                         return err;
8507
8508                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8509         }
8510
8511         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8512 }
8513
8514 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8515                             u16 data_len)
8516 {
8517         struct mgmt_cp_add_ext_adv_data *cp = data;
8518         struct mgmt_rp_add_ext_adv_data rp;
8519         u8 schedule_instance = 0;
8520         struct adv_info *next_instance;
8521         struct adv_info *adv_instance;
8522         int err = 0;
8523         struct mgmt_pending_cmd *cmd;
8524
8525         BT_DBG("%s", hdev->name);
8526
8527         hci_dev_lock(hdev);
8528
8529         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8530
8531         if (!adv_instance) {
8532                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8533                                       MGMT_STATUS_INVALID_PARAMS);
8534                 goto unlock;
8535         }
8536
8537         /* In new interface, we require that we are powered to register */
8538         if (!hdev_is_powered(hdev)) {
8539                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8540                                       MGMT_STATUS_REJECTED);
8541                 goto clear_new_instance;
8542         }
8543
8544         if (adv_busy(hdev)) {
8545                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8546                                       MGMT_STATUS_BUSY);
8547                 goto clear_new_instance;
8548         }
8549
8550         /* Validate new data */
8551         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8552                                cp->adv_data_len, true) ||
8553             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8554                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8555                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8556                                       MGMT_STATUS_INVALID_PARAMS);
8557                 goto clear_new_instance;
8558         }
8559
8560         /* Set the data in the advertising instance */
8561         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8562                                   cp->data, cp->scan_rsp_len,
8563                                   cp->data + cp->adv_data_len);
8564
8565         /* If using software rotation, determine next instance to use */
8566         if (hdev->cur_adv_instance == cp->instance) {
8567                 /* If the currently advertised instance is being changed
8568                  * then cancel the current advertising and schedule the
8569                  * next instance. If there is only one instance then the
8570                  * overridden advertising data will be visible right
8571                  * away
8572                  */
8573                 cancel_adv_timeout(hdev);
8574
8575                 next_instance = hci_get_next_instance(hdev, cp->instance);
8576                 if (next_instance)
8577                         schedule_instance = next_instance->instance;
8578         } else if (!hdev->adv_instance_timeout) {
8579                 /* Immediately advertise the new instance if no other
8580                  * instance is currently being advertised.
8581                  */
8582                 schedule_instance = cp->instance;
8583         }
8584
8585         /* If the HCI_ADVERTISING flag is set or there is no instance to
8586          * be advertised then we have no HCI communication to make.
8587          * Simply return.
8588          */
8589         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
8590                 if (adv_instance->pending) {
8591                         mgmt_advertising_added(sk, hdev, cp->instance);
8592                         adv_instance->pending = false;
8593                 }
8594                 rp.instance = cp->instance;
8595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8596                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8597                 goto unlock;
8598         }
8599
8600         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8601                                data_len);
8602         if (!cmd) {
8603                 err = -ENOMEM;
8604                 goto clear_new_instance;
8605         }
8606
8607         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
8608                                  add_ext_adv_data_complete);
8609         if (err < 0) {
8610                 mgmt_pending_free(cmd);
8611                 goto clear_new_instance;
8612         }
8613
8614         /* We were successful in updating data, so trigger advertising_added
8615          * event if this is an instance that wasn't previously advertising. If
8616          * a failure occurs in the requests we initiated, we will remove the
8617          * instance again in add_advertising_complete
8618          */
8619         if (adv_instance->pending)
8620                 mgmt_advertising_added(sk, hdev, cp->instance);
8621
8622         goto unlock;
8623
8624 clear_new_instance:
8625         hci_remove_adv_instance(hdev, cp->instance);
8626
8627 unlock:
8628         hci_dev_unlock(hdev);
8629
8630         return err;
8631 }
8632
8633 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
8634                                         int err)
8635 {
8636         struct mgmt_pending_cmd *cmd = data;
8637         struct mgmt_cp_remove_advertising *cp = cmd->param;
8638         struct mgmt_rp_remove_advertising rp;
8639
8640         bt_dev_dbg(hdev, "err %d", err);
8641
8642         memset(&rp, 0, sizeof(rp));
8643         rp.instance = cp->instance;
8644
8645         if (err)
8646                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8647                                 mgmt_status(err));
8648         else
8649                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8650                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8651
8652         mgmt_pending_free(cmd);
8653 }
8654
8655 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
8656 {
8657         struct mgmt_pending_cmd *cmd = data;
8658         struct mgmt_cp_remove_advertising *cp = cmd->param;
8659         int err;
8660
8661         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
8662         if (err)
8663                 return err;
8664
8665         if (list_empty(&hdev->adv_instances))
8666                 err = hci_disable_advertising_sync(hdev);
8667
8668         return err;
8669 }
8670
8671 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8672                               void *data, u16 data_len)
8673 {
8674         struct mgmt_cp_remove_advertising *cp = data;
8675         struct mgmt_pending_cmd *cmd;
8676         int err;
8677
8678         bt_dev_dbg(hdev, "sock %p", sk);
8679
8680         hci_dev_lock(hdev);
8681
8682         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8683                 err = mgmt_cmd_status(sk, hdev->id,
8684                                       MGMT_OP_REMOVE_ADVERTISING,
8685                                       MGMT_STATUS_INVALID_PARAMS);
8686                 goto unlock;
8687         }
8688
8689         if (pending_find(MGMT_OP_SET_LE, hdev)) {
8690                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8691                                       MGMT_STATUS_BUSY);
