net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42 #include "aosp.h"
  43
  44 #define MGMT_VERSION    1
  45 #define MGMT_REVISION   22
  46
  47 static const u16 mgmt_commands[] = {
  48         MGMT_OP_READ_INDEX_LIST,
  49         MGMT_OP_READ_INFO,
  50         MGMT_OP_SET_POWERED,
  51         MGMT_OP_SET_DISCOVERABLE,
  52         MGMT_OP_SET_CONNECTABLE,
  53         MGMT_OP_SET_FAST_CONNECTABLE,
  54         MGMT_OP_SET_BONDABLE,
  55         MGMT_OP_SET_LINK_SECURITY,
  56         MGMT_OP_SET_SSP,
  57         MGMT_OP_SET_HS,
  58         MGMT_OP_SET_LE,
  59         MGMT_OP_SET_DEV_CLASS,
  60         MGMT_OP_SET_LOCAL_NAME,
  61         MGMT_OP_ADD_UUID,
  62         MGMT_OP_REMOVE_UUID,
  63         MGMT_OP_LOAD_LINK_KEYS,
  64         MGMT_OP_LOAD_LONG_TERM_KEYS,
  65         MGMT_OP_DISCONNECT,
  66         MGMT_OP_GET_CONNECTIONS,
  67         MGMT_OP_PIN_CODE_REPLY,
  68         MGMT_OP_PIN_CODE_NEG_REPLY,
  69         MGMT_OP_SET_IO_CAPABILITY,
  70         MGMT_OP_PAIR_DEVICE,
  71         MGMT_OP_CANCEL_PAIR_DEVICE,
  72         MGMT_OP_UNPAIR_DEVICE,
  73         MGMT_OP_USER_CONFIRM_REPLY,
  74         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  75         MGMT_OP_USER_PASSKEY_REPLY,
  76         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  77         MGMT_OP_READ_LOCAL_OOB_DATA,
  78         MGMT_OP_ADD_REMOTE_OOB_DATA,
  79         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  80         MGMT_OP_START_DISCOVERY,
  81         MGMT_OP_STOP_DISCOVERY,
  82         MGMT_OP_CONFIRM_NAME,
  83         MGMT_OP_BLOCK_DEVICE,
  84         MGMT_OP_UNBLOCK_DEVICE,
  85         MGMT_OP_SET_DEVICE_ID,
  86         MGMT_OP_SET_ADVERTISING,
  87         MGMT_OP_SET_BREDR,
  88         MGMT_OP_SET_STATIC_ADDRESS,
  89         MGMT_OP_SET_SCAN_PARAMS,
  90         MGMT_OP_SET_SECURE_CONN,
  91         MGMT_OP_SET_DEBUG_KEYS,
  92         MGMT_OP_SET_PRIVACY,
  93         MGMT_OP_LOAD_IRKS,
  94         MGMT_OP_GET_CONN_INFO,
  95         MGMT_OP_GET_CLOCK_INFO,
  96         MGMT_OP_ADD_DEVICE,
  97         MGMT_OP_REMOVE_DEVICE,
  98         MGMT_OP_LOAD_CONN_PARAM,
  99         MGMT_OP_READ_UNCONF_INDEX_LIST,
 100         MGMT_OP_READ_CONFIG_INFO,
 101         MGMT_OP_SET_EXTERNAL_CONFIG,
 102         MGMT_OP_SET_PUBLIC_ADDRESS,
 103         MGMT_OP_START_SERVICE_DISCOVERY,
 104         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 105         MGMT_OP_READ_EXT_INDEX_LIST,
 106         MGMT_OP_READ_ADV_FEATURES,
 107         MGMT_OP_ADD_ADVERTISING,
 108         MGMT_OP_REMOVE_ADVERTISING,
 109         MGMT_OP_GET_ADV_SIZE_INFO,
 110         MGMT_OP_START_LIMITED_DISCOVERY,
 111         MGMT_OP_READ_EXT_INFO,
 112         MGMT_OP_SET_APPEARANCE,
 113         MGMT_OP_GET_PHY_CONFIGURATION,
 114         MGMT_OP_SET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_BLOCKED_KEYS,
 116         MGMT_OP_SET_WIDEBAND_SPEECH,
 117         MGMT_OP_READ_CONTROLLER_CAP,
 118         MGMT_OP_READ_EXP_FEATURES_INFO,
 119         MGMT_OP_SET_EXP_FEATURE,
 120         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_GET_DEVICE_FLAGS,
 125         MGMT_OP_SET_DEVICE_FLAGS,
 126         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 127         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 128         MGMT_OP_REMOVE_ADV_MONITOR,
 129         MGMT_OP_ADD_EXT_ADV_PARAMS,
 130         MGMT_OP_ADD_EXT_ADV_DATA,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 132         MGMT_OP_SET_MESH_RECEIVER,
 133         MGMT_OP_MESH_READ_FEATURES,
 134         MGMT_OP_MESH_SEND,
 135         MGMT_OP_MESH_SEND_CANCEL,
 136 };
 137
 138 static const u16 mgmt_events[] = {
 139         MGMT_EV_CONTROLLER_ERROR,
 140         MGMT_EV_INDEX_ADDED,
 141         MGMT_EV_INDEX_REMOVED,
 142         MGMT_EV_NEW_SETTINGS,
 143         MGMT_EV_CLASS_OF_DEV_CHANGED,
 144         MGMT_EV_LOCAL_NAME_CHANGED,
 145         MGMT_EV_NEW_LINK_KEY,
 146         MGMT_EV_NEW_LONG_TERM_KEY,
 147         MGMT_EV_DEVICE_CONNECTED,
 148         MGMT_EV_DEVICE_DISCONNECTED,
 149         MGMT_EV_CONNECT_FAILED,
 150         MGMT_EV_PIN_CODE_REQUEST,
 151         MGMT_EV_USER_CONFIRM_REQUEST,
 152         MGMT_EV_USER_PASSKEY_REQUEST,
 153         MGMT_EV_AUTH_FAILED,
 154         MGMT_EV_DEVICE_FOUND,
 155         MGMT_EV_DISCOVERING,
 156         MGMT_EV_DEVICE_BLOCKED,
 157         MGMT_EV_DEVICE_UNBLOCKED,
 158         MGMT_EV_DEVICE_UNPAIRED,
 159         MGMT_EV_PASSKEY_NOTIFY,
 160         MGMT_EV_NEW_IRK,
 161         MGMT_EV_NEW_CSRK,
 162         MGMT_EV_DEVICE_ADDED,
 163         MGMT_EV_DEVICE_REMOVED,
 164         MGMT_EV_NEW_CONN_PARAM,
 165         MGMT_EV_UNCONF_INDEX_ADDED,
 166         MGMT_EV_UNCONF_INDEX_REMOVED,
 167         MGMT_EV_NEW_CONFIG_OPTIONS,
 168         MGMT_EV_EXT_INDEX_ADDED,
 169         MGMT_EV_EXT_INDEX_REMOVED,
 170         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 171         MGMT_EV_ADVERTISING_ADDED,
 172         MGMT_EV_ADVERTISING_REMOVED,
 173         MGMT_EV_EXT_INFO_CHANGED,
 174         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 175         MGMT_EV_EXP_FEATURE_CHANGED,
 176         MGMT_EV_DEVICE_FLAGS_CHANGED,
 177         MGMT_EV_ADV_MONITOR_ADDED,
 178         MGMT_EV_ADV_MONITOR_REMOVED,
 179         MGMT_EV_CONTROLLER_SUSPEND,
 180         MGMT_EV_CONTROLLER_RESUME,
 181         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 182         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 183 };
 184
 185 static const u16 mgmt_untrusted_commands[] = {
 186         MGMT_OP_READ_INDEX_LIST,
 187         MGMT_OP_READ_INFO,
 188         MGMT_OP_READ_UNCONF_INDEX_LIST,
 189         MGMT_OP_READ_CONFIG_INFO,
 190         MGMT_OP_READ_EXT_INDEX_LIST,
 191         MGMT_OP_READ_EXT_INFO,
 192         MGMT_OP_READ_CONTROLLER_CAP,
 193         MGMT_OP_READ_EXP_FEATURES_INFO,
 194         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 195         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 196 };
 197
 198 static const u16 mgmt_untrusted_events[] = {
 199         MGMT_EV_INDEX_ADDED,
 200         MGMT_EV_INDEX_REMOVED,
 201         MGMT_EV_NEW_SETTINGS,
 202         MGMT_EV_CLASS_OF_DEV_CHANGED,
 203         MGMT_EV_LOCAL_NAME_CHANGED,
 204         MGMT_EV_UNCONF_INDEX_ADDED,
 205         MGMT_EV_UNCONF_INDEX_REMOVED,
 206         MGMT_EV_NEW_CONFIG_OPTIONS,
 207         MGMT_EV_EXT_INDEX_ADDED,
 208         MGMT_EV_EXT_INDEX_REMOVED,
 209         MGMT_EV_EXT_INFO_CHANGED,
 210         MGMT_EV_EXP_FEATURE_CHANGED,
 211 };
 212
 213 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 214
 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 216                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 217
 218 /* HCI to MGMT error code conversion table */
 219 static const u8 mgmt_status_table[] = {
 220         MGMT_STATUS_SUCCESS,
 221         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 222         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 223         MGMT_STATUS_FAILED,             /* Hardware Failure */
 224         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 225         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 226         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 227         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 228         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 229         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 230         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 231         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 232         MGMT_STATUS_BUSY,               /* Command Disallowed */
 233         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 234         MGMT_STATUS_REJECTED,           /* Rejected Security */
 235         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 236         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 237         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 239         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 240         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 241         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 242         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 243         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 244         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 245         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 246         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 247         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 248         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 249         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 250         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 251         MGMT_STATUS_FAILED,             /* Unspecified Error */
 252         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 253         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 254         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 255         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 256         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 257         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 258         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 259         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 260         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 262         MGMT_STATUS_FAILED,             /* Transaction Collision */
 263         MGMT_STATUS_FAILED,             /* Reserved for future use */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 265         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 266         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 267         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 269         MGMT_STATUS_FAILED,             /* Reserved for future use */
 270         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 271         MGMT_STATUS_FAILED,             /* Reserved for future use */
 272         MGMT_STATUS_FAILED,             /* Slot Violation */
 273         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 274         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 275         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 276         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 277         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 278         MGMT_STATUS_BUSY,               /* Controller Busy */
 279         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 280         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 281         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 282         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 283         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 284 };
 285
 286 static u8 mgmt_errno_status(int err)
 287 {
 288         switch (err) {
 289         case 0:
 290                 return MGMT_STATUS_SUCCESS;
 291         case -EPERM:
 292                 return MGMT_STATUS_REJECTED;
 293         case -EINVAL:
 294                 return MGMT_STATUS_INVALID_PARAMS;
 295         case -EOPNOTSUPP:
 296                 return MGMT_STATUS_NOT_SUPPORTED;
 297         case -EBUSY:
 298                 return MGMT_STATUS_BUSY;
 299         case -ETIMEDOUT:
 300                 return MGMT_STATUS_AUTH_FAILED;
 301         case -ENOMEM:
 302                 return MGMT_STATUS_NO_RESOURCES;
 303         case -EISCONN:
 304                 return MGMT_STATUS_ALREADY_CONNECTED;
 305         case -ENOTCONN:
 306                 return MGMT_STATUS_DISCONNECTED;
 307         }
 308
 309         return MGMT_STATUS_FAILED;
 310 }
 311
 312 static u8 mgmt_status(int err)
 313 {
 314         if (err < 0)
 315                 return mgmt_errno_status(err);
 316
 317         if (err < ARRAY_SIZE(mgmt_status_table))
 318                 return mgmt_status_table[err];
 319
 320         return MGMT_STATUS_FAILED;
 321 }
 322
 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 324                             u16 len, int flag)
 325 {
 326         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 327                                flag, NULL);
 328 }
 329
 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 331                               u16 len, int flag, struct sock *skip_sk)
 332 {
 333         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 334                                flag, skip_sk);
 335 }
 336
 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 338                       struct sock *skip_sk)
 339 {
 340         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 341                                HCI_SOCK_TRUSTED, skip_sk);
 342 }
 343
 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 345 {
 346         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 347                                    skip_sk);
 348 }
 349
 350 static u8 le_addr_type(u8 mgmt_addr_type)
 351 {
 352         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 353                 return ADDR_LE_DEV_PUBLIC;
 354         else
 355                 return ADDR_LE_DEV_RANDOM;
 356 }
 357
 358 void mgmt_fill_version_info(void *ver)
 359 {
 360         struct mgmt_rp_read_version *rp = ver;
 361
 362         rp->version = MGMT_VERSION;
 363         rp->revision = cpu_to_le16(MGMT_REVISION);
 364 }
 365
 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 367                         u16 data_len)
 368 {
 369         struct mgmt_rp_read_version rp;
 370
 371         bt_dev_dbg(hdev, "sock %p", sk);
 372
 373         mgmt_fill_version_info(&rp);
 374
 375         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 376                                  &rp, sizeof(rp));
 377 }
 378
 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 380                          u16 data_len)
 381 {
 382         struct mgmt_rp_read_commands *rp;
 383         u16 num_commands, num_events;
 384         size_t rp_size;
 385         int i, err;
 386
 387         bt_dev_dbg(hdev, "sock %p", sk);
 388
 389         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 390                 num_commands = ARRAY_SIZE(mgmt_commands);
 391                 num_events = ARRAY_SIZE(mgmt_events);
 392         } else {
 393                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 394                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 395         }
 396
 397         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 398
 399         rp = kmalloc(rp_size, GFP_KERNEL);
 400         if (!rp)
 401                 return -ENOMEM;
 402
 403         rp->num_commands = cpu_to_le16(num_commands);
 404         rp->num_events = cpu_to_le16(num_events);
 405
 406         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 407                 __le16 *opcode = rp->opcodes;
 408
 409                 for (i = 0; i < num_commands; i++, opcode++)
 410                         put_unaligned_le16(mgmt_commands[i], opcode);
 411
 412                 for (i = 0; i < num_events; i++, opcode++)
 413                         put_unaligned_le16(mgmt_events[i], opcode);
 414         } else {
 415                 __le16 *opcode = rp->opcodes;
 416
 417                 for (i = 0; i < num_commands; i++, opcode++)
 418                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 419
 420                 for (i = 0; i < num_events; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 422         }
 423
 424         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 425                                 rp, rp_size);
 426         kfree(rp);
 427
 428         return err;
 429 }
 430
 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 432                            u16 data_len)
 433 {
 434         struct mgmt_rp_read_index_list *rp;
 435         struct hci_dev *d;
 436         size_t rp_len;
 437         u16 count;
 438         int err;
 439
 440         bt_dev_dbg(hdev, "sock %p", sk);
 441
 442         read_lock(&hci_dev_list_lock);
 443
 444         count = 0;
 445         list_for_each_entry(d, &hci_dev_list, list) {
 446                 if (d->dev_type == HCI_PRIMARY &&
 447                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 448                         count++;
 449         }
 450
 451         rp_len = sizeof(*rp) + (2 * count);
 452         rp = kmalloc(rp_len, GFP_ATOMIC);
 453         if (!rp) {
 454                 read_unlock(&hci_dev_list_lock);
 455                 return -ENOMEM;
 456         }
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 461                     hci_dev_test_flag(d, HCI_CONFIG) ||
 462                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 463                         continue;
 464
 465                 /* Devices marked as raw-only are neither configured
 466                  * nor unconfigured controllers.
 467                  */
 468                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 469                         continue;
 470
 471                 if (d->dev_type == HCI_PRIMARY &&
 472                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 473                         rp->index[count++] = cpu_to_le16(d->id);
 474                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 475                 }
 476         }
 477
 478         rp->num_controllers = cpu_to_le16(count);
 479         rp_len = sizeof(*rp) + (2 * count);
 480
 481         read_unlock(&hci_dev_list_lock);
 482
 483         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 484                                 0, rp, rp_len);
 485
 486         kfree(rp);
 487
 488         return err;
 489 }
 490
 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 492                                   void *data, u16 data_len)
 493 {
 494         struct mgmt_rp_read_unconf_index_list *rp;
 495         struct hci_dev *d;
 496         size_t rp_len;
 497         u16 count;
 498         int err;
 499
 500         bt_dev_dbg(hdev, "sock %p", sk);
 501
 502         read_lock(&hci_dev_list_lock);
 503
 504         count = 0;
 505         list_for_each_entry(d, &hci_dev_list, list) {
 506                 if (d->dev_type == HCI_PRIMARY &&
 507                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 508                         count++;
 509         }
 510
 511         rp_len = sizeof(*rp) + (2 * count);
 512         rp = kmalloc(rp_len, GFP_ATOMIC);
 513         if (!rp) {
 514                 read_unlock(&hci_dev_list_lock);
 515                 return -ENOMEM;
 516         }
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 521                     hci_dev_test_flag(d, HCI_CONFIG) ||
 522                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 523                         continue;
 524
 525                 /* Devices marked as raw-only are neither configured
 526                  * nor unconfigured controllers.
 527                  */
 528                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 529                         continue;
 530
 531                 if (d->dev_type == HCI_PRIMARY &&
 532                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 533                         rp->index[count++] = cpu_to_le16(d->id);
 534                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 535                 }
 536         }
 537
 538         rp->num_controllers = cpu_to_le16(count);
 539         rp_len = sizeof(*rp) + (2 * count);
 540
 541         read_unlock(&hci_dev_list_lock);
 542
 543         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 544                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 545
 546         kfree(rp);
 547
 548         return err;
 549 }
 550
 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 552                                void *data, u16 data_len)
 553 {
 554         struct mgmt_rp_read_ext_index_list *rp;
 555         struct hci_dev *d;
 556         u16 count;
 557         int err;
 558
 559         bt_dev_dbg(hdev, "sock %p", sk);
 560
 561         read_lock(&hci_dev_list_lock);
 562
 563         count = 0;
 564         list_for_each_entry(d, &hci_dev_list, list) {
 565                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 566                         count++;
 567         }
 568
 569         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 570         if (!rp) {
 571                 read_unlock(&hci_dev_list_lock);
 572                 return -ENOMEM;
 573         }
 574
 575         count = 0;
 576         list_for_each_entry(d, &hci_dev_list, list) {
 577                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 578                     hci_dev_test_flag(d, HCI_CONFIG) ||
 579                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 580                         continue;
 581
 582                 /* Devices marked as raw-only are neither configured
 583                  * nor unconfigured controllers.
 584                  */
 585                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 586                         continue;
 587
 588                 if (d->dev_type == HCI_PRIMARY) {
 589                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 590                                 rp->entry[count].type = 0x01;
 591                         else
 592                                 rp->entry[count].type = 0x00;
 593                 } else if (d->dev_type == HCI_AMP) {
 594                         rp->entry[count].type = 0x02;
 595                 } else {
 596                         continue;
 597                 }
 598
 599                 rp->entry[count].bus = d->bus;
 600                 rp->entry[count++].index = cpu_to_le16(d->id);
 601                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 602         }
 603
 604         rp->num_controllers = cpu_to_le16(count);
 605
 606         read_unlock(&hci_dev_list_lock);
 607
 608         /* If this command is called at least once, then all the
 609          * default index and unconfigured index events are disabled
 610          * and from now on only extended index events are used.
 611          */
 612         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 613         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 614         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 615
 616         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 617                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 618                                 struct_size(rp, entry, count));
 619
 620         kfree(rp);
 621
 622         return err;
 623 }
 624
 625 static bool is_configured(struct hci_dev *hdev)
 626 {
 627         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 628             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 629                 return false;
 630
 631         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 632              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 633             !bacmp(&hdev->public_addr, BDADDR_ANY))
 634                 return false;
 635
 636         return true;
 637 }
 638
 639 static __le32 get_missing_options(struct hci_dev *hdev)
 640 {
 641         u32 options = 0;
 642
 643         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 644             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 648              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 649             !bacmp(&hdev->public_addr, BDADDR_ANY))
 650                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 651
 652         return cpu_to_le32(options);
 653 }
 654
 655 static int new_options(struct hci_dev *hdev, struct sock *skip)
 656 {
 657         __le32 options = get_missing_options(hdev);
 658
 659         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 660                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 661 }
 662
 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 664 {
 665         __le32 options = get_missing_options(hdev);
 666
 667         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 668                                  sizeof(options));
 669 }
 670
 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 672                             void *data, u16 data_len)
 673 {
 674         struct mgmt_rp_read_config_info rp;
 675         u32 options = 0;
 676
 677         bt_dev_dbg(hdev, "sock %p", sk);
 678
 679         hci_dev_lock(hdev);
 680
 681         memset(&rp, 0, sizeof(rp));
 682         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 683
 684         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 685                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 686
 687         if (hdev->set_bdaddr)
 688                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 689
 690         rp.supported_options = cpu_to_le32(options);
 691         rp.missing_options = get_missing_options(hdev);
 692
 693         hci_dev_unlock(hdev);
 694
 695         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 696                                  &rp, sizeof(rp));
 697 }
 698
 699 static u32 get_supported_phys(struct hci_dev *hdev)
 700 {
 701         u32 supported_phys = 0;
 702
 703         if (lmp_bredr_capable(hdev)) {
 704                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 705
 706                 if (hdev->features[0][0] & LMP_3SLOT)
 707                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_5SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 711
 712                 if (lmp_edr_2m_capable(hdev)) {
 713                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 714
 715                         if (lmp_edr_3slot_capable(hdev))
 716                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 717
 718                         if (lmp_edr_5slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 720
 721                         if (lmp_edr_3m_capable(hdev)) {
 722                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 723
 724                                 if (lmp_edr_3slot_capable(hdev))
 725                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 726
 727                                 if (lmp_edr_5slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 729                         }
 730                 }
 731         }
 732
 733         if (lmp_le_capable(hdev)) {
 734                 supported_phys |= MGMT_PHY_LE_1M_TX;
 735                 supported_phys |= MGMT_PHY_LE_1M_RX;
 736
 737                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 738                         supported_phys |= MGMT_PHY_LE_2M_TX;
 739                         supported_phys |= MGMT_PHY_LE_2M_RX;
 740                 }
 741
 742                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 743                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 744                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 745                 }
 746         }
 747
 748         return supported_phys;
 749 }
 750
 751 static u32 get_selected_phys(struct hci_dev *hdev)
 752 {
 753         u32 selected_phys = 0;
 754
 755         if (lmp_bredr_capable(hdev)) {
 756                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 757
 758                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 759                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 762                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 763
 764                 if (lmp_edr_2m_capable(hdev)) {
 765                         if (!(hdev->pkt_type & HCI_2DH1))
 766                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 767
 768                         if (lmp_edr_3slot_capable(hdev) &&
 769                             !(hdev->pkt_type & HCI_2DH3))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 771
 772                         if (lmp_edr_5slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH5))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 775
 776                         if (lmp_edr_3m_capable(hdev)) {
 777                                 if (!(hdev->pkt_type & HCI_3DH1))
 778                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 779
 780                                 if (lmp_edr_3slot_capable(hdev) &&
 781                                     !(hdev->pkt_type & HCI_3DH3))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 783
 784                                 if (lmp_edr_5slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH5))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 787                         }
 788                 }
 789         }
 790
 791         if (lmp_le_capable(hdev)) {
 792                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 793                         selected_phys |= MGMT_PHY_LE_1M_TX;
 794
 795                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_RX;
 797
 798                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 799                         selected_phys |= MGMT_PHY_LE_2M_TX;
 800
 801                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_RX;
 803
 804                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 805                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 806
 807                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 809         }
 810
 811         return selected_phys;
 812 }
 813
 814 static u32 get_configurable_phys(struct hci_dev *hdev)
 815 {
 816         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 817                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 818 }
 819
 820 static u32 get_supported_settings(struct hci_dev *hdev)
 821 {
 822         u32 settings = 0;
 823
 824         settings |= MGMT_SETTING_POWERED;
 825         settings |= MGMT_SETTING_BONDABLE;
 826         settings |= MGMT_SETTING_DEBUG_KEYS;
 827         settings |= MGMT_SETTING_CONNECTABLE;
 828         settings |= MGMT_SETTING_DISCOVERABLE;
 829
 830         if (lmp_bredr_capable(hdev)) {
 831                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 832                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 833                 settings |= MGMT_SETTING_BREDR;
 834                 settings |= MGMT_SETTING_LINK_SECURITY;
 835
 836                 if (lmp_ssp_capable(hdev)) {
 837                         settings |= MGMT_SETTING_SSP;
 838                         if (IS_ENABLED(CONFIG_BT_HS))
 839                                 settings |= MGMT_SETTING_HS;
 840                 }
 841
 842                 if (lmp_sc_capable(hdev))
 843                         settings |= MGMT_SETTING_SECURE_CONN;
 844
 845                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 846                              &hdev->quirks))
 847                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 848         }
 849
 850         if (lmp_le_capable(hdev)) {
 851                 settings |= MGMT_SETTING_LE;
 852                 settings |= MGMT_SETTING_SECURE_CONN;
 853                 settings |= MGMT_SETTING_PRIVACY;
 854                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 855                 settings |= MGMT_SETTING_ADVERTISING;
 856         }
 857
 858         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 859             hdev->set_bdaddr)
 860                 settings |= MGMT_SETTING_CONFIGURATION;
 861
 862         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 863
 864         return settings;
 865 }
 866
 867 static u32 get_current_settings(struct hci_dev *hdev)
 868 {
 869         u32 settings = 0;
 870
 871         if (hdev_is_powered(hdev))
 872                 settings |= MGMT_SETTING_POWERED;
 873
 874         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 875                 settings |= MGMT_SETTING_CONNECTABLE;
 876
 877         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 878                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 879
 880         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 881                 settings |= MGMT_SETTING_DISCOVERABLE;
 882
 883         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 884                 settings |= MGMT_SETTING_BONDABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 887                 settings |= MGMT_SETTING_BREDR;
 888
 889         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 890                 settings |= MGMT_SETTING_LE;
 891
 892         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 893                 settings |= MGMT_SETTING_LINK_SECURITY;
 894
 895         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 896                 settings |= MGMT_SETTING_SSP;
 897
 898         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 899                 settings |= MGMT_SETTING_HS;
 900
 901         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 902                 settings |= MGMT_SETTING_ADVERTISING;
 903
 904         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 905                 settings |= MGMT_SETTING_SECURE_CONN;
 906
 907         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 908                 settings |= MGMT_SETTING_DEBUG_KEYS;
 909
 910         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 911                 settings |= MGMT_SETTING_PRIVACY;
 912
 913         /* The current setting for static address has two purposes. The
 914          * first is to indicate if the static address will be used and
 915          * the second is to indicate if it is actually set.
 916          *
 917          * This means if the static address is not configured, this flag
 918          * will never be set. If the address is configured, then if the
 919          * address is actually used decides if the flag is set or not.
 920          *
 921          * For single mode LE only controllers and dual-mode controllers
 922          * with BR/EDR disabled, the existence of the static address will
 923          * be evaluated.
 924          */
 925         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 926             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 927             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 928                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 929                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 930         }
 931
 932         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 933                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 934
 935         return settings;
 936 }
 937
 938 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 939 {
 940         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 941 }
 942
 943 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 944 {
 945         struct mgmt_pending_cmd *cmd;
 946
 947         /* If there's a pending mgmt command the flags will not yet have
 948          * their final values, so check for this first.
 949          */
 950         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 951         if (cmd) {
 952                 struct mgmt_mode *cp = cmd->param;
 953                 if (cp->val == 0x01)
 954                         return LE_AD_GENERAL;
 955                 else if (cp->val == 0x02)
 956                         return LE_AD_LIMITED;
 957         } else {
 958                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 959                         return LE_AD_LIMITED;
 960                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 961                         return LE_AD_GENERAL;
 962         }
 963
 964         return 0;
 965 }
 966
 967 bool mgmt_get_connectable(struct hci_dev *hdev)
 968 {
 969         struct mgmt_pending_cmd *cmd;
 970
 971         /* If there's a pending mgmt command the flag will not yet have
 972          * it's final value, so check for this first.
 973          */
 974         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 975         if (cmd) {
 976                 struct mgmt_mode *cp = cmd->param;
 977
 978                 return cp->val;
 979         }
 980
 981         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 982 }
 983
 984 static int service_cache_sync(struct hci_dev *hdev, void *data)
 985 {
 986         hci_update_eir_sync(hdev);
 987         hci_update_class_sync(hdev);
 988
 989         return 0;
 990 }
 991
 992 static void service_cache_off(struct work_struct *work)
 993 {
 994         struct hci_dev *hdev = container_of(work, struct hci_dev,
 995                                             service_cache.work);
 996
 997         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 998                 return;
 999
1000         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1001 }
1002
1003 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1004 {
1005         /* The generation of a new RPA and programming it into the
1006          * controller happens in the hci_req_enable_advertising()
1007          * function.
1008          */
1009         if (ext_adv_capable(hdev))
1010                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1011         else
1012                 return hci_enable_advertising_sync(hdev);
1013 }
1014
1015 static void rpa_expired(struct work_struct *work)
1016 {
1017         struct hci_dev *hdev = container_of(work, struct hci_dev,
1018                                             rpa_expired.work);
1019
1020         bt_dev_dbg(hdev, "");
1021
1022         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1023
1024         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1025                 return;
1026
1027         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1028 }
1029
1030 static void discov_off(struct work_struct *work)
1031 {
1032         struct hci_dev *hdev = container_of(work, struct hci_dev,
1033                                             discov_off.work);
1034
1035         bt_dev_dbg(hdev, "");
1036
1037         hci_dev_lock(hdev);
1038
1039         /* When discoverable timeout triggers, then just make sure
1040          * the limited discoverable flag is cleared. Even in the case
1041          * of a timeout triggered from general discoverable, it is
1042          * safe to unconditionally clear the flag.
1043          */
1044         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1045         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1046         hdev->discov_timeout = 0;
1047
1048         hci_update_discoverable(hdev);
1049
1050         mgmt_new_settings(hdev);
1051
1052         hci_dev_unlock(hdev);
1053 }
1054
1055 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1056
1057 static void mesh_send_complete(struct hci_dev *hdev,
1058                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1059 {
1060         u8 handle = mesh_tx->handle;
1061
1062         if (!silent)
1063                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1064                            sizeof(handle), NULL);
1065
1066         mgmt_mesh_remove(mesh_tx);
1067 }
1068
1069 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1070 {
1071         struct mgmt_mesh_tx *mesh_tx;
1072
1073         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1074         hci_disable_advertising_sync(hdev);
1075         mesh_tx = mgmt_mesh_next(hdev, NULL);
1076
1077         if (mesh_tx)
1078                 mesh_send_complete(hdev, mesh_tx, false);
1079
1080         return 0;
1081 }
1082
1083 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1084 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1085 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1086 {
1087         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1088
1089         if (!mesh_tx)
1090                 return;
1091
1092         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1093                                  mesh_send_start_complete);
1094
1095         if (err < 0)
1096                 mesh_send_complete(hdev, mesh_tx, false);
1097         else
1098                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1099 }
1100
1101 static void mesh_send_done(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             mesh_send_done.work);
1105
1106         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1107                 return;
1108
1109         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1110 }
1111
1112 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1113 {
1114         if (hci_dev_test_flag(hdev, HCI_MGMT))
1115                 return;
1116
1117         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1118
1119         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1120         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1121         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1122         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1123
1124         /* Non-mgmt controlled devices get this bit set
1125          * implicitly so that pairing works for them, however
1126          * for mgmt we require user-space to explicitly enable
1127          * it
1128          */
1129         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1130
1131         hci_dev_set_flag(hdev, HCI_MGMT);
1132 }
1133
1134 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1135                                 void *data, u16 data_len)
1136 {
1137         struct mgmt_rp_read_info rp;
1138
1139         bt_dev_dbg(hdev, "sock %p", sk);
1140
1141         hci_dev_lock(hdev);
1142
1143         memset(&rp, 0, sizeof(rp));
1144
1145         bacpy(&rp.bdaddr, &hdev->bdaddr);
1146
1147         rp.version = hdev->hci_ver;
1148         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1149
1150         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1151         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1152
1153         memcpy(rp.dev_class, hdev->dev_class, 3);
1154
1155         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1156         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1157
1158         hci_dev_unlock(hdev);
1159
1160         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1161                                  sizeof(rp));
1162 }
1163
1164 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1165 {
1166         u16 eir_len = 0;
1167         size_t name_len;
1168
1169         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1170                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1171                                           hdev->dev_class, 3);
1172
1173         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1174                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1175                                           hdev->appearance);
1176
1177         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1178         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1179                                   hdev->dev_name, name_len);
1180
1181         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1182         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1183                                   hdev->short_name, name_len);
1184
1185         return eir_len;
1186 }
1187
1188 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1189                                     void *data, u16 data_len)
1190 {
1191         char buf[512];
1192         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1193         u16 eir_len;
1194
1195         bt_dev_dbg(hdev, "sock %p", sk);
1196
1197         memset(&buf, 0, sizeof(buf));
1198
1199         hci_dev_lock(hdev);
1200
1201         bacpy(&rp->bdaddr, &hdev->bdaddr);
1202
1203         rp->version = hdev->hci_ver;
1204         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1205
1206         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1207         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1208
1209
1210         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1211         rp->eir_len = cpu_to_le16(eir_len);
1212
1213         hci_dev_unlock(hdev);
1214
1215         /* If this command is called at least once, then the events
1216          * for class of device and local name changes are disabled
1217          * and only the new extended controller information event
1218          * is used.
1219          */
1220         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1221         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1222         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1223
1224         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1225                                  sizeof(*rp) + eir_len);
1226 }
1227
1228 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1229 {
1230         char buf[512];
1231         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1232         u16 eir_len;
1233
1234         memset(buf, 0, sizeof(buf));
1235
1236         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1237         ev->eir_len = cpu_to_le16(eir_len);
1238
1239         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1240                                   sizeof(*ev) + eir_len,
1241                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1242 }
1243
1244 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1245 {
1246         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1247
1248         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1249                                  sizeof(settings));
1250 }
1251
1252 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1253 {
1254         struct mgmt_ev_advertising_added ev;
1255
1256         ev.instance = instance;
1257
1258         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1259 }
1260
1261 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1262                               u8 instance)
1263 {
1264         struct mgmt_ev_advertising_removed ev;
1265
1266         ev.instance = instance;
1267
1268         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1269 }
1270
1271 static void cancel_adv_timeout(struct hci_dev *hdev)
1272 {
1273         if (hdev->adv_instance_timeout) {
1274                 hdev->adv_instance_timeout = 0;
1275                 cancel_delayed_work(&hdev->adv_instance_expire);
1276         }
1277 }
1278
1279 /* This function requires the caller holds hdev->lock */
1280 static void restart_le_actions(struct hci_dev *hdev)
1281 {
1282         struct hci_conn_params *p;
1283
1284         list_for_each_entry(p, &hdev->le_conn_params, list) {
1285                 /* Needed for AUTO_OFF case where might not "really"
1286                  * have been powered off.