8692                 goto unlock;
8693         }
8694
8695         if (list_empty(&hdev->adv_instances)) {
8696                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8697                                       MGMT_STATUS_INVALID_PARAMS);
8698                 goto unlock;
8699         }
8700
8701         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8702                                data_len);
8703         if (!cmd) {
8704                 err = -ENOMEM;
8705                 goto unlock;
8706         }
8707
8708         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
8709                                  remove_advertising_complete);
8710         if (err < 0)
8711                 mgmt_pending_free(cmd);
8712
8713 unlock:
8714         hci_dev_unlock(hdev);
8715
8716         return err;
8717 }
8718
8719 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8720                              void *data, u16 data_len)
8721 {
8722         struct mgmt_cp_get_adv_size_info *cp = data;
8723         struct mgmt_rp_get_adv_size_info rp;
8724         u32 flags, supported_flags;
8725
8726         bt_dev_dbg(hdev, "sock %p", sk);
8727
8728         if (!lmp_le_capable(hdev))
8729                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8730                                        MGMT_STATUS_REJECTED);
8731
8732         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8733                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8734                                        MGMT_STATUS_INVALID_PARAMS);
8735
8736         flags = __le32_to_cpu(cp->flags);
8737
8738         /* The current implementation only supports a subset of the specified
8739          * flags.
8740          */
8741         supported_flags = get_supported_adv_flags(hdev);
8742         if (flags & ~supported_flags)
8743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8744                                        MGMT_STATUS_INVALID_PARAMS);
8745
8746         rp.instance = cp->instance;
8747         rp.flags = cp->flags;
8748         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8749         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8750
8751         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8752                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8753 }
8754
8755 static const struct hci_mgmt_handler mgmt_handlers[] = {
8756         { NULL }, /* 0x0000 (no command) */
8757         { read_version,            MGMT_READ_VERSION_SIZE,
8758                                                 HCI_MGMT_NO_HDEV |
8759                                                 HCI_MGMT_UNTRUSTED },
8760         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8761                                                 HCI_MGMT_NO_HDEV |
8762                                                 HCI_MGMT_UNTRUSTED },
8763         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8764                                                 HCI_MGMT_NO_HDEV |
8765                                                 HCI_MGMT_UNTRUSTED },
8766         { read_controller_info,    MGMT_READ_INFO_SIZE,
8767                                                 HCI_MGMT_UNTRUSTED },
8768         { set_powered,             MGMT_SETTING_SIZE },
8769         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8770         { set_connectable,         MGMT_SETTING_SIZE },
8771         { set_fast_connectable,    MGMT_SETTING_SIZE },
8772         { set_bondable,            MGMT_SETTING_SIZE },
8773         { set_link_security,       MGMT_SETTING_SIZE },
8774         { set_ssp,                 MGMT_SETTING_SIZE },
8775         { set_hs,                  MGMT_SETTING_SIZE },
8776         { set_le,                  MGMT_SETTING_SIZE },
8777         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8778         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8779         { add_uuid,                MGMT_ADD_UUID_SIZE },
8780         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8781         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8782                                                 HCI_MGMT_VAR_LEN },
8783         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8784                                                 HCI_MGMT_VAR_LEN },
8785         { disconnect,              MGMT_DISCONNECT_SIZE },
8786         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8787         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8788         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8789         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8790         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8791         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8792         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8793         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8794         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8795         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8796         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8797         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8798         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8799                                                 HCI_MGMT_VAR_LEN },
8800         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8801         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8802         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8803         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8804         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8805         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8806         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8807         { set_advertising,         MGMT_SETTING_SIZE },
8808         { set_bredr,               MGMT_SETTING_SIZE },
8809         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8810         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8811         { set_secure_conn,         MGMT_SETTING_SIZE },
8812         { set_debug_keys,          MGMT_SETTING_SIZE },
8813         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8814         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8815                                                 HCI_MGMT_VAR_LEN },
8816         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8817         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8818         { add_device,              MGMT_ADD_DEVICE_SIZE },
8819         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8820         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8821                                                 HCI_MGMT_VAR_LEN },
8822         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8823                                                 HCI_MGMT_NO_HDEV |
8824                                                 HCI_MGMT_UNTRUSTED },
8825         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8826                                                 HCI_MGMT_UNCONFIGURED |
8827                                                 HCI_MGMT_UNTRUSTED },
8828         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8829                                                 HCI_MGMT_UNCONFIGURED },
8830         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8831                                                 HCI_MGMT_UNCONFIGURED },