1287                  */
1288                 list_del_init(&p->action);
1289
1290                 switch (p->auto_connect) {
1291                 case HCI_AUTO_CONN_DIRECT:
1292                 case HCI_AUTO_CONN_ALWAYS:
1293                         list_add(&p->action, &hdev->pend_le_conns);
1294                         break;
1295                 case HCI_AUTO_CONN_REPORT:
1296                         list_add(&p->action, &hdev->pend_le_reports);
1297                         break;
1298                 default:
1299                         break;
1300                 }
1301         }
1302 }
1303
1304 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1305 {
1306         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1307
1308         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1309                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1310 }
1311
1312 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1313 {
1314         struct mgmt_pending_cmd *cmd = data;
1315         struct mgmt_mode *cp;
1316
1317         /* Make sure cmd still outstanding. */
1318         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1319                 return;
1320
1321         cp = cmd->param;
1322
1323         bt_dev_dbg(hdev, "err %d", err);
1324
1325         if (!err) {
1326                 if (cp->val) {
1327                         hci_dev_lock(hdev);
1328                         restart_le_actions(hdev);
1329                         hci_update_passive_scan(hdev);
1330                         hci_dev_unlock(hdev);
1331                 }
1332
1333                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1334
1335                 /* Only call new_setting for power on as power off is deferred
1336                  * to hdev->power_off work which does call hci_dev_do_close.
1337                  */
1338                 if (cp->val)
1339                         new_settings(hdev, cmd->sk);
1340         } else {
1341                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1342                                 mgmt_status(err));
1343         }
1344
1345         mgmt_pending_remove(cmd);
1346 }
1347
1348 static int set_powered_sync(struct hci_dev *hdev, void *data)
1349 {
1350         struct mgmt_pending_cmd *cmd = data;
1351         struct mgmt_mode *cp = cmd->param;
1352
1353         BT_DBG("%s", hdev->name);
1354
1355         return hci_set_powered_sync(hdev, cp->val);
1356 }
1357
1358 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1359                        u16 len)
1360 {
1361         struct mgmt_mode *cp = data;
1362         struct mgmt_pending_cmd *cmd;
1363         int err;
1364
1365         bt_dev_dbg(hdev, "sock %p", sk);
1366
1367         if (cp->val != 0x00 && cp->val != 0x01)
1368                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1369                                        MGMT_STATUS_INVALID_PARAMS);
1370
1371         hci_dev_lock(hdev);
1372
1373         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1374                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1375                                       MGMT_STATUS_BUSY);
1376                 goto failed;
1377         }
1378
1379         if (!!cp->val == hdev_is_powered(hdev)) {
1380                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1381                 goto failed;
1382         }
1383
1384         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1385         if (!cmd) {
1386                 err = -ENOMEM;
1387                 goto failed;
1388         }
1389
1390         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1391                                  mgmt_set_powered_complete);
1392
1393         if (err < 0)
1394                 mgmt_pending_remove(cmd);
1395
1396 failed:
1397         hci_dev_unlock(hdev);
1398         return err;
1399 }
1400
1401 int mgmt_new_settings(struct hci_dev *hdev)
1402 {
1403         return new_settings(hdev, NULL);
1404 }
1405
1406 struct cmd_lookup {
1407         struct sock *sk;
1408         struct hci_dev *hdev;
1409         u8 mgmt_status;
1410 };
1411
1412 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1413 {
1414         struct cmd_lookup *match = data;
1415
1416         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1417
1418         list_del(&cmd->list);
1419
1420         if (match->sk == NULL) {
1421                 match->sk = cmd->sk;
1422                 sock_hold(match->sk);
1423         }
1424
1425         mgmt_pending_free(cmd);
1426 }
1427
1428 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1429 {
1430         u8 *status = data;
1431
1432         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1433         mgmt_pending_remove(cmd);
1434 }
1435
1436 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1437 {
1438         if (cmd->cmd_complete) {
1439                 u8 *status = data;
1440
1441                 cmd->cmd_complete(cmd, *status);
1442                 mgmt_pending_remove(cmd);
1443
1444                 return;
1445         }
1446
1447         cmd_status_rsp(cmd, data);
1448 }
1449
1450 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1451 {
1452         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1453                                  cmd->param, cmd->param_len);
1454 }
1455
1456 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1457 {
1458         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1459                                  cmd->param, sizeof(struct mgmt_addr_info));
1460 }
1461
1462 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1463 {
1464         if (!lmp_bredr_capable(hdev))
1465                 return MGMT_STATUS_NOT_SUPPORTED;
1466         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1467                 return MGMT_STATUS_REJECTED;
1468         else
1469                 return MGMT_STATUS_SUCCESS;
1470 }
1471
1472 static u8 mgmt_le_support(struct hci_dev *hdev)
1473 {
1474         if (!lmp_le_capable(hdev))
1475                 return MGMT_STATUS_NOT_SUPPORTED;
1476         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1477                 return MGMT_STATUS_REJECTED;
1478         else
1479                 return MGMT_STATUS_SUCCESS;
1480 }
1481
1482 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1483                                            int err)
1484 {
1485         struct mgmt_pending_cmd *cmd = data;
1486
1487         bt_dev_dbg(hdev, "err %d", err);
1488
1489         /* Make sure cmd still outstanding. */
1490         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1491                 return;
1492
1493         hci_dev_lock(hdev);
1494
1495         if (err) {
1496                 u8 mgmt_err = mgmt_status(err);
1497                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1498                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499                 goto done;
1500         }
1501
1502         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1503             hdev->discov_timeout > 0) {
1504                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1505                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1506         }
1507
1508         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1509         new_settings(hdev, cmd->sk);
1510
1511 done:
1512         mgmt_pending_remove(cmd);
1513         hci_dev_unlock(hdev);
1514 }
1515
1516 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1517 {
1518         BT_DBG("%s", hdev->name);
1519
1520         return hci_update_discoverable_sync(hdev);
1521 }
1522
1523 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1524                             u16 len)
1525 {
1526         struct mgmt_cp_set_discoverable *cp = data;
1527         struct mgmt_pending_cmd *cmd;
1528         u16 timeout;
1529         int err;
1530
1531         bt_dev_dbg(hdev, "sock %p", sk);
1532
1533         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1534             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1535                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1536                                        MGMT_STATUS_REJECTED);
1537
1538         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1539                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1540                                        MGMT_STATUS_INVALID_PARAMS);
1541
1542         timeout = __le16_to_cpu(cp->timeout);
1543
1544         /* Disabling discoverable requires that no timeout is set,
1545          * and enabling limited discoverable requires a timeout.
1546          */
1547         if ((cp->val == 0x00 && timeout > 0) ||
1548             (cp->val == 0x02 && timeout == 0))
1549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1550                                        MGMT_STATUS_INVALID_PARAMS);
1551
1552         hci_dev_lock(hdev);
1553
1554         if (!hdev_is_powered(hdev) && timeout > 0) {
1555                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1556                                       MGMT_STATUS_NOT_POWERED);
1557                 goto failed;
1558         }
1559
1560         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1561             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1562                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1563                                       MGMT_STATUS_BUSY);
1564                 goto failed;
1565         }
1566
1567         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1569                                       MGMT_STATUS_REJECTED);
1570                 goto failed;
1571         }
1572
1573         if (hdev->advertising_paused) {
1574                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1575                                       MGMT_STATUS_BUSY);
1576                 goto failed;
1577         }
1578
1579         if (!hdev_is_powered(hdev)) {
1580                 bool changed = false;
1581
1582                 /* Setting limited discoverable when powered off is
1583                  * not a valid operation since it requires a timeout
1584                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1585                  */
1586                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1587                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1588                         changed = true;
1589                 }
1590
1591                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1592                 if (err < 0)
1593                         goto failed;
1594
1595                 if (changed)
1596                         err = new_settings(hdev, sk);
1597
1598                 goto failed;
1599         }
1600
1601         /* If the current mode is the same, then just update the timeout
1602          * value with the new value. And if only the timeout gets updated,
1603          * then no need for any HCI transactions.
1604          */
1605         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1606             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1607                                                    HCI_LIMITED_DISCOVERABLE)) {
1608                 cancel_delayed_work(&hdev->discov_off);
1609                 hdev->discov_timeout = timeout;
1610
1611                 if (cp->val && hdev->discov_timeout > 0) {
1612                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1613                         queue_delayed_work(hdev->req_workqueue,
1614                                            &hdev->discov_off, to);
1615                 }
1616
1617                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1618                 goto failed;
1619         }
1620
1621         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1622         if (!cmd) {
1623                 err = -ENOMEM;
1624                 goto failed;
1625         }
1626
1627         /* Cancel any potential discoverable timeout that might be
1628          * still active and store new timeout value. The arming of
1629          * the timeout happens in the complete handler.
1630          */
1631         cancel_delayed_work(&hdev->discov_off);
1632         hdev->discov_timeout = timeout;
1633
1634         if (cp->val)
1635                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1636         else
1637                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1638
1639         /* Limited discoverable mode */
1640         if (cp->val == 0x02)
1641                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1642         else
1643                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1644
1645         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1646                                  mgmt_set_discoverable_complete);
1647
1648         if (err < 0)
1649                 mgmt_pending_remove(cmd);
1650
1651 failed:
1652         hci_dev_unlock(hdev);
1653         return err;
1654 }
1655
1656 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1657                                           int err)
1658 {
1659         struct mgmt_pending_cmd *cmd = data;
1660
1661         bt_dev_dbg(hdev, "err %d", err);
1662
1663         /* Make sure cmd still outstanding. */
1664         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1665                 return;
1666
1667         hci_dev_lock(hdev);
1668
1669         if (err) {
1670                 u8 mgmt_err = mgmt_status(err);
1671                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1672                 goto done;
1673         }
1674
1675         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1676         new_settings(hdev, cmd->sk);
1677
1678 done:
1679         if (cmd)
1680                 mgmt_pending_remove(cmd);
1681
1682         hci_dev_unlock(hdev);
1683 }
1684
1685 static int set_connectable_update_settings(struct hci_dev *hdev,
1686                                            struct sock *sk, u8 val)
1687 {
1688         bool changed = false;
1689         int err;
1690
1691         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1692                 changed = true;
1693
1694         if (val) {
1695                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1696         } else {
1697                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1698                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1699         }
1700
1701         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1702         if (err < 0)
1703                 return err;
1704
1705         if (changed) {
1706                 hci_update_scan(hdev);
1707                 hci_update_passive_scan(hdev);
1708                 return new_settings(hdev, sk);
1709         }
1710
1711         return 0;
1712 }
1713
1714 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1715 {
1716         BT_DBG("%s", hdev->name);
1717
1718         return hci_update_connectable_sync(hdev);
1719 }
1720
1721 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1722                            u16 len)
1723 {
1724         struct mgmt_mode *cp = data;
1725         struct mgmt_pending_cmd *cmd;
1726         int err;
1727
1728         bt_dev_dbg(hdev, "sock %p", sk);
1729
1730         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1731             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1732                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1733                                        MGMT_STATUS_REJECTED);
1734
1735         if (cp->val != 0x00 && cp->val != 0x01)
1736                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1737                                        MGMT_STATUS_INVALID_PARAMS);
1738
1739         hci_dev_lock(hdev);
1740
1741         if (!hdev_is_powered(hdev)) {
1742                 err = set_connectable_update_settings(hdev, sk, cp->val);
1743                 goto failed;
1744         }
1745
1746         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1747             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1748                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1749                                       MGMT_STATUS_BUSY);
1750                 goto failed;
1751         }
1752
1753         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1754         if (!cmd) {
1755                 err = -ENOMEM;
1756                 goto failed;
1757         }
1758
1759         if (cp->val) {
1760                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1761         } else {
1762                 if (hdev->discov_timeout > 0)
1763                         cancel_delayed_work(&hdev->discov_off);
1764
1765                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1766                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1767                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1768         }
1769
1770         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1771                                  mgmt_set_connectable_complete);
1772
1773         if (err < 0)
1774                 mgmt_pending_remove(cmd);
1775
1776 failed:
1777         hci_dev_unlock(hdev);
1778         return err;
1779 }
1780
1781 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1782                         u16 len)
1783 {
1784         struct mgmt_mode *cp = data;
1785         bool changed;
1786         int err;
1787
1788         bt_dev_dbg(hdev, "sock %p", sk);
1789
1790         if (cp->val != 0x00 && cp->val != 0x01)
1791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1792                                        MGMT_STATUS_INVALID_PARAMS);
1793
1794         hci_dev_lock(hdev);
1795
1796         if (cp->val)
1797                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1798         else
1799                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1800
1801         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1802         if (err < 0)
1803                 goto unlock;
1804
1805         if (changed) {
1806                 /* In limited privacy mode the change of bondable mode
1807                  * may affect the local advertising address.
1808                  */
1809                 hci_update_discoverable(hdev);
1810
1811                 err = new_settings(hdev, sk);
1812         }
1813
1814 unlock:
1815         hci_dev_unlock(hdev);
1816         return err;
1817 }
1818
1819 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1820                              u16 len)
1821 {
1822         struct mgmt_mode *cp = data;
1823         struct mgmt_pending_cmd *cmd;
1824         u8 val, status;
1825         int err;
1826
1827         bt_dev_dbg(hdev, "sock %p", sk);
1828
1829         status = mgmt_bredr_support(hdev);
1830         if (status)
1831                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1832                                        status);
1833
1834         if (cp->val != 0x00 && cp->val != 0x01)
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1836                                        MGMT_STATUS_INVALID_PARAMS);
1837
1838         hci_dev_lock(hdev);
1839
1840         if (!hdev_is_powered(hdev)) {
1841                 bool changed = false;
1842
1843                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1844                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1845                         changed = true;
1846                 }
1847
1848                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1849                 if (err < 0)
1850                         goto failed;
1851
1852                 if (changed)
1853                         err = new_settings(hdev, sk);
1854
1855                 goto failed;
1856         }
1857
1858         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1859                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1860                                       MGMT_STATUS_BUSY);
1861                 goto failed;
1862         }
1863
1864         val = !!cp->val;
1865
1866         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1867                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1868                 goto failed;
1869         }
1870
1871         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1872         if (!cmd) {
1873                 err = -ENOMEM;
1874                 goto failed;
1875         }
1876
1877         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1878         if (err < 0) {
1879                 mgmt_pending_remove(cmd);
1880                 goto failed;
1881         }
1882
1883 failed:
1884         hci_dev_unlock(hdev);
1885         return err;
1886 }
1887
1888 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1889 {
1890         struct cmd_lookup match = { NULL, hdev };
1891         struct mgmt_pending_cmd *cmd = data;
1892         struct mgmt_mode *cp = cmd->param;
1893         u8 enable = cp->val;
1894         bool changed;
1895
1896         /* Make sure cmd still outstanding. */
1897         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1898                 return;
1899
1900         if (err) {
1901                 u8 mgmt_err = mgmt_status(err);
1902
1903                 if (enable && hci_dev_test_and_clear_flag(hdev,
1904                                                           HCI_SSP_ENABLED)) {
1905                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1906                         new_settings(hdev, NULL);
1907                 }
1908
1909                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1910                                      &mgmt_err);
1911                 return;
1912         }
1913
1914         if (enable) {
1915                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1916         } else {
1917                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1918
1919                 if (!changed)
1920                         changed = hci_dev_test_and_clear_flag(hdev,
1921                                                               HCI_HS_ENABLED);
1922                 else
1923                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1924         }
1925
1926         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1927
1928         if (changed)
1929                 new_settings(hdev, match.sk);
1930
1931         if (match.sk)
1932                 sock_put(match.sk);
1933
1934         hci_update_eir_sync(hdev);
1935 }
1936
1937 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1938 {
1939         struct mgmt_pending_cmd *cmd = data;
1940         struct mgmt_mode *cp = cmd->param;
1941         bool changed = false;
1942         int err;
1943
1944         if (cp->val)
1945                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1946
1947         err = hci_write_ssp_mode_sync(hdev, cp->val);
1948
1949         if (!err && changed)
1950                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1951
1952         return err;
1953 }
1954
1955 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1956 {
1957         struct mgmt_mode *cp = data;
1958         struct mgmt_pending_cmd *cmd;
1959         u8 status;
1960         int err;
1961
1962         bt_dev_dbg(hdev, "sock %p", sk);
1963
1964         status = mgmt_bredr_support(hdev);
1965         if (status)
1966                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1967
1968         if (!lmp_ssp_capable(hdev))
1969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1970                                        MGMT_STATUS_NOT_SUPPORTED);
1971
1972         if (cp->val != 0x00 && cp->val != 0x01)
1973                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1974                                        MGMT_STATUS_INVALID_PARAMS);
1975
1976         hci_dev_lock(hdev);
1977
1978         if (!hdev_is_powered(hdev)) {
1979                 bool changed;
1980
1981                 if (cp->val) {
1982                         changed = !hci_dev_test_and_set_flag(hdev,
1983                                                              HCI_SSP_ENABLED);
1984                 } else {
1985                         changed = hci_dev_test_and_clear_flag(hdev,
1986                                                               HCI_SSP_ENABLED);
1987                         if (!changed)
1988                                 changed = hci_dev_test_and_clear_flag(hdev,
1989                                                                       HCI_HS_ENABLED);
1990                         else
1991                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1992                 }
1993
1994                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1995                 if (err < 0)
1996                         goto failed;
1997
1998                 if (changed)
1999                         err = new_settings(hdev, sk);
2000
2001                 goto failed;
2002         }
2003
2004         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2005                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2006                                       MGMT_STATUS_BUSY);
2007                 goto failed;
2008         }
2009
2010         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2011                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2012                 goto failed;
2013         }
2014
2015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2016         if (!cmd)
2017                 err = -ENOMEM;
2018         else
2019                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2020                                          set_ssp_complete);
2021
2022         if (err < 0) {
2023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2024                                       MGMT_STATUS_FAILED);
2025
2026                 if (cmd)
2027                         mgmt_pending_remove(cmd);
2028         }
2029
2030 failed:
2031         hci_dev_unlock(hdev);
2032         return err;
2033 }
2034
2035 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2036 {
2037         struct mgmt_mode *cp = data;
2038         bool changed;
2039         u8 status;
2040         int err;
2041
2042         bt_dev_dbg(hdev, "sock %p", sk);
2043
2044         if (!IS_ENABLED(CONFIG_BT_HS))
2045                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2046                                        MGMT_STATUS_NOT_SUPPORTED);
2047
2048         status = mgmt_bredr_support(hdev);
2049         if (status)
2050                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2051
2052         if (!lmp_ssp_capable(hdev))
2053                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2054                                        MGMT_STATUS_NOT_SUPPORTED);
2055
2056         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2057                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2058                                        MGMT_STATUS_REJECTED);
2059
2060         if (cp->val != 0x00 && cp->val != 0x01)
2061                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2062                                        MGMT_STATUS_INVALID_PARAMS);
2063
2064         hci_dev_lock(hdev);
2065
2066         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2067                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2068                                       MGMT_STATUS_BUSY);
2069                 goto unlock;
2070         }
2071
2072         if (cp->val) {
2073                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2074         } else {
2075                 if (hdev_is_powered(hdev)) {
2076                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2077                                               MGMT_STATUS_REJECTED);
2078                         goto unlock;
2079                 }
2080
2081                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2082         }
2083
2084         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2085         if (err < 0)
2086                 goto unlock;
2087
2088         if (changed)
2089                 err = new_settings(hdev, sk);
2090
2091 unlock:
2092         hci_dev_unlock(hdev);
2093         return err;
2094 }
2095
2096 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2097 {
2098         struct cmd_lookup match = { NULL, hdev };
2099         u8 status = mgmt_status(err);
2100
2101         bt_dev_dbg(hdev, "err %d", err);
2102
2103         if (status) {
2104                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2105                                                         &status);
2106                 return;
2107         }
2108
2109         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2110
2111         new_settings(hdev, match.sk);
2112
2113         if (match.sk)
2114                 sock_put(match.sk);
2115 }
2116
2117 static int set_le_sync(struct hci_dev *hdev, void *data)
2118 {
2119         struct mgmt_pending_cmd *cmd = data;
2120         struct mgmt_mode *cp = cmd->param;
2121         u8 val = !!cp->val;
2122         int err;
2123
2124         if (!val) {
2125                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2126
2127                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2128                         hci_disable_advertising_sync(hdev);
2129
2130                 if (ext_adv_capable(hdev))
2131                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2132         } else {
2133                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2134         }
2135
2136         err = hci_write_le_host_supported_sync(hdev, val, 0);
2137
2138         /* Make sure the controller has a good default for
2139          * advertising data. Restrict the update to when LE
2140          * has actually been enabled. During power on, the
2141          * update in powered_update_hci will take care of it.
2142          */
2143         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2144                 if (ext_adv_capable(hdev)) {
2145                         int status;
2146
2147                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2148                         if (!status)
2149                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2150                 } else {
2151                         hci_update_adv_data_sync(hdev, 0x00);
2152                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2153                 }
2154
2155                 hci_update_passive_scan(hdev);
2156         }
2157
2158         return err;
2159 }
2160
2161 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2162 {
2163         struct mgmt_pending_cmd *cmd = data;
2164         u8 status = mgmt_status(err);
2165         struct sock *sk = cmd->sk;
2166
2167         if (status) {
2168                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2169                                      cmd_status_rsp, &status);
2170                 return;
2171         }
2172
2173         mgmt_pending_remove(cmd);
2174         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2175 }
2176
2177 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2178 {
2179         struct mgmt_pending_cmd *cmd = data;
2180         struct mgmt_cp_set_mesh *cp = cmd->param;
2181         size_t len = cmd->param_len;
2182
2183         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2184
2185         if (cp->enable)
2186                 hci_dev_set_flag(hdev, HCI_MESH);
2187         else
2188                 hci_dev_clear_flag(hdev, HCI_MESH);
2189
2190         len -= sizeof(*cp);
2191
2192         /* If filters don't fit, forward all adv pkts */
2193         if (len <= sizeof(hdev->mesh_ad_types))
2194                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2195
2196         hci_update_passive_scan_sync(hdev);
2197         return 0;
2198 }
2199
2200 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2201 {
2202         struct mgmt_cp_set_mesh *cp = data;
2203         struct mgmt_pending_cmd *cmd;
2204         int err = 0;
2205
2206         bt_dev_dbg(hdev, "sock %p", sk);
2207
2208         if (!lmp_le_capable(hdev) ||
2209             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2210                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2211                                        MGMT_STATUS_NOT_SUPPORTED);
2212
2213         if (cp->enable != 0x00 && cp->enable != 0x01)
2214                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2215                                        MGMT_STATUS_INVALID_PARAMS);
2216
2217         hci_dev_lock(hdev);
2218
2219         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2220         if (!cmd)
2221                 err = -ENOMEM;
2222         else
2223                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2224                                          set_mesh_complete);
2225
2226         if (err < 0) {
2227                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2228                                       MGMT_STATUS_FAILED);
2229
2230                 if (cmd)
2231                         mgmt_pending_remove(cmd);
2232         }
2233
2234         hci_dev_unlock(hdev);
2235         return err;
2236 }
2237
2238 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2239 {
2240         struct mgmt_mesh_tx *mesh_tx = data;
2241         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2242         unsigned long mesh_send_interval;
2243         u8 mgmt_err = mgmt_status(err);
2244
2245         /* Report any errors here, but don't report completion */
2246
2247         if (mgmt_err) {
2248                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2249                 /* Send Complete Error Code for handle */
2250                 mesh_send_complete(hdev, mesh_tx, false);
2251                 return;
2252         }
2253
2254         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2255         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2256                            mesh_send_interval);
2257 }
2258
2259 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2260 {
2261         struct mgmt_mesh_tx *mesh_tx = data;
2262         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2263         struct adv_info *adv, *next_instance;
2264         u8 instance = hdev->le_num_of_adv_sets + 1;
2265         u16 timeout, duration;
2266         int err = 0;
2267
2268         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2269                 return MGMT_STATUS_BUSY;
2270
2271         timeout = 1000;
2272         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2273         adv = hci_add_adv_instance(hdev, instance, 0,
2274                                    send->adv_data_len, send->adv_data,
2275                                    0, NULL,
2276                                    timeout, duration,
2277                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2278                                    hdev->le_adv_min_interval,
2279                                    hdev->le_adv_max_interval,
2280                                    mesh_tx->handle);
2281
2282         if (!IS_ERR(adv))
2283                 mesh_tx->instance = instance;
2284         else
2285                 err = PTR_ERR(adv);
2286
2287         if (hdev->cur_adv_instance == instance) {
2288                 /* If the currently advertised instance is being changed then
2289                  * cancel the current advertising and schedule the next
2290                  * instance. If there is only one instance then the overridden
2291                  * advertising data will be visible right away.
2292                  */
2293                 cancel_adv_timeout(hdev);
2294
2295                 next_instance = hci_get_next_instance(hdev, instance);
2296                 if (next_instance)
2297                         instance = next_instance->instance;
2298                 else
2299                         instance = 0;
2300         } else if (hdev->adv_instance_timeout) {
2301                 /* Immediately advertise the new instance if no other, or
2302                  * let it go naturally from queue if ADV is already happening
2303                  */
2304                 instance = 0;
2305         }
2306
2307         if (instance)
2308                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2309
2310         return err;
2311 }
2312
2313 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2314 {
2315         struct mgmt_rp_mesh_read_features *rp = data;
2316
2317         if (rp->used_handles >= rp->max_handles)
2318                 return;
2319
2320         rp->handles[rp->used_handles++] = mesh_tx->handle;
2321 }
2322
2323 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2324                          void *data, u16 len)
2325 {
2326         struct mgmt_rp_mesh_read_features rp;
2327
2328         if (!lmp_le_capable(hdev) ||
2329             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2331                                        MGMT_STATUS_NOT_SUPPORTED);
2332
2333         memset(&rp, 0, sizeof(rp));
2334         rp.index = cpu_to_le16(hdev->id);
2335         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2336                 rp.max_handles = MESH_HANDLES_MAX;
2337
2338         hci_dev_lock(hdev);
2339
2340         if (rp.max_handles)
2341                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2342
2343         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2344                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2345
2346         hci_dev_unlock(hdev);
2347         return 0;
2348 }
2349
2350 static int send_cancel(struct hci_dev *hdev, void *data)
2351 {
2352         struct mgmt_pending_cmd *cmd = data;
2353         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2354         struct mgmt_mesh_tx *mesh_tx;
2355
2356         if (!cancel->handle) {
2357                 do {
2358                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2359
2360                         if (mesh_tx)
2361                                 mesh_send_complete(hdev, mesh_tx, false);
2362                 } while (mesh_tx);
2363         } else {
2364                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2365
2366                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2367                         mesh_send_complete(hdev, mesh_tx, false);
2368         }
2369
2370         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2371                           0, NULL, 0);
2372         mgmt_pending_free(cmd);
2373
2374         return 0;
2375 }
2376
2377 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2378                             void *data, u16 len)
2379 {
2380         struct mgmt_pending_cmd *cmd;
2381         int err;
2382
2383         if (!lmp_le_capable(hdev) ||
2384             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2385                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2386                                        MGMT_STATUS_NOT_SUPPORTED);
2387
2388         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2389                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2390                                        MGMT_STATUS_REJECTED);
2391
2392         hci_dev_lock(hdev);
2393         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2394         if (!cmd)
2395                 err = -ENOMEM;
2396         else
2397                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2398
2399         if (err < 0) {
2400                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2401                                       MGMT_STATUS_FAILED);
2402
2403                 if (cmd)
2404                         mgmt_pending_free(cmd);
2405         }
2406
2407         hci_dev_unlock(hdev);
2408         return err;
2409 }
2410
2411 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2412 {
2413         struct mgmt_mesh_tx *mesh_tx;
2414         struct mgmt_cp_mesh_send *send = data;
2415         struct mgmt_rp_mesh_read_features rp;
2416         bool sending;
2417         int err = 0;
2418
2419         if (!lmp_le_capable(hdev) ||
2420             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2421                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2422                                        MGMT_STATUS_NOT_SUPPORTED);
2423         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2424             len <= MGMT_MESH_SEND_SIZE ||
2425             len > (MGMT_MESH_SEND_SIZE + 31))
2426                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2427                                        MGMT_STATUS_REJECTED);
2428
2429         hci_dev_lock(hdev);
2430
2431         memset(&rp, 0, sizeof(rp));
2432         rp.max_handles = MESH_HANDLES_MAX;
2433
2434         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2435
2436         if (rp.max_handles <= rp.used_handles) {
2437                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2438                                       MGMT_STATUS_BUSY);
2439                 goto done;
2440         }
2441
2442         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2443         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2444
2445         if (!mesh_tx)
2446                 err = -ENOMEM;
2447         else if (!sending)
2448                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2449                                          mesh_send_start_complete);
2450
2451         if (err < 0) {
2452                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2454                                       MGMT_STATUS_FAILED);
2455
2456                 if (mesh_tx) {
2457                         if (sending)
2458                                 mgmt_mesh_remove(mesh_tx);
2459                 }
2460         } else {
2461                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2462
2463                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2464                                   &mesh_tx->handle, 1);
2465         }
2466
2467 done:
2468         hci_dev_unlock(hdev);
2469         return err;
2470 }
2471
2472 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2473 {
2474         struct mgmt_mode *cp = data;
2475         struct mgmt_pending_cmd *cmd;
2476         int err;
2477         u8 val, enabled;
2478
2479         bt_dev_dbg(hdev, "sock %p", sk);
2480
2481         if (!lmp_le_capable(hdev))
2482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2483                                        MGMT_STATUS_NOT_SUPPORTED);
2484
2485         if (cp->val != 0x00 && cp->val != 0x01)
2486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2487                                        MGMT_STATUS_INVALID_PARAMS);
2488
2489         /* Bluetooth single mode LE only controllers or dual-mode
2490          * controllers configured as LE only devices, do not allow
2491          * switching LE off. These have either LE enabled explicitly
2492          * or BR/EDR has been previously switched off.
2493          *
2494          * When trying to enable an already enabled LE, then gracefully
2495          * send a positive response. Trying to disable it however will
2496          * result into rejection.
2497          */
2498         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2499                 if (cp->val == 0x01)
2500                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2501
2502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2503                                        MGMT_STATUS_REJECTED);
2504         }
2505
2506         hci_dev_lock(hdev);
2507
2508         val = !!cp->val;
2509         enabled = lmp_host_le_capable(hdev);
2510
2511         if (!hdev_is_powered(hdev) || val == enabled) {
2512                 bool changed = false;
2513
2514                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2515                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2516                         changed = true;
2517                 }
2518
2519                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2520                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2521                         changed = true;
2522                 }
2523
2524                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2525                 if (err < 0)
2526                         goto unlock;
2527
2528                 if (changed)
2529                         err = new_settings(hdev, sk);
2530
2531                 goto unlock;
2532         }
2533
2534         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2535             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2536                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2537                                       MGMT_STATUS_BUSY);
2538                 goto unlock;
2539         }
2540
2541         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2542         if (!cmd)
2543                 err = -ENOMEM;
2544         else
2545                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2546                                          set_le_complete);
2547
2548         if (err < 0) {
2549                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2550                                       MGMT_STATUS_FAILED);
2551
2552                 if (cmd)
2553                         mgmt_pending_remove(cmd);
2554         }
2555
2556 unlock:
2557         hci_dev_unlock(hdev);
2558         return err;
2559 }
2560
2561 /* This is a helper function to test for pending mgmt commands that can
2562  * cause CoD or EIR HCI commands. We can only allow one such pending
2563  * mgmt command at a time since otherwise we cannot easily track what
2564  * the current values are, will be, and based on that calculate if a new
2565  * HCI command needs to be sent and if yes with what value.
2566  */
2567 static bool pending_eir_or_class(struct hci_dev *hdev)
2568 {
2569         struct mgmt_pending_cmd *cmd;
2570
2571         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2572                 switch (cmd->opcode) {
2573                 case MGMT_OP_ADD_UUID:
2574                 case MGMT_OP_REMOVE_UUID:
2575                 case MGMT_OP_SET_DEV_CLASS:
2576                 case MGMT_OP_SET_POWERED:
2577                         return true;
2578                 }
2579         }
2580
2581         return false;
2582 }
2583
2584 static const u8 bluetooth_base_uuid[] = {
2585                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2586                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2587 };
2588
2589 static u8 get_uuid_size(const u8 *uuid)
2590 {
2591         u32 val;
2592
2593         if (memcmp(uuid, bluetooth_base_uuid, 12))
2594                 return 128;
2595
2596         val = get_unaligned_le32(&uuid[12]);
2597         if (val > 0xffff)
2598                 return 32;
2599
2600         return 16;
2601 }
2602
2603 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2604 {
2605         struct mgmt_pending_cmd *cmd = data;
2606
2607         bt_dev_dbg(hdev, "err %d", err);
2608
2609         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2610                           mgmt_status(err), hdev->dev_class, 3);
2611
2612         mgmt_pending_free(cmd);
2613 }
2614
2615 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2616 {
2617         int err;
2618
2619         err = hci_update_class_sync(hdev);
2620         if (err)
2621                 return err;
2622
2623         return hci_update_eir_sync(hdev);
2624 }
2625
2626 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2627 {
2628         struct mgmt_cp_add_uuid *cp = data;
2629         struct mgmt_pending_cmd *cmd;
2630         struct bt_uuid *uuid;
2631         int err;
2632
2633         bt_dev_dbg(hdev, "sock %p", sk);
2634
2635         hci_dev_lock(hdev);
2636
2637         if (pending_eir_or_class(hdev)) {
2638                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2639                                       MGMT_STATUS_BUSY);
2640                 goto failed;
2641         }
2642
2643         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2644         if (!uuid) {
2645                 err = -ENOMEM;
2646                 goto failed;
2647         }
2648
2649         memcpy(uuid->uuid, cp->uuid, 16);
2650         uuid->svc_hint = cp->svc_hint;
2651         uuid->size = get_uuid_size(cp->uuid);
2652
2653         list_add_tail(&uuid->list, &hdev->uuids);
2654
2655         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2656         if (!cmd) {
2657                 err = -ENOMEM;
2658                 goto failed;
2659         }
2660
2661         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2662         if (err < 0) {
2663                 mgmt_pending_free(cmd);
2664                 goto failed;
2665         }
2666
2667 failed:
2668         hci_dev_unlock(hdev);
2669         return err;
2670 }
2671
2672 static bool enable_service_cache(struct hci_dev *hdev)
2673 {
2674         if (!hdev_is_powered(hdev))
2675                 return false;
2676
2677         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2678                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2679                                    CACHE_TIMEOUT);
2680                 return true;
2681         }
2682
2683         return false;
2684 }
2685
2686 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2687 {
2688         int err;
2689
2690         err = hci_update_class_sync(hdev);
2691         if (err)
2692                 return err;
2693
2694         return hci_update_eir_sync(hdev);
2695 }
2696
2697 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2698                        u16 len)
2699 {
2700         struct mgmt_cp_remove_uuid *cp = data;
2701         struct mgmt_pending_cmd *cmd;
2702         struct bt_uuid *match, *tmp;
2703         static const u8 bt_uuid_any[] = {
2704                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2705         };
2706         int err, found;
2707
2708         bt_dev_dbg(hdev, "sock %p", sk);
2709
2710         hci_dev_lock(hdev);
2711
2712         if (pending_eir_or_class(hdev)) {
2713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2714                                       MGMT_STATUS_BUSY);
2715                 goto unlock;
2716         }
2717
2718         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2719                 hci_uuids_clear(hdev);
2720
2721                 if (enable_service_cache(hdev)) {
2722                         err = mgmt_cmd_complete(sk, hdev->id,
2723                                                 MGMT_OP_REMOVE_UUID,
2724                                                 0, hdev->dev_class, 3);
2725                         goto unlock;
2726                 }
2727
2728                 goto update_class;
2729         }
2730
2731         found = 0;
2732
2733         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2734                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2735                         continue;
2736
2737                 list_del(&match->list);
2738                 kfree(match);
2739                 found++;
2740         }
2741
2742         if (found == 0) {
2743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2744                                       MGMT_STATUS_INVALID_PARAMS);
2745                 goto unlock;
2746         }
2747
2748 update_class:
2749         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2750         if (!cmd) {
2751                 err = -ENOMEM;
2752                 goto unlock;
2753         }
2754
2755         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2756                                  mgmt_class_complete);
2757         if (err < 0)
2758                 mgmt_pending_free(cmd);
2759
2760 unlock:
2761         hci_dev_unlock(hdev);
2762         return err;
2763 }
2764
2765 static int set_class_sync(struct hci_dev *hdev, void *data)
2766 {
2767         int err = 0;
2768
2769         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2770                 cancel_delayed_work_sync(&hdev->service_cache);
2771                 err = hci_update_eir_sync(hdev);
2772         }
2773
2774         if (err)
2775                 return err;
2776
2777         return hci_update_class_sync(hdev);
2778 }
2779
2780 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2781                          u16 len)
2782 {
2783         struct mgmt_cp_set_dev_class *cp = data;
2784         struct mgmt_pending_cmd *cmd;
2785         int err;
2786
2787         bt_dev_dbg(hdev, "sock %p", sk);
2788
2789         if (!lmp_bredr_capable(hdev))
2790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2791                                        MGMT_STATUS_NOT_SUPPORTED);
2792
2793         hci_dev_lock(hdev);
2794
2795         if (pending_eir_or_class(hdev)) {
2796                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2797                                       MGMT_STATUS_BUSY);
2798                 goto unlock;
2799         }
2800
2801         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2802                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2803                                       MGMT_STATUS_INVALID_PARAMS);
2804                 goto unlock;
2805         }
2806
2807         hdev->major_class = cp->major;
2808         hdev->minor_class = cp->minor;
2809
2810         if (!hdev_is_powered(hdev)) {
2811                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2812                                         hdev->dev_class, 3);
2813                 goto unlock;
2814         }
2815
2816         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2817         if (!cmd) {
2818                 err = -ENOMEM;
2819                 goto unlock;
2820         }
2821
2822         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2823                                  mgmt_class_complete);
2824         if (err < 0)
2825                 mgmt_pending_free(cmd);
2826
2827 unlock:
2828         hci_dev_unlock(hdev);
2829         return err;
2830 }
2831
2832 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2833                           u16 len)
2834 {
2835         struct mgmt_cp_load_link_keys *cp = data;
2836         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2837                                    sizeof(struct mgmt_link_key_info));
2838         u16 key_count, expected_len;
2839         bool changed;
2840         int i;
2841
2842         bt_dev_dbg(hdev, "sock %p", sk);
2843
2844         if (!lmp_bredr_capable(hdev))
2845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2846                                        MGMT_STATUS_NOT_SUPPORTED);
2847
2848         key_count = __le16_to_cpu(cp->key_count);
2849         if (key_count > max_key_count) {
2850                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2851                            key_count);
2852                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2853                                        MGMT_STATUS_INVALID_PARAMS);
2854         }
2855
2856         expected_len = struct_size(cp, keys, key_count);
2857         if (expected_len != len) {
2858                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2859                            expected_len, len);
2860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2861                                        MGMT_STATUS_INVALID_PARAMS);
2862         }
2863
2864         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2865                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2866                                        MGMT_STATUS_INVALID_PARAMS);
2867
2868         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2869                    key_count);
2870
2871         for (i = 0; i < key_count; i++) {
2872                 struct mgmt_link_key_info *key = &cp->keys[i];
2873
2874                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2875                         return mgmt_cmd_status(sk, hdev->id,
2876                                                MGMT_OP_LOAD_LINK_KEYS,
2877                                                MGMT_STATUS_INVALID_PARAMS);
2878         }
2879
2880         hci_dev_lock(hdev);
2881
2882         hci_link_keys_clear(hdev);
2883
2884         if (cp->debug_keys)
2885                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2886         else
2887                 changed = hci_dev_test_and_clear_flag(hdev,
2888                                                       HCI_KEEP_DEBUG_KEYS);
2889
2890         if (changed)
2891                 new_settings(hdev, NULL);
2892
2893         for (i = 0; i < key_count; i++) {
2894                 struct mgmt_link_key_info *key = &cp->keys[i];
2895
2896                 if (hci_is_blocked_key(hdev,
2897                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2898                                        key->val)) {
2899                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2900                                     &key->addr.bdaddr);
2901                         continue;
2902                 }
2903
2904                 /* Always ignore debug keys and require a new pairing if
2905                  * the user wants to use them.
2906                  */
2907                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2908                         continue;
2909
2910                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2911                                  key->type, key->pin_len, NULL);
2912         }
2913
2914         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2915
2916         hci_dev_unlock(hdev);
2917
2918         return 0;
2919 }
2920
2921 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2922                            u8 addr_type, struct sock *skip_sk)
2923 {
2924         struct mgmt_ev_device_unpaired ev;
2925
2926         bacpy(&ev.addr.bdaddr, bdaddr);
2927         ev.addr.type = addr_type;
2928
2929         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2930                           skip_sk);
2931 }
2932
2933 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2934 {
2935         struct mgmt_pending_cmd *cmd = data;
2936         struct mgmt_cp_unpair_device *cp = cmd->param;
2937
2938         if (!err)
2939                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2940
2941         cmd->cmd_complete(cmd, err);
2942         mgmt_pending_free(cmd);
2943 }
2944
2945 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2946 {
2947         struct mgmt_pending_cmd *cmd = data;
2948         struct mgmt_cp_unpair_device *cp = cmd->param;
2949         struct hci_conn *conn;
2950
2951         if (cp->addr.type == BDADDR_BREDR)
2952                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2953                                                &cp->addr.bdaddr);
2954         else
2955                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2956                                                le_addr_type(cp->addr.type));
2957
2958         if (!conn)
2959                 return 0;
2960
2961         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2962 }
2963
2964 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2965                          u16 len)
2966 {
2967         struct mgmt_cp_unpair_device *cp = data;
2968         struct mgmt_rp_unpair_device rp;
2969         struct hci_conn_params *params;
2970         struct mgmt_pending_cmd *cmd;
2971         struct hci_conn *conn;
2972         u8 addr_type;
2973         int err;
2974
2975         memset(&rp, 0, sizeof(rp));
2976         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2977         rp.addr.type = cp->addr.type;
2978
2979         if (!bdaddr_type_is_valid(cp->addr.type))
2980                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2981                                          MGMT_STATUS_INVALID_PARAMS,
2982                                          &rp, sizeof(rp));
2983
2984         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2985                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2986                                          MGMT_STATUS_INVALID_PARAMS,
2987                                          &rp, sizeof(rp));
2988
2989         hci_dev_lock(hdev);
2990
2991         if (!hdev_is_powered(hdev)) {
2992                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2993                                         MGMT_STATUS_NOT_POWERED, &rp,
2994                                         sizeof(rp));
2995                 goto unlock;
2996         }
2997
2998         if (cp->addr.type == BDADDR_BREDR) {
2999                 /* If disconnection is requested, then look up the
3000                  * connection. If the remote device is connected, it
3001                  * will be later used to terminate the link.
3002                  *
3003                  * Setting it to NULL explicitly will cause no
3004                  * termination of the link.
3005                  */
3006                 if (cp->disconnect)
3007                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3008                                                        &cp->addr.bdaddr);
3009                 else
3010                         conn = NULL;
3011
3012                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3013                 if (err < 0) {
3014                         err = mgmt_cmd_complete(sk, hdev->id,
3015                                                 MGMT_OP_UNPAIR_DEVICE,
3016                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3017                                                 sizeof(rp));
3018                         goto unlock;
3019                 }
3020
3021                 goto done;
3022         }
3023
3024         /* LE address type */
3025         addr_type = le_addr_type(cp->addr.type);
3026
3027         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3028         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3029         if (err < 0) {
3030                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3031                                         MGMT_STATUS_NOT_PAIRED, &rp,
3032                                         sizeof(rp));
3033                 goto unlock;
3034         }
3035
3036         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3037         if (!conn) {
3038                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3039                 goto done;
3040         }
3041
3042
3043         /* Defer clearing up the connection parameters until closing to
3044          * give a chance of keeping them if a repairing happens.
3045          */
3046         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3047
3048         /* Disable auto-connection parameters if present */
3049         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3050         if (params) {
3051                 if (params->explicit_connect)
3052                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3053                 else
3054                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3055         }
3056
3057         /* If disconnection is not requested, then clear the connection
3058          * variable so that the link is not terminated.
3059          */
3060         if (!cp->disconnect)
3061                 conn = NULL;
3062
3063 done:
3064         /* If the connection variable is set, then termination of the
3065          * link is requested.
3066          */
3067         if (!conn) {
3068                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3069                                         &rp, sizeof(rp));
3070                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3071                 goto unlock;
3072         }
3073
3074         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3075                                sizeof(*cp));
3076         if (!cmd) {
3077                 err = -ENOMEM;
3078                 goto unlock;
3079         }
3080
3081         cmd->cmd_complete = addr_cmd_complete;
3082
3083         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3084                                  unpair_device_complete);
3085         if (err < 0)
3086                 mgmt_pending_free(cmd);
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3094                       u16 len)
3095 {
3096         struct mgmt_cp_disconnect *cp = data;
3097         struct mgmt_rp_disconnect rp;
3098         struct mgmt_pending_cmd *cmd;
3099         struct hci_conn *conn;
3100         int err;
3101
3102         bt_dev_dbg(hdev, "sock %p", sk);
3103
3104         memset(&rp, 0, sizeof(rp));
3105         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3106         rp.addr.type = cp->addr.type;
3107
3108         if (!bdaddr_type_is_valid(cp->addr.type))
3109                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3110                                          MGMT_STATUS_INVALID_PARAMS,
3111                                          &rp, sizeof(rp));
3112
3113         hci_dev_lock(hdev);
3114
3115         if (!test_bit(HCI_UP, &hdev->flags)) {
3116                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3117                                         MGMT_STATUS_NOT_POWERED, &rp,
3118                                         sizeof(rp));
3119                 goto failed;
3120         }
3121
3122         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3124                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3125                 goto failed;
3126         }
3127
3128         if (cp->addr.type == BDADDR_BREDR)
3129                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3130                                                &cp->addr.bdaddr);
3131         else
3132                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3133                                                le_addr_type(cp->addr.type));
3134
3135         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3136                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3137                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3138                                         sizeof(rp));
3139                 goto failed;
3140         }
3141
3142         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto failed;
3146         }
3147
3148         cmd->cmd_complete = generic_cmd_complete;
3149
3150         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3151         if (err < 0)
3152                 mgmt_pending_remove(cmd);
3153
3154 failed:
3155         hci_dev_unlock(hdev);
3156         return err;
3157 }
3158
3159 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3160 {
3161         switch (link_type) {
3162         case LE_LINK:
3163                 switch (addr_type) {
3164                 case ADDR_LE_DEV_PUBLIC:
3165                         return BDADDR_LE_PUBLIC;
3166
3167                 default:
3168                         /* Fallback to LE Random address type */
3169                         return BDADDR_LE_RANDOM;
3170                 }
3171
3172         default:
3173                 /* Fallback to BR/EDR type */
3174                 return BDADDR_BREDR;
3175         }
3176 }
3177
3178 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3179                            u16 data_len)
3180 {
3181         struct mgmt_rp_get_connections *rp;
3182         struct hci_conn *c;
3183         int err;
3184         u16 i;
3185
3186         bt_dev_dbg(hdev, "sock %p", sk);
3187
3188         hci_dev_lock(hdev);
3189
3190         if (!hdev_is_powered(hdev)) {
3191                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3192                                       MGMT_STATUS_NOT_POWERED);
3193                 goto unlock;
3194         }
3195
3196         i = 0;
3197         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3198                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3199                         i++;
3200         }
3201
3202         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3203         if (!rp) {
3204                 err = -ENOMEM;
3205                 goto unlock;
3206         }
3207
3208         i = 0;
3209         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3210                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3211                         continue;
3212                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3213                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3214                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3215                         continue;
3216                 i++;
3217         }
3218
3219         rp->conn_count = cpu_to_le16(i);
3220
3221         /* Recalculate length in case of filtered SCO connections, etc */
3222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3223                                 struct_size(rp, addr, i));
3224
3225         kfree(rp);
3226
3227 unlock:
3228         hci_dev_unlock(hdev);
3229         return err;
3230 }
3231
3232 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3233                                    struct mgmt_cp_pin_code_neg_reply *cp)
3234 {
3235         struct mgmt_pending_cmd *cmd;
3236         int err;
3237
3238         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3239                                sizeof(*cp));
3240         if (!cmd)
3241                 return -ENOMEM;
3242
3243         cmd->cmd_complete = addr_cmd_complete;
3244
3245         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3246                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3247         if (err < 0)
3248                 mgmt_pending_remove(cmd);
3249
3250         return err;
3251 }
3252
3253 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3254                           u16 len)
3255 {
3256         struct hci_conn *conn;
3257         struct mgmt_cp_pin_code_reply *cp = data;
3258         struct hci_cp_pin_code_reply reply;
3259         struct mgmt_pending_cmd *cmd;
3260         int err;
3261
3262         bt_dev_dbg(hdev, "sock %p", sk);
3263
3264         hci_dev_lock(hdev);
3265
3266         if (!hdev_is_powered(hdev)) {
3267                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3268                                       MGMT_STATUS_NOT_POWERED);
3269                 goto failed;
3270         }
3271
3272         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3273         if (!conn) {
3274                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3275                                       MGMT_STATUS_NOT_CONNECTED);
3276                 goto failed;
3277         }
3278
3279         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3280                 struct mgmt_cp_pin_code_neg_reply ncp;
3281
3282                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3283
3284                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3285
3286                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3287                 if (err >= 0)
3288                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3289                                               MGMT_STATUS_INVALID_PARAMS);
3290
3291                 goto failed;
3292         }
3293
3294         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3295         if (!cmd) {
3296                 err = -ENOMEM;
3297                 goto failed;
3298         }
3299
3300         cmd->cmd_complete = addr_cmd_complete;
3301
3302         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3303         reply.pin_len = cp->pin_len;
3304         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3305
3306         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3307         if (err < 0)
3308                 mgmt_pending_remove(cmd);
3309
3310 failed:
3311         hci_dev_unlock(hdev);
3312         return err;
3313 }
3314
3315 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3316                              u16 len)
3317 {
3318         struct mgmt_cp_set_io_capability *cp = data;
3319
3320         bt_dev_dbg(hdev, "sock %p", sk);
3321
3322         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3323                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3324                                        MGMT_STATUS_INVALID_PARAMS);
3325
3326         hci_dev_lock(hdev);
3327
3328         hdev->io_capability = cp->io_capability;
3329
3330         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3331
3332         hci_dev_unlock(hdev);
3333
3334         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3335                                  NULL, 0);
3336 }
3337
3338 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3339 {
3340         struct hci_dev *hdev = conn->hdev;
3341         struct mgmt_pending_cmd *cmd;
3342
3343         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3344                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3345                         continue;
3346
3347                 if (cmd->user_data != conn)
3348                         continue;
3349
3350                 return cmd;
3351         }
3352
3353         return NULL;
3354 }
3355
3356 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3357 {
3358         struct mgmt_rp_pair_device rp;
3359         struct hci_conn *conn = cmd->user_data;
3360         int err;
3361
3362         bacpy(&rp.addr.bdaddr, &conn->dst);
3363         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3364
3365         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3366                                 status, &rp, sizeof(rp));
3367
3368         /* So we don't get further callbacks for this connection */
3369         conn->connect_cfm_cb = NULL;
3370         conn->security_cfm_cb = NULL;
3371         conn->disconn_cfm_cb = NULL;
3372
3373         hci_conn_drop(conn);
3374
3375         /* The device is paired so there is no need to remove
3376          * its connection parameters anymore.
3377          */
3378         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3379
3380         hci_conn_put(conn);
3381
3382         return err;
3383 }
3384
3385 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3386 {
3387         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3388         struct mgmt_pending_cmd *cmd;
3389
3390         cmd = find_pairing(conn);
3391         if (cmd) {
3392                 cmd->cmd_complete(cmd, status);
3393                 mgmt_pending_remove(cmd);
3394         }
3395 }
3396
3397 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3398 {
3399         struct mgmt_pending_cmd *cmd;
3400
3401         BT_DBG("status %u", status);
3402
3403         cmd = find_pairing(conn);
3404         if (!cmd) {
3405                 BT_DBG("Unable to find a pending command");
3406                 return;
3407         }
3408
3409         cmd->cmd_complete(cmd, mgmt_status(status));
3410         mgmt_pending_remove(cmd);
3411 }
3412
3413 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3414 {
3415         struct mgmt_pending_cmd *cmd;
3416
3417         BT_DBG("status %u", status);
3418
3419         if (!status)
3420                 return;
3421
3422         cmd = find_pairing(conn);
3423         if (!cmd) {
3424                 BT_DBG("Unable to find a pending command");
3425                 return;
3426         }
3427
3428         cmd->cmd_complete(cmd, mgmt_status(status));
3429         mgmt_pending_remove(cmd);
3430 }
3431
3432 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3433                        u16 len)
3434 {
3435         struct mgmt_cp_pair_device *cp = data;
3436         struct mgmt_rp_pair_device rp;
3437         struct mgmt_pending_cmd *cmd;
3438         u8 sec_level, auth_type;
3439         struct hci_conn *conn;
3440         int err;
3441
3442         bt_dev_dbg(hdev, "sock %p", sk);
3443
3444         memset(&rp, 0, sizeof(rp));
3445         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3446         rp.addr.type = cp->addr.type;
3447
3448         if (!bdaddr_type_is_valid(cp->addr.type))
3449                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3450                                          MGMT_STATUS_INVALID_PARAMS,
3451                                          &rp, sizeof(rp));
3452
3453         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3454                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3455                                          MGMT_STATUS_INVALID_PARAMS,
3456                                          &rp, sizeof(rp));
3457
3458         hci_dev_lock(hdev);
3459
3460         if (!hdev_is_powered(hdev)) {
3461                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3462                                         MGMT_STATUS_NOT_POWERED, &rp,
3463                                         sizeof(rp));
3464                 goto unlock;
3465         }
3466
3467         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3468                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3469                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3470                                         sizeof(rp));
3471                 goto unlock;
3472         }
3473
3474         sec_level = BT_SECURITY_MEDIUM;
3475         auth_type = HCI_AT_DEDICATED_BONDING;
3476
3477         if (cp->addr.type == BDADDR_BREDR) {
3478                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3479                                        auth_type, CONN_REASON_PAIR_DEVICE);
3480         } else {
3481                 u8 addr_type = le_addr_type(cp->addr.type);
3482                 struct hci_conn_params *p;
3483
3484                 /* When pairing a new device, it is expected to remember
3485                  * this device for future connections. Adding the connection
3486                  * parameter information ahead of time allows tracking
3487                  * of the peripheral preferred values and will speed up any
3488                  * further connection establishment.
3489                  *
3490                  * If connection parameters already exist, then they
3491                  * will be kept and this function does nothing.
3492                  */
3493                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3494
3495                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3496                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3497
3498                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3499                                            sec_level, HCI_LE_CONN_TIMEOUT,
3500                                            CONN_REASON_PAIR_DEVICE);
3501         }
3502
3503         if (IS_ERR(conn)) {
3504                 int status;
3505
3506                 if (PTR_ERR(conn) == -EBUSY)
3507                         status = MGMT_STATUS_BUSY;
3508                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3509                         status = MGMT_STATUS_NOT_SUPPORTED;
3510                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3511                         status = MGMT_STATUS_REJECTED;
3512                 else
3513                         status = MGMT_STATUS_CONNECT_FAILED;
3514
3515                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3516                                         status, &rp, sizeof(rp));
3517                 goto unlock;
3518         }
3519
3520         if (conn->connect_cfm_cb) {
3521                 hci_conn_drop(conn);
3522                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3523                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3524                 goto unlock;
3525         }
3526
3527         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3528         if (!cmd) {
3529                 err = -ENOMEM;
3530                 hci_conn_drop(conn);
3531                 goto unlock;
3532         }
3533
3534         cmd->cmd_complete = pairing_complete;
3535
3536         /* For LE, just connecting isn't a proof that the pairing finished */
3537         if (cp->addr.type == BDADDR_BREDR) {
3538                 conn->connect_cfm_cb = pairing_complete_cb;
3539                 conn->security_cfm_cb = pairing_complete_cb;
3540                 conn->disconn_cfm_cb = pairing_complete_cb;
3541         } else {
3542                 conn->connect_cfm_cb = le_pairing_complete_cb;
3543                 conn->security_cfm_cb = le_pairing_complete_cb;
3544                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3545         }
3546
3547         conn->io_capability = cp->io_cap;
3548         cmd->user_data = hci_conn_get(conn);
3549
3550         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3551             hci_conn_security(conn, sec_level, auth_type, true)) {
3552                 cmd->cmd_complete(cmd, 0);
3553                 mgmt_pending_remove(cmd);
3554         }
3555
3556         err = 0;
3557
3558 unlock:
3559         hci_dev_unlock(hdev);
3560         return err;
3561 }
3562
3563 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3564 {
3565         struct hci_conn *conn;
3566         u16 handle = PTR_ERR(data);
3567
3568         conn = hci_conn_hash_lookup_handle(hdev, handle);
3569         if (!conn)
3570                 return 0;
3571
3572         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3573 }
3574
3575 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3576                               u16 len)
3577 {
3578         struct mgmt_addr_info *addr = data;
3579         struct mgmt_pending_cmd *cmd;
3580         struct hci_conn *conn;
3581         int err;
3582
3583         bt_dev_dbg(hdev, "sock %p", sk);
3584
3585         hci_dev_lock(hdev);
3586
3587         if (!hdev_is_powered(hdev)) {
3588                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3589                                       MGMT_STATUS_NOT_POWERED);
3590                 goto unlock;
3591         }
3592
3593         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3594         if (!cmd) {
3595                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3596                                       MGMT_STATUS_INVALID_PARAMS);
3597                 goto unlock;
3598         }
3599
3600         conn = cmd->user_data;
3601
3602         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3604                                       MGMT_STATUS_INVALID_PARAMS);
3605                 goto unlock;
3606         }
3607
3608         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3609         mgmt_pending_remove(cmd);
3610
3611         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3612                                 addr, sizeof(*addr));
3613
3614         /* Since user doesn't want to proceed with the connection, abort any
3615          * ongoing pairing and then terminate the link if it was created
3616          * because of the pair device action.
3617          */
3618         if (addr->type == BDADDR_BREDR)
3619                 hci_remove_link_key(hdev, &addr->bdaddr);
3620         else
3621                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3622                                               le_addr_type(addr->type));
3623
3624         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3625                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3626                                    NULL);
3627
3628 unlock:
3629         hci_dev_unlock(hdev);
3630         return err;
3631 }
3632
3633 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3634                              struct mgmt_addr_info *addr, u16 mgmt_op,
3635                              u16 hci_op, __le32 passkey)
3636 {
3637         struct mgmt_pending_cmd *cmd;
3638         struct hci_conn *conn;
3639         int err;
3640
3641         hci_dev_lock(hdev);
3642
3643         if (!hdev_is_powered(hdev)) {
3644                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3645                                         MGMT_STATUS_NOT_POWERED, addr,
3646                                         sizeof(*addr));
3647                 goto done;
3648         }
3649
3650         if (addr->type == BDADDR_BREDR)
3651                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3652         else
3653                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3654                                                le_addr_type(addr->type));
3655
3656         if (!conn) {
3657                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3658                                         MGMT_STATUS_NOT_CONNECTED, addr,
3659                                         sizeof(*addr));
3660                 goto done;
3661         }
3662
3663         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3664                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3665                 if (!err)
3666                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3667                                                 MGMT_STATUS_SUCCESS, addr,
3668                                                 sizeof(*addr));
3669                 else
3670                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3671                                                 MGMT_STATUS_FAILED, addr,
3672                                                 sizeof(*addr));
3673
3674                 goto done;
3675         }
3676
3677         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3678         if (!cmd) {
3679                 err = -ENOMEM;
3680                 goto done;
3681         }
3682
3683         cmd->cmd_complete = addr_cmd_complete;
3684
3685         /* Continue with pairing via HCI */
3686         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3687                 struct hci_cp_user_passkey_reply cp;
3688
3689                 bacpy(&cp.bdaddr, &addr->bdaddr);
3690                 cp.passkey = passkey;
3691                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3692         } else
3693                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3694                                    &addr->bdaddr);
3695
3696         if (err < 0)
3697                 mgmt_pending_remove(cmd);
3698
3699 done:
3700         hci_dev_unlock(hdev);
3701         return err;
3702 }
3703
3704 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3705                               void *data, u16 len)
3706 {
3707         struct mgmt_cp_pin_code_neg_reply *cp = data;
3708
3709         bt_dev_dbg(hdev, "sock %p", sk);
3710
3711         return user_pairing_resp(sk, hdev, &cp->addr,
3712                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3713                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3714 }
3715
3716 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3717                               u16 len)
3718 {
3719         struct mgmt_cp_user_confirm_reply *cp = data;
3720
3721         bt_dev_dbg(hdev, "sock %p", sk);
3722
3723         if (len != sizeof(*cp))
3724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3725                                        MGMT_STATUS_INVALID_PARAMS);
3726
3727         return user_pairing_resp(sk, hdev, &cp->addr,
3728                                  MGMT_OP_USER_CONFIRM_REPLY,
3729                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3730 }
3731
3732 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3733                                   void *data, u16 len)
3734 {
3735         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3736
3737         bt_dev_dbg(hdev, "sock %p", sk);
3738
3739         return user_pairing_resp(sk, hdev, &cp->addr,
3740                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3741                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3742 }
3743
3744 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3745                               u16 len)
3746 {
3747         struct mgmt_cp_user_passkey_reply *cp = data;
3748
3749         bt_dev_dbg(hdev, "sock %p", sk);
3750
3751         return user_pairing_resp(sk, hdev, &cp->addr,
3752                                  MGMT_OP_USER_PASSKEY_REPLY,
3753                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3754 }
3755
3756 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3757                                   void *data, u16 len)
3758 {
3759         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3760
3761         bt_dev_dbg(hdev, "sock %p", sk);
3762
3763         return user_pairing_resp(sk, hdev, &cp->addr,
3764                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3765                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3766 }
3767
3768 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3769 {
3770         struct adv_info *adv_instance;
3771
3772         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3773         if (!adv_instance)
3774                 return 0;
3775
3776         /* stop if current instance doesn't need to be changed */
3777         if (!(adv_instance->flags & flags))
3778                 return 0;
3779
3780         cancel_adv_timeout(hdev);
3781
3782         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3783         if (!adv_instance)
3784                 return 0;
3785
3786         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3787
3788         return 0;
3789 }
3790
3791 static int name_changed_sync(struct hci_dev *hdev, void *data)
3792 {
3793         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3794 }
3795
3796 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3797 {
3798         struct mgmt_pending_cmd *cmd = data;
3799         struct mgmt_cp_set_local_name *cp = cmd->param;
3800         u8 status = mgmt_status(err);
3801
3802         bt_dev_dbg(hdev, "err %d", err);
3803
3804         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3805                 return;
3806
3807         if (status) {
3808                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3809                                 status);
3810         } else {
3811                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3812                                   cp, sizeof(*cp));
3813
3814                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3815                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3816         }
3817
3818         mgmt_pending_remove(cmd);
3819 }
3820
3821 static int set_name_sync(struct hci_dev *hdev, void *data)
3822 {
3823         if (lmp_bredr_capable(hdev)) {
3824                 hci_update_name_sync(hdev);
3825                 hci_update_eir_sync(hdev);
3826         }
3827
3828         /* The name is stored in the scan response data and so
3829          * no need to update the advertising data here.
3830          */
3831         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3832                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3833
3834         return 0;
3835 }
3836
3837 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3838                           u16 len)
3839 {
3840         struct mgmt_cp_set_local_name *cp = data;
3841         struct mgmt_pending_cmd *cmd;
3842         int err;
3843
3844         bt_dev_dbg(hdev, "sock %p", sk);
3845
3846         hci_dev_lock(hdev);
3847
3848         /* If the old values are the same as the new ones just return a
3849          * direct command complete event.