8832         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8833                                                 HCI_MGMT_VAR_LEN },
8834         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8835         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8836                                                 HCI_MGMT_NO_HDEV |
8837                                                 HCI_MGMT_UNTRUSTED },
8838         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8839         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8840                                                 HCI_MGMT_VAR_LEN },
8841         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8842         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8843         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8844         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8845                                                 HCI_MGMT_UNTRUSTED },
8846         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8847         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8848         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8849         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8850                                                 HCI_MGMT_VAR_LEN },
8851         { set_wideband_speech,     MGMT_SETTING_SIZE },
8852         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8853                                                 HCI_MGMT_UNTRUSTED },
8854         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8855                                                 HCI_MGMT_UNTRUSTED |
8856                                                 HCI_MGMT_HDEV_OPTIONAL },
8857         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8858                                                 HCI_MGMT_VAR_LEN |
8859                                                 HCI_MGMT_HDEV_OPTIONAL },
8860         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8861                                                 HCI_MGMT_UNTRUSTED },
8862         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8863                                                 HCI_MGMT_VAR_LEN },
8864         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8865                                                 HCI_MGMT_UNTRUSTED },
8866         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8867                                                 HCI_MGMT_VAR_LEN },
8868         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8869         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8870         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8871         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8872                                                 HCI_MGMT_VAR_LEN },
8873         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8874         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8875                                                 HCI_MGMT_VAR_LEN },
8876         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8877                                                 HCI_MGMT_VAR_LEN },
8878         { add_adv_patterns_monitor_rssi,
8879                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8880                                                 HCI_MGMT_VAR_LEN },
8881 };
8882
8883 void mgmt_index_added(struct hci_dev *hdev)
8884 {
8885         struct mgmt_ev_ext_index ev;
8886
8887         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8888                 return;
8889
8890         switch (hdev->dev_type) {
8891         case HCI_PRIMARY:
8892                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8893                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8894                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8895                         ev.type = 0x01;
8896                 } else {
8897                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8898                                          HCI_MGMT_INDEX_EVENTS);
8899                         ev.type = 0x00;
8900                 }
8901                 break;
8902         case HCI_AMP:
8903                 ev.type = 0x02;
8904                 break;
8905         default:
8906                 return;
8907         }
8908
8909         ev.bus = hdev->bus;
8910
8911         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8912                          HCI_MGMT_EXT_INDEX_EVENTS);
8913 }
8914
8915 void mgmt_index_removed(struct hci_dev *hdev)
8916 {
8917         struct mgmt_ev_ext_index ev;
8918         u8 status = MGMT_STATUS_INVALID_INDEX;
8919
8920         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8921                 return;
8922
8923         switch (hdev->dev_type) {
8924         case HCI_PRIMARY:
8925                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8926
8927                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8928                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8929                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8930                         ev.type = 0x01;
8931                 } else {
8932                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8933                                          HCI_MGMT_INDEX_EVENTS);
8934                         ev.type = 0x00;
8935                 }
8936                 break;
8937         case HCI_AMP:
8938                 ev.type = 0x02;
8939                 break;
8940         default:
8941                 return;
8942         }
8943
8944         ev.bus = hdev->bus;
8945
8946         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8947                          HCI_MGMT_EXT_INDEX_EVENTS);
8948
8949         /* Cancel any remaining timed work */
8950         if (!hci_dev_test_flag(hdev, HCI_MGMT))
8951                 return;
8952         cancel_delayed_work_sync(&hdev->discov_off);
8953         cancel_delayed_work_sync(&hdev->service_cache);
8954         cancel_delayed_work_sync(&hdev->rpa_expired);
8955 }
8956
8957 void mgmt_power_on(struct hci_dev *hdev, int err)
8958 {
8959         struct cmd_lookup match = { NULL, hdev };
8960
8961         bt_dev_dbg(hdev, "err %d", err);
8962
8963         hci_dev_lock(hdev);
8964
8965         if (!err) {
8966                 restart_le_actions(hdev);
8967                 hci_update_passive_scan(hdev);
8968         }
8969
8970         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8971
8972         new_settings(hdev, match.sk);
8973
8974         if (match.sk)
8975                 sock_put(match.sk);
8976
8977         hci_dev_unlock(hdev);
8978 }
8979
8980 void __mgmt_power_off(struct hci_dev *hdev)
8981 {
8982         struct cmd_lookup match = { NULL, hdev };
8983         u8 status, zero_cod[] = { 0, 0, 0 };
8984
8985         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8986
8987         /* If the power off is because of hdev unregistration let
8988          * use the appropriate INVALID_INDEX status. Otherwise use
8989          * NOT_POWERED. We cover both scenarios here since later in
8990          * mgmt_index_removed() any hci_conn callbacks will have already
8991          * been triggered, potentially causing misleading DISCONNECTED
8992          * status responses.