3850          */
3851         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3852             !memcmp(hdev->short_name, cp->short_name,
3853                     sizeof(hdev->short_name))) {
3854                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3855                                         data, len);
3856                 goto failed;
3857         }
3858
3859         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3860
3861         if (!hdev_is_powered(hdev)) {
3862                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3863
3864                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3865                                         data, len);
3866                 if (err < 0)
3867                         goto failed;
3868
3869                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3870                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3871                 ext_info_changed(hdev, sk);
3872
3873                 goto failed;
3874         }
3875
3876         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3877         if (!cmd)
3878                 err = -ENOMEM;
3879         else
3880                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3881                                          set_name_complete);
3882
3883         if (err < 0) {
3884                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3885                                       MGMT_STATUS_FAILED);
3886
3887                 if (cmd)
3888                         mgmt_pending_remove(cmd);
3889
3890                 goto failed;
3891         }
3892
3893         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3894
3895 failed:
3896         hci_dev_unlock(hdev);
3897         return err;
3898 }
3899
3900 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3901 {
3902         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3903 }
3904
3905 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3906                           u16 len)
3907 {
3908         struct mgmt_cp_set_appearance *cp = data;
3909         u16 appearance;
3910         int err;
3911
3912         bt_dev_dbg(hdev, "sock %p", sk);
3913
3914         if (!lmp_le_capable(hdev))
3915                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3916                                        MGMT_STATUS_NOT_SUPPORTED);
3917
3918         appearance = le16_to_cpu(cp->appearance);
3919
3920         hci_dev_lock(hdev);
3921
3922         if (hdev->appearance != appearance) {
3923                 hdev->appearance = appearance;
3924
3925                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3926                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3927                                            NULL);
3928
3929                 ext_info_changed(hdev, sk);
3930         }
3931
3932         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3933                                 0);
3934
3935         hci_dev_unlock(hdev);
3936
3937         return err;
3938 }
3939
3940 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3941                                  void *data, u16 len)
3942 {
3943         struct mgmt_rp_get_phy_configuration rp;
3944
3945         bt_dev_dbg(hdev, "sock %p", sk);
3946
3947         hci_dev_lock(hdev);
3948
3949         memset(&rp, 0, sizeof(rp));
3950
3951         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3952         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3953         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3954
3955         hci_dev_unlock(hdev);
3956
3957         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3958                                  &rp, sizeof(rp));
3959 }
3960
3961 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3962 {
3963         struct mgmt_ev_phy_configuration_changed ev;
3964
3965         memset(&ev, 0, sizeof(ev));
3966
3967         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3968
3969         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3970                           sizeof(ev), skip);
3971 }
3972
3973 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3974 {
3975         struct mgmt_pending_cmd *cmd = data;
3976         struct sk_buff *skb = cmd->skb;
3977         u8 status = mgmt_status(err);
3978
3979         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3980                 return;
3981
3982         if (!status) {
3983                 if (!skb)
3984                         status = MGMT_STATUS_FAILED;
3985                 else if (IS_ERR(skb))
3986                         status = mgmt_status(PTR_ERR(skb));
3987                 else
3988                         status = mgmt_status(skb->data[0]);
3989         }
3990
3991         bt_dev_dbg(hdev, "status %d", status);
3992
3993         if (status) {
3994                 mgmt_cmd_status(cmd->sk, hdev->id,
3995                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3996         } else {
3997                 mgmt_cmd_complete(cmd->sk, hdev->id,
3998                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3999                                   NULL, 0);
4000
4001                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4002         }
4003
4004         if (skb && !IS_ERR(skb))
4005                 kfree_skb(skb);
4006
4007         mgmt_pending_remove(cmd);
4008 }
4009
4010 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4011 {
4012         struct mgmt_pending_cmd *cmd = data;
4013         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4014         struct hci_cp_le_set_default_phy cp_phy;
4015         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4016
4017         memset(&cp_phy, 0, sizeof(cp_phy));
4018
4019         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4020                 cp_phy.all_phys |= 0x01;
4021
4022         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4023                 cp_phy.all_phys |= 0x02;
4024
4025         if (selected_phys & MGMT_PHY_LE_1M_TX)
4026                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4027
4028         if (selected_phys & MGMT_PHY_LE_2M_TX)
4029                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4030
4031         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4032                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4033
4034         if (selected_phys & MGMT_PHY_LE_1M_RX)
4035                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4036
4037         if (selected_phys & MGMT_PHY_LE_2M_RX)
4038                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4039
4040         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4041                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4042
4043         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4044                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4045
4046         return 0;
4047 }
4048
4049 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4050                                  void *data, u16 len)
4051 {
4052         struct mgmt_cp_set_phy_configuration *cp = data;
4053         struct mgmt_pending_cmd *cmd;
4054         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4055         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4056         bool changed = false;
4057         int err;
4058
4059         bt_dev_dbg(hdev, "sock %p", sk);
4060
4061         configurable_phys = get_configurable_phys(hdev);
4062         supported_phys = get_supported_phys(hdev);
4063         selected_phys = __le32_to_cpu(cp->selected_phys);
4064
4065         if (selected_phys & ~supported_phys)
4066                 return mgmt_cmd_status(sk, hdev->id,
4067                                        MGMT_OP_SET_PHY_CONFIGURATION,
4068                                        MGMT_STATUS_INVALID_PARAMS);
4069
4070         unconfigure_phys = supported_phys & ~configurable_phys;
4071
4072         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4073                 return mgmt_cmd_status(sk, hdev->id,
4074                                        MGMT_OP_SET_PHY_CONFIGURATION,
4075                                        MGMT_STATUS_INVALID_PARAMS);
4076
4077         if (selected_phys == get_selected_phys(hdev))
4078                 return mgmt_cmd_complete(sk, hdev->id,
4079                                          MGMT_OP_SET_PHY_CONFIGURATION,
4080                                          0, NULL, 0);
4081
4082         hci_dev_lock(hdev);
4083
4084         if (!hdev_is_powered(hdev)) {
4085                 err = mgmt_cmd_status(sk, hdev->id,
4086                                       MGMT_OP_SET_PHY_CONFIGURATION,
4087                                       MGMT_STATUS_REJECTED);
4088                 goto unlock;
4089         }
4090
4091         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4092                 err = mgmt_cmd_status(sk, hdev->id,
4093                                       MGMT_OP_SET_PHY_CONFIGURATION,
4094                                       MGMT_STATUS_BUSY);
4095                 goto unlock;
4096         }
4097
4098         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4099                 pkt_type |= (HCI_DH3 | HCI_DM3);
4100         else
4101                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4102
4103         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4104                 pkt_type |= (HCI_DH5 | HCI_DM5);
4105         else
4106                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4107
4108         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4109                 pkt_type &= ~HCI_2DH1;
4110         else
4111                 pkt_type |= HCI_2DH1;
4112
4113         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4114                 pkt_type &= ~HCI_2DH3;
4115         else
4116                 pkt_type |= HCI_2DH3;
4117
4118         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4119                 pkt_type &= ~HCI_2DH5;
4120         else
4121                 pkt_type |= HCI_2DH5;
4122
4123         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4124                 pkt_type &= ~HCI_3DH1;
4125         else
4126                 pkt_type |= HCI_3DH1;
4127
4128         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4129                 pkt_type &= ~HCI_3DH3;
4130         else
4131                 pkt_type |= HCI_3DH3;
4132
4133         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4134                 pkt_type &= ~HCI_3DH5;
4135         else
4136                 pkt_type |= HCI_3DH5;
4137
4138         if (pkt_type != hdev->pkt_type) {
4139                 hdev->pkt_type = pkt_type;
4140                 changed = true;
4141         }
4142
4143         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4144             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4145                 if (changed)
4146                         mgmt_phy_configuration_changed(hdev, sk);
4147
4148                 err = mgmt_cmd_complete(sk, hdev->id,
4149                                         MGMT_OP_SET_PHY_CONFIGURATION,
4150                                         0, NULL, 0);
4151
4152                 goto unlock;
4153         }
4154
4155         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4156                                len);
4157         if (!cmd)
4158                 err = -ENOMEM;
4159         else
4160                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4161                                          set_default_phy_complete);
4162
4163         if (err < 0) {
4164                 err = mgmt_cmd_status(sk, hdev->id,
4165                                       MGMT_OP_SET_PHY_CONFIGURATION,
4166                                       MGMT_STATUS_FAILED);
4167
4168                 if (cmd)
4169                         mgmt_pending_remove(cmd);
4170         }
4171
4172 unlock:
4173         hci_dev_unlock(hdev);
4174
4175         return err;
4176 }
4177
4178 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4179                             u16 len)
4180 {
4181         int err = MGMT_STATUS_SUCCESS;
4182         struct mgmt_cp_set_blocked_keys *keys = data;
4183         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4184                                    sizeof(struct mgmt_blocked_key_info));
4185         u16 key_count, expected_len;
4186         int i;
4187
4188         bt_dev_dbg(hdev, "sock %p", sk);
4189
4190         key_count = __le16_to_cpu(keys->key_count);
4191         if (key_count > max_key_count) {
4192                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4193                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4194                                        MGMT_STATUS_INVALID_PARAMS);
4195         }
4196
4197         expected_len = struct_size(keys, keys, key_count);
4198         if (expected_len != len) {
4199                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4200                            expected_len, len);
4201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4202                                        MGMT_STATUS_INVALID_PARAMS);
4203         }
4204
4205         hci_dev_lock(hdev);
4206
4207         hci_blocked_keys_clear(hdev);
4208
4209         for (i = 0; i < key_count; ++i) {
4210                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4211
4212                 if (!b) {
4213                         err = MGMT_STATUS_NO_RESOURCES;
4214                         break;
4215                 }
4216
4217                 b->type = keys->keys[i].type;
4218                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4219                 list_add_rcu(&b->list, &hdev->blocked_keys);
4220         }
4221         hci_dev_unlock(hdev);
4222
4223         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4224                                 err, NULL, 0);
4225 }
4226
4227 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4228                                void *data, u16 len)
4229 {
4230         struct mgmt_mode *cp = data;
4231         int err;
4232         bool changed = false;
4233
4234         bt_dev_dbg(hdev, "sock %p", sk);
4235
4236         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4237                 return mgmt_cmd_status(sk, hdev->id,
4238                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4239                                        MGMT_STATUS_NOT_SUPPORTED);
4240
4241         if (cp->val != 0x00 && cp->val != 0x01)
4242                 return mgmt_cmd_status(sk, hdev->id,
4243                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4244                                        MGMT_STATUS_INVALID_PARAMS);
4245
4246         hci_dev_lock(hdev);
4247
4248         if (hdev_is_powered(hdev) &&
4249             !!cp->val != hci_dev_test_flag(hdev,
4250                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4251                 err = mgmt_cmd_status(sk, hdev->id,
4252                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4253                                       MGMT_STATUS_REJECTED);
4254                 goto unlock;
4255         }
4256
4257         if (cp->val)
4258                 changed = !hci_dev_test_and_set_flag(hdev,
4259                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4260         else
4261                 changed = hci_dev_test_and_clear_flag(hdev,
4262                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4263
4264         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4265         if (err < 0)
4266                 goto unlock;
4267
4268         if (changed)
4269                 err = new_settings(hdev, sk);
4270
4271 unlock:
4272         hci_dev_unlock(hdev);
4273         return err;
4274 }
4275
4276 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4277                                void *data, u16 data_len)
4278 {
4279         char buf[20];
4280         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4281         u16 cap_len = 0;
4282         u8 flags = 0;
4283         u8 tx_power_range[2];
4284
4285         bt_dev_dbg(hdev, "sock %p", sk);
4286
4287         memset(&buf, 0, sizeof(buf));
4288
4289         hci_dev_lock(hdev);
4290
4291         /* When the Read Simple Pairing Options command is supported, then
4292          * the remote public key validation is supported.
4293          *
4294          * Alternatively, when Microsoft extensions are available, they can
4295          * indicate support for public key validation as well.
4296          */
4297         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4298                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4299
4300         flags |= 0x02;          /* Remote public key validation (LE) */
4301
4302         /* When the Read Encryption Key Size command is supported, then the
4303          * encryption key size is enforced.
4304          */
4305         if (hdev->commands[20] & 0x10)
4306                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4307
4308         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4309
4310         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4311                                   &flags, 1);
4312
4313         /* When the Read Simple Pairing Options command is supported, then
4314          * also max encryption key size information is provided.
4315          */
4316         if (hdev->commands[41] & 0x08)
4317                 cap_len = eir_append_le16(rp->cap, cap_len,
4318                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4319                                           hdev->max_enc_key_size);
4320
4321         cap_len = eir_append_le16(rp->cap, cap_len,
4322                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4323                                   SMP_MAX_ENC_KEY_SIZE);
4324
4325         /* Append the min/max LE tx power parameters if we were able to fetch
4326          * it from the controller
4327          */
4328         if (hdev->commands[38] & 0x80) {
4329                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4330                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4331                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4332                                           tx_power_range, 2);
4333         }
4334
4335         rp->cap_len = cpu_to_le16(cap_len);
4336
4337         hci_dev_unlock(hdev);
4338
4339         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4340                                  rp, sizeof(*rp) + cap_len);
4341 }
4342
4343 #ifdef CONFIG_BT_FEATURE_DEBUG
4344 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4345 static const u8 debug_uuid[16] = {
4346         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4347         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4348 };
4349 #endif
4350
4351 /* 330859bc-7506-492d-9370-9a6f0614037f */
4352 static const u8 quality_report_uuid[16] = {
4353         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4354         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4355 };
4356
4357 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4358 static const u8 offload_codecs_uuid[16] = {
4359         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4360         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4361 };
4362
4363 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4364 static const u8 le_simultaneous_roles_uuid[16] = {
4365         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4366         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4367 };
4368
4369 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4370 static const u8 rpa_resolution_uuid[16] = {
4371         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4372         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4373 };
4374
4375 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4376 static const u8 iso_socket_uuid[16] = {
4377         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4378         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4379 };
4380
4381 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4382 static const u8 mgmt_mesh_uuid[16] = {
4383         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4384         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4385 };
4386
4387 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4388                                   void *data, u16 data_len)
4389 {
4390         struct mgmt_rp_read_exp_features_info *rp;
4391         size_t len;
4392         u16 idx = 0;
4393         u32 flags;
4394         int status;
4395
4396         bt_dev_dbg(hdev, "sock %p", sk);
4397
4398         /* Enough space for 7 features */
4399         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4400         rp = kzalloc(len, GFP_KERNEL);
4401         if (!rp)
4402                 return -ENOMEM;
4403
4404 #ifdef CONFIG_BT_FEATURE_DEBUG
4405         if (!hdev) {
4406                 flags = bt_dbg_get() ? BIT(0) : 0;
4407
4408                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4409                 rp->features[idx].flags = cpu_to_le32(flags);
4410                 idx++;
4411         }
4412 #endif
4413
4414         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4415                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4416                         flags = BIT(0);
4417                 else
4418                         flags = 0;
4419
4420                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4421                 rp->features[idx].flags = cpu_to_le32(flags);
4422                 idx++;
4423         }
4424
4425         if (hdev && ll_privacy_capable(hdev)) {
4426                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4427                         flags = BIT(0) | BIT(1);
4428                 else
4429                         flags = BIT(1);
4430
4431                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4432                 rp->features[idx].flags = cpu_to_le32(flags);
4433                 idx++;
4434         }
4435
4436         if (hdev && (aosp_has_quality_report(hdev) ||
4437                      hdev->set_quality_report)) {
4438                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4439                         flags = BIT(0);
4440                 else
4441                         flags = 0;
4442
4443                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4444                 rp->features[idx].flags = cpu_to_le32(flags);
4445                 idx++;
4446         }
4447
4448         if (hdev && hdev->get_data_path_id) {
4449                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4450                         flags = BIT(0);
4451                 else
4452                         flags = 0;
4453
4454                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4455                 rp->features[idx].flags = cpu_to_le32(flags);
4456                 idx++;
4457         }
4458
4459         if (IS_ENABLED(CONFIG_BT_LE)) {
4460                 flags = iso_enabled() ? BIT(0) : 0;
4461                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4462                 rp->features[idx].flags = cpu_to_le32(flags);
4463                 idx++;
4464         }
4465
4466         if (hdev && lmp_le_capable(hdev)) {
4467                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4468                         flags = BIT(0);
4469                 else
4470                         flags = 0;
4471
4472                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4473                 rp->features[idx].flags = cpu_to_le32(flags);
4474                 idx++;
4475         }
4476
4477         rp->feature_count = cpu_to_le16(idx);
4478
4479         /* After reading the experimental features information, enable
4480          * the events to update client on any future change.
4481          */
4482         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4483
4484         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4485                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4486                                    0, rp, sizeof(*rp) + (20 * idx));
4487
4488         kfree(rp);
4489         return status;
4490 }
4491
4492 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4493                                           struct sock *skip)
4494 {
4495         struct mgmt_ev_exp_feature_changed ev;
4496
4497         memset(&ev, 0, sizeof(ev));
4498         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4499         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4500
4501         // Do we need to be atomic with the conn_flags?
4502         if (enabled && privacy_mode_capable(hdev))
4503                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4504         else
4505                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4506
4507         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4508                                   &ev, sizeof(ev),
4509                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4510
4511 }
4512
4513 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4514                                bool enabled, struct sock *skip)
4515 {
4516         struct mgmt_ev_exp_feature_changed ev;
4517
4518         memset(&ev, 0, sizeof(ev));
4519         memcpy(ev.uuid, uuid, 16);
4520         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4521
4522         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4523                                   &ev, sizeof(ev),
4524                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4525 }
4526
4527 #define EXP_FEAT(_uuid, _set_func)      \
4528 {                                       \
4529         .uuid = _uuid,                  \
4530         .set_func = _set_func,          \
4531 }
4532
4533 /* The zero key uuid is special. Multiple exp features are set through it. */
4534 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4535                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4536 {
4537         struct mgmt_rp_set_exp_feature rp;
4538
4539         memset(rp.uuid, 0, 16);
4540         rp.flags = cpu_to_le32(0);
4541
4542 #ifdef CONFIG_BT_FEATURE_DEBUG
4543         if (!hdev) {
4544                 bool changed = bt_dbg_get();
4545
4546                 bt_dbg_set(false);
4547
4548                 if (changed)
4549                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4550         }
4551 #endif
4552
4553         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4554                 bool changed;
4555
4556                 changed = hci_dev_test_and_clear_flag(hdev,
4557                                                       HCI_ENABLE_LL_PRIVACY);
4558                 if (changed)
4559                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4560                                             sk);
4561         }
4562
4563         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4564
4565         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4566                                  MGMT_OP_SET_EXP_FEATURE, 0,
4567                                  &rp, sizeof(rp));
4568 }
4569
4570 #ifdef CONFIG_BT_FEATURE_DEBUG
4571 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4572                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4573 {
4574         struct mgmt_rp_set_exp_feature rp;
4575
4576         bool val, changed;
4577         int err;
4578
4579         /* Command requires to use the non-controller index */
4580         if (hdev)
4581                 return mgmt_cmd_status(sk, hdev->id,
4582                                        MGMT_OP_SET_EXP_FEATURE,
4583                                        MGMT_STATUS_INVALID_INDEX);
4584
4585         /* Parameters are limited to a single octet */
4586         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4587                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4588                                        MGMT_OP_SET_EXP_FEATURE,
4589                                        MGMT_STATUS_INVALID_PARAMS);
4590
4591         /* Only boolean on/off is supported */
4592         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4593                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4594                                        MGMT_OP_SET_EXP_FEATURE,
4595                                        MGMT_STATUS_INVALID_PARAMS);
4596
4597         val = !!cp->param[0];
4598         changed = val ? !bt_dbg_get() : bt_dbg_get();
4599         bt_dbg_set(val);
4600
4601         memcpy(rp.uuid, debug_uuid, 16);
4602         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4603
4604         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4605
4606         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4607                                 MGMT_OP_SET_EXP_FEATURE, 0,
4608                                 &rp, sizeof(rp));
4609
4610         if (changed)
4611                 exp_feature_changed(hdev, debug_uuid, val, sk);
4612
4613         return err;
4614 }
4615 #endif
4616
4617 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4618                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4619 {
4620         struct mgmt_rp_set_exp_feature rp;
4621         bool val, changed;
4622         int err;
4623
4624         /* Command requires to use the controller index */
4625         if (!hdev)
4626                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4627                                        MGMT_OP_SET_EXP_FEATURE,
4628                                        MGMT_STATUS_INVALID_INDEX);
4629
4630         /* Changes can only be made when controller is powered down */
4631         if (hdev_is_powered(hdev))
4632                 return mgmt_cmd_status(sk, hdev->id,
4633                                        MGMT_OP_SET_EXP_FEATURE,
4634                                        MGMT_STATUS_REJECTED);
4635
4636         /* Parameters are limited to a single octet */
4637         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4638                 return mgmt_cmd_status(sk, hdev->id,
4639                                        MGMT_OP_SET_EXP_FEATURE,
4640                                        MGMT_STATUS_INVALID_PARAMS);
4641
4642         /* Only boolean on/off is supported */
4643         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4644                 return mgmt_cmd_status(sk, hdev->id,
4645                                        MGMT_OP_SET_EXP_FEATURE,
4646                                        MGMT_STATUS_INVALID_PARAMS);
4647
4648         val = !!cp->param[0];
4649
4650         if (val) {
4651                 changed = !hci_dev_test_and_set_flag(hdev,
4652                                                      HCI_MESH_EXPERIMENTAL);
4653         } else {
4654                 hci_dev_clear_flag(hdev, HCI_MESH);
4655                 changed = hci_dev_test_and_clear_flag(hdev,
4656                                                       HCI_MESH_EXPERIMENTAL);
4657         }
4658
4659         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4660         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4661
4662         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4663
4664         err = mgmt_cmd_complete(sk, hdev->id,
4665                                 MGMT_OP_SET_EXP_FEATURE, 0,
4666                                 &rp, sizeof(rp));
4667
4668         if (changed)
4669                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4670
4671         return err;
4672 }
4673
4674 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4675                                    struct mgmt_cp_set_exp_feature *cp,
4676                                    u16 data_len)
4677 {
4678         struct mgmt_rp_set_exp_feature rp;
4679         bool val, changed;
4680         int err;
4681         u32 flags;
4682
4683         /* Command requires to use the controller index */
4684         if (!hdev)
4685                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4686                                        MGMT_OP_SET_EXP_FEATURE,
4687                                        MGMT_STATUS_INVALID_INDEX);
4688
4689         /* Changes can only be made when controller is powered down */
4690         if (hdev_is_powered(hdev))
4691                 return mgmt_cmd_status(sk, hdev->id,
4692                                        MGMT_OP_SET_EXP_FEATURE,
4693                                        MGMT_STATUS_REJECTED);
4694
4695         /* Parameters are limited to a single octet */
4696         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4697                 return mgmt_cmd_status(sk, hdev->id,
4698                                        MGMT_OP_SET_EXP_FEATURE,
4699                                        MGMT_STATUS_INVALID_PARAMS);
4700
4701         /* Only boolean on/off is supported */
4702         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4703                 return mgmt_cmd_status(sk, hdev->id,
4704                                        MGMT_OP_SET_EXP_FEATURE,
4705                                        MGMT_STATUS_INVALID_PARAMS);
4706
4707         val = !!cp->param[0];
4708
4709         if (val) {
4710                 changed = !hci_dev_test_and_set_flag(hdev,
4711                                                      HCI_ENABLE_LL_PRIVACY);
4712                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4713
4714                 /* Enable LL privacy + supported settings changed */
4715                 flags = BIT(0) | BIT(1);
4716         } else {
4717                 changed = hci_dev_test_and_clear_flag(hdev,
4718                                                       HCI_ENABLE_LL_PRIVACY);
4719
4720                 /* Disable LL privacy + supported settings changed */
4721                 flags = BIT(1);
4722         }
4723
4724         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4725         rp.flags = cpu_to_le32(flags);
4726
4727         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4728
4729         err = mgmt_cmd_complete(sk, hdev->id,
4730                                 MGMT_OP_SET_EXP_FEATURE, 0,
4731                                 &rp, sizeof(rp));
4732
4733         if (changed)
4734                 exp_ll_privacy_feature_changed(val, hdev, sk);
4735
4736         return err;
4737 }
4738
4739 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4740                                    struct mgmt_cp_set_exp_feature *cp,
4741                                    u16 data_len)
4742 {
4743         struct mgmt_rp_set_exp_feature rp;
4744         bool val, changed;
4745         int err;
4746
4747         /* Command requires to use a valid controller index */
4748         if (!hdev)
4749                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4750                                        MGMT_OP_SET_EXP_FEATURE,
4751                                        MGMT_STATUS_INVALID_INDEX);
4752
4753         /* Parameters are limited to a single octet */
4754         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4755                 return mgmt_cmd_status(sk, hdev->id,
4756                                        MGMT_OP_SET_EXP_FEATURE,
4757                                        MGMT_STATUS_INVALID_PARAMS);
4758
4759         /* Only boolean on/off is supported */
4760         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4761                 return mgmt_cmd_status(sk, hdev->id,
4762                                        MGMT_OP_SET_EXP_FEATURE,
4763                                        MGMT_STATUS_INVALID_PARAMS);
4764
4765         hci_req_sync_lock(hdev);
4766
4767         val = !!cp->param[0];
4768         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4769
4770         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4771                 err = mgmt_cmd_status(sk, hdev->id,
4772                                       MGMT_OP_SET_EXP_FEATURE,
4773                                       MGMT_STATUS_NOT_SUPPORTED);
4774                 goto unlock_quality_report;
4775         }
4776
4777         if (changed) {
4778                 if (hdev->set_quality_report)
4779                         err = hdev->set_quality_report(hdev, val);
4780                 else
4781                         err = aosp_set_quality_report(hdev, val);
4782
4783                 if (err) {
4784                         err = mgmt_cmd_status(sk, hdev->id,
4785                                               MGMT_OP_SET_EXP_FEATURE,
4786                                               MGMT_STATUS_FAILED);
4787                         goto unlock_quality_report;
4788                 }
4789
4790                 if (val)
4791                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4792                 else
4793                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4794         }
4795
4796         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4797
4798         memcpy(rp.uuid, quality_report_uuid, 16);
4799         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4800         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4801
4802         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4803                                 &rp, sizeof(rp));
4804
4805         if (changed)
4806                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4807
4808 unlock_quality_report:
4809         hci_req_sync_unlock(hdev);
4810         return err;
4811 }
4812
4813 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4814                                   struct mgmt_cp_set_exp_feature *cp,
4815                                   u16 data_len)
4816 {
4817         bool val, changed;
4818         int err;
4819         struct mgmt_rp_set_exp_feature rp;
4820
4821         /* Command requires to use a valid controller index */
4822         if (!hdev)
4823                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4824                                        MGMT_OP_SET_EXP_FEATURE,
4825                                        MGMT_STATUS_INVALID_INDEX);
4826
4827         /* Parameters are limited to a single octet */
4828         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4829                 return mgmt_cmd_status(sk, hdev->id,
4830                                        MGMT_OP_SET_EXP_FEATURE,
4831                                        MGMT_STATUS_INVALID_PARAMS);
4832
4833         /* Only boolean on/off is supported */
4834         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4835                 return mgmt_cmd_status(sk, hdev->id,
4836                                        MGMT_OP_SET_EXP_FEATURE,
4837                                        MGMT_STATUS_INVALID_PARAMS);
4838
4839         val = !!cp->param[0];
4840         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4841
4842         if (!hdev->get_data_path_id) {
4843                 return mgmt_cmd_status(sk, hdev->id,
4844                                        MGMT_OP_SET_EXP_FEATURE,
4845                                        MGMT_STATUS_NOT_SUPPORTED);
4846         }
4847
4848         if (changed) {
4849                 if (val)
4850                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4851                 else
4852                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4853         }
4854
4855         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4856                     val, changed);
4857
4858         memcpy(rp.uuid, offload_codecs_uuid, 16);
4859         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4860         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4861         err = mgmt_cmd_complete(sk, hdev->id,
4862                                 MGMT_OP_SET_EXP_FEATURE, 0,
4863                                 &rp, sizeof(rp));
4864
4865         if (changed)
4866                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4867
4868         return err;
4869 }
4870
4871 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4872                                           struct mgmt_cp_set_exp_feature *cp,
4873                                           u16 data_len)
4874 {
4875         bool val, changed;
4876         int err;
4877         struct mgmt_rp_set_exp_feature rp;
4878
4879         /* Command requires to use a valid controller index */
4880         if (!hdev)
4881                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4882                                        MGMT_OP_SET_EXP_FEATURE,
4883                                        MGMT_STATUS_INVALID_INDEX);
4884
4885         /* Parameters are limited to a single octet */
4886         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4887                 return mgmt_cmd_status(sk, hdev->id,
4888                                        MGMT_OP_SET_EXP_FEATURE,
4889                                        MGMT_STATUS_INVALID_PARAMS);
4890
4891         /* Only boolean on/off is supported */
4892         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4893                 return mgmt_cmd_status(sk, hdev->id,
4894                                        MGMT_OP_SET_EXP_FEATURE,
4895                                        MGMT_STATUS_INVALID_PARAMS);
4896
4897         val = !!cp->param[0];
4898         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4899
4900         if (!hci_dev_le_state_simultaneous(hdev)) {
4901                 return mgmt_cmd_status(sk, hdev->id,
4902                                        MGMT_OP_SET_EXP_FEATURE,
4903                                        MGMT_STATUS_NOT_SUPPORTED);
4904         }
4905
4906         if (changed) {
4907                 if (val)
4908                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4909                 else
4910                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4911         }
4912
4913         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4914                     val, changed);
4915
4916         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4917         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4918         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4919         err = mgmt_cmd_complete(sk, hdev->id,
4920                                 MGMT_OP_SET_EXP_FEATURE, 0,
4921                                 &rp, sizeof(rp));
4922
4923         if (changed)
4924                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4925
4926         return err;
4927 }
4928
4929 #ifdef CONFIG_BT_LE
4930 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4931                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4932 {
4933         struct mgmt_rp_set_exp_feature rp;
4934         bool val, changed = false;
4935         int err;
4936
4937         /* Command requires to use the non-controller index */
4938         if (hdev)
4939                 return mgmt_cmd_status(sk, hdev->id,
4940                                        MGMT_OP_SET_EXP_FEATURE,
4941                                        MGMT_STATUS_INVALID_INDEX);
4942
4943         /* Parameters are limited to a single octet */
4944         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4945                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4946                                        MGMT_OP_SET_EXP_FEATURE,
4947                                        MGMT_STATUS_INVALID_PARAMS);
4948
4949         /* Only boolean on/off is supported */
4950         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4951                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4952                                        MGMT_OP_SET_EXP_FEATURE,
4953                                        MGMT_STATUS_INVALID_PARAMS);
4954
4955         val = cp->param[0] ? true : false;
4956         if (val)
4957                 err = iso_init();
4958         else
4959                 err = iso_exit();
4960
4961         if (!err)
4962                 changed = true;
4963
4964         memcpy(rp.uuid, iso_socket_uuid, 16);
4965         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4966
4967         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4968
4969         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4970                                 MGMT_OP_SET_EXP_FEATURE, 0,
4971                                 &rp, sizeof(rp));
4972
4973         if (changed)
4974                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4975
4976         return err;
4977 }
4978 #endif
4979
4980 static const struct mgmt_exp_feature {
4981         const u8 *uuid;
4982         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4983                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4984 } exp_features[] = {
4985         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4986 #ifdef CONFIG_BT_FEATURE_DEBUG
4987         EXP_FEAT(debug_uuid, set_debug_func),
4988 #endif
4989         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4990         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4991         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4992         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4993         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4994 #ifdef CONFIG_BT_LE
4995         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4996 #endif
4997
4998         /* end with a null feature */
4999         EXP_FEAT(NULL, NULL)
5000 };
5001
5002 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5003                            void *data, u16 data_len)
5004 {
5005         struct mgmt_cp_set_exp_feature *cp = data;
5006         size_t i = 0;
5007
5008         bt_dev_dbg(hdev, "sock %p", sk);
5009
5010         for (i = 0; exp_features[i].uuid; i++) {
5011                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5012                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5013         }
5014
5015         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5016                                MGMT_OP_SET_EXP_FEATURE,
5017                                MGMT_STATUS_NOT_SUPPORTED);
5018 }
5019
5020 static u32 get_params_flags(struct hci_dev *hdev,
5021                             struct hci_conn_params *params)
5022 {
5023         u32 flags = hdev->conn_flags;
5024
5025         /* Devices using RPAs can only be programmed in the acceptlist if
5026          * LL Privacy has been enable otherwise they cannot mark
5027          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5028          */
5029         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5030             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5031                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5032
5033         return flags;
5034 }
5035
5036 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5037                             u16 data_len)
5038 {
5039         struct mgmt_cp_get_device_flags *cp = data;
5040         struct mgmt_rp_get_device_flags rp;
5041         struct bdaddr_list_with_flags *br_params;
5042         struct hci_conn_params *params;
5043         u32 supported_flags;
5044         u32 current_flags = 0;
5045         u8 status = MGMT_STATUS_INVALID_PARAMS;
5046
5047         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5048                    &cp->addr.bdaddr, cp->addr.type);
5049
5050         hci_dev_lock(hdev);
5051
5052         supported_flags = hdev->conn_flags;
5053
5054         memset(&rp, 0, sizeof(rp));
5055
5056         if (cp->addr.type == BDADDR_BREDR) {
5057                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5058                                                               &cp->addr.bdaddr,
5059                                                               cp->addr.type);
5060                 if (!br_params)
5061                         goto done;
5062
5063                 current_flags = br_params->flags;
5064         } else {
5065                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5066                                                 le_addr_type(cp->addr.type));
5067                 if (!params)
5068                         goto done;
5069
5070                 supported_flags = get_params_flags(hdev, params);
5071                 current_flags = params->flags;
5072         }
5073
5074         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5075         rp.addr.type = cp->addr.type;
5076         rp.supported_flags = cpu_to_le32(supported_flags);
5077         rp.current_flags = cpu_to_le32(current_flags);
5078
5079         status = MGMT_STATUS_SUCCESS;
5080
5081 done:
5082         hci_dev_unlock(hdev);
5083
5084         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5085                                 &rp, sizeof(rp));
5086 }
5087
5088 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5089                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5090                                  u32 supported_flags, u32 current_flags)
5091 {
5092         struct mgmt_ev_device_flags_changed ev;
5093
5094         bacpy(&ev.addr.bdaddr, bdaddr);
5095         ev.addr.type = bdaddr_type;
5096         ev.supported_flags = cpu_to_le32(supported_flags);
5097         ev.current_flags = cpu_to_le32(current_flags);
5098
5099         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5100 }
5101
5102 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5103                             u16 len)
5104 {
5105         struct mgmt_cp_set_device_flags *cp = data;
5106         struct bdaddr_list_with_flags *br_params;
5107         struct hci_conn_params *params;
5108         u8 status = MGMT_STATUS_INVALID_PARAMS;
5109         u32 supported_flags;
5110         u32 current_flags = __le32_to_cpu(cp->current_flags);
5111
5112         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5113                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5114
5115         // We should take hci_dev_lock() early, I think.. conn_flags can change
5116         supported_flags = hdev->conn_flags;
5117
5118         if ((supported_flags | current_flags) != supported_flags) {
5119                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5120                             current_flags, supported_flags);
5121                 goto done;
5122         }
5123
5124         hci_dev_lock(hdev);
5125
5126         if (cp->addr.type == BDADDR_BREDR) {
5127                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5128                                                               &cp->addr.bdaddr,
5129                                                               cp->addr.type);
5130
5131                 if (br_params) {
5132                         br_params->flags = current_flags;
5133                         status = MGMT_STATUS_SUCCESS;
5134                 } else {
5135                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5136                                     &cp->addr.bdaddr, cp->addr.type);
5137                 }
5138
5139                 goto unlock;
5140         }
5141
5142         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5143                                         le_addr_type(cp->addr.type));
5144         if (!params) {
5145                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5146                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5147                 goto unlock;
5148         }
5149
5150         supported_flags = get_params_flags(hdev, params);
5151
5152         if ((supported_flags | current_flags) != supported_flags) {
5153                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5154                             current_flags, supported_flags);
5155                 goto unlock;
5156         }
5157
5158         params->flags = current_flags;
5159         status = MGMT_STATUS_SUCCESS;
5160
5161         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5162          * has been set.
5163          */
5164         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5165                 hci_update_passive_scan(hdev);
5166
5167 unlock:
5168         hci_dev_unlock(hdev);
5169
5170 done:
5171         if (status == MGMT_STATUS_SUCCESS)
5172                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5173                                      supported_flags, current_flags);
5174
5175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5176                                  &cp->addr, sizeof(cp->addr));
5177 }
5178
5179 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5180                                    u16 handle)
5181 {
5182         struct mgmt_ev_adv_monitor_added ev;
5183
5184         ev.monitor_handle = cpu_to_le16(handle);
5185
5186         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5187 }
5188
5189 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5190 {
5191         struct mgmt_ev_adv_monitor_removed ev;
5192         struct mgmt_pending_cmd *cmd;
5193         struct sock *sk_skip = NULL;
5194         struct mgmt_cp_remove_adv_monitor *cp;
5195
5196         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5197         if (cmd) {
5198                 cp = cmd->param;
5199
5200                 if (cp->monitor_handle)
5201                         sk_skip = cmd->sk;
5202         }
5203
5204         ev.monitor_handle = cpu_to_le16(handle);
5205
5206         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5207 }
5208
5209 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5210                                  void *data, u16 len)
5211 {
5212         struct adv_monitor *monitor = NULL;
5213         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5214         int handle, err;
5215         size_t rp_size = 0;
5216         __u32 supported = 0;
5217         __u32 enabled = 0;
5218         __u16 num_handles = 0;
5219         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5220
5221         BT_DBG("request for %s", hdev->name);
5222
5223         hci_dev_lock(hdev);
5224
5225         if (msft_monitor_supported(hdev))
5226                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5227
5228         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5229                 handles[num_handles++] = monitor->handle;
5230
5231         hci_dev_unlock(hdev);
5232
5233         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5234         rp = kmalloc(rp_size, GFP_KERNEL);
5235         if (!rp)
5236                 return -ENOMEM;
5237
5238         /* All supported features are currently enabled */
5239         enabled = supported;
5240
5241         rp->supported_features = cpu_to_le32(supported);
5242         rp->enabled_features = cpu_to_le32(enabled);
5243         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5244         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5245         rp->num_handles = cpu_to_le16(num_handles);
5246         if (num_handles)
5247                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5248
5249         err = mgmt_cmd_complete(sk, hdev->id,
5250                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5251                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5252
5253         kfree(rp);
5254
5255         return err;
5256 }
5257
5258 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5259                                                    void *data, int status)
5260 {
5261         struct mgmt_rp_add_adv_patterns_monitor rp;
5262         struct mgmt_pending_cmd *cmd = data;
5263         struct adv_monitor *monitor = cmd->user_data;
5264
5265         hci_dev_lock(hdev);
5266
5267         rp.monitor_handle = cpu_to_le16(monitor->handle);
5268
5269         if (!status) {
5270                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5271                 hdev->adv_monitors_cnt++;
5272                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5273                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5274                 hci_update_passive_scan(hdev);
5275         }
5276
5277         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5278                           mgmt_status(status), &rp, sizeof(rp));
5279         mgmt_pending_remove(cmd);
5280
5281         hci_dev_unlock(hdev);
5282         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5283                    rp.monitor_handle, status);
5284 }
5285
5286 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5287 {
5288         struct mgmt_pending_cmd *cmd = data;
5289         struct adv_monitor *monitor = cmd->user_data;
5290
5291         return hci_add_adv_monitor(hdev, monitor);
5292 }
5293
5294 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5295                                       struct adv_monitor *m, u8 status,
5296                                       void *data, u16 len, u16 op)
5297 {
5298         struct mgmt_pending_cmd *cmd;
5299         int err;
5300
5301         hci_dev_lock(hdev);
5302
5303         if (status)
5304                 goto unlock;
5305
5306         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5307             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5308             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5309             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5310                 status = MGMT_STATUS_BUSY;
5311                 goto unlock;
5312         }
5313
5314         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5315         if (!cmd) {
5316                 status = MGMT_STATUS_NO_RESOURCES;
5317                 goto unlock;
5318         }
5319
5320         cmd->user_data = m;
5321         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5322                                  mgmt_add_adv_patterns_monitor_complete);
5323         if (err) {
5324                 if (err == -ENOMEM)
5325                         status = MGMT_STATUS_NO_RESOURCES;
5326                 else
5327                         status = MGMT_STATUS_FAILED;
5328
5329                 goto unlock;
5330         }
5331
5332         hci_dev_unlock(hdev);
5333
5334         return 0;
5335
5336 unlock:
5337         hci_free_adv_monitor(hdev, m);
5338         hci_dev_unlock(hdev);
5339         return mgmt_cmd_status(sk, hdev->id, op, status);
5340 }
5341
5342 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5343                                    struct mgmt_adv_rssi_thresholds *rssi)
5344 {
5345         if (rssi) {
5346                 m->rssi.low_threshold = rssi->low_threshold;
5347                 m->rssi.low_threshold_timeout =
5348                     __le16_to_cpu(rssi->low_threshold_timeout);
5349                 m->rssi.high_threshold = rssi->high_threshold;
5350                 m->rssi.high_threshold_timeout =
5351                     __le16_to_cpu(rssi->high_threshold_timeout);
5352                 m->rssi.sampling_period = rssi->sampling_period;
5353         } else {
5354                 /* Default values. These numbers are the least constricting
5355                  * parameters for MSFT API to work, so it behaves as if there
5356                  * are no rssi parameter to consider. May need to be changed
5357                  * if other API are to be supported.
5358                  */
5359                 m->rssi.low_threshold = -127;
5360                 m->rssi.low_threshold_timeout = 60;
5361                 m->rssi.high_threshold = -127;
5362                 m->rssi.high_threshold_timeout = 0;
5363                 m->rssi.sampling_period = 0;
5364         }
5365 }
5366
5367 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5368                                     struct mgmt_adv_pattern *patterns)
5369 {
5370         u8 offset = 0, length = 0;
5371         struct adv_pattern *p = NULL;
5372         int i;
5373
5374         for (i = 0; i < pattern_count; i++) {
5375                 offset = patterns[i].offset;
5376                 length = patterns[i].length;
5377                 if (offset >= HCI_MAX_AD_LENGTH ||
5378                     length > HCI_MAX_AD_LENGTH ||
5379                     (offset + length) > HCI_MAX_AD_LENGTH)
5380                         return MGMT_STATUS_INVALID_PARAMS;
5381
5382                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5383                 if (!p)
5384                         return MGMT_STATUS_NO_RESOURCES;
5385
5386                 p->ad_type = patterns[i].ad_type;
5387                 p->offset = patterns[i].offset;
5388                 p->length = patterns[i].length;
5389                 memcpy(p->value, patterns[i].value, p->length);
5390
5391                 INIT_LIST_HEAD(&p->list);
5392                 list_add(&p->list, &m->patterns);
5393         }
5394
5395         return MGMT_STATUS_SUCCESS;
5396 }
5397
5398 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5399                                     void *data, u16 len)
5400 {
5401         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5402         struct adv_monitor *m = NULL;
5403         u8 status = MGMT_STATUS_SUCCESS;
5404         size_t expected_size = sizeof(*cp);
5405
5406         BT_DBG("request for %s", hdev->name);
5407
5408         if (len <= sizeof(*cp)) {
5409                 status = MGMT_STATUS_INVALID_PARAMS;
5410                 goto done;
5411         }
5412
5413         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5414         if (len != expected_size) {
5415                 status = MGMT_STATUS_INVALID_PARAMS;
5416                 goto done;
5417         }
5418
5419         m = kzalloc(sizeof(*m), GFP_KERNEL);
5420         if (!m) {
5421                 status = MGMT_STATUS_NO_RESOURCES;
5422                 goto done;
5423         }
5424
5425         INIT_LIST_HEAD(&m->patterns);
5426
5427         parse_adv_monitor_rssi(m, NULL);
5428         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5429
5430 done:
5431         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5432                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5433 }
5434
5435 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5436                                          void *data, u16 len)
5437 {
5438         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5439         struct adv_monitor *m = NULL;
5440         u8 status = MGMT_STATUS_SUCCESS;
5441         size_t expected_size = sizeof(*cp);
5442
5443         BT_DBG("request for %s", hdev->name);
5444
5445         if (len <= sizeof(*cp)) {
5446                 status = MGMT_STATUS_INVALID_PARAMS;
5447                 goto done;
5448         }
5449
5450         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5451         if (len != expected_size) {
5452                 status = MGMT_STATUS_INVALID_PARAMS;
5453                 goto done;
5454         }
5455
5456         m = kzalloc(sizeof(*m), GFP_KERNEL);
5457         if (!m) {
5458                 status = MGMT_STATUS_NO_RESOURCES;
5459                 goto done;
5460         }
5461
5462         INIT_LIST_HEAD(&m->patterns);
5463
5464         parse_adv_monitor_rssi(m, &cp->rssi);
5465         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5466
5467 done:
5468         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5469                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5470 }
5471
5472 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5473                                              void *data, int status)
5474 {
5475         struct mgmt_rp_remove_adv_monitor rp;
5476         struct mgmt_pending_cmd *cmd = data;
5477         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5478
5479         hci_dev_lock(hdev);
5480
5481         rp.monitor_handle = cp->monitor_handle;
5482
5483         if (!status)
5484                 hci_update_passive_scan(hdev);
5485
5486         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5487                           mgmt_status(status), &rp, sizeof(rp));
5488         mgmt_pending_remove(cmd);
5489
5490         hci_dev_unlock(hdev);
5491         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5492                    rp.monitor_handle, status);
5493 }
5494
5495 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5496 {
5497         struct mgmt_pending_cmd *cmd = data;
5498         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5499         u16 handle = __le16_to_cpu(cp->monitor_handle);
5500
5501         if (!handle)
5502                 return hci_remove_all_adv_monitor(hdev);
5503
5504         return hci_remove_single_adv_monitor(hdev, handle);
5505 }
5506
5507 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5508                               void *data, u16 len)
5509 {
5510         struct mgmt_pending_cmd *cmd;
5511         int err, status;
5512
5513         hci_dev_lock(hdev);
5514
5515         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5516             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5517             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5518             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5519                 status = MGMT_STATUS_BUSY;
5520                 goto unlock;
5521         }
5522
5523         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5524         if (!cmd) {
5525                 status = MGMT_STATUS_NO_RESOURCES;
5526                 goto unlock;
5527         }
5528
5529         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5530                                  mgmt_remove_adv_monitor_complete);
5531
5532         if (err) {
5533                 mgmt_pending_remove(cmd);
5534
5535                 if (err == -ENOMEM)
5536                         status = MGMT_STATUS_NO_RESOURCES;
5537                 else
5538                         status = MGMT_STATUS_FAILED;
5539
5540                 goto unlock;
5541         }
5542
5543         hci_dev_unlock(hdev);
5544
5545         return 0;
5546
5547 unlock:
5548         hci_dev_unlock(hdev);
5549         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5550                                status);
5551 }
5552
5553 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5554 {
5555         struct mgmt_rp_read_local_oob_data mgmt_rp;
5556         size_t rp_size = sizeof(mgmt_rp);
5557         struct mgmt_pending_cmd *cmd = data;
5558         struct sk_buff *skb = cmd->skb;
5559         u8 status = mgmt_status(err);
5560
5561         if (!status) {
5562                 if (!skb)
5563                         status = MGMT_STATUS_FAILED;
5564                 else if (IS_ERR(skb))
5565                         status = mgmt_status(PTR_ERR(skb));
5566                 else
5567                         status = mgmt_status(skb->data[0]);
5568         }
5569
5570         bt_dev_dbg(hdev, "status %d", status);
5571
5572         if (status) {
5573                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5574                 goto remove;
5575         }
5576
5577         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5578
5579         if (!bredr_sc_enabled(hdev)) {
5580                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5581
5582                 if (skb->len < sizeof(*rp)) {
5583                         mgmt_cmd_status(cmd->sk, hdev->id,
5584                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5585                                         MGMT_STATUS_FAILED);
5586                         goto remove;
5587                 }
5588
5589                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5590                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5591
5592                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5593         } else {
5594                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5595
5596                 if (skb->len < sizeof(*rp)) {
5597                         mgmt_cmd_status(cmd->sk, hdev->id,
5598                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5599                                         MGMT_STATUS_FAILED);
5600                         goto remove;
5601                 }
5602
5603                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5604                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5605
5606                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5607                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5608         }
5609
5610         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5611                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5612
5613 remove:
5614         if (skb && !IS_ERR(skb))
5615                 kfree_skb(skb);
5616
5617         mgmt_pending_free(cmd);
5618 }
5619
5620 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5621 {
5622         struct mgmt_pending_cmd *cmd = data;
5623
5624         if (bredr_sc_enabled(hdev))
5625                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5626         else
5627                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5628
5629         if (IS_ERR(cmd->skb))
5630                 return PTR_ERR(cmd->skb);
5631         else
5632                 return 0;
5633 }
5634
5635 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5636                                void *data, u16 data_len)
5637 {
5638         struct mgmt_pending_cmd *cmd;
5639         int err;
5640
5641         bt_dev_dbg(hdev, "sock %p", sk);
5642
5643         hci_dev_lock(hdev);
5644
5645         if (!hdev_is_powered(hdev)) {
5646                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5647                                       MGMT_STATUS_NOT_POWERED);
5648                 goto unlock;
5649         }
5650
5651         if (!lmp_ssp_capable(hdev)) {
5652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5653                                       MGMT_STATUS_NOT_SUPPORTED);
5654                 goto unlock;
5655         }
5656
5657         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5658         if (!cmd)
5659                 err = -ENOMEM;
5660         else
5661                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5662                                          read_local_oob_data_complete);
5663
5664         if (err < 0) {
5665                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5666                                       MGMT_STATUS_FAILED);
5667
5668                 if (cmd)
5669                         mgmt_pending_free(cmd);
5670         }
5671
5672 unlock:
5673         hci_dev_unlock(hdev);
5674         return err;
5675 }
5676
5677 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5678                                void *data, u16 len)
5679 {
5680         struct mgmt_addr_info *addr = data;
5681         int err;
5682
5683         bt_dev_dbg(hdev, "sock %p", sk);
5684
5685         if (!bdaddr_type_is_valid(addr->type))
5686                 return mgmt_cmd_complete(sk, hdev->id,
5687                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5688                                          MGMT_STATUS_INVALID_PARAMS,
5689                                          addr, sizeof(*addr));
5690
5691         hci_dev_lock(hdev);
5692
5693         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5694                 struct mgmt_cp_add_remote_oob_data *cp = data;
5695                 u8 status;
5696
5697                 if (cp->addr.type != BDADDR_BREDR) {
5698                         err = mgmt_cmd_complete(sk, hdev->id,
5699                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5700                                                 MGMT_STATUS_INVALID_PARAMS,
5701                                                 &cp->addr, sizeof(cp->addr));
5702                         goto unlock;
5703                 }
5704
5705                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5706                                               cp->addr.type, cp->hash,
5707                                               cp->rand, NULL, NULL);
5708                 if (err < 0)
5709                         status = MGMT_STATUS_FAILED;
5710                 else
5711                         status = MGMT_STATUS_SUCCESS;
5712
5713                 err = mgmt_cmd_complete(sk, hdev->id,
5714                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5715                                         &cp->addr, sizeof(cp->addr));
5716         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5717                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5718                 u8 *rand192, *hash192, *rand256, *hash256;
5719                 u8 status;
5720
5721                 if (bdaddr_type_is_le(cp->addr.type)) {
5722                         /* Enforce zero-valued 192-bit parameters as
5723                          * long as legacy SMP OOB isn't implemented.
5724                          */
5725                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5726                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5727                                 err = mgmt_cmd_complete(sk, hdev->id,
5728                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5729                                                         MGMT_STATUS_INVALID_PARAMS,
5730                                                         addr, sizeof(*addr));
5731                                 goto unlock;
5732                         }
5733
5734                         rand192 = NULL;
5735                         hash192 = NULL;
5736                 } else {
5737                         /* In case one of the P-192 values is set to zero,
5738                          * then just disable OOB data for P-192.
5739                          */
5740                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5741                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5742                                 rand192 = NULL;
5743                                 hash192 = NULL;
5744                         } else {
5745                                 rand192 = cp->rand192;
5746                                 hash192 = cp->hash192;
5747                         }
5748                 }
5749
5750                 /* In case one of the P-256 values is set to zero, then just
5751                  * disable OOB data for P-256.
5752                  */
5753                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5754                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5755                         rand256 = NULL;
5756                         hash256 = NULL;
5757                 } else {
5758                         rand256 = cp->rand256;
5759                         hash256 = cp->hash256;
5760                 }
5761
5762                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5763                                               cp->addr.type, hash192, rand192,
5764                                               hash256, rand256);
5765                 if (err < 0)
5766                         status = MGMT_STATUS_FAILED;
5767                 else
5768                         status = MGMT_STATUS_SUCCESS;
5769
5770                 err = mgmt_cmd_complete(sk, hdev->id,
5771                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5772                                         status, &cp->addr, sizeof(cp->addr));
5773         } else {
5774                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5775                            len);
5776                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5777                                       MGMT_STATUS_INVALID_PARAMS);
5778         }
5779
5780 unlock:
5781         hci_dev_unlock(hdev);
5782         return err;
5783 }
5784
5785 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5786                                   void *data, u16 len)
5787 {
5788         struct mgmt_cp_remove_remote_oob_data *cp = data;
5789         u8 status;
5790         int err;
5791
5792         bt_dev_dbg(hdev, "sock %p", sk);
5793
5794         if (cp->addr.type != BDADDR_BREDR)
5795                 return mgmt_cmd_complete(sk, hdev->id,
5796                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5797                                          MGMT_STATUS_INVALID_PARAMS,
5798                                          &cp->addr, sizeof(cp->addr));
5799
5800         hci_dev_lock(hdev);
5801
5802         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5803                 hci_remote_oob_data_clear(hdev);
5804                 status = MGMT_STATUS_SUCCESS;
5805                 goto done;
5806         }
5807
5808         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5809         if (err < 0)
5810                 status = MGMT_STATUS_INVALID_PARAMS;
5811         else
5812                 status = MGMT_STATUS_SUCCESS;
5813
5814 done:
5815         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5816                                 status, &cp->addr, sizeof(cp->addr));
5817
5818         hci_dev_unlock(hdev);
5819         return err;
5820 }
5821
5822 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5823 {
5824         struct mgmt_pending_cmd *cmd;
5825
5826         bt_dev_dbg(hdev, "status %u", status);
5827
5828         hci_dev_lock(hdev);
5829
5830         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5831         if (!cmd)
5832                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5833
5834         if (!cmd)
5835                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5836
5837         if (cmd) {
5838                 cmd->cmd_complete(cmd, mgmt_status(status));
5839                 mgmt_pending_remove(cmd);
5840         }
5841
5842         hci_dev_unlock(hdev);
5843 }
5844
5845 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5846                                     uint8_t *mgmt_status)
5847 {
5848         switch (type) {
5849         case DISCOV_TYPE_LE:
5850                 *mgmt_status = mgmt_le_support(hdev);
5851                 if (*mgmt_status)
5852                         return false;
5853                 break;
5854         case DISCOV_TYPE_INTERLEAVED:
5855                 *mgmt_status = mgmt_le_support(hdev);
5856                 if (*mgmt_status)
5857                         return false;
5858                 fallthrough;
5859         case DISCOV_TYPE_BREDR:
5860                 *mgmt_status = mgmt_bredr_support(hdev);
5861                 if (*mgmt_status)
5862                         return false;
5863                 break;
5864         default:
5865                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5866                 return false;
5867         }
5868
5869         return true;
5870 }
5871
5872 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5873 {
5874         struct mgmt_pending_cmd *cmd = data;
5875
5876         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5877             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5878             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5879                 return;
5880
5881         bt_dev_dbg(hdev, "err %d", err);
5882
5883         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5884                           cmd->param, 1);
5885         mgmt_pending_remove(cmd);
5886
5887         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5888                                 DISCOVERY_FINDING);
5889 }
5890
5891 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5892 {
5893         return hci_start_discovery_sync(hdev);
5894 }
5895
5896 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5897                                     u16 op, void *data, u16 len)
5898 {
5899         struct mgmt_cp_start_discovery *cp = data;
5900         struct mgmt_pending_cmd *cmd;
5901         u8 status;
5902         int err;
5903
5904         bt_dev_dbg(hdev, "sock %p", sk);
5905
5906         hci_dev_lock(hdev);
5907
5908         if (!hdev_is_powered(hdev)) {
5909                 err = mgmt_cmd_complete(sk, hdev->id, op,
5910                                         MGMT_STATUS_NOT_POWERED,
5911                                         &cp->type, sizeof(cp->type));
5912                 goto failed;
5913         }
5914
5915         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5916             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5917                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5918                                         &cp->type, sizeof(cp->type));
5919                 goto failed;
5920         }
5921
5922         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5923                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5924                                         &cp->type, sizeof(cp->type));
5925                 goto failed;
5926         }
5927
5928         /* Can't start discovery when it is paused */
5929         if (hdev->discovery_paused) {
5930                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5931                                         &cp->type, sizeof(cp->type));
5932                 goto failed;
5933         }
5934
5935         /* Clear the discovery filter first to free any previously
5936          * allocated memory for the UUID list.
5937          */
5938         hci_discovery_filter_clear(hdev);
5939
5940         hdev->discovery.type = cp->type;
5941         hdev->discovery.report_invalid_rssi = false;
5942         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5943                 hdev->discovery.limited = true;
5944         else
5945                 hdev->discovery.limited = false;
5946
5947         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5948         if (!cmd) {
5949                 err = -ENOMEM;
5950                 goto failed;
5951         }
5952
5953         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5954                                  start_discovery_complete);
5955         if (err < 0) {
5956                 mgmt_pending_remove(cmd);
5957                 goto failed;
5958         }
5959
5960         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5961
5962 failed:
5963         hci_dev_unlock(hdev);
5964         return err;
5965 }
5966
5967 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5968                            void *data, u16 len)
5969 {
5970         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5971                                         data, len);
5972 }
5973
5974 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5975                                    void *data, u16 len)
5976 {
5977         return start_discovery_internal(sk, hdev,
5978                                         MGMT_OP_START_LIMITED_DISCOVERY,
5979                                         data, len);
5980 }
5981
5982 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5983                                    void *data, u16 len)
5984 {
5985         struct mgmt_cp_start_service_discovery *cp = data;
5986         struct mgmt_pending_cmd *cmd;
5987         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5988         u16 uuid_count, expected_len;
5989         u8 status;
5990         int err;
5991
5992         bt_dev_dbg(hdev, "sock %p", sk);
5993
5994         hci_dev_lock(hdev);
5995
5996         if (!hdev_is_powered(hdev)) {
5997                 err = mgmt_cmd_complete(sk, hdev->id,
5998                                         MGMT_OP_START_SERVICE_DISCOVERY,
5999                                         MGMT_STATUS_NOT_POWERED,
6000                                         &cp->type, sizeof(cp->type));
6001                 goto failed;
6002         }
6003
6004         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6005             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6006                 err = mgmt_cmd_complete(sk, hdev->id,
6007                                         MGMT_OP_START_SERVICE_DISCOVERY,
6008                                         MGMT_STATUS_BUSY, &cp->type,
6009                                         sizeof(cp->type));
6010                 goto failed;
6011         }
6012
6013         if (hdev->discovery_paused) {
6014                 err = mgmt_cmd_complete(sk, hdev->id,
6015                                         MGMT_OP_START_SERVICE_DISCOVERY,
6016                                         MGMT_STATUS_BUSY, &cp->type,
6017                                         sizeof(cp->type));
6018                 goto failed;
6019         }
6020
6021         uuid_count = __le16_to_cpu(cp->uuid_count);
6022         if (uuid_count > max_uuid_count) {
6023                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6024                            uuid_count);
6025                 err = mgmt_cmd_complete(sk, hdev->id,
6026                                         MGMT_OP_START_SERVICE_DISCOVERY,
6027                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6028                                         sizeof(cp->type));
6029                 goto failed;
6030         }
6031
6032         expected_len = sizeof(*cp) + uuid_count * 16;
6033         if (expected_len != len) {
6034                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6035                            expected_len, len);
6036                 err = mgmt_cmd_complete(sk, hdev->id,
6037                                         MGMT_OP_START_SERVICE_DISCOVERY,
6038                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6039                                         sizeof(cp->type));
6040                 goto failed;
6041         }
6042
6043         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6044                 err = mgmt_cmd_complete(sk, hdev->id,
6045                                         MGMT_OP_START_SERVICE_DISCOVERY,
6046                                         status, &cp->type, sizeof(cp->type));
6047                 goto failed;
6048         }
6049
6050         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6051                                hdev, data, len);
6052         if (!cmd) {
6053                 err = -ENOMEM;
6054                 goto failed;
6055         }
6056
6057         /* Clear the discovery filter first to free any previously
6058          * allocated memory for the UUID list.
6059          */
6060         hci_discovery_filter_clear(hdev);
6061
6062         hdev->discovery.result_filtering = true;
6063         hdev->discovery.type = cp->type;
6064         hdev->discovery.rssi = cp->rssi;
6065         hdev->discovery.uuid_count = uuid_count;
6066
6067         if (uuid_count > 0) {
6068                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6069                                                 GFP_KERNEL);
6070                 if (!hdev->discovery.uuids) {
6071                         err = mgmt_cmd_complete(sk, hdev->id,
6072                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6073                                                 MGMT_STATUS_FAILED,
6074                                                 &cp->type, sizeof(cp->type));
6075                         mgmt_pending_remove(cmd);
6076                         goto failed;
6077                 }
6078         }
6079
6080         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6081                                  start_discovery_complete);
6082         if (err < 0) {
6083                 mgmt_pending_remove(cmd);
6084                 goto failed;
6085         }
6086
6087         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6088
6089 failed:
6090         hci_dev_unlock(hdev);
6091         return err;
6092 }
6093
6094 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6095 {
6096         struct mgmt_pending_cmd *cmd;
6097
6098         bt_dev_dbg(hdev, "status %u", status);
6099
6100         hci_dev_lock(hdev);
6101
6102         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6103         if (cmd) {
6104                 cmd->cmd_complete(cmd, mgmt_status(status));
6105                 mgmt_pending_remove(cmd);
6106         }
6107
6108         hci_dev_unlock(hdev);
6109 }
6110
6111 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6112 {
6113         struct mgmt_pending_cmd *cmd = data;
6114
6115         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6116                 return;
6117
6118         bt_dev_dbg(hdev, "err %d", err);
6119
6120         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6121                           cmd->param, 1);
6122         mgmt_pending_remove(cmd);
6123
6124         if (!err)
6125                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6126 }
6127
6128 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6129 {
6130         return hci_stop_discovery_sync(hdev);
6131 }
6132
6133 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6134                           u16 len)
6135 {
6136         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6137         struct mgmt_pending_cmd *cmd;
6138         int err;
6139
6140         bt_dev_dbg(hdev, "sock %p", sk);
6141
6142         hci_dev_lock(hdev);
6143
6144         if (!hci_discovery_active(hdev)) {
6145                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6146                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6147                                         sizeof(mgmt_cp->type));
6148                 goto unlock;
6149         }
6150
6151         if (hdev->discovery.type != mgmt_cp->type) {
6152                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6153                                         MGMT_STATUS_INVALID_PARAMS,
6154                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6155                 goto unlock;
6156         }
6157
6158         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6159         if (!cmd) {
6160                 err = -ENOMEM;
6161                 goto unlock;
6162         }
6163
6164         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6165                                  stop_discovery_complete);
6166         if (err < 0) {
6167                 mgmt_pending_remove(cmd);
6168                 goto unlock;
6169         }
6170
6171         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6172
6173 unlock:
6174         hci_dev_unlock(hdev);
6175         return err;
6176 }
6177
6178 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6179                         u16 len)
6180 {
6181         struct mgmt_cp_confirm_name *cp = data;
6182         struct inquiry_entry *e;
6183         int err;
6184
6185         bt_dev_dbg(hdev, "sock %p", sk);
6186
6187         hci_dev_lock(hdev);
6188
6189         if (!hci_discovery_active(hdev)) {
6190                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6191                                         MGMT_STATUS_FAILED, &cp->addr,
6192                                         sizeof(cp->addr));
6193                 goto failed;
6194         }
6195
6196         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6197         if (!e) {
6198                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6199                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6200                                         sizeof(cp->addr));
6201                 goto failed;
6202         }
6203
6204         if (cp->name_known) {
6205                 e->name_state = NAME_KNOWN;
6206                 list_del(&e->list);
6207         } else {
6208                 e->name_state = NAME_NEEDED;
6209                 hci_inquiry_cache_update_resolve(hdev, e);
6210         }
6211
6212         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6213                                 &cp->addr, sizeof(cp->addr));
6214
6215 failed:
6216         hci_dev_unlock(hdev);
6217         return err;
6218 }
6219
6220 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6221                         u16 len)
6222 {
6223         struct mgmt_cp_block_device *cp = data;
6224         u8 status;
6225         int err;
6226
6227         bt_dev_dbg(hdev, "sock %p", sk);
6228
6229         if (!bdaddr_type_is_valid(cp->addr.type))
6230                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6231                                          MGMT_STATUS_INVALID_PARAMS,
6232                                          &cp->addr, sizeof(cp->addr));
6233
6234         hci_dev_lock(hdev);
6235
6236         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6237                                   cp->addr.type);
6238         if (err < 0) {
6239                 status = MGMT_STATUS_FAILED;
6240                 goto done;
6241         }
6242
6243         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6244                    sk);
6245         status = MGMT_STATUS_SUCCESS;
6246
6247 done:
6248         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6249                                 &cp->addr, sizeof(cp->addr));
6250
6251         hci_dev_unlock(hdev);
6252
6253         return err;
6254 }
6255
6256 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6257                           u16 len)
6258 {
6259         struct mgmt_cp_unblock_device *cp = data;
6260         u8 status;
6261         int err;
6262
6263         bt_dev_dbg(hdev, "sock %p", sk);
6264
6265         if (!bdaddr_type_is_valid(cp->addr.type))
6266                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6267                                          MGMT_STATUS_INVALID_PARAMS,
6268                                          &cp->addr, sizeof(cp->addr));
6269
6270         hci_dev_lock(hdev);
6271
6272         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6273                                   cp->addr.type);
6274         if (err < 0) {
6275                 status = MGMT_STATUS_INVALID_PARAMS;
6276                 goto done;
6277         }
6278
6279         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6280                    sk);
6281         status = MGMT_STATUS_SUCCESS;
6282
6283 done:
6284         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6285                                 &cp->addr, sizeof(cp->addr));
6286
6287         hci_dev_unlock(hdev);
6288
6289         return err;
6290 }
6291
6292 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6293 {
6294         return hci_update_eir_sync(hdev);
6295 }
6296
6297 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6298                          u16 len)
6299 {
6300         struct mgmt_cp_set_device_id *cp = data;
6301         int err;
6302         __u16 source;
6303
6304         bt_dev_dbg(hdev, "sock %p", sk);
6305
6306         source = __le16_to_cpu(cp->source);
6307
6308         if (source > 0x0002)
6309                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6310                                        MGMT_STATUS_INVALID_PARAMS);
6311
6312         hci_dev_lock(hdev);
6313
6314         hdev->devid_source = source;
6315         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6316         hdev->devid_product = __le16_to_cpu(cp->product);
6317         hdev->devid_version = __le16_to_cpu(cp->version);
6318
6319         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6320                                 NULL, 0);
6321
6322         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6323
6324         hci_dev_unlock(hdev);
6325
6326         return err;
6327 }
6328
6329 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6330 {
6331         if (err)
6332                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6333         else
6334                 bt_dev_dbg(hdev, "status %d", err);
6335 }
6336
6337 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6338 {
6339         struct cmd_lookup match = { NULL, hdev };
6340         u8 instance;
6341         struct adv_info *adv_instance;
6342         u8 status = mgmt_status(err);
6343
6344         if (status) {
6345                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6346                                      cmd_status_rsp, &status);
6347                 return;
6348         }
6349
6350         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6351                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6352         else
6353                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6354
6355         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6356                              &match);
6357
6358         new_settings(hdev, match.sk);
6359
6360         if (match.sk)
6361                 sock_put(match.sk);
6362
6363         /* If "Set Advertising" was just disabled and instance advertising was
6364          * set up earlier, then re-enable multi-instance advertising.
6365          */
6366         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6367             list_empty(&hdev->adv_instances))
6368                 return;
6369
6370         instance = hdev->cur_adv_instance;
6371         if (!instance) {
6372                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6373                                                         struct adv_info, list);
6374                 if (!adv_instance)
6375                         return;
6376
6377                 instance = adv_instance->instance;
6378         }
6379
6380         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6381
6382         enable_advertising_instance(hdev, err);
6383 }
6384
6385 static int set_adv_sync(struct hci_dev *hdev, void *data)
6386 {
6387         struct mgmt_pending_cmd *cmd = data;
6388         struct mgmt_mode *cp = cmd->param;
6389         u8 val = !!cp->val;
6390
6391         if (cp->val == 0x02)
6392                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6393         else
6394                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6395
6396         cancel_adv_timeout(hdev);
6397
6398         if (val) {
6399                 /* Switch to instance "0" for the Set Advertising setting.
6400                  * We cannot use update_[adv|scan_rsp]_data() here as the
6401                  * HCI_ADVERTISING flag is not yet set.
6402                  */
6403                 hdev->cur_adv_instance = 0x00;
6404
6405                 if (ext_adv_capable(hdev)) {
6406                         hci_start_ext_adv_sync(hdev, 0x00);
6407                 } else {
6408                         hci_update_adv_data_sync(hdev, 0x00);
6409                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6410                         hci_enable_advertising_sync(hdev);
6411                 }
6412         } else {
6413                 hci_disable_advertising_sync(hdev);
6414         }
6415
6416         return 0;
6417 }
6418
6419 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6420                            u16 len)
6421 {
6422         struct mgmt_mode *cp = data;
6423         struct mgmt_pending_cmd *cmd;
6424         u8 val, status;
6425         int err;
6426
6427         bt_dev_dbg(hdev, "sock %p", sk);
6428
6429         status = mgmt_le_support(hdev);
6430         if (status)
6431                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6432                                        status);
6433
6434         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6436                                        MGMT_STATUS_INVALID_PARAMS);
6437
6438         if (hdev->advertising_paused)
6439                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6440                                        MGMT_STATUS_BUSY);
6441
6442         hci_dev_lock(hdev);
6443
6444         val = !!cp->val;
6445
6446         /* The following conditions are ones which mean that we should
6447          * not do any HCI communication but directly send a mgmt
6448          * response to user space (after toggling the flag if
6449          * necessary).
6450          */
6451         if (!hdev_is_powered(hdev) ||
6452             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6453              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6454             hci_dev_test_flag(hdev, HCI_MESH) ||
6455             hci_conn_num(hdev, LE_LINK) > 0 ||
6456             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6457              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6458                 bool changed;
6459
6460                 if (cp->val) {
6461                         hdev->cur_adv_instance = 0x00;
6462                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6463                         if (cp->val == 0x02)
6464                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6465                         else
6466                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6467                 } else {
6468                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6469                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6470                 }
6471
6472                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6473                 if (err < 0)
6474                         goto unlock;
6475
6476                 if (changed)
6477                         err = new_settings(hdev, sk);
6478
6479                 goto unlock;
6480         }
6481
6482         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6483             pending_find(MGMT_OP_SET_LE, hdev)) {
6484                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6485                                       MGMT_STATUS_BUSY);
6486                 goto unlock;
6487         }
6488
6489         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6490         if (!cmd)
6491                 err = -ENOMEM;
6492         else
6493                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6494                                          set_advertising_complete);
6495
6496         if (err < 0 && cmd)
6497                 mgmt_pending_remove(cmd);
6498
6499 unlock:
6500         hci_dev_unlock(hdev);
6501         return err;
6502 }
6503
6504 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6505                               void *data, u16 len)
6506 {
6507         struct mgmt_cp_set_static_address *cp = data;
6508         int err;
6509
6510         bt_dev_dbg(hdev, "sock %p", sk);
6511
6512         if (!lmp_le_capable(hdev))
6513                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6514                                        MGMT_STATUS_NOT_SUPPORTED);
6515
6516         if (hdev_is_powered(hdev))
6517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6518                                        MGMT_STATUS_REJECTED);
6519
6520         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6521                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6522                         return mgmt_cmd_status(sk, hdev->id,
6523                                                MGMT_OP_SET_STATIC_ADDRESS,
6524                                                MGMT_STATUS_INVALID_PARAMS);
6525
6526                 /* Two most significant bits shall be set */
6527                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6528                         return mgmt_cmd_status(sk, hdev->id,
6529                                                MGMT_OP_SET_STATIC_ADDRESS,
6530                                                MGMT_STATUS_INVALID_PARAMS);
6531         }
6532
6533         hci_dev_lock(hdev);
6534
6535         bacpy(&hdev->static_addr, &cp->bdaddr);
6536
6537         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6538         if (err < 0)
6539                 goto unlock;
6540
6541         err = new_settings(hdev, sk);
6542
6543 unlock:
6544         hci_dev_unlock(hdev);
6545         return err;
6546 }
6547
6548 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6549                            void *data, u16 len)
6550 {
6551         struct mgmt_cp_set_scan_params *cp = data;
6552         __u16 interval, window;
6553         int err;
6554
6555         bt_dev_dbg(hdev, "sock %p", sk);
6556
6557         if (!lmp_le_capable(hdev))
6558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6559                                        MGMT_STATUS_NOT_SUPPORTED);
6560
6561         interval = __le16_to_cpu(cp->interval);
6562
6563         if (interval < 0x0004 || interval > 0x4000)
6564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6565                                        MGMT_STATUS_INVALID_PARAMS);
6566
6567         window = __le16_to_cpu(cp->window);
6568
6569         if (window < 0x0004 || window > 0x4000)
6570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6571                                        MGMT_STATUS_INVALID_PARAMS);
6572
6573         if (window > interval)
6574                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6575                                        MGMT_STATUS_INVALID_PARAMS);
6576
6577         hci_dev_lock(hdev);
6578
6579         hdev->le_scan_interval = interval;
6580         hdev->le_scan_window = window;
6581
6582         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6583                                 NULL, 0);
6584
6585         /* If background scan is running, restart it so new parameters are
6586          * loaded.