8993          */
8994         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8995                 status = MGMT_STATUS_INVALID_INDEX;
8996         else
8997                 status = MGMT_STATUS_NOT_POWERED;
8998
8999         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9000
9001         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9002                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9003                                    zero_cod, sizeof(zero_cod),
9004                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9005                 ext_info_changed(hdev, NULL);
9006         }
9007
9008         new_settings(hdev, match.sk);
9009
9010         if (match.sk)
9011                 sock_put(match.sk);
9012 }
9013
9014 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9015 {
9016         struct mgmt_pending_cmd *cmd;
9017         u8 status;
9018
9019         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9020         if (!cmd)
9021                 return;
9022
9023         if (err == -ERFKILL)
9024                 status = MGMT_STATUS_RFKILLED;
9025         else
9026                 status = MGMT_STATUS_FAILED;
9027
9028         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9029
9030         mgmt_pending_remove(cmd);
9031 }
9032
9033 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9034                        bool persistent)
9035 {
9036         struct mgmt_ev_new_link_key ev;
9037
9038         memset(&ev, 0, sizeof(ev));
9039
9040         ev.store_hint = persistent;
9041         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9042         ev.key.addr.type = BDADDR_BREDR;
9043         ev.key.type = key->type;
9044         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9045         ev.key.pin_len = key->pin_len;
9046
9047         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9048 }
9049
9050 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9051 {
9052         switch (ltk->type) {
9053         case SMP_LTK:
9054         case SMP_LTK_RESPONDER:
9055                 if (ltk->authenticated)
9056                         return MGMT_LTK_AUTHENTICATED;
9057                 return MGMT_LTK_UNAUTHENTICATED;
9058         case SMP_LTK_P256:
9059                 if (ltk->authenticated)
9060                         return MGMT_LTK_P256_AUTH;
9061                 return MGMT_LTK_P256_UNAUTH;
9062         case SMP_LTK_P256_DEBUG:
9063                 return MGMT_LTK_P256_DEBUG;
9064         }
9065
9066         return MGMT_LTK_UNAUTHENTICATED;
9067 }
9068
9069 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9070 {
9071         struct mgmt_ev_new_long_term_key ev;
9072
9073         memset(&ev, 0, sizeof(ev));
9074
9075         /* Devices using resolvable or non-resolvable random addresses
9076          * without providing an identity resolving key don't require
9077          * to store long term keys. Their addresses will change the
9078          * next time around.
9079          *
9080          * Only when a remote device provides an identity address
9081          * make sure the long term key is stored. If the remote
9082          * identity is known, the long term keys are internally
9083          * mapped to the identity address. So allow static random
9084          * and public addresses here.
9085          */
9086         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9087             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9088                 ev.store_hint = 0x00;
9089         else
9090                 ev.store_hint = persistent;
9091
9092         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9093         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9094         ev.key.type = mgmt_ltk_type(key);
9095         ev.key.enc_size = key->enc_size;
9096         ev.key.ediv = key->ediv;
9097         ev.key.rand = key->rand;
9098
9099         if (key->type == SMP_LTK)
9100                 ev.key.initiator = 1;
9101
9102         /* Make sure we copy only the significant bytes based on the
9103          * encryption key size, and set the rest of the value to zeroes.
9104          */
9105         memcpy(ev.key.val, key->val, key->enc_size);
9106         memset(ev.key.val + key->enc_size, 0,
9107                sizeof(ev.key.val) - key->enc_size);
9108
9109         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9110 }
9111
9112 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9113 {
9114         struct mgmt_ev_new_irk ev;
9115
9116         memset(&ev, 0, sizeof(ev));
9117
9118         ev.store_hint = persistent;
9119
9120         bacpy(&ev.rpa, &irk->rpa);
9121         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9122         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9123         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9124
9125         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9126 }
9127
9128 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9129                    bool persistent)
9130 {
9131         struct mgmt_ev_new_csrk ev;
9132
9133         memset(&ev, 0, sizeof(ev));
9134
9135         /* Devices using resolvable or non-resolvable random addresses
9136          * without providing an identity resolving key don't require
9137          * to store signature resolving keys. Their addresses will change
9138          * the next time around.
9139          *
9140          * Only when a remote device provides an identity address
9141          * make sure the signature resolving key is stored. So allow
9142          * static random and public addresses here.
9143          */
9144         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9145             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9146                 ev.store_hint = 0x00;
9147         else
9148                 ev.store_hint = persistent;
9149
9150         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9151         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9152         ev.key.type = csrk->type;
9153         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9154
9155         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9156 }
9157
9158 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9159                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9160                          u16 max_interval, u16 latency, u16 timeout)
9161 {
9162         struct mgmt_ev_new_conn_param ev;
9163
9164         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9165                 return;
9166
9167         memset(&ev, 0, sizeof(ev));
9168         bacpy(&ev.addr.bdaddr, bdaddr);
9169         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9170         ev.store_hint = store_hint;
9171         ev.min_interval = cpu_to_le16(min_interval);
9172         ev.max_interval = cpu_to_le16(max_interval);
9173         ev.latency = cpu_to_le16(latency);
9174         ev.timeout = cpu_to_le16(timeout);
9175
9176         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9177 }
9178
9179 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9180                            u8 *name, u8 name_len)
9181 {
9182         struct sk_buff *skb;
9183         struct mgmt_ev_device_connected *ev;
9184         u16 eir_len = 0;
9185         u32 flags = 0;
9186
9187         /* allocate buff for LE or BR/EDR adv */
9188         if (conn->le_adv_data_len > 0)
9189                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9190                                      sizeof(*ev) + conn->le_adv_data_len);
9191         else
9192                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9193                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9194                                      eir_precalc_len(sizeof(conn->dev_class)));
9195
9196         ev = skb_put(skb, sizeof(*ev));
9197         bacpy(&ev->addr.bdaddr, &conn->dst);
9198         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9199
9200         if (conn->out)
9201                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9202
9203         ev->flags = __cpu_to_le32(flags);
9204
9205         /* We must ensure that the EIR Data fields are ordered and
9206          * unique. Keep it simple for now and avoid the problem by not
9207          * adding any BR/EDR data to the LE adv.