6587          */
6588         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6589             hdev->discovery.state == DISCOVERY_STOPPED)
6590                 hci_update_passive_scan(hdev);
6591
6592         hci_dev_unlock(hdev);
6593
6594         return err;
6595 }
6596
6597 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6598 {
6599         struct mgmt_pending_cmd *cmd = data;
6600
6601         bt_dev_dbg(hdev, "err %d", err);
6602
6603         if (err) {
6604                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6605                                 mgmt_status(err));
6606         } else {
6607                 struct mgmt_mode *cp = cmd->param;
6608
6609                 if (cp->val)
6610                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6611                 else
6612                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6613
6614                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6615                 new_settings(hdev, cmd->sk);
6616         }
6617
6618         mgmt_pending_free(cmd);
6619 }
6620
6621 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6622 {
6623         struct mgmt_pending_cmd *cmd = data;
6624         struct mgmt_mode *cp = cmd->param;
6625
6626         return hci_write_fast_connectable_sync(hdev, cp->val);
6627 }
6628
6629 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6630                                 void *data, u16 len)
6631 {
6632         struct mgmt_mode *cp = data;
6633         struct mgmt_pending_cmd *cmd;
6634         int err;
6635
6636         bt_dev_dbg(hdev, "sock %p", sk);
6637
6638         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6639             hdev->hci_ver < BLUETOOTH_VER_1_2)
6640                 return mgmt_cmd_status(sk, hdev->id,
6641                                        MGMT_OP_SET_FAST_CONNECTABLE,
6642                                        MGMT_STATUS_NOT_SUPPORTED);
6643
6644         if (cp->val != 0x00 && cp->val != 0x01)
6645                 return mgmt_cmd_status(sk, hdev->id,
6646                                        MGMT_OP_SET_FAST_CONNECTABLE,
6647                                        MGMT_STATUS_INVALID_PARAMS);
6648
6649         hci_dev_lock(hdev);
6650
6651         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6652                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6653                 goto unlock;
6654         }
6655
6656         if (!hdev_is_powered(hdev)) {
6657                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6658                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6659                 new_settings(hdev, sk);
6660                 goto unlock;
6661         }
6662
6663         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6664                                len);
6665         if (!cmd)
6666                 err = -ENOMEM;
6667         else
6668                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6669                                          fast_connectable_complete);
6670
6671         if (err < 0) {
6672                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6673                                 MGMT_STATUS_FAILED);
6674
6675                 if (cmd)
6676                         mgmt_pending_free(cmd);
6677         }
6678
6679 unlock:
6680         hci_dev_unlock(hdev);
6681
6682         return err;
6683 }
6684
6685 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6686 {
6687         struct mgmt_pending_cmd *cmd = data;
6688
6689         bt_dev_dbg(hdev, "err %d", err);
6690
6691         if (err) {
6692                 u8 mgmt_err = mgmt_status(err);
6693
6694                 /* We need to restore the flag if related HCI commands
6695                  * failed.
6696                  */
6697                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6698
6699                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6700         } else {
6701                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6702                 new_settings(hdev, cmd->sk);
6703         }
6704
6705         mgmt_pending_free(cmd);
6706 }
6707
6708 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6709 {
6710         int status;
6711
6712         status = hci_write_fast_connectable_sync(hdev, false);
6713
6714         if (!status)
6715                 status = hci_update_scan_sync(hdev);
6716
6717         /* Since only the advertising data flags will change, there
6718          * is no need to update the scan response data.
6719          */
6720         if (!status)
6721                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6722
6723         return status;
6724 }
6725
6726 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6727 {
6728         struct mgmt_mode *cp = data;
6729         struct mgmt_pending_cmd *cmd;
6730         int err;
6731
6732         bt_dev_dbg(hdev, "sock %p", sk);
6733
6734         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6735                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6736                                        MGMT_STATUS_NOT_SUPPORTED);
6737
6738         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6740                                        MGMT_STATUS_REJECTED);
6741
6742         if (cp->val != 0x00 && cp->val != 0x01)
6743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6744                                        MGMT_STATUS_INVALID_PARAMS);
6745
6746         hci_dev_lock(hdev);
6747
6748         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6749                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6750                 goto unlock;
6751         }
6752
6753         if (!hdev_is_powered(hdev)) {
6754                 if (!cp->val) {
6755                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6756                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6757                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6758                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6759                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6760                 }
6761
6762                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6763
6764                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6765                 if (err < 0)
6766                         goto unlock;
6767
6768                 err = new_settings(hdev, sk);
6769                 goto unlock;
6770         }
6771
6772         /* Reject disabling when powered on */
6773         if (!cp->val) {
6774                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6775                                       MGMT_STATUS_REJECTED);
6776                 goto unlock;
6777         } else {
6778                 /* When configuring a dual-mode controller to operate
6779                  * with LE only and using a static address, then switching
6780                  * BR/EDR back on is not allowed.
6781                  *
6782                  * Dual-mode controllers shall operate with the public
6783                  * address as its identity address for BR/EDR and LE. So
6784                  * reject the attempt to create an invalid configuration.
6785                  *
6786                  * The same restrictions applies when secure connections
6787                  * has been enabled. For BR/EDR this is a controller feature
6788                  * while for LE it is a host stack feature. This means that
6789                  * switching BR/EDR back on when secure connections has been
6790                  * enabled is not a supported transaction.
6791                  */
6792                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6793                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6794                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6795                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6796                                               MGMT_STATUS_REJECTED);
6797                         goto unlock;
6798                 }
6799         }
6800
6801         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6802         if (!cmd)
6803                 err = -ENOMEM;
6804         else
6805                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6806                                          set_bredr_complete);
6807
6808         if (err < 0) {
6809                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6810                                 MGMT_STATUS_FAILED);
6811                 if (cmd)
6812                         mgmt_pending_free(cmd);
6813
6814                 goto unlock;
6815         }
6816
6817         /* We need to flip the bit already here so that
6818          * hci_req_update_adv_data generates the correct flags.
6819          */
6820         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6821
6822 unlock:
6823         hci_dev_unlock(hdev);
6824         return err;
6825 }
6826
6827 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6828 {
6829         struct mgmt_pending_cmd *cmd = data;
6830         struct mgmt_mode *cp;
6831
6832         bt_dev_dbg(hdev, "err %d", err);
6833
6834         if (err) {
6835                 u8 mgmt_err = mgmt_status(err);
6836
6837                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6838                 goto done;
6839         }
6840
6841         cp = cmd->param;
6842
6843         switch (cp->val) {
6844         case 0x00:
6845                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6846                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6847                 break;
6848         case 0x01:
6849                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6850                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6851                 break;
6852         case 0x02:
6853                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6854                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6855                 break;
6856         }
6857
6858         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6859         new_settings(hdev, cmd->sk);
6860
6861 done:
6862         mgmt_pending_free(cmd);
6863 }
6864
6865 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6866 {
6867         struct mgmt_pending_cmd *cmd = data;
6868         struct mgmt_mode *cp = cmd->param;
6869         u8 val = !!cp->val;
6870
6871         /* Force write of val */
6872         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6873
6874         return hci_write_sc_support_sync(hdev, val);
6875 }
6876
6877 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6878                            void *data, u16 len)
6879 {
6880         struct mgmt_mode *cp = data;
6881         struct mgmt_pending_cmd *cmd;
6882         u8 val;
6883         int err;
6884
6885         bt_dev_dbg(hdev, "sock %p", sk);
6886
6887         if (!lmp_sc_capable(hdev) &&
6888             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6890                                        MGMT_STATUS_NOT_SUPPORTED);
6891
6892         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6893             lmp_sc_capable(hdev) &&
6894             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6895                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6896                                        MGMT_STATUS_REJECTED);
6897
6898         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6900                                        MGMT_STATUS_INVALID_PARAMS);
6901
6902         hci_dev_lock(hdev);
6903
6904         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6905             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6906                 bool changed;
6907
6908                 if (cp->val) {
6909                         changed = !hci_dev_test_and_set_flag(hdev,
6910                                                              HCI_SC_ENABLED);
6911                         if (cp->val == 0x02)
6912                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6913                         else
6914                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6915                 } else {
6916                         changed = hci_dev_test_and_clear_flag(hdev,
6917                                                               HCI_SC_ENABLED);
6918                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6919                 }
6920
6921                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6922                 if (err < 0)
6923                         goto failed;
6924
6925                 if (changed)
6926                         err = new_settings(hdev, sk);
6927
6928                 goto failed;
6929         }
6930
6931         val = !!cp->val;
6932
6933         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6934             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6935                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6936                 goto failed;
6937         }
6938
6939         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6940         if (!cmd)
6941                 err = -ENOMEM;
6942         else
6943                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6944                                          set_secure_conn_complete);
6945
6946         if (err < 0) {
6947                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6948                                 MGMT_STATUS_FAILED);
6949                 if (cmd)
6950                         mgmt_pending_free(cmd);
6951         }
6952
6953 failed:
6954         hci_dev_unlock(hdev);
6955         return err;
6956 }
6957
6958 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6959                           void *data, u16 len)
6960 {
6961         struct mgmt_mode *cp = data;
6962         bool changed, use_changed;
6963         int err;
6964
6965         bt_dev_dbg(hdev, "sock %p", sk);
6966
6967         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6968                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6969                                        MGMT_STATUS_INVALID_PARAMS);
6970
6971         hci_dev_lock(hdev);
6972
6973         if (cp->val)
6974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6975         else
6976                 changed = hci_dev_test_and_clear_flag(hdev,
6977                                                       HCI_KEEP_DEBUG_KEYS);
6978
6979         if (cp->val == 0x02)
6980                 use_changed = !hci_dev_test_and_set_flag(hdev,
6981                                                          HCI_USE_DEBUG_KEYS);
6982         else
6983                 use_changed = hci_dev_test_and_clear_flag(hdev,
6984                                                           HCI_USE_DEBUG_KEYS);
6985
6986         if (hdev_is_powered(hdev) && use_changed &&
6987             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6988                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6989                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6990                              sizeof(mode), &mode);
6991         }
6992
6993         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6994         if (err < 0)
6995                 goto unlock;
6996
6997         if (changed)
6998                 err = new_settings(hdev, sk);
6999
7000 unlock:
7001         hci_dev_unlock(hdev);
7002         return err;
7003 }
7004
7005 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7006                        u16 len)
7007 {
7008         struct mgmt_cp_set_privacy *cp = cp_data;
7009         bool changed;
7010         int err;
7011
7012         bt_dev_dbg(hdev, "sock %p", sk);
7013
7014         if (!lmp_le_capable(hdev))
7015                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7016                                        MGMT_STATUS_NOT_SUPPORTED);
7017
7018         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7019                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7020                                        MGMT_STATUS_INVALID_PARAMS);
7021
7022         if (hdev_is_powered(hdev))
7023                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7024                                        MGMT_STATUS_REJECTED);
7025
7026         hci_dev_lock(hdev);
7027
7028         /* If user space supports this command it is also expected to
7029          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7030          */
7031         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7032
7033         if (cp->privacy) {
7034                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7035                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7036                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7037                 hci_adv_instances_set_rpa_expired(hdev, true);
7038                 if (cp->privacy == 0x02)
7039                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7040                 else
7041                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7042         } else {
7043                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7044                 memset(hdev->irk, 0, sizeof(hdev->irk));
7045                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7046                 hci_adv_instances_set_rpa_expired(hdev, false);
7047                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7048         }
7049
7050         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7051         if (err < 0)
7052                 goto unlock;
7053
7054         if (changed)
7055                 err = new_settings(hdev, sk);
7056
7057 unlock:
7058         hci_dev_unlock(hdev);
7059         return err;
7060 }
7061
7062 static bool irk_is_valid(struct mgmt_irk_info *irk)
7063 {
7064         switch (irk->addr.type) {
7065         case BDADDR_LE_PUBLIC:
7066                 return true;
7067
7068         case BDADDR_LE_RANDOM:
7069                 /* Two most significant bits shall be set */
7070                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7071                         return false;
7072                 return true;
7073         }
7074
7075         return false;
7076 }
7077
7078 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7079                      u16 len)
7080 {
7081         struct mgmt_cp_load_irks *cp = cp_data;
7082         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7083                                    sizeof(struct mgmt_irk_info));
7084         u16 irk_count, expected_len;
7085         int i, err;
7086
7087         bt_dev_dbg(hdev, "sock %p", sk);
7088
7089         if (!lmp_le_capable(hdev))
7090                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7091                                        MGMT_STATUS_NOT_SUPPORTED);
7092
7093         irk_count = __le16_to_cpu(cp->irk_count);
7094         if (irk_count > max_irk_count) {
7095                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7096                            irk_count);
7097                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7098                                        MGMT_STATUS_INVALID_PARAMS);
7099         }
7100
7101         expected_len = struct_size(cp, irks, irk_count);
7102         if (expected_len != len) {
7103                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7104                            expected_len, len);
7105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7106                                        MGMT_STATUS_INVALID_PARAMS);
7107         }
7108
7109         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7110
7111         for (i = 0; i < irk_count; i++) {
7112                 struct mgmt_irk_info *key = &cp->irks[i];
7113
7114                 if (!irk_is_valid(key))
7115                         return mgmt_cmd_status(sk, hdev->id,
7116                                                MGMT_OP_LOAD_IRKS,
7117                                                MGMT_STATUS_INVALID_PARAMS);
7118         }
7119
7120         hci_dev_lock(hdev);
7121
7122         hci_smp_irks_clear(hdev);
7123
7124         for (i = 0; i < irk_count; i++) {
7125                 struct mgmt_irk_info *irk = &cp->irks[i];
7126
7127                 if (hci_is_blocked_key(hdev,
7128                                        HCI_BLOCKED_KEY_TYPE_IRK,
7129                                        irk->val)) {
7130                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7131                                     &irk->addr.bdaddr);
7132                         continue;
7133                 }
7134
7135                 hci_add_irk(hdev, &irk->addr.bdaddr,
7136                             le_addr_type(irk->addr.type), irk->val,
7137                             BDADDR_ANY);
7138         }
7139
7140         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7141
7142         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7143
7144         hci_dev_unlock(hdev);
7145
7146         return err;
7147 }
7148
7149 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7150 {
7151         if (key->initiator != 0x00 && key->initiator != 0x01)
7152                 return false;
7153
7154         switch (key->addr.type) {
7155         case BDADDR_LE_PUBLIC:
7156                 return true;
7157
7158         case BDADDR_LE_RANDOM:
7159                 /* Two most significant bits shall be set */
7160                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7161                         return false;
7162                 return true;
7163         }
7164
7165         return false;
7166 }
7167
7168 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7169                                void *cp_data, u16 len)
7170 {
7171         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7172         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7173                                    sizeof(struct mgmt_ltk_info));
7174         u16 key_count, expected_len;
7175         int i, err;
7176
7177         bt_dev_dbg(hdev, "sock %p", sk);
7178
7179         if (!lmp_le_capable(hdev))
7180                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7181                                        MGMT_STATUS_NOT_SUPPORTED);
7182
7183         key_count = __le16_to_cpu(cp->key_count);
7184         if (key_count > max_key_count) {
7185                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7186                            key_count);
7187                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7188                                        MGMT_STATUS_INVALID_PARAMS);
7189         }
7190
7191         expected_len = struct_size(cp, keys, key_count);
7192         if (expected_len != len) {
7193                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7194                            expected_len, len);
7195                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7196                                        MGMT_STATUS_INVALID_PARAMS);
7197         }
7198
7199         bt_dev_dbg(hdev, "key_count %u", key_count);
7200
7201         for (i = 0; i < key_count; i++) {
7202                 struct mgmt_ltk_info *key = &cp->keys[i];
7203
7204                 if (!ltk_is_valid(key))
7205                         return mgmt_cmd_status(sk, hdev->id,
7206                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7207                                                MGMT_STATUS_INVALID_PARAMS);
7208         }
7209
7210         hci_dev_lock(hdev);
7211
7212         hci_smp_ltks_clear(hdev);
7213
7214         for (i = 0; i < key_count; i++) {
7215                 struct mgmt_ltk_info *key = &cp->keys[i];
7216                 u8 type, authenticated;
7217
7218                 if (hci_is_blocked_key(hdev,
7219                                        HCI_BLOCKED_KEY_TYPE_LTK,
7220                                        key->val)) {
7221                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7222                                     &key->addr.bdaddr);
7223                         continue;
7224                 }
7225
7226                 switch (key->type) {
7227                 case MGMT_LTK_UNAUTHENTICATED:
7228                         authenticated = 0x00;
7229                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7230                         break;
7231                 case MGMT_LTK_AUTHENTICATED:
7232                         authenticated = 0x01;
7233                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7234                         break;
7235                 case MGMT_LTK_P256_UNAUTH:
7236                         authenticated = 0x00;
7237                         type = SMP_LTK_P256;
7238                         break;
7239                 case MGMT_LTK_P256_AUTH:
7240                         authenticated = 0x01;
7241                         type = SMP_LTK_P256;
7242                         break;
7243                 case MGMT_LTK_P256_DEBUG:
7244                         authenticated = 0x00;
7245                         type = SMP_LTK_P256_DEBUG;
7246                         fallthrough;
7247                 default:
7248                         continue;
7249                 }
7250
7251                 hci_add_ltk(hdev, &key->addr.bdaddr,
7252                             le_addr_type(key->addr.type), type, authenticated,
7253                             key->val, key->enc_size, key->ediv, key->rand);
7254         }
7255
7256         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7257                            NULL, 0);
7258
7259         hci_dev_unlock(hdev);
7260
7261         return err;
7262 }
7263
7264 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7265 {
7266         struct mgmt_pending_cmd *cmd = data;
7267         struct hci_conn *conn = cmd->user_data;
7268         struct mgmt_cp_get_conn_info *cp = cmd->param;
7269         struct mgmt_rp_get_conn_info rp;
7270         u8 status;
7271
7272         bt_dev_dbg(hdev, "err %d", err);
7273
7274         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
7275
7276         status = mgmt_status(err);
7277         if (status == MGMT_STATUS_SUCCESS) {
7278                 rp.rssi = conn->rssi;
7279                 rp.tx_power = conn->tx_power;
7280                 rp.max_tx_power = conn->max_tx_power;
7281         } else {
7282                 rp.rssi = HCI_RSSI_INVALID;
7283                 rp.tx_power = HCI_TX_POWER_INVALID;
7284                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7285         }
7286
7287         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7288                           &rp, sizeof(rp));
7289
7290         mgmt_pending_free(cmd);
7291 }
7292
7293 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7294 {
7295         struct mgmt_pending_cmd *cmd = data;
7296         struct mgmt_cp_get_conn_info *cp = cmd->param;
7297         struct hci_conn *conn;
7298         int err;
7299         __le16   handle;
7300
7301         /* Make sure we are still connected */
7302         if (cp->addr.type == BDADDR_BREDR)
7303                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7304                                                &cp->addr.bdaddr);
7305         else
7306                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7307
7308         if (!conn || conn->state != BT_CONNECTED)
7309                 return MGMT_STATUS_NOT_CONNECTED;
7310
7311         cmd->user_data = conn;
7312         handle = cpu_to_le16(conn->handle);
7313
7314         /* Refresh RSSI each time */
7315         err = hci_read_rssi_sync(hdev, handle);
7316
7317         /* For LE links TX power does not change thus we don't need to
7318          * query for it once value is known.
7319          */
7320         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7321                      conn->tx_power == HCI_TX_POWER_INVALID))
7322                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7323
7324         /* Max TX power needs to be read only once per connection */
7325         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7326                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7327
7328         return err;
7329 }
7330
7331 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7332                          u16 len)
7333 {
7334         struct mgmt_cp_get_conn_info *cp = data;
7335         struct mgmt_rp_get_conn_info rp;
7336         struct hci_conn *conn;
7337         unsigned long conn_info_age;
7338         int err = 0;
7339
7340         bt_dev_dbg(hdev, "sock %p", sk);
7341
7342         memset(&rp, 0, sizeof(rp));
7343         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7344         rp.addr.type = cp->addr.type;
7345
7346         if (!bdaddr_type_is_valid(cp->addr.type))
7347                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7348                                          MGMT_STATUS_INVALID_PARAMS,
7349                                          &rp, sizeof(rp));
7350
7351         hci_dev_lock(hdev);
7352
7353         if (!hdev_is_powered(hdev)) {
7354                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7355                                         MGMT_STATUS_NOT_POWERED, &rp,
7356                                         sizeof(rp));
7357                 goto unlock;
7358         }
7359
7360         if (cp->addr.type == BDADDR_BREDR)
7361                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7362                                                &cp->addr.bdaddr);
7363         else
7364                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7365
7366         if (!conn || conn->state != BT_CONNECTED) {
7367                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7368                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7369                                         sizeof(rp));
7370                 goto unlock;
7371         }
7372
7373         /* To avoid client trying to guess when to poll again for information we
7374          * calculate conn info age as random value between min/max set in hdev.
7375          */
7376         conn_info_age = hdev->conn_info_min_age +
7377                         prandom_u32_max(hdev->conn_info_max_age -
7378                                         hdev->conn_info_min_age);
7379
7380         /* Query controller to refresh cached values if they are too old or were
7381          * never read.
7382          */
7383         if (time_after(jiffies, conn->conn_info_timestamp +
7384                        msecs_to_jiffies(conn_info_age)) ||
7385             !conn->conn_info_timestamp) {
7386                 struct mgmt_pending_cmd *cmd;
7387
7388                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7389                                        len);
7390                 if (!cmd) {
7391                         err = -ENOMEM;
7392                 } else {
7393                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7394                                                  cmd, get_conn_info_complete);
7395                 }
7396
7397                 if (err < 0) {
7398                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7399                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
7400
7401                         if (cmd)
7402                                 mgmt_pending_free(cmd);
7403
7404                         goto unlock;
7405                 }
7406
7407                 conn->conn_info_timestamp = jiffies;
7408         } else {
7409                 /* Cache is valid, just reply with values cached in hci_conn */
7410                 rp.rssi = conn->rssi;
7411                 rp.tx_power = conn->tx_power;
7412                 rp.max_tx_power = conn->max_tx_power;
7413
7414                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7415                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7416         }
7417
7418 unlock:
7419         hci_dev_unlock(hdev);
7420         return err;
7421 }
7422
7423 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7424 {
7425         struct mgmt_pending_cmd *cmd = data;
7426         struct mgmt_cp_get_clock_info *cp = cmd->param;
7427         struct mgmt_rp_get_clock_info rp;
7428         struct hci_conn *conn = cmd->user_data;
7429         u8 status = mgmt_status(err);
7430
7431         bt_dev_dbg(hdev, "err %d", err);
7432
7433         memset(&rp, 0, sizeof(rp));
7434         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7435         rp.addr.type = cp->addr.type;
7436
7437         if (err)
7438                 goto complete;
7439
7440         rp.local_clock = cpu_to_le32(hdev->clock);
7441
7442         if (conn) {
7443                 rp.piconet_clock = cpu_to_le32(conn->clock);
7444                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7445         }
7446
7447 complete:
7448         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7449                           sizeof(rp));
7450
7451         mgmt_pending_free(cmd);
7452 }
7453
7454 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7455 {
7456         struct mgmt_pending_cmd *cmd = data;
7457         struct mgmt_cp_get_clock_info *cp = cmd->param;
7458         struct hci_cp_read_clock hci_cp;
7459         struct hci_conn *conn;
7460
7461         memset(&hci_cp, 0, sizeof(hci_cp));
7462         hci_read_clock_sync(hdev, &hci_cp);
7463
7464         /* Make sure connection still exists */
7465         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7466         if (!conn || conn->state != BT_CONNECTED)
7467                 return MGMT_STATUS_NOT_CONNECTED;
7468
7469         cmd->user_data = conn;
7470         hci_cp.handle = cpu_to_le16(conn->handle);
7471         hci_cp.which = 0x01; /* Piconet clock */
7472
7473         return hci_read_clock_sync(hdev, &hci_cp);
7474 }
7475
7476 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7477                                                                 u16 len)
7478 {
7479         struct mgmt_cp_get_clock_info *cp = data;
7480         struct mgmt_rp_get_clock_info rp;
7481         struct mgmt_pending_cmd *cmd;
7482         struct hci_conn *conn;
7483         int err;
7484
7485         bt_dev_dbg(hdev, "sock %p", sk);
7486
7487         memset(&rp, 0, sizeof(rp));
7488         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7489         rp.addr.type = cp->addr.type;
7490
7491         if (cp->addr.type != BDADDR_BREDR)
7492                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7493                                          MGMT_STATUS_INVALID_PARAMS,
7494                                          &rp, sizeof(rp));
7495
7496         hci_dev_lock(hdev);
7497
7498         if (!hdev_is_powered(hdev)) {
7499                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7500                                         MGMT_STATUS_NOT_POWERED, &rp,
7501                                         sizeof(rp));
7502                 goto unlock;
7503         }
7504
7505         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7506                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7507                                                &cp->addr.bdaddr);
7508                 if (!conn || conn->state != BT_CONNECTED) {
7509                         err = mgmt_cmd_complete(sk, hdev->id,
7510                                                 MGMT_OP_GET_CLOCK_INFO,
7511                                                 MGMT_STATUS_NOT_CONNECTED,
7512                                                 &rp, sizeof(rp));
7513                         goto unlock;
7514                 }
7515         } else {
7516                 conn = NULL;
7517         }
7518
7519         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7520         if (!cmd)
7521                 err = -ENOMEM;
7522         else
7523                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7524                                          get_clock_info_complete);
7525
7526         if (err < 0) {
7527                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7528                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
7529
7530                 if (cmd)
7531                         mgmt_pending_free(cmd);
7532         }
7533
7534
7535 unlock:
7536         hci_dev_unlock(hdev);
7537         return err;
7538 }
7539
7540 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7541 {
7542         struct hci_conn *conn;
7543
7544         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7545         if (!conn)
7546                 return false;
7547
7548         if (conn->dst_type != type)
7549                 return false;
7550
7551         if (conn->state != BT_CONNECTED)
7552                 return false;
7553
7554         return true;
7555 }
7556
7557 /* This function requires the caller holds hdev->lock */
7558 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7559                                u8 addr_type, u8 auto_connect)
7560 {
7561         struct hci_conn_params *params;
7562
7563         params = hci_conn_params_add(hdev, addr, addr_type);
7564         if (!params)
7565                 return -EIO;
7566
7567         if (params->auto_connect == auto_connect)
7568                 return 0;
7569
7570         list_del_init(&params->action);
7571
7572         switch (auto_connect) {
7573         case HCI_AUTO_CONN_DISABLED:
7574         case HCI_AUTO_CONN_LINK_LOSS:
7575                 /* If auto connect is being disabled when we're trying to
7576                  * connect to device, keep connecting.
7577                  */
7578                 if (params->explicit_connect)
7579                         list_add(&params->action, &hdev->pend_le_conns);
7580                 break;
7581         case HCI_AUTO_CONN_REPORT:
7582                 if (params->explicit_connect)
7583                         list_add(&params->action, &hdev->pend_le_conns);
7584                 else
7585                         list_add(&params->action, &hdev->pend_le_reports);
7586                 break;
7587         case HCI_AUTO_CONN_DIRECT:
7588         case HCI_AUTO_CONN_ALWAYS:
7589                 if (!is_connected(hdev, addr, addr_type))
7590                         list_add(&params->action, &hdev->pend_le_conns);
7591                 break;
7592         }
7593
7594         params->auto_connect = auto_connect;
7595
7596         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7597                    addr, addr_type, auto_connect);
7598
7599         return 0;
7600 }
7601
7602 static void device_added(struct sock *sk, struct hci_dev *hdev,
7603                          bdaddr_t *bdaddr, u8 type, u8 action)
7604 {
7605         struct mgmt_ev_device_added ev;
7606
7607         bacpy(&ev.addr.bdaddr, bdaddr);
7608         ev.addr.type = type;
7609         ev.action = action;
7610
7611         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7612 }
7613
7614 static int add_device_sync(struct hci_dev *hdev, void *data)
7615 {
7616         return hci_update_passive_scan_sync(hdev);
7617 }
7618
7619 static int add_device(struct sock *sk, struct hci_dev *hdev,
7620                       void *data, u16 len)
7621 {
7622         struct mgmt_cp_add_device *cp = data;
7623         u8 auto_conn, addr_type;
7624         struct hci_conn_params *params;
7625         int err;
7626         u32 current_flags = 0;
7627         u32 supported_flags;
7628
7629         bt_dev_dbg(hdev, "sock %p", sk);
7630
7631         if (!bdaddr_type_is_valid(cp->addr.type) ||
7632             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7633                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7634                                          MGMT_STATUS_INVALID_PARAMS,
7635                                          &cp->addr, sizeof(cp->addr));
7636
7637         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7638                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7639                                          MGMT_STATUS_INVALID_PARAMS,
7640                                          &cp->addr, sizeof(cp->addr));
7641
7642         hci_dev_lock(hdev);
7643
7644         if (cp->addr.type == BDADDR_BREDR) {
7645                 /* Only incoming connections action is supported for now */
7646                 if (cp->action != 0x01) {
7647                         err = mgmt_cmd_complete(sk, hdev->id,
7648                                                 MGMT_OP_ADD_DEVICE,
7649                                                 MGMT_STATUS_INVALID_PARAMS,
7650                                                 &cp->addr, sizeof(cp->addr));
7651                         goto unlock;
7652                 }
7653
7654                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7655                                                      &cp->addr.bdaddr,
7656                                                      cp->addr.type, 0);
7657                 if (err)
7658                         goto unlock;
7659
7660                 hci_update_scan(hdev);
7661
7662                 goto added;
7663         }
7664
7665         addr_type = le_addr_type(cp->addr.type);
7666
7667         if (cp->action == 0x02)
7668                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7669         else if (cp->action == 0x01)
7670                 auto_conn = HCI_AUTO_CONN_DIRECT;
7671         else
7672                 auto_conn = HCI_AUTO_CONN_REPORT;
7673
7674         /* Kernel internally uses conn_params with resolvable private
7675          * address, but Add Device allows only identity addresses.
7676          * Make sure it is enforced before calling
7677          * hci_conn_params_lookup.
7678          */
7679         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7680                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7681                                         MGMT_STATUS_INVALID_PARAMS,
7682                                         &cp->addr, sizeof(cp->addr));
7683                 goto unlock;
7684         }
7685
7686         /* If the connection parameters don't exist for this device,
7687          * they will be created and configured with defaults.
7688          */
7689         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7690                                 auto_conn) < 0) {
7691                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7692                                         MGMT_STATUS_FAILED, &cp->addr,
7693                                         sizeof(cp->addr));
7694                 goto unlock;
7695         } else {
7696                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7697                                                 addr_type);
7698                 if (params)
7699                         current_flags = params->flags;
7700         }
7701
7702         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7703         if (err < 0)
7704                 goto unlock;
7705
7706 added:
7707         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7708         supported_flags = hdev->conn_flags;
7709         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7710                              supported_flags, current_flags);
7711
7712         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7713                                 MGMT_STATUS_SUCCESS, &cp->addr,
7714                                 sizeof(cp->addr));
7715
7716 unlock:
7717         hci_dev_unlock(hdev);
7718         return err;
7719 }
7720
7721 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7722                            bdaddr_t *bdaddr, u8 type)
7723 {
7724         struct mgmt_ev_device_removed ev;
7725
7726         bacpy(&ev.addr.bdaddr, bdaddr);
7727         ev.addr.type = type;
7728
7729         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7730 }
7731
7732 static int remove_device_sync(struct hci_dev *hdev, void *data)
7733 {
7734         return hci_update_passive_scan_sync(hdev);
7735 }
7736
7737 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7738                          void *data, u16 len)
7739 {
7740         struct mgmt_cp_remove_device *cp = data;
7741         int err;
7742
7743         bt_dev_dbg(hdev, "sock %p", sk);
7744
7745         hci_dev_lock(hdev);
7746
7747         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7748                 struct hci_conn_params *params;
7749                 u8 addr_type;
7750
7751                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7752                         err = mgmt_cmd_complete(sk, hdev->id,
7753                                                 MGMT_OP_REMOVE_DEVICE,
7754                                                 MGMT_STATUS_INVALID_PARAMS,
7755                                                 &cp->addr, sizeof(cp->addr));
7756                         goto unlock;
7757                 }
7758
7759                 if (cp->addr.type == BDADDR_BREDR) {
7760                         err = hci_bdaddr_list_del(&hdev->accept_list,
7761                                                   &cp->addr.bdaddr,
7762                                                   cp->addr.type);
7763                         if (err) {
7764                                 err = mgmt_cmd_complete(sk, hdev->id,
7765                                                         MGMT_OP_REMOVE_DEVICE,
7766                                                         MGMT_STATUS_INVALID_PARAMS,
7767                                                         &cp->addr,
7768                                                         sizeof(cp->addr));
7769                                 goto unlock;
7770                         }
7771
7772                         hci_update_scan(hdev);
7773
7774                         device_removed(sk, hdev, &cp->addr.bdaddr,
7775                                        cp->addr.type);
7776                         goto complete;
7777                 }
7778
7779                 addr_type = le_addr_type(cp->addr.type);
7780
7781                 /* Kernel internally uses conn_params with resolvable private
7782                  * address, but Remove Device allows only identity addresses.
7783                  * Make sure it is enforced before calling
7784                  * hci_conn_params_lookup.
7785                  */
7786                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7787                         err = mgmt_cmd_complete(sk, hdev->id,
7788                                                 MGMT_OP_REMOVE_DEVICE,
7789                                                 MGMT_STATUS_INVALID_PARAMS,
7790                                                 &cp->addr, sizeof(cp->addr));
7791                         goto unlock;
7792                 }
7793
7794                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7795                                                 addr_type);
7796                 if (!params) {
7797                         err = mgmt_cmd_complete(sk, hdev->id,
7798                                                 MGMT_OP_REMOVE_DEVICE,
7799                                                 MGMT_STATUS_INVALID_PARAMS,
7800                                                 &cp->addr, sizeof(cp->addr));
7801                         goto unlock;
7802                 }
7803
7804                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7805                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7806                         err = mgmt_cmd_complete(sk, hdev->id,
7807                                                 MGMT_OP_REMOVE_DEVICE,
7808                                                 MGMT_STATUS_INVALID_PARAMS,
7809                                                 &cp->addr, sizeof(cp->addr));
7810                         goto unlock;
7811                 }
7812
7813                 list_del(&params->action);
7814                 list_del(&params->list);
7815                 kfree(params);
7816
7817                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7818         } else {
7819                 struct hci_conn_params *p, *tmp;
7820                 struct bdaddr_list *b, *btmp;
7821
7822                 if (cp->addr.type) {
7823                         err = mgmt_cmd_complete(sk, hdev->id,
7824                                                 MGMT_OP_REMOVE_DEVICE,
7825                                                 MGMT_STATUS_INVALID_PARAMS,
7826                                                 &cp->addr, sizeof(cp->addr));
7827                         goto unlock;
7828                 }
7829
7830                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7831                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7832                         list_del(&b->list);
7833                         kfree(b);
7834                 }
7835
7836                 hci_update_scan(hdev);
7837
7838                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7839                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7840                                 continue;
7841                         device_removed(sk, hdev, &p->addr, p->addr_type);
7842                         if (p->explicit_connect) {
7843                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7844                                 continue;
7845                         }
7846                         list_del(&p->action);
7847                         list_del(&p->list);
7848                         kfree(p);
7849                 }
7850
7851                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
7852         }
7853
7854         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7855
7856 complete:
7857         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7858                                 MGMT_STATUS_SUCCESS, &cp->addr,
7859                                 sizeof(cp->addr));
7860 unlock:
7861         hci_dev_unlock(hdev);
7862         return err;
7863 }
7864
7865 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7866                            u16 len)
7867 {
7868         struct mgmt_cp_load_conn_param *cp = data;
7869         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7870                                      sizeof(struct mgmt_conn_param));
7871         u16 param_count, expected_len;
7872         int i;
7873
7874         if (!lmp_le_capable(hdev))
7875                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7876                                        MGMT_STATUS_NOT_SUPPORTED);
7877
7878         param_count = __le16_to_cpu(cp->param_count);
7879         if (param_count > max_param_count) {
7880                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7881                            param_count);
7882                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7883                                        MGMT_STATUS_INVALID_PARAMS);
7884         }
7885
7886         expected_len = struct_size(cp, params, param_count);
7887         if (expected_len != len) {
7888                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7889                            expected_len, len);
7890                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7891                                        MGMT_STATUS_INVALID_PARAMS);
7892         }
7893
7894         bt_dev_dbg(hdev, "param_count %u", param_count);
7895
7896         hci_dev_lock(hdev);
7897
7898         hci_conn_params_clear_disabled(hdev);
7899
7900         for (i = 0; i < param_count; i++) {
7901                 struct mgmt_conn_param *param = &cp->params[i];
7902                 struct hci_conn_params *hci_param;
7903                 u16 min, max, latency, timeout;
7904                 u8 addr_type;
7905
7906                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7907                            param->addr.type);
7908
7909                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7910                         addr_type = ADDR_LE_DEV_PUBLIC;
7911                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7912                         addr_type = ADDR_LE_DEV_RANDOM;
7913                 } else {
7914                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7915                         continue;
7916                 }
7917
7918                 min = le16_to_cpu(param->min_interval);
7919                 max = le16_to_cpu(param->max_interval);
7920                 latency = le16_to_cpu(param->latency);
7921                 timeout = le16_to_cpu(param->timeout);
7922
7923                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7924                            min, max, latency, timeout);
7925
7926                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7927                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7928                         continue;
7929                 }
7930
7931                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7932                                                 addr_type);
7933                 if (!hci_param) {
7934                         bt_dev_err(hdev, "failed to add connection parameters");
7935                         continue;
7936                 }
7937
7938                 hci_param->conn_min_interval = min;
7939                 hci_param->conn_max_interval = max;
7940                 hci_param->conn_latency = latency;
7941                 hci_param->supervision_timeout = timeout;
7942         }
7943
7944         hci_dev_unlock(hdev);
7945
7946         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7947                                  NULL, 0);
7948 }
7949
7950 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7951                                void *data, u16 len)
7952 {
7953         struct mgmt_cp_set_external_config *cp = data;
7954         bool changed;
7955         int err;
7956
7957         bt_dev_dbg(hdev, "sock %p", sk);
7958
7959         if (hdev_is_powered(hdev))
7960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7961                                        MGMT_STATUS_REJECTED);
7962
7963         if (cp->config != 0x00 && cp->config != 0x01)
7964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7965                                          MGMT_STATUS_INVALID_PARAMS);
7966
7967         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7968                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7969                                        MGMT_STATUS_NOT_SUPPORTED);
7970
7971         hci_dev_lock(hdev);
7972
7973         if (cp->config)
7974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7975         else
7976                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7977
7978         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7979         if (err < 0)
7980                 goto unlock;
7981
7982         if (!changed)
7983                 goto unlock;
7984
7985         err = new_options(hdev, sk);
7986
7987         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7988                 mgmt_index_removed(hdev);
7989
7990                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7991                         hci_dev_set_flag(hdev, HCI_CONFIG);
7992                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7993
7994                         queue_work(hdev->req_workqueue, &hdev->power_on);
7995                 } else {
7996                         set_bit(HCI_RAW, &hdev->flags);
7997                         mgmt_index_added(hdev);
7998                 }
7999         }
8000
8001 unlock:
8002         hci_dev_unlock(hdev);
8003         return err;
8004 }
8005
8006 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8007                               void *data, u16 len)
8008 {
8009         struct mgmt_cp_set_public_address *cp = data;
8010         bool changed;
8011         int err;
8012
8013         bt_dev_dbg(hdev, "sock %p", sk);
8014
8015         if (hdev_is_powered(hdev))
8016                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8017                                        MGMT_STATUS_REJECTED);
8018
8019         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8020                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8021                                        MGMT_STATUS_INVALID_PARAMS);
8022
8023         if (!hdev->set_bdaddr)
8024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8025                                        MGMT_STATUS_NOT_SUPPORTED);
8026
8027         hci_dev_lock(hdev);
8028
8029         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8030         bacpy(&hdev->public_addr, &cp->bdaddr);
8031
8032         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8033         if (err < 0)
8034                 goto unlock;
8035
8036         if (!changed)
8037                 goto unlock;
8038
8039         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8040                 err = new_options(hdev, sk);
8041
8042         if (is_configured(hdev)) {
8043                 mgmt_index_removed(hdev);
8044
8045                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8046
8047                 hci_dev_set_flag(hdev, HCI_CONFIG);
8048                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8049
8050                 queue_work(hdev->req_workqueue, &hdev->power_on);
8051         }
8052
8053 unlock:
8054         hci_dev_unlock(hdev);
8055         return err;
8056 }
8057
8058 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8059                                              int err)
8060 {
8061         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8062         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8063         u8 *h192, *r192, *h256, *r256;
8064         struct mgmt_pending_cmd *cmd = data;
8065         struct sk_buff *skb = cmd->skb;
8066         u8 status = mgmt_status(err);
8067         u16 eir_len;
8068
8069         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
8070                 return;
8071
8072         if (!status) {
8073                 if (!skb)
8074                         status = MGMT_STATUS_FAILED;
8075                 else if (IS_ERR(skb))
8076                         status = mgmt_status(PTR_ERR(skb));
8077                 else
8078                         status = mgmt_status(skb->data[0]);
8079         }
8080
8081         bt_dev_dbg(hdev, "status %u", status);
8082
8083         mgmt_cp = cmd->param;
8084
8085         if (status) {
8086                 status = mgmt_status(status);
8087                 eir_len = 0;
8088
8089                 h192 = NULL;
8090                 r192 = NULL;
8091                 h256 = NULL;
8092                 r256 = NULL;
8093         } else if (!bredr_sc_enabled(hdev)) {
8094                 struct hci_rp_read_local_oob_data *rp;
8095
8096                 if (skb->len != sizeof(*rp)) {
8097                         status = MGMT_STATUS_FAILED;
8098                         eir_len = 0;
8099                 } else {
8100                         status = MGMT_STATUS_SUCCESS;
8101                         rp = (void *)skb->data;
8102
8103                         eir_len = 5 + 18 + 18;
8104                         h192 = rp->hash;
8105                         r192 = rp->rand;
8106                         h256 = NULL;
8107                         r256 = NULL;
8108                 }
8109         } else {
8110                 struct hci_rp_read_local_oob_ext_data *rp;
8111
8112                 if (skb->len != sizeof(*rp)) {
8113                         status = MGMT_STATUS_FAILED;
8114                         eir_len = 0;
8115                 } else {
8116                         status = MGMT_STATUS_SUCCESS;
8117                         rp = (void *)skb->data;
8118
8119                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8120                                 eir_len = 5 + 18 + 18;
8121                                 h192 = NULL;
8122                                 r192 = NULL;
8123                         } else {
8124                                 eir_len = 5 + 18 + 18 + 18 + 18;
8125                                 h192 = rp->hash192;
8126                                 r192 = rp->rand192;
8127                         }
8128
8129                         h256 = rp->hash256;
8130                         r256 = rp->rand256;
8131                 }
8132         }
8133
8134         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8135         if (!mgmt_rp)
8136                 goto done;
8137
8138         if (eir_len == 0)
8139                 goto send_rsp;
8140
8141         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8142                                   hdev->dev_class, 3);
8143
8144         if (h192 && r192) {
8145                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8146                                           EIR_SSP_HASH_C192, h192, 16);
8147                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8148                                           EIR_SSP_RAND_R192, r192, 16);
8149         }
8150
8151         if (h256 && r256) {
8152                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8153                                           EIR_SSP_HASH_C256, h256, 16);
8154                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8155                                           EIR_SSP_RAND_R256, r256, 16);
8156         }
8157
8158 send_rsp:
8159         mgmt_rp->type = mgmt_cp->type;
8160         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8161
8162         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8163                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8164                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8165         if (err < 0 || status)
8166                 goto done;
8167
8168         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8169
8170         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8171                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8172                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8173 done:
8174         if (skb && !IS_ERR(skb))
8175                 kfree_skb(skb);
8176
8177         kfree(mgmt_rp);
8178         mgmt_pending_remove(cmd);
8179 }
8180
8181 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8182                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8183 {
8184         struct mgmt_pending_cmd *cmd;
8185         int err;
8186
8187         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8188                                cp, sizeof(*cp));
8189         if (!cmd)
8190                 return -ENOMEM;
8191
8192         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8193                                  read_local_oob_ext_data_complete);
8194
8195         if (err < 0) {
8196                 mgmt_pending_remove(cmd);
8197                 return err;
8198         }
8199
8200         return 0;
8201 }
8202
8203 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8204                                    void *data, u16 data_len)
8205 {
8206         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8207         struct mgmt_rp_read_local_oob_ext_data *rp;
8208         size_t rp_len;
8209         u16 eir_len;
8210         u8 status, flags, role, addr[7], hash[16], rand[16];
8211         int err;
8212
8213         bt_dev_dbg(hdev, "sock %p", sk);
8214
8215         if (hdev_is_powered(hdev)) {
8216                 switch (cp->type) {
8217                 case BIT(BDADDR_BREDR):
8218                         status = mgmt_bredr_support(hdev);
8219                         if (status)
8220                                 eir_len = 0;
8221                         else
8222                                 eir_len = 5;
8223                         break;
8224                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8225                         status = mgmt_le_support(hdev);
8226                         if (status)
8227                                 eir_len = 0;
8228                         else
8229                                 eir_len = 9 + 3 + 18 + 18 + 3;
8230                         break;
8231                 default:
8232                         status = MGMT_STATUS_INVALID_PARAMS;
8233                         eir_len = 0;
8234                         break;
8235                 }
8236         } else {
8237                 status = MGMT_STATUS_NOT_POWERED;
8238                 eir_len = 0;
8239         }
8240
8241         rp_len = sizeof(*rp) + eir_len;
8242         rp = kmalloc(rp_len, GFP_ATOMIC);
8243         if (!rp)
8244                 return -ENOMEM;
8245
8246         if (!status && !lmp_ssp_capable(hdev)) {
8247                 status = MGMT_STATUS_NOT_SUPPORTED;
8248                 eir_len = 0;
8249         }
8250
8251         if (status)
8252                 goto complete;
8253
8254         hci_dev_lock(hdev);
8255
8256         eir_len = 0;
8257         switch (cp->type) {
8258         case BIT(BDADDR_BREDR):
8259                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8260                         err = read_local_ssp_oob_req(hdev, sk, cp);
8261                         hci_dev_unlock(hdev);
8262                         if (!err)
8263                                 goto done;
8264
8265                         status = MGMT_STATUS_FAILED;
8266                         goto complete;
8267                 } else {
8268                         eir_len = eir_append_data(rp->eir, eir_len,
8269                                                   EIR_CLASS_OF_DEV,
8270                                                   hdev->dev_class, 3);
8271                 }
8272                 break;
8273         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8274                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8275                     smp_generate_oob(hdev, hash, rand) < 0) {
8276                         hci_dev_unlock(hdev);
8277                         status = MGMT_STATUS_FAILED;
8278                         goto complete;
8279                 }
8280
8281                 /* This should return the active RPA, but since the RPA
8282                  * is only programmed on demand, it is really hard to fill
8283                  * this in at the moment. For now disallow retrieving
8284                  * local out-of-band data when privacy is in use.
8285                  *
8286                  * Returning the identity address will not help here since
8287                  * pairing happens before the identity resolving key is
8288                  * known and thus the connection establishment happens
8289                  * based on the RPA and not the identity address.
8290                  */
8291                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8292                         hci_dev_unlock(hdev);
8293                         status = MGMT_STATUS_REJECTED;
8294                         goto complete;
8295                 }
8296
8297                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8298                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8299                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8300                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8301                         memcpy(addr, &hdev->static_addr, 6);
8302                         addr[6] = 0x01;
8303                 } else {
8304                         memcpy(addr, &hdev->bdaddr, 6);
8305                         addr[6] = 0x00;
8306                 }
8307
8308                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8309                                           addr, sizeof(addr));
8310
8311                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8312                         role = 0x02;
8313                 else
8314                         role = 0x01;
8315
8316                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8317                                           &role, sizeof(role));
8318
8319                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8320                         eir_len = eir_append_data(rp->eir, eir_len,
8321                                                   EIR_LE_SC_CONFIRM,
8322                                                   hash, sizeof(hash));
8323
8324                         eir_len = eir_append_data(rp->eir, eir_len,
8325                                                   EIR_LE_SC_RANDOM,
8326                                                   rand, sizeof(rand));
8327                 }
8328
8329                 flags = mgmt_get_adv_discov_flags(hdev);
8330
8331                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8332                         flags |= LE_AD_NO_BREDR;
8333
8334                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8335                                           &flags, sizeof(flags));
8336                 break;
8337         }
8338
8339         hci_dev_unlock(hdev);
8340
8341         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8342
8343         status = MGMT_STATUS_SUCCESS;
8344
8345 complete:
8346         rp->type = cp->type;
8347         rp->eir_len = cpu_to_le16(eir_len);
8348
8349         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8350                                 status, rp, sizeof(*rp) + eir_len);
8351         if (err < 0 || status)
8352                 goto done;
8353
8354         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8355                                  rp, sizeof(*rp) + eir_len,
8356                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8357
8358 done:
8359         kfree(rp);
8360
8361         return err;
8362 }
8363
8364 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8365 {
8366         u32 flags = 0;
8367
8368         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8369         flags |= MGMT_ADV_FLAG_DISCOV;
8370         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8371         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8372         flags |= MGMT_ADV_FLAG_APPEARANCE;
8373         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8374         flags |= MGMT_ADV_PARAM_DURATION;
8375         flags |= MGMT_ADV_PARAM_TIMEOUT;
8376         flags |= MGMT_ADV_PARAM_INTERVALS;
8377         flags |= MGMT_ADV_PARAM_TX_POWER;
8378         flags |= MGMT_ADV_PARAM_SCAN_RSP;
8379
8380         /* In extended adv TX_POWER returned from Set Adv Param
8381          * will be always valid.
8382          */
8383         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8384                 flags |= MGMT_ADV_FLAG_TX_POWER;
8385
8386         if (ext_adv_capable(hdev)) {
8387                 flags |= MGMT_ADV_FLAG_SEC_1M;
8388                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8389                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8390
8391                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
8392                         flags |= MGMT_ADV_FLAG_SEC_2M;
8393
8394                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
8395                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8396         }
8397
8398         return flags;
8399 }
8400
8401 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8402                              void *data, u16 data_len)
8403 {
8404         struct mgmt_rp_read_adv_features *rp;
8405         size_t rp_len;
8406         int err;
8407         struct adv_info *adv_instance;
8408         u32 supported_flags;
8409         u8 *instance;
8410
8411         bt_dev_dbg(hdev, "sock %p", sk);
8412
8413         if (!lmp_le_capable(hdev))
8414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8415                                        MGMT_STATUS_REJECTED);
8416
8417         hci_dev_lock(hdev);
8418
8419         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8420         rp = kmalloc(rp_len, GFP_ATOMIC);
8421         if (!rp) {
8422                 hci_dev_unlock(hdev);
8423                 return -ENOMEM;
8424         }
8425
8426         supported_flags = get_supported_adv_flags(hdev);
8427
8428         rp->supported_flags = cpu_to_le32(supported_flags);
8429         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
8430         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
8431         rp->max_instances = hdev->le_num_of_adv_sets;
8432         rp->num_instances = hdev->adv_instance_cnt;
8433
8434         instance = rp->instance;
8435         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8436                 /* Only instances 1-le_num_of_adv_sets are externally visible */
8437                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8438                         *instance = adv_instance->instance;
8439                         instance++;
8440                 } else {
8441                         rp->num_instances--;
8442                         rp_len--;
8443                 }
8444         }
8445
8446         hci_dev_unlock(hdev);
8447
8448         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8449                                 MGMT_STATUS_SUCCESS, rp, rp_len);
8450
8451         kfree(rp);
8452
8453         return err;
8454 }
8455
8456 static u8 calculate_name_len(struct hci_dev *hdev)
8457 {
8458         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
8459
8460         return eir_append_local_name(hdev, buf, 0);
8461 }
8462
8463 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8464                            bool is_adv_data)
8465 {
8466         u8 max_len = HCI_MAX_AD_LENGTH;
8467
8468         if (is_adv_data) {
8469                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8470                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
8471                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
8472                         max_len -= 3;
8473
8474                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8475                         max_len -= 3;
8476         } else {
8477                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8478                         max_len -= calculate_name_len(hdev);
8479
8480                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8481                         max_len -= 4;
8482         }
8483
8484         return max_len;
8485 }
8486
8487 static bool flags_managed(u32 adv_flags)
8488 {
8489         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8490                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8491                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8492 }
8493
8494 static bool tx_power_managed(u32 adv_flags)
8495 {
8496         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8497 }
8498
8499 static bool name_managed(u32 adv_flags)
8500 {
8501         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8502 }
8503
8504 static bool appearance_managed(u32 adv_flags)
8505 {
8506         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8507 }
8508
8509 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8510                               u8 len, bool is_adv_data)
8511 {
8512         int i, cur_len;
8513         u8 max_len;
8514
8515         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8516
8517         if (len > max_len)
8518                 return false;
8519
8520         /* Make sure that the data is correctly formatted. */
8521         for (i = 0; i < len; i += (cur_len + 1)) {
8522                 cur_len = data[i];
8523
8524                 if (!cur_len)
8525                         continue;
8526
8527                 if (data[i + 1] == EIR_FLAGS &&
8528                     (!is_adv_data || flags_managed(adv_flags)))
8529                         return false;
8530
8531                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8532                         return false;
8533
8534                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8535                         return false;
8536
8537                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8538                         return false;
8539
8540                 if (data[i + 1] == EIR_APPEARANCE &&
8541                     appearance_managed(adv_flags))
8542                         return false;
8543
8544                 /* If the current field length would exceed the total data
8545                  * length, then it's invalid.
8546                  */
8547                 if (i + cur_len >= len)
8548                         return false;
8549         }
8550
8551         return true;
8552 }
8553
8554 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8555 {
8556         u32 supported_flags, phy_flags;
8557
8558         /* The current implementation only supports a subset of the specified
8559          * flags. Also need to check mutual exclusiveness of sec flags.
8560          */
8561         supported_flags = get_supported_adv_flags(hdev);
8562         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8563         if (adv_flags & ~supported_flags ||
8564             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8565                 return false;
8566
8567         return true;
8568 }
8569
8570 static bool adv_busy(struct hci_dev *hdev)
8571 {
8572         return pending_find(MGMT_OP_SET_LE, hdev);
8573 }
8574
8575 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8576                              int err)
8577 {
8578         struct adv_info *adv, *n;
8579
8580         bt_dev_dbg(hdev, "err %d", err);
8581
8582         hci_dev_lock(hdev);
8583
8584         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8585                 u8 instance;
8586
8587                 if (!adv->pending)
8588                         continue;
8589
8590                 if (!err) {
8591                         adv->pending = false;
8592                         continue;
8593                 }
8594
8595                 instance = adv->instance;
8596
8597                 if (hdev->cur_adv_instance == instance)
8598                         cancel_adv_timeout(hdev);
8599
8600                 hci_remove_adv_instance(hdev, instance);
8601                 mgmt_advertising_removed(sk, hdev, instance);
8602         }
8603
8604         hci_dev_unlock(hdev);
8605 }
8606
8607 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8608 {
8609         struct mgmt_pending_cmd *cmd = data;
8610         struct mgmt_cp_add_advertising *cp = cmd->param;
8611         struct mgmt_rp_add_advertising rp;
8612
8613         memset(&rp, 0, sizeof(rp));
8614
8615         rp.instance = cp->instance;
8616
8617         if (err)
8618                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8619                                 mgmt_status(err));
8620         else
8621                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8622                                   mgmt_status(err), &rp, sizeof(rp));
8623
8624         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8625
8626         mgmt_pending_free(cmd);
8627 }
8628
8629 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8630 {
8631         struct mgmt_pending_cmd *cmd = data;
8632         struct mgmt_cp_add_advertising *cp = cmd->param;
8633
8634         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8635 }
8636
8637 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8638                            void *data, u16 data_len)
8639 {
8640         struct mgmt_cp_add_advertising *cp = data;
8641         struct mgmt_rp_add_advertising rp;
8642         u32 flags;
8643         u8 status;
8644         u16 timeout, duration;
8645         unsigned int prev_instance_cnt;
8646         u8 schedule_instance = 0;
8647         struct adv_info *adv, *next_instance;
8648         int err;
8649         struct mgmt_pending_cmd *cmd;
8650
8651         bt_dev_dbg(hdev, "sock %p", sk);
8652
8653         status = mgmt_le_support(hdev);
8654         if (status)
8655                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8656                                        status);
8657
8658         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8659                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8660                                        MGMT_STATUS_INVALID_PARAMS);
8661
8662         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8663                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8664                                        MGMT_STATUS_INVALID_PARAMS);
8665
8666         flags = __le32_to_cpu(cp->flags);
8667         timeout = __le16_to_cpu(cp->timeout);
8668         duration = __le16_to_cpu(cp->duration);
8669
8670         if (!requested_adv_flags_are_valid(hdev, flags))
8671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8672                                        MGMT_STATUS_INVALID_PARAMS);
8673
8674         hci_dev_lock(hdev);
8675
8676         if (timeout && !hdev_is_powered(hdev)) {
8677                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8678                                       MGMT_STATUS_REJECTED);
8679                 goto unlock;
8680         }
8681
8682         if (adv_busy(hdev)) {
8683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8684                                       MGMT_STATUS_BUSY);
8685                 goto unlock;
8686         }
8687
8688         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8689             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8690                                cp->scan_rsp_len, false)) {
8691                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8692                                       MGMT_STATUS_INVALID_PARAMS);
8693                 goto unlock;
8694         }
8695
8696         prev_instance_cnt = hdev->adv_instance_cnt;
8697
8698         adv = hci_add_adv_instance(hdev, cp->instance, flags,
8699                                    cp->adv_data_len, cp->data,
8700                                    cp->scan_rsp_len,
8701                                    cp->data + cp->adv_data_len,
8702                                    timeout, duration,
8703                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8704                                    hdev->le_adv_min_interval,
8705                                    hdev->le_adv_max_interval, 0);
8706         if (IS_ERR(adv)) {
8707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8708                                       MGMT_STATUS_FAILED);
8709                 goto unlock;
8710         }
8711
8712         /* Only trigger an advertising added event if a new instance was
8713          * actually added.
8714          */
8715         if (hdev->adv_instance_cnt > prev_instance_cnt)
8716                 mgmt_advertising_added(sk, hdev, cp->instance);
8717
8718         if (hdev->cur_adv_instance == cp->instance) {
8719                 /* If the currently advertised instance is being changed then
8720                  * cancel the current advertising and schedule the next
8721                  * instance. If there is only one instance then the overridden
8722                  * advertising data will be visible right away.
8723                  */
8724                 cancel_adv_timeout(hdev);
8725
8726                 next_instance = hci_get_next_instance(hdev, cp->instance);
8727                 if (next_instance)
8728                         schedule_instance = next_instance->instance;
8729         } else if (!hdev->adv_instance_timeout) {
8730                 /* Immediately advertise the new instance if no other
8731                  * instance is currently being advertised.
8732                  */
8733                 schedule_instance = cp->instance;
8734         }
8735
8736         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8737          * there is no instance to be advertised then we have no HCI
8738          * communication to make. Simply return.
8739          */
8740         if (!hdev_is_powered(hdev) ||
8741             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8742             !schedule_instance) {
8743                 rp.instance = cp->instance;
8744                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8745                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8746                 goto unlock;
8747         }
8748
8749         /* We're good to go, update advertising data, parameters, and start
8750          * advertising.
8751          */
8752         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8753                                data_len);
8754         if (!cmd) {
8755                 err = -ENOMEM;
8756                 goto unlock;
8757         }
8758
8759         cp->instance = schedule_instance;
8760
8761         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8762                                  add_advertising_complete);
8763         if (err < 0)
8764                 mgmt_pending_free(cmd);
8765
8766 unlock:
8767         hci_dev_unlock(hdev);
8768
8769         return err;
8770 }
8771
8772 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8773                                         int err)
8774 {
8775         struct mgmt_pending_cmd *cmd = data;
8776         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8777         struct mgmt_rp_add_ext_adv_params rp;
8778         struct adv_info *adv;
8779         u32 flags;
8780
8781         BT_DBG("%s", hdev->name);
8782
8783         hci_dev_lock(hdev);
8784
8785         adv = hci_find_adv_instance(hdev, cp->instance);
8786         if (!adv)
8787                 goto unlock;
8788
8789         rp.instance = cp->instance;
8790         rp.tx_power = adv->tx_power;
8791
8792         /* While we're at it, inform userspace of the available space for this
8793          * advertisement, given the flags that will be used.
8794          */
8795         flags = __le32_to_cpu(cp->flags);
8796         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8797         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8798
8799         if (err) {
8800                 /* If this advertisement was previously advertising and we
8801                  * failed to update it, we signal that it has been removed and
8802                  * delete its structure
8803                  */
8804                 if (!adv->pending)
8805                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8806
8807                 hci_remove_adv_instance(hdev, cp->instance);
8808
8809                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8810                                 mgmt_status(err));
8811         } else {
8812                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8813                                   mgmt_status(err), &rp, sizeof(rp));
8814         }
8815
8816 unlock:
8817         if (cmd)
8818                 mgmt_pending_free(cmd);
8819
8820         hci_dev_unlock(hdev);
8821 }
8822
8823 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8824 {
8825         struct mgmt_pending_cmd *cmd = data;
8826         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8827
8828         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8829 }
8830
8831 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8832                               void *data, u16 data_len)
8833 {
8834         struct mgmt_cp_add_ext_adv_params *cp = data;
8835         struct mgmt_rp_add_ext_adv_params rp;
8836         struct mgmt_pending_cmd *cmd = NULL;
8837         struct adv_info *adv;
8838         u32 flags, min_interval, max_interval;
8839         u16 timeout, duration;
8840         u8 status;
8841         s8 tx_power;
8842         int err;
8843
8844         BT_DBG("%s", hdev->name);
8845
8846         status = mgmt_le_support(hdev);
8847         if (status)
8848                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8849                                        status);
8850
8851         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8852                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8853                                        MGMT_STATUS_INVALID_PARAMS);
8854
8855         /* The purpose of breaking add_advertising into two separate MGMT calls
8856          * for params and data is to allow more parameters to be added to this
8857          * structure in the future. For this reason, we verify that we have the
8858          * bare minimum structure we know of when the interface was defined. Any
8859          * extra parameters we don't know about will be ignored in this request.
8860          */
8861         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8862                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8863                                        MGMT_STATUS_INVALID_PARAMS);
8864
8865         flags = __le32_to_cpu(cp->flags);
8866
8867         if (!requested_adv_flags_are_valid(hdev, flags))
8868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8869                                        MGMT_STATUS_INVALID_PARAMS);
8870
8871         hci_dev_lock(hdev);
8872
8873         /* In new interface, we require that we are powered to register */
8874         if (!hdev_is_powered(hdev)) {
8875                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8876                                       MGMT_STATUS_REJECTED);
8877                 goto unlock;
8878         }
8879
8880         if (adv_busy(hdev)) {
8881                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8882                                       MGMT_STATUS_BUSY);
8883                 goto unlock;
8884         }
8885
8886         /* Parse defined parameters from request, use defaults otherwise */
8887         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8888                   __le16_to_cpu(cp->timeout) : 0;
8889
8890         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8891                    __le16_to_cpu(cp->duration) :
8892                    hdev->def_multi_adv_rotation_duration;
8893
8894         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8895                        __le32_to_cpu(cp->min_interval) :
8896                        hdev->le_adv_min_interval;
8897
8898         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8899                        __le32_to_cpu(cp->max_interval) :
8900                        hdev->le_adv_max_interval;
8901
8902         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8903                    cp->tx_power :
8904                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8905
8906         /* Create advertising instance with no advertising or response data */
8907         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8908                                    timeout, duration, tx_power, min_interval,
8909                                    max_interval, 0);
8910
8911         if (IS_ERR(adv)) {
8912                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8913                                       MGMT_STATUS_FAILED);
8914                 goto unlock;
8915         }
8916
8917         /* Submit request for advertising params if ext adv available */
8918         if (ext_adv_capable(hdev)) {
8919                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8920                                        data, data_len);
8921                 if (!cmd) {
8922                         err = -ENOMEM;
8923                         hci_remove_adv_instance(hdev, cp->instance);
8924                         goto unlock;
8925                 }
8926
8927                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8928                                          add_ext_adv_params_complete);
8929                 if (err < 0)
8930                         mgmt_pending_free(cmd);
8931         } else {
8932                 rp.instance = cp->instance;
8933                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8934                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8935                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8936                 err = mgmt_cmd_complete(sk, hdev->id,
8937                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8938                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8939         }
8940
8941 unlock:
8942         hci_dev_unlock(hdev);
8943
8944         return err;
8945 }
8946
8947 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8948 {
8949         struct mgmt_pending_cmd *cmd = data;
8950         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8951         struct mgmt_rp_add_advertising rp;
8952
8953         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8954
8955         memset(&rp, 0, sizeof(rp));
8956
8957         rp.instance = cp->instance;
8958
8959         if (err)
8960                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8961                                 mgmt_status(err));
8962         else
8963                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8964                                   mgmt_status(err), &rp, sizeof(rp));
8965
8966         mgmt_pending_free(cmd);
8967 }
8968
8969 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8970 {
8971         struct mgmt_pending_cmd *cmd = data;
8972         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8973         int err;
8974
8975         if (ext_adv_capable(hdev)) {
8976                 err = hci_update_adv_data_sync(hdev, cp->instance);
8977                 if (err)
8978                         return err;
8979
8980                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8981                 if (err)
8982                         return err;
8983
8984                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8985         }
8986
8987         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8988 }
8989
8990 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8991                             u16 data_len)
8992 {
8993         struct mgmt_cp_add_ext_adv_data *cp = data;
8994         struct mgmt_rp_add_ext_adv_data rp;
8995         u8 schedule_instance = 0;
8996         struct adv_info *next_instance;
8997         struct adv_info *adv_instance;
8998         int err = 0;
8999         struct mgmt_pending_cmd *cmd;
9000
9001         BT_DBG("%s", hdev->name);
9002
9003         hci_dev_lock(hdev);
9004
9005         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9006
9007         if (!adv_instance) {
9008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9009                                       MGMT_STATUS_INVALID_PARAMS);
9010                 goto unlock;
9011         }
9012
9013         /* In new interface, we require that we are powered to register */
9014         if (!hdev_is_powered(hdev)) {
9015                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9016                                       MGMT_STATUS_REJECTED);
9017                 goto clear_new_instance;
9018         }
9019
9020         if (adv_busy(hdev)) {
9021                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9022                                       MGMT_STATUS_BUSY);
9023                 goto clear_new_instance;
9024         }
9025
9026         /* Validate new data */
9027         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9028                                cp->adv_data_len, true) ||
9029             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9030                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9031                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9032                                       MGMT_STATUS_INVALID_PARAMS);
9033                 goto clear_new_instance;
9034         }
9035
9036         /* Set the data in the advertising instance */
9037         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9038                                   cp->data, cp->scan_rsp_len,
9039                                   cp->data + cp->adv_data_len);
9040
9041         /* If using software rotation, determine next instance to use */
9042         if (hdev->cur_adv_instance == cp->instance) {
9043                 /* If the currently advertised instance is being changed
9044                  * then cancel the current advertising and schedule the
9045                  * next instance. If there is only one instance then the
9046                  * overridden advertising data will be visible right
9047                  * away
9048                  */
9049                 cancel_adv_timeout(hdev);
9050
9051                 next_instance = hci_get_next_instance(hdev, cp->instance);
9052                 if (next_instance)
9053                         schedule_instance = next_instance->instance;
9054         } else if (!hdev->adv_instance_timeout) {
9055                 /* Immediately advertise the new instance if no other
9056                  * instance is currently being advertised.
9057                  */
9058                 schedule_instance = cp->instance;
9059         }
9060
9061         /* If the HCI_ADVERTISING flag is set or there is no instance to
9062          * be advertised then we have no HCI communication to make.
9063          * Simply return.