9208          */
9209         if (conn->le_adv_data_len > 0) {
9210                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9211                 eir_len = conn->le_adv_data_len;
9212         } else {
9213                 if (name)
9214                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9215
9216                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9217                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9218                                                     conn->dev_class, sizeof(conn->dev_class));
9219         }
9220
9221         ev->eir_len = cpu_to_le16(eir_len);
9222
9223         mgmt_event_skb(skb, NULL);
9224 }
9225
9226 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9227 {
9228         struct sock **sk = data;
9229
9230         cmd->cmd_complete(cmd, 0);
9231
9232         *sk = cmd->sk;
9233         sock_hold(*sk);
9234
9235         mgmt_pending_remove(cmd);
9236 }
9237
9238 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9239 {
9240         struct hci_dev *hdev = data;
9241         struct mgmt_cp_unpair_device *cp = cmd->param;
9242
9243         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9244
9245         cmd->cmd_complete(cmd, 0);
9246         mgmt_pending_remove(cmd);
9247 }
9248
9249 bool mgmt_powering_down(struct hci_dev *hdev)
9250 {
9251         struct mgmt_pending_cmd *cmd;
9252         struct mgmt_mode *cp;
9253
9254         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9255         if (!cmd)
9256                 return false;
9257
9258         cp = cmd->param;
9259         if (!cp->val)
9260                 return true;
9261
9262         return false;
9263 }
9264
9265 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9266                               u8 link_type, u8 addr_type, u8 reason,
9267                               bool mgmt_connected)
9268 {
9269         struct mgmt_ev_device_disconnected ev;
9270         struct sock *sk = NULL;
9271
9272         /* The connection is still in hci_conn_hash so test for 1
9273          * instead of 0 to know if this is the last one.
9274          */
9275         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9276                 cancel_delayed_work(&hdev->power_off);
9277                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9278         }
9279
9280         if (!mgmt_connected)
9281                 return;
9282
9283         if (link_type != ACL_LINK && link_type != LE_LINK)
9284                 return;
9285
9286         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9287
9288         bacpy(&ev.addr.bdaddr, bdaddr);
9289         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9290         ev.reason = reason;
9291
9292         /* Report disconnects due to suspend */
9293         if (hdev->suspended)
9294                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9295
9296         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9297
9298         if (sk)
9299                 sock_put(sk);
9300
9301         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9302                              hdev);
9303 }
9304
9305 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9306                             u8 link_type, u8 addr_type, u8 status)
9307 {
9308         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9309         struct mgmt_cp_disconnect *cp;
9310         struct mgmt_pending_cmd *cmd;
9311
9312         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9313                              hdev);
9314
9315         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9316         if (!cmd)
9317                 return;
9318
9319         cp = cmd->param;
9320
9321         if (bacmp(bdaddr, &cp->addr.bdaddr))
9322                 return;
9323
9324         if (cp->addr.type != bdaddr_type)
9325                 return;
9326
9327         cmd->cmd_complete(cmd, mgmt_status(status));
9328         mgmt_pending_remove(cmd);
9329 }
9330
9331 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9332                          u8 addr_type, u8 status)
9333 {
9334         struct mgmt_ev_connect_failed ev;
9335
9336         /* The connection is still in hci_conn_hash so test for 1
9337          * instead of 0 to know if this is the last one.
9338          */
9339         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9340                 cancel_delayed_work(&hdev->power_off);
9341                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9342         }
9343
9344         bacpy(&ev.addr.bdaddr, bdaddr);
9345         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9346         ev.status = mgmt_status(status);
9347
9348         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9349 }
9350
9351 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9352 {
9353         struct mgmt_ev_pin_code_request ev;
9354
9355         bacpy(&ev.addr.bdaddr, bdaddr);
9356         ev.addr.type = BDADDR_BREDR;
9357         ev.secure = secure;
9358
9359         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9360 }
9361
9362 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9363                                   u8 status)
9364 {
9365         struct mgmt_pending_cmd *cmd;
9366
9367         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9368         if (!cmd)
9369                 return;
9370
9371         cmd->cmd_complete(cmd, mgmt_status(status));
9372         mgmt_pending_remove(cmd);
9373 }
9374
9375 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9376                                       u8 status)
9377 {
9378         struct mgmt_pending_cmd *cmd;
9379
9380         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9381         if (!cmd)
9382                 return;
9383
9384         cmd->cmd_complete(cmd, mgmt_status(status));
9385         mgmt_pending_remove(cmd);
9386 }
9387
9388 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9389                               u8 link_type, u8 addr_type, u32 value,
9390                               u8 confirm_hint)
9391 {
9392         struct mgmt_ev_user_confirm_request ev;
9393
9394         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9395
9396         bacpy(&ev.addr.bdaddr, bdaddr);
9397         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9398         ev.confirm_hint = confirm_hint;
9399         ev.value = cpu_to_le32(value);
9400
9401         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9402                           NULL);
9403 }
9404
9405 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9406                               u8 link_type, u8 addr_type)
9407 {
9408         struct mgmt_ev_user_passkey_request ev;
9409
9410         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9411
9412         bacpy(&ev.addr.bdaddr, bdaddr);
9413         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9414
9415         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9416                           NULL);
9417 }
9418
9419 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9420                                       u8 link_type, u8 addr_type, u8 status,
9421                                       u8 opcode)
9422 {
9423         struct mgmt_pending_cmd *cmd;
9424
9425         cmd = pending_find(opcode, hdev);
9426         if (!cmd)
9427                 return -ENOENT;
9428
9429         cmd->cmd_complete(cmd, mgmt_status(status));
9430         mgmt_pending_remove(cmd);
9431
9432         return 0;
9433 }
9434
9435 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9436                                      u8 link_type, u8 addr_type, u8 status)
9437 {
9438         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9439                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9440 }
9441
9442 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9443                                          u8 link_type, u8 addr_type, u8 status)
9444 {
9445         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9446                                           status,
9447                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9448 }
9449
9450 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9451                                      u8 link_type, u8 addr_type, u8 status)
9452 {
9453         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9454                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9455 }
9456
9457 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9458                                          u8 link_type, u8 addr_type, u8 status)
9459 {
9460         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9461                                           status,
9462                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9463 }
9464
9465 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9466                              u8 link_type, u8 addr_type, u32 passkey,
9467                              u8 entered)
9468 {
9469         struct mgmt_ev_passkey_notify ev;
9470
9471         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9472
9473         bacpy(&ev.addr.bdaddr, bdaddr);
9474         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9475         ev.passkey = __cpu_to_le32(passkey);
9476         ev.entered = entered;
9477
9478         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9479 }
9480
9481 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9482 {
9483         struct mgmt_ev_auth_failed ev;
9484         struct mgmt_pending_cmd *cmd;
9485         u8 status = mgmt_status(hci_status);
9486
9487         bacpy(&ev.addr.bdaddr, &conn->dst);
9488         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9489         ev.status = status;
9490
9491         cmd = find_pairing(conn);
9492
9493         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9494                     cmd ? cmd->sk : NULL);
9495
9496         if (cmd) {
9497                 cmd->cmd_complete(cmd, status);
9498                 mgmt_pending_remove(cmd);
9499         }
9500 }
9501
9502 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9503 {
9504         struct cmd_lookup match = { NULL, hdev };
9505         bool changed;
9506
9507         if (status) {
9508                 u8 mgmt_err = mgmt_status(status);
9509                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9510                                      cmd_status_rsp, &mgmt_err);
9511                 return;
9512         }
9513
9514         if (test_bit(HCI_AUTH, &hdev->flags))
9515                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9516         else
9517                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9518
9519         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9520                              &match);
9521
9522         if (changed)
9523                 new_settings(hdev, match.sk);
9524
9525         if (match.sk)
9526                 sock_put(match.sk);
9527 }
9528
9529 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9530 {
9531         struct cmd_lookup *match = data;
9532
9533         if (match->sk == NULL) {
9534                 match->sk = cmd->sk;
9535                 sock_hold(match->sk);
9536         }
9537 }
9538
9539 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9540                                     u8 status)
9541 {
9542         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9543
9544         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9545         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9546         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9547
9548         if (!status) {
9549                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9550                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9551                 ext_info_changed(hdev, NULL);
9552         }
9553
9554         if (match.sk)
9555                 sock_put(match.sk);
9556 }
9557
9558 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9559 {
9560         struct mgmt_cp_set_local_name ev;
9561         struct mgmt_pending_cmd *cmd;
9562
9563         if (status)
9564                 return;
9565
9566         memset(&ev, 0, sizeof(ev));
9567         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9568         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9569
9570         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9571         if (!cmd) {
9572                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9573
9574                 /* If this is a HCI command related to powering on the
9575                  * HCI dev don't send any mgmt signals.
9576                  */
9577                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9578                         return;
9579         }
9580
9581         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9582                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9583         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9584 }
9585
9586 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9587 {
9588         int i;
9589
9590         for (i = 0; i < uuid_count; i++) {
9591                 if (!memcmp(uuid, uuids[i], 16))
9592                         return true;
9593         }
9594
9595         return false;
9596 }
9597
9598 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9599 {
9600         u16 parsed = 0;
9601
9602         while (parsed < eir_len) {
9603                 u8 field_len = eir[0];
9604                 u8 uuid[16];
9605                 int i;
9606
9607                 if (field_len == 0)
9608                         break;
9609
9610                 if (eir_len - parsed < field_len + 1)
9611                         break;
9612
9613                 switch (eir[1]) {
9614                 case EIR_UUID16_ALL:
9615                 case EIR_UUID16_SOME:
9616                         for (i = 0; i + 3 <= field_len; i += 2) {
9617                                 memcpy(uuid, bluetooth_base_uuid, 16);
9618                                 uuid[13] = eir[i + 3];
9619                                 uuid[12] = eir[i + 2];
9620                                 if (has_uuid(uuid, uuid_count, uuids))
9621                                         return true;
9622                         }
9623                         break;
9624                 case EIR_UUID32_ALL:
9625                 case EIR_UUID32_SOME:
9626                         for (i = 0; i + 5 <= field_len; i += 4) {
9627                                 memcpy(uuid, bluetooth_base_uuid, 16);
9628                                 uuid[15] = eir[i + 5];
9629                                 uuid[14] = eir[i + 4];
9630                                 uuid[13] = eir[i + 3];
9631                                 uuid[12] = eir[i + 2];
9632                                 if (has_uuid(uuid, uuid_count, uuids))
9633                                         return true;
9634                         }
9635                         break;
9636                 case EIR_UUID128_ALL:
9637                 case EIR_UUID128_SOME:
9638                         for (i = 0; i + 17 <= field_len; i += 16) {
9639                                 memcpy(uuid, eir + i + 2, 16);
9640                                 if (has_uuid(uuid, uuid_count, uuids))
9641                                         return true;
9642                         }
9643                         break;
9644                 }
9645
9646                 parsed += field_len + 1;
9647                 eir += field_len + 1;
9648         }
9649
9650         return false;
9651 }
9652
9653 static void restart_le_scan(struct hci_dev *hdev)
9654 {
9655         /* If controller is not scanning we are done. */
9656         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9657                 return;
9658
9659         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9660                        hdev->discovery.scan_start +
9661                        hdev->discovery.scan_duration))
9662                 return;
9663
9664         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9665                            DISCOV_LE_RESTART_DELAY);
9666 }
9667
9668 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9669                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9670 {
9671         /* If a RSSI threshold has been specified, and
9672          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9673          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9674          * is set, let it through for further processing, as we might need to
9675          * restart the scan.
9676          *
9677          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9678          * the results are also dropped.
9679          */
9680         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9681             (rssi == HCI_RSSI_INVALID ||
9682             (rssi < hdev->discovery.rssi &&
9683              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9684                 return  false;
9685
9686         if (hdev->discovery.uuid_count != 0) {
9687                 /* If a list of UUIDs is provided in filter, results with no
9688                  * matching UUID should be dropped.
9689                  */
9690                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9691                                    hdev->discovery.uuids) &&
9692                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9693                                    hdev->discovery.uuid_count,
9694                                    hdev->discovery.uuids))
9695                         return false;
9696         }
9697
9698         /* If duplicate filtering does not report RSSI changes, then restart
9699          * scanning to ensure updated result with updated RSSI values.
9700          */
9701         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9702                 restart_le_scan(hdev);
9703
9704                 /* Validate RSSI value against the RSSI threshold once more. */
9705                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9706                     rssi < hdev->discovery.rssi)
9707                         return false;
9708         }
9709
9710         return true;
9711 }
9712
9713 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
9714                                   bdaddr_t *bdaddr, u8 addr_type)
9715 {
9716         struct mgmt_ev_adv_monitor_device_lost ev;
9717
9718         ev.monitor_handle = cpu_to_le16(handle);
9719         bacpy(&ev.addr.bdaddr, bdaddr);
9720         ev.addr.type = addr_type;
9721
9722         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
9723                    NULL);
9724 }
9725
9726 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
9727                                                struct sk_buff *skb,
9728                                                struct sock *skip_sk,
9729                                                u16 handle)
9730 {
9731         struct sk_buff *advmon_skb;
9732         size_t advmon_skb_len;
9733         __le16 *monitor_handle;
9734
9735         if (!skb)
9736                 return;
9737
9738         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
9739                           sizeof(struct mgmt_ev_device_found)) + skb->len;
9740         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
9741                                     advmon_skb_len);
9742         if (!advmon_skb)
9743                 return;
9744
9745         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
9746          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
9747          * store monitor_handle of the matched monitor.
9748          */
9749         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
9750         *monitor_handle = cpu_to_le16(handle);
9751         skb_put_data(advmon_skb, skb->data, skb->len);
9752
9753         mgmt_event_skb(advmon_skb, skip_sk);
9754 }
9755
9756 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
9757                                           bdaddr_t *bdaddr, bool report_device,
9758                                           struct sk_buff *skb,
9759                                           struct sock *skip_sk)
9760 {
9761         struct monitored_device *dev, *tmp;
9762         bool matched = false;
9763         bool notified = false;
9764
9765         /* We have received the Advertisement Report because:
9766          * 1. the kernel has initiated active discovery
9767          * 2. if not, we have pend_le_reports > 0 in which case we are doing
9768          *    passive scanning
9769          * 3. if none of the above is true, we have one or more active
9770          *    Advertisement Monitor
9771          *
9772          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
9773          * and report ONLY one advertisement per device for the matched Monitor
9774          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
9775          *
9776          * For case 3, since we are not active scanning and all advertisements
9777          * received are due to a matched Advertisement Monitor, report all
9778          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
9779          */
9780         if (report_device && !hdev->advmon_pend_notify) {
9781                 mgmt_event_skb(skb, skip_sk);
9782                 return;
9783         }
9784
9785         hdev->advmon_pend_notify = false;
9786
9787         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
9788                 if (!bacmp(&dev->bdaddr, bdaddr)) {
9789                         matched = true;
9790
9791                         if (!dev->notified) {
9792                                 mgmt_send_adv_monitor_device_found(hdev, skb,
9793                                                                    skip_sk,
9794                                                                    dev->handle);
9795                                 notified = true;
9796                                 dev->notified = true;
9797                         }
9798                 }
9799
9800                 if (!dev->notified)
9801                         hdev->advmon_pend_notify = true;
9802         }
9803
9804         if (!report_device &&
9805             ((matched && !notified) || !msft_monitor_supported(hdev))) {
9806                 /* Handle 0 indicates that we are not active scanning and this
9807                  * is a subsequent advertisement report for an already matched
9808                  * Advertisement Monitor or the controller offloading support
9809                  * is not available.
9810                  */
9811                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
9812         }
9813
9814         if (report_device)
9815                 mgmt_event_skb(skb, skip_sk);
9816         else
9817                 kfree_skb(skb);
9818 }
9819
9820 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9821                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9822                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9823 {
9824         struct sk_buff *skb;
9825         struct mgmt_ev_device_found *ev;
9826         bool report_device = hci_discovery_active(hdev);
9827
9828         /* Don't send events for a non-kernel initiated discovery. With
9829          * LE one exception is if we have pend_le_reports > 0 in which
9830          * case we're doing passive scanning and want these events.
9831          */
9832         if (!hci_discovery_active(hdev)) {
9833                 if (link_type == ACL_LINK)
9834                         return;
9835                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
9836                         report_device = true;
9837                 else if (!hci_is_adv_monitoring(hdev))
9838                         return;
9839         }
9840
9841         if (hdev->discovery.result_filtering) {
9842                 /* We are using service discovery */
9843                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9844                                      scan_rsp_len))
9845                         return;
9846         }
9847
9848         if (hdev->discovery.limited) {
9849                 /* Check for limited discoverable bit */
9850                 if (dev_class) {
9851                         if (!(dev_class[1] & 0x20))
9852                                 return;
9853                 } else {
9854                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9855                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9856                                 return;
9857                 }
9858         }
9859
9860         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
9861         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
9862                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
9863         if (!skb)
9864                 return;
9865
9866         ev = skb_put(skb, sizeof(*ev));
9867
9868         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9869          * RSSI value was reported as 0 when not available. This behavior
9870          * is kept when using device discovery. This is required for full
9871          * backwards compatibility with the API.
9872          *
9873          * However when using service discovery, the value 127 will be
9874          * returned when the RSSI is not available.
9875          */
9876         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9877             link_type == ACL_LINK)
9878                 rssi = 0;
9879
9880         bacpy(&ev->addr.bdaddr, bdaddr);
9881         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9882         ev->rssi = rssi;
9883         ev->flags = cpu_to_le32(flags);
9884
9885         if (eir_len > 0)
9886                 /* Copy EIR or advertising data into event */
9887                 skb_put_data(skb, eir, eir_len);
9888
9889         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
9890                 u8 eir_cod[5];
9891
9892                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
9893                                            dev_class, 3);
9894                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
9895         }
9896
9897         if (scan_rsp_len > 0)
9898                 /* Append scan response data to event */
9899                 skb_put_data(skb, scan_rsp, scan_rsp_len);
9900
9901         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9902
9903         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
9904 }
9905
9906 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9907                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9908 {
9909         struct sk_buff *skb;
9910         struct mgmt_ev_device_found *ev;
9911         u16 eir_len = 0;
9912         u32 flags = 0;
9913
9914         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
9915                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
9916
9917         ev = skb_put(skb, sizeof(*ev));
9918         bacpy(&ev->addr.bdaddr, bdaddr);
9919         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9920         ev->rssi = rssi;
9921
9922         if (name)
9923                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9924         else
9925                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
9926
9927         ev->eir_len = cpu_to_le16(eir_len);
9928         ev->flags = cpu_to_le32(flags);
9929
9930         mgmt_event_skb(skb, NULL);
9931 }
9932
9933 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9934 {
9935         struct mgmt_ev_discovering ev;
9936
9937         bt_dev_dbg(hdev, "discovering %u", discovering);
9938
9939         memset(&ev, 0, sizeof(ev));
9940         ev.type = hdev->discovery.type;
9941         ev.discovering = discovering;
9942
9943         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9944 }
9945
9946 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9947 {
9948         struct mgmt_ev_controller_suspend ev;
9949
9950         ev.suspend_state = state;
9951         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9952 }
9953
9954 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9955                    u8 addr_type)
9956 {
9957         struct mgmt_ev_controller_resume ev;
9958
9959         ev.wake_reason = reason;
9960         if (bdaddr) {
9961                 bacpy(&ev.addr.bdaddr, bdaddr);
9962                 ev.addr.type = addr_type;
9963         } else {
9964                 memset(&ev.addr, 0, sizeof(ev.addr));
9965         }
9966
9967         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9968 }
9969
9970 static struct hci_mgmt_chan chan = {
9971         .channel        = HCI_CHANNEL_CONTROL,
9972         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9973         .handlers       = mgmt_handlers,
9974         .hdev_init      = mgmt_init_hdev,
9975 };
9976
9977 int mgmt_init(void)
9978 {
9979         return hci_mgmt_chan_register(&chan);
9980 }
9981
9982 void mgmt_exit(void)
9983 {
9984         hci_mgmt_chan_unregister(&chan);
9985 }