9064          */
9065         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9066                 if (adv_instance->pending) {
9067                         mgmt_advertising_added(sk, hdev, cp->instance);
9068                         adv_instance->pending = false;
9069                 }
9070                 rp.instance = cp->instance;
9071                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9072                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9073                 goto unlock;
9074         }
9075
9076         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9077                                data_len);
9078         if (!cmd) {
9079                 err = -ENOMEM;
9080                 goto clear_new_instance;
9081         }
9082
9083         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9084                                  add_ext_adv_data_complete);
9085         if (err < 0) {
9086                 mgmt_pending_free(cmd);
9087                 goto clear_new_instance;
9088         }
9089
9090         /* We were successful in updating data, so trigger advertising_added
9091          * event if this is an instance that wasn't previously advertising. If
9092          * a failure occurs in the requests we initiated, we will remove the
9093          * instance again in add_advertising_complete
9094          */
9095         if (adv_instance->pending)
9096                 mgmt_advertising_added(sk, hdev, cp->instance);
9097
9098         goto unlock;
9099
9100 clear_new_instance:
9101         hci_remove_adv_instance(hdev, cp->instance);
9102
9103 unlock:
9104         hci_dev_unlock(hdev);
9105
9106         return err;
9107 }
9108
9109 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9110                                         int err)
9111 {
9112         struct mgmt_pending_cmd *cmd = data;
9113         struct mgmt_cp_remove_advertising *cp = cmd->param;
9114         struct mgmt_rp_remove_advertising rp;
9115
9116         bt_dev_dbg(hdev, "err %d", err);
9117
9118         memset(&rp, 0, sizeof(rp));
9119         rp.instance = cp->instance;
9120
9121         if (err)
9122                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9123                                 mgmt_status(err));
9124         else
9125                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9126                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9127
9128         mgmt_pending_free(cmd);
9129 }
9130
9131 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9132 {
9133         struct mgmt_pending_cmd *cmd = data;
9134         struct mgmt_cp_remove_advertising *cp = cmd->param;
9135         int err;
9136
9137         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9138         if (err)
9139                 return err;
9140
9141         if (list_empty(&hdev->adv_instances))
9142                 err = hci_disable_advertising_sync(hdev);
9143
9144         return err;
9145 }
9146
9147 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9148                               void *data, u16 data_len)
9149 {
9150         struct mgmt_cp_remove_advertising *cp = data;
9151         struct mgmt_pending_cmd *cmd;
9152         int err;
9153
9154         bt_dev_dbg(hdev, "sock %p", sk);
9155
9156         hci_dev_lock(hdev);
9157
9158         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9159                 err = mgmt_cmd_status(sk, hdev->id,
9160                                       MGMT_OP_REMOVE_ADVERTISING,
9161                                       MGMT_STATUS_INVALID_PARAMS);
9162                 goto unlock;
9163         }
9164
9165         if (pending_find(MGMT_OP_SET_LE, hdev)) {
9166                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9167                                       MGMT_STATUS_BUSY);
9168                 goto unlock;
9169         }
9170
9171         if (list_empty(&hdev->adv_instances)) {
9172                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9173                                       MGMT_STATUS_INVALID_PARAMS);
9174                 goto unlock;
9175         }
9176
9177         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9178                                data_len);
9179         if (!cmd) {
9180                 err = -ENOMEM;
9181                 goto unlock;
9182         }
9183
9184         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9185                                  remove_advertising_complete);
9186         if (err < 0)
9187                 mgmt_pending_free(cmd);
9188
9189 unlock:
9190         hci_dev_unlock(hdev);
9191
9192         return err;
9193 }
9194
9195 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9196                              void *data, u16 data_len)
9197 {
9198         struct mgmt_cp_get_adv_size_info *cp = data;
9199         struct mgmt_rp_get_adv_size_info rp;
9200         u32 flags, supported_flags;
9201
9202         bt_dev_dbg(hdev, "sock %p", sk);
9203
9204         if (!lmp_le_capable(hdev))
9205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9206                                        MGMT_STATUS_REJECTED);
9207
9208         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9210                                        MGMT_STATUS_INVALID_PARAMS);
9211
9212         flags = __le32_to_cpu(cp->flags);
9213
9214         /* The current implementation only supports a subset of the specified
9215          * flags.
9216          */
9217         supported_flags = get_supported_adv_flags(hdev);
9218         if (flags & ~supported_flags)
9219                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9220                                        MGMT_STATUS_INVALID_PARAMS);
9221
9222         rp.instance = cp->instance;
9223         rp.flags = cp->flags;
9224         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9225         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9226
9227         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9228                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9229 }
9230
9231 static const struct hci_mgmt_handler mgmt_handlers[] = {
9232         { NULL }, /* 0x0000 (no command) */
9233         { read_version,            MGMT_READ_VERSION_SIZE,
9234                                                 HCI_MGMT_NO_HDEV |
9235                                                 HCI_MGMT_UNTRUSTED },
9236         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9237                                                 HCI_MGMT_NO_HDEV |
9238                                                 HCI_MGMT_UNTRUSTED },
9239         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9240                                                 HCI_MGMT_NO_HDEV |
9241                                                 HCI_MGMT_UNTRUSTED },
9242         { read_controller_info,    MGMT_READ_INFO_SIZE,
9243                                                 HCI_MGMT_UNTRUSTED },
9244         { set_powered,             MGMT_SETTING_SIZE },
9245         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9246         { set_connectable,         MGMT_SETTING_SIZE },
9247         { set_fast_connectable,    MGMT_SETTING_SIZE },
9248         { set_bondable,            MGMT_SETTING_SIZE },
9249         { set_link_security,       MGMT_SETTING_SIZE },
9250         { set_ssp,                 MGMT_SETTING_SIZE },
9251         { set_hs,                  MGMT_SETTING_SIZE },
9252         { set_le,                  MGMT_SETTING_SIZE },
9253         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9254         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9255         { add_uuid,                MGMT_ADD_UUID_SIZE },
9256         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9257         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9258                                                 HCI_MGMT_VAR_LEN },
9259         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9260                                                 HCI_MGMT_VAR_LEN },
9261         { disconnect,              MGMT_DISCONNECT_SIZE },
9262         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9263         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9264         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9265         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9266         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9267         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9268         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9269         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9270         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9271         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9272         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9273         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9274         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9275                                                 HCI_MGMT_VAR_LEN },
9276         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9277         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9278         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9279         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9280         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9281         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9282         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9283         { set_advertising,         MGMT_SETTING_SIZE },
9284         { set_bredr,               MGMT_SETTING_SIZE },
9285         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9286         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9287         { set_secure_conn,         MGMT_SETTING_SIZE },
9288         { set_debug_keys,          MGMT_SETTING_SIZE },
9289         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9290         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9291                                                 HCI_MGMT_VAR_LEN },
9292         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9293         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9294         { add_device,              MGMT_ADD_DEVICE_SIZE },
9295         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9296         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9297                                                 HCI_MGMT_VAR_LEN },
9298         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9299                                                 HCI_MGMT_NO_HDEV |
9300                                                 HCI_MGMT_UNTRUSTED },
9301         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9302                                                 HCI_MGMT_UNCONFIGURED |
9303                                                 HCI_MGMT_UNTRUSTED },
9304         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9305                                                 HCI_MGMT_UNCONFIGURED },
9306         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9307                                                 HCI_MGMT_UNCONFIGURED },
9308         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9309                                                 HCI_MGMT_VAR_LEN },
9310         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9311         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9312                                                 HCI_MGMT_NO_HDEV |
9313                                                 HCI_MGMT_UNTRUSTED },
9314         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9315         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9316                                                 HCI_MGMT_VAR_LEN },
9317         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9318         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9319         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9320         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9321                                                 HCI_MGMT_UNTRUSTED },
9322         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9323         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9324         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9325         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9326                                                 HCI_MGMT_VAR_LEN },
9327         { set_wideband_speech,     MGMT_SETTING_SIZE },
9328         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
9329                                                 HCI_MGMT_UNTRUSTED },
9330         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9331                                                 HCI_MGMT_UNTRUSTED |
9332                                                 HCI_MGMT_HDEV_OPTIONAL },
9333         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9334                                                 HCI_MGMT_VAR_LEN |
9335                                                 HCI_MGMT_HDEV_OPTIONAL },
9336         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9337                                                 HCI_MGMT_UNTRUSTED },
9338         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9339                                                 HCI_MGMT_VAR_LEN },
9340         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9341                                                 HCI_MGMT_UNTRUSTED },
9342         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9343                                                 HCI_MGMT_VAR_LEN },
9344         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9345         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9346         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9347         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9348                                                 HCI_MGMT_VAR_LEN },
9349         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9350         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9351                                                 HCI_MGMT_VAR_LEN },
9352         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
9353                                                 HCI_MGMT_VAR_LEN },
9354         { add_adv_patterns_monitor_rssi,
9355                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE },
9356         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
9357                                                 HCI_MGMT_VAR_LEN },
9358         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
9359         { mesh_send,               MGMT_MESH_SEND_SIZE,
9360                                                 HCI_MGMT_VAR_LEN },
9361         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
9362 };
9363
9364 void mgmt_index_added(struct hci_dev *hdev)
9365 {
9366         struct mgmt_ev_ext_index ev;
9367
9368         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9369                 return;
9370
9371         switch (hdev->dev_type) {
9372         case HCI_PRIMARY:
9373                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9374                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9375                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9376                         ev.type = 0x01;
9377                 } else {
9378                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9379                                          HCI_MGMT_INDEX_EVENTS);
9380                         ev.type = 0x00;
9381                 }
9382                 break;
9383         case HCI_AMP:
9384                 ev.type = 0x02;
9385                 break;
9386         default:
9387                 return;
9388         }
9389
9390         ev.bus = hdev->bus;
9391
9392         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9393                          HCI_MGMT_EXT_INDEX_EVENTS);
9394 }
9395
9396 void mgmt_index_removed(struct hci_dev *hdev)
9397 {
9398         struct mgmt_ev_ext_index ev;
9399         u8 status = MGMT_STATUS_INVALID_INDEX;
9400
9401         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9402                 return;
9403
9404         switch (hdev->dev_type) {
9405         case HCI_PRIMARY:
9406                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9407
9408                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9409                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9410                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9411                         ev.type = 0x01;
9412                 } else {
9413                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9414                                          HCI_MGMT_INDEX_EVENTS);
9415                         ev.type = 0x00;
9416                 }
9417                 break;
9418         case HCI_AMP:
9419                 ev.type = 0x02;
9420                 break;
9421         default:
9422                 return;
9423         }
9424
9425         ev.bus = hdev->bus;
9426
9427         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9428                          HCI_MGMT_EXT_INDEX_EVENTS);
9429
9430         /* Cancel any remaining timed work */
9431         if (!hci_dev_test_flag(hdev, HCI_MGMT))
9432                 return;
9433         cancel_delayed_work_sync(&hdev->discov_off);
9434         cancel_delayed_work_sync(&hdev->service_cache);
9435         cancel_delayed_work_sync(&hdev->rpa_expired);
9436 }
9437
9438 void mgmt_power_on(struct hci_dev *hdev, int err)
9439 {
9440         struct cmd_lookup match = { NULL, hdev };
9441
9442         bt_dev_dbg(hdev, "err %d", err);
9443
9444         hci_dev_lock(hdev);
9445
9446         if (!err) {
9447                 restart_le_actions(hdev);
9448                 hci_update_passive_scan(hdev);
9449         }
9450
9451         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9452
9453         new_settings(hdev, match.sk);
9454
9455         if (match.sk)
9456                 sock_put(match.sk);
9457
9458         hci_dev_unlock(hdev);
9459 }
9460
9461 void __mgmt_power_off(struct hci_dev *hdev)
9462 {
9463         struct cmd_lookup match = { NULL, hdev };
9464         u8 status, zero_cod[] = { 0, 0, 0 };
9465
9466         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9467
9468         /* If the power off is because of hdev unregistration let
9469          * use the appropriate INVALID_INDEX status. Otherwise use
9470          * NOT_POWERED. We cover both scenarios here since later in
9471          * mgmt_index_removed() any hci_conn callbacks will have already
9472          * been triggered, potentially causing misleading DISCONNECTED
9473          * status responses.
9474          */
9475         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9476                 status = MGMT_STATUS_INVALID_INDEX;
9477         else
9478                 status = MGMT_STATUS_NOT_POWERED;
9479
9480         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9481
9482         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9483                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9484                                    zero_cod, sizeof(zero_cod),
9485                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9486                 ext_info_changed(hdev, NULL);
9487         }
9488
9489         new_settings(hdev, match.sk);
9490
9491         if (match.sk)
9492                 sock_put(match.sk);
9493 }
9494
9495 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9496 {
9497         struct mgmt_pending_cmd *cmd;
9498         u8 status;
9499
9500         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9501         if (!cmd)
9502                 return;
9503
9504         if (err == -ERFKILL)
9505                 status = MGMT_STATUS_RFKILLED;
9506         else
9507                 status = MGMT_STATUS_FAILED;
9508
9509         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9510
9511         mgmt_pending_remove(cmd);
9512 }
9513
9514 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9515                        bool persistent)
9516 {
9517         struct mgmt_ev_new_link_key ev;
9518
9519         memset(&ev, 0, sizeof(ev));
9520
9521         ev.store_hint = persistent;
9522         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9523         ev.key.addr.type = BDADDR_BREDR;
9524         ev.key.type = key->type;
9525         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9526         ev.key.pin_len = key->pin_len;
9527
9528         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9529 }
9530
9531 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9532 {
9533         switch (ltk->type) {
9534         case SMP_LTK:
9535         case SMP_LTK_RESPONDER:
9536                 if (ltk->authenticated)
9537                         return MGMT_LTK_AUTHENTICATED;
9538                 return MGMT_LTK_UNAUTHENTICATED;
9539         case SMP_LTK_P256:
9540                 if (ltk->authenticated)
9541                         return MGMT_LTK_P256_AUTH;
9542                 return MGMT_LTK_P256_UNAUTH;
9543         case SMP_LTK_P256_DEBUG:
9544                 return MGMT_LTK_P256_DEBUG;
9545         }
9546
9547         return MGMT_LTK_UNAUTHENTICATED;
9548 }
9549
9550 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9551 {
9552         struct mgmt_ev_new_long_term_key ev;
9553
9554         memset(&ev, 0, sizeof(ev));
9555
9556         /* Devices using resolvable or non-resolvable random addresses
9557          * without providing an identity resolving key don't require
9558          * to store long term keys. Their addresses will change the
9559          * next time around.
9560          *
9561          * Only when a remote device provides an identity address
9562          * make sure the long term key is stored. If the remote
9563          * identity is known, the long term keys are internally
9564          * mapped to the identity address. So allow static random
9565          * and public addresses here.
9566          */
9567         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9568             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9569                 ev.store_hint = 0x00;
9570         else
9571                 ev.store_hint = persistent;
9572
9573         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9574         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9575         ev.key.type = mgmt_ltk_type(key);
9576         ev.key.enc_size = key->enc_size;
9577         ev.key.ediv = key->ediv;
9578         ev.key.rand = key->rand;
9579
9580         if (key->type == SMP_LTK)
9581                 ev.key.initiator = 1;
9582
9583         /* Make sure we copy only the significant bytes based on the
9584          * encryption key size, and set the rest of the value to zeroes.
9585          */
9586         memcpy(ev.key.val, key->val, key->enc_size);
9587         memset(ev.key.val + key->enc_size, 0,
9588                sizeof(ev.key.val) - key->enc_size);
9589
9590         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9591 }
9592
9593 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9594 {
9595         struct mgmt_ev_new_irk ev;
9596
9597         memset(&ev, 0, sizeof(ev));
9598
9599         ev.store_hint = persistent;
9600
9601         bacpy(&ev.rpa, &irk->rpa);
9602         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9603         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9604         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9605
9606         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9607 }
9608
9609 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9610                    bool persistent)
9611 {
9612         struct mgmt_ev_new_csrk ev;
9613
9614         memset(&ev, 0, sizeof(ev));
9615
9616         /* Devices using resolvable or non-resolvable random addresses
9617          * without providing an identity resolving key don't require
9618          * to store signature resolving keys. Their addresses will change
9619          * the next time around.
9620          *
9621          * Only when a remote device provides an identity address
9622          * make sure the signature resolving key is stored. So allow
9623          * static random and public addresses here.
9624          */
9625         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9626             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9627                 ev.store_hint = 0x00;
9628         else
9629                 ev.store_hint = persistent;
9630
9631         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9632         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9633         ev.key.type = csrk->type;
9634         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9635
9636         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9637 }
9638
9639 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9640                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9641                          u16 max_interval, u16 latency, u16 timeout)
9642 {
9643         struct mgmt_ev_new_conn_param ev;
9644
9645         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9646                 return;
9647
9648         memset(&ev, 0, sizeof(ev));
9649         bacpy(&ev.addr.bdaddr, bdaddr);
9650         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9651         ev.store_hint = store_hint;
9652         ev.min_interval = cpu_to_le16(min_interval);
9653         ev.max_interval = cpu_to_le16(max_interval);
9654         ev.latency = cpu_to_le16(latency);
9655         ev.timeout = cpu_to_le16(timeout);
9656
9657         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9658 }
9659
9660 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9661                            u8 *name, u8 name_len)
9662 {
9663         struct sk_buff *skb;
9664         struct mgmt_ev_device_connected *ev;
9665         u16 eir_len = 0;
9666         u32 flags = 0;
9667
9668         /* allocate buff for LE or BR/EDR adv */
9669         if (conn->le_adv_data_len > 0)
9670                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9671                                      sizeof(*ev) + conn->le_adv_data_len);
9672         else
9673                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9674                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9675                                      eir_precalc_len(sizeof(conn->dev_class)));
9676
9677         ev = skb_put(skb, sizeof(*ev));
9678         bacpy(&ev->addr.bdaddr, &conn->dst);
9679         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9680
9681         if (conn->out)
9682                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9683
9684         ev->flags = __cpu_to_le32(flags);
9685
9686         /* We must ensure that the EIR Data fields are ordered and
9687          * unique. Keep it simple for now and avoid the problem by not
9688          * adding any BR/EDR data to the LE adv.
9689          */
9690         if (conn->le_adv_data_len > 0) {
9691                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9692                 eir_len = conn->le_adv_data_len;
9693         } else {
9694                 if (name)
9695                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9696
9697                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9698                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9699                                                     conn->dev_class, sizeof(conn->dev_class));
9700         }
9701
9702         ev->eir_len = cpu_to_le16(eir_len);
9703
9704         mgmt_event_skb(skb, NULL);
9705 }
9706
9707 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9708 {
9709         struct sock **sk = data;
9710
9711         cmd->cmd_complete(cmd, 0);
9712
9713         *sk = cmd->sk;
9714         sock_hold(*sk);
9715
9716         mgmt_pending_remove(cmd);
9717 }
9718
9719 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9720 {
9721         struct hci_dev *hdev = data;
9722         struct mgmt_cp_unpair_device *cp = cmd->param;
9723
9724         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9725
9726         cmd->cmd_complete(cmd, 0);
9727         mgmt_pending_remove(cmd);
9728 }
9729
9730 bool mgmt_powering_down(struct hci_dev *hdev)
9731 {
9732         struct mgmt_pending_cmd *cmd;
9733         struct mgmt_mode *cp;
9734
9735         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9736         if (!cmd)
9737                 return false;
9738
9739         cp = cmd->param;
9740         if (!cp->val)
9741                 return true;
9742
9743         return false;
9744 }
9745
9746 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9747                               u8 link_type, u8 addr_type, u8 reason,
9748                               bool mgmt_connected)
9749 {
9750         struct mgmt_ev_device_disconnected ev;
9751         struct sock *sk = NULL;
9752
9753         /* The connection is still in hci_conn_hash so test for 1
9754          * instead of 0 to know if this is the last one.
9755          */
9756         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9757                 cancel_delayed_work(&hdev->power_off);
9758                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9759         }
9760
9761         if (!mgmt_connected)
9762                 return;
9763
9764         if (link_type != ACL_LINK && link_type != LE_LINK)
9765                 return;
9766
9767         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9768
9769         bacpy(&ev.addr.bdaddr, bdaddr);
9770         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9771         ev.reason = reason;
9772
9773         /* Report disconnects due to suspend */
9774         if (hdev->suspended)
9775                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9776
9777         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9778
9779         if (sk)
9780                 sock_put(sk);
9781
9782         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9783                              hdev);
9784 }
9785
9786 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9787                             u8 link_type, u8 addr_type, u8 status)
9788 {
9789         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9790         struct mgmt_cp_disconnect *cp;
9791         struct mgmt_pending_cmd *cmd;
9792
9793         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9794                              hdev);
9795
9796         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9797         if (!cmd)
9798                 return;
9799
9800         cp = cmd->param;
9801
9802         if (bacmp(bdaddr, &cp->addr.bdaddr))
9803                 return;
9804
9805         if (cp->addr.type != bdaddr_type)
9806                 return;
9807
9808         cmd->cmd_complete(cmd, mgmt_status(status));
9809         mgmt_pending_remove(cmd);
9810 }
9811
9812 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9813                          u8 addr_type, u8 status)
9814 {
9815         struct mgmt_ev_connect_failed ev;
9816
9817         /* The connection is still in hci_conn_hash so test for 1
9818          * instead of 0 to know if this is the last one.
9819          */
9820         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9821                 cancel_delayed_work(&hdev->power_off);
9822                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9823         }
9824
9825         bacpy(&ev.addr.bdaddr, bdaddr);
9826         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9827         ev.status = mgmt_status(status);
9828
9829         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9830 }
9831
9832 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9833 {
9834         struct mgmt_ev_pin_code_request ev;
9835
9836         bacpy(&ev.addr.bdaddr, bdaddr);
9837         ev.addr.type = BDADDR_BREDR;
9838         ev.secure = secure;
9839
9840         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9841 }
9842
9843 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9844                                   u8 status)
9845 {
9846         struct mgmt_pending_cmd *cmd;
9847
9848         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9849         if (!cmd)
9850                 return;
9851
9852         cmd->cmd_complete(cmd, mgmt_status(status));
9853         mgmt_pending_remove(cmd);
9854 }
9855
9856 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9857                                       u8 status)
9858 {
9859         struct mgmt_pending_cmd *cmd;
9860
9861         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9862         if (!cmd)
9863                 return;
9864
9865         cmd->cmd_complete(cmd, mgmt_status(status));
9866         mgmt_pending_remove(cmd);
9867 }
9868
9869 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9870                               u8 link_type, u8 addr_type, u32 value,
9871                               u8 confirm_hint)
9872 {
9873         struct mgmt_ev_user_confirm_request ev;
9874
9875         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9876
9877         bacpy(&ev.addr.bdaddr, bdaddr);
9878         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9879         ev.confirm_hint = confirm_hint;
9880         ev.value = cpu_to_le32(value);
9881
9882         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9883                           NULL);
9884 }
9885
9886 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9887                               u8 link_type, u8 addr_type)
9888 {
9889         struct mgmt_ev_user_passkey_request ev;
9890
9891         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9892
9893         bacpy(&ev.addr.bdaddr, bdaddr);
9894         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9895
9896         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9897                           NULL);
9898 }
9899
9900 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9901                                       u8 link_type, u8 addr_type, u8 status,
9902                                       u8 opcode)
9903 {
9904         struct mgmt_pending_cmd *cmd;
9905
9906         cmd = pending_find(opcode, hdev);
9907         if (!cmd)
9908                 return -ENOENT;
9909
9910         cmd->cmd_complete(cmd, mgmt_status(status));
9911         mgmt_pending_remove(cmd);
9912
9913         return 0;
9914 }
9915
9916 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9917                                      u8 link_type, u8 addr_type, u8 status)
9918 {
9919         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9920                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9921 }
9922
9923 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9924                                          u8 link_type, u8 addr_type, u8 status)
9925 {
9926         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9927                                           status,
9928                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9929 }
9930
9931 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9932                                      u8 link_type, u8 addr_type, u8 status)
9933 {
9934         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9935                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9936 }
9937
9938 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9939                                          u8 link_type, u8 addr_type, u8 status)
9940 {
9941         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9942                                           status,
9943                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9944 }
9945
9946 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9947                              u8 link_type, u8 addr_type, u32 passkey,
9948                              u8 entered)
9949 {
9950         struct mgmt_ev_passkey_notify ev;
9951
9952         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9953
9954         bacpy(&ev.addr.bdaddr, bdaddr);
9955         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9956         ev.passkey = __cpu_to_le32(passkey);
9957         ev.entered = entered;
9958
9959         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9960 }
9961
9962 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9963 {
9964         struct mgmt_ev_auth_failed ev;
9965         struct mgmt_pending_cmd *cmd;
9966         u8 status = mgmt_status(hci_status);
9967
9968         bacpy(&ev.addr.bdaddr, &conn->dst);
9969         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9970         ev.status = status;
9971
9972         cmd = find_pairing(conn);
9973
9974         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9975                     cmd ? cmd->sk : NULL);
9976
9977         if (cmd) {
9978                 cmd->cmd_complete(cmd, status);
9979                 mgmt_pending_remove(cmd);
9980         }
9981 }
9982
9983 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9984 {
9985         struct cmd_lookup match = { NULL, hdev };
9986         bool changed;
9987
9988         if (status) {
9989                 u8 mgmt_err = mgmt_status(status);
9990                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9991                                      cmd_status_rsp, &mgmt_err);
9992                 return;
9993         }
9994
9995         if (test_bit(HCI_AUTH, &hdev->flags))
9996                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9997         else
9998                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9999
10000         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10001                              &match);
10002
10003         if (changed)
10004                 new_settings(hdev, match.sk);
10005
10006         if (match.sk)
10007                 sock_put(match.sk);
10008 }
10009
10010 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10011 {
10012         struct cmd_lookup *match = data;
10013
10014         if (match->sk == NULL) {
10015                 match->sk = cmd->sk;
10016                 sock_hold(match->sk);
10017         }
10018 }
10019
10020 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10021                                     u8 status)
10022 {
10023         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10024
10025         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
10026         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
10027         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
10028
10029         if (!status) {
10030                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10031                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10032                 ext_info_changed(hdev, NULL);
10033         }
10034
10035         if (match.sk)
10036                 sock_put(match.sk);
10037 }
10038
10039 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10040 {
10041         struct mgmt_cp_set_local_name ev;
10042         struct mgmt_pending_cmd *cmd;
10043
10044         if (status)
10045                 return;
10046
10047         memset(&ev, 0, sizeof(ev));
10048         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10049         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10050
10051         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10052         if (!cmd) {
10053                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10054
10055                 /* If this is a HCI command related to powering on the
10056                  * HCI dev don't send any mgmt signals.
10057                  */
10058                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10059                         return;
10060         }
10061
10062         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10063                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10064         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10065 }
10066
10067 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10068 {
10069         int i;
10070
10071         for (i = 0; i < uuid_count; i++) {
10072                 if (!memcmp(uuid, uuids[i], 16))
10073                         return true;
10074         }
10075
10076         return false;
10077 }
10078
10079 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10080 {
10081         u16 parsed = 0;
10082
10083         while (parsed < eir_len) {
10084                 u8 field_len = eir[0];
10085                 u8 uuid[16];
10086                 int i;
10087
10088                 if (field_len == 0)
10089                         break;
10090
10091                 if (eir_len - parsed < field_len + 1)
10092                         break;
10093
10094                 switch (eir[1]) {
10095                 case EIR_UUID16_ALL:
10096                 case EIR_UUID16_SOME:
10097                         for (i = 0; i + 3 <= field_len; i += 2) {
10098                                 memcpy(uuid, bluetooth_base_uuid, 16);
10099                                 uuid[13] = eir[i + 3];
10100                                 uuid[12] = eir[i + 2];
10101                                 if (has_uuid(uuid, uuid_count, uuids))
10102                                         return true;
10103                         }
10104                         break;
10105                 case EIR_UUID32_ALL:
10106                 case EIR_UUID32_SOME:
10107                         for (i = 0; i + 5 <= field_len; i += 4) {
10108                                 memcpy(uuid, bluetooth_base_uuid, 16);
10109                                 uuid[15] = eir[i + 5];
10110                                 uuid[14] = eir[i + 4];
10111                                 uuid[13] = eir[i + 3];
10112                                 uuid[12] = eir[i + 2];
10113                                 if (has_uuid(uuid, uuid_count, uuids))
10114                                         return true;
10115                         }
10116                         break;
10117                 case EIR_UUID128_ALL:
10118                 case EIR_UUID128_SOME:
10119                         for (i = 0; i + 17 <= field_len; i += 16) {
10120                                 memcpy(uuid, eir + i + 2, 16);
10121                                 if (has_uuid(uuid, uuid_count, uuids))
10122                                         return true;
10123                         }
10124                         break;
10125                 }
10126
10127                 parsed += field_len + 1;
10128                 eir += field_len + 1;
10129         }
10130
10131         return false;
10132 }
10133
10134 static void restart_le_scan(struct hci_dev *hdev)
10135 {
10136         /* If controller is not scanning we are done. */
10137         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
10138                 return;
10139
10140         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
10141                        hdev->discovery.scan_start +
10142                        hdev->discovery.scan_duration))
10143                 return;
10144
10145         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
10146                            DISCOV_LE_RESTART_DELAY);
10147 }
10148
10149 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10150                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10151 {
10152         /* If a RSSI threshold has been specified, and
10153          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10154          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10155          * is set, let it through for further processing, as we might need to
10156          * restart the scan.
10157          *
10158          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10159          * the results are also dropped.
10160          */
10161         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10162             (rssi == HCI_RSSI_INVALID ||
10163             (rssi < hdev->discovery.rssi &&
10164              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10165                 return  false;
10166
10167         if (hdev->discovery.uuid_count != 0) {
10168                 /* If a list of UUIDs is provided in filter, results with no
10169                  * matching UUID should be dropped.
10170                  */
10171                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10172                                    hdev->discovery.uuids) &&
10173                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10174                                    hdev->discovery.uuid_count,
10175                                    hdev->discovery.uuids))
10176                         return false;
10177         }
10178
10179         /* If duplicate filtering does not report RSSI changes, then restart
10180          * scanning to ensure updated result with updated RSSI values.
10181          */
10182         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10183                 restart_le_scan(hdev);
10184
10185                 /* Validate RSSI value against the RSSI threshold once more. */
10186                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10187                     rssi < hdev->discovery.rssi)
10188                         return false;
10189         }
10190
10191         return true;
10192 }
10193
10194 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10195                                   bdaddr_t *bdaddr, u8 addr_type)
10196 {
10197         struct mgmt_ev_adv_monitor_device_lost ev;
10198
10199         ev.monitor_handle = cpu_to_le16(handle);
10200         bacpy(&ev.addr.bdaddr, bdaddr);
10201         ev.addr.type = addr_type;
10202
10203         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10204                    NULL);
10205 }
10206
10207 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10208                                                struct sk_buff *skb,
10209                                                struct sock *skip_sk,
10210                                                u16 handle)
10211 {
10212         struct sk_buff *advmon_skb;
10213         size_t advmon_skb_len;
10214         __le16 *monitor_handle;
10215
10216         if (!skb)
10217                 return;
10218
10219         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10220                           sizeof(struct mgmt_ev_device_found)) + skb->len;
10221         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10222                                     advmon_skb_len);
10223         if (!advmon_skb)
10224                 return;
10225
10226         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10227          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10228          * store monitor_handle of the matched monitor.
10229          */
10230         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10231         *monitor_handle = cpu_to_le16(handle);
10232         skb_put_data(advmon_skb, skb->data, skb->len);
10233
10234         mgmt_event_skb(advmon_skb, skip_sk);
10235 }
10236
10237 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10238                                           bdaddr_t *bdaddr, bool report_device,
10239                                           struct sk_buff *skb,
10240                                           struct sock *skip_sk)
10241 {
10242         struct monitored_device *dev, *tmp;
10243         bool matched = false;
10244         bool notified = false;
10245
10246         /* We have received the Advertisement Report because:
10247          * 1. the kernel has initiated active discovery
10248          * 2. if not, we have pend_le_reports > 0 in which case we are doing
10249          *    passive scanning
10250          * 3. if none of the above is true, we have one or more active
10251          *    Advertisement Monitor
10252          *
10253          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10254          * and report ONLY one advertisement per device for the matched Monitor
10255          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10256          *
10257          * For case 3, since we are not active scanning and all advertisements
10258          * received are due to a matched Advertisement Monitor, report all
10259          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10260          */
10261         if (report_device && !hdev->advmon_pend_notify) {
10262                 mgmt_event_skb(skb, skip_sk);
10263                 return;
10264         }
10265
10266         hdev->advmon_pend_notify = false;
10267
10268         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10269                 if (!bacmp(&dev->bdaddr, bdaddr)) {
10270                         matched = true;
10271
10272                         if (!dev->notified) {
10273                                 mgmt_send_adv_monitor_device_found(hdev, skb,
10274                                                                    skip_sk,
10275                                                                    dev->handle);
10276                                 notified = true;
10277                                 dev->notified = true;
10278                         }
10279                 }
10280
10281                 if (!dev->notified)
10282                         hdev->advmon_pend_notify = true;
10283         }
10284
10285         if (!report_device &&
10286             ((matched && !notified) || !msft_monitor_supported(hdev))) {
10287                 /* Handle 0 indicates that we are not active scanning and this
10288                  * is a subsequent advertisement report for an already matched
10289                  * Advertisement Monitor or the controller offloading support
10290                  * is not available.
10291                  */
10292                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10293         }
10294
10295         if (report_device)
10296                 mgmt_event_skb(skb, skip_sk);
10297         else
10298                 kfree_skb(skb);
10299 }
10300
10301 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10302                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10303                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10304                               u64 instant)
10305 {
10306         struct sk_buff *skb;
10307         struct mgmt_ev_mesh_device_found *ev;
10308         int i, j;
10309
10310         if (!hdev->mesh_ad_types[0])
10311                 goto accepted;
10312
10313         /* Scan for requested AD types */
10314         if (eir_len > 0) {
10315                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10316                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10317                                 if (!hdev->mesh_ad_types[j])
10318                                         break;
10319
10320                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
10321                                         goto accepted;
10322                         }
10323                 }
10324         }
10325
10326         if (scan_rsp_len > 0) {
10327                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10328                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10329                                 if (!hdev->mesh_ad_types[j])
10330                                         break;
10331
10332                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10333                                         goto accepted;
10334                         }
10335                 }
10336         }
10337
10338         return;
10339
10340 accepted:
10341         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10342                              sizeof(*ev) + eir_len + scan_rsp_len);
10343         if (!skb)
10344                 return;
10345
10346         ev = skb_put(skb, sizeof(*ev));
10347
10348         bacpy(&ev->addr.bdaddr, bdaddr);
10349         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10350         ev->rssi = rssi;
10351         ev->flags = cpu_to_le32(flags);
10352         ev->instant = cpu_to_le64(instant);
10353
10354         if (eir_len > 0)
10355                 /* Copy EIR or advertising data into event */
10356                 skb_put_data(skb, eir, eir_len);
10357
10358         if (scan_rsp_len > 0)
10359                 /* Append scan response data to event */
10360                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10361
10362         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10363
10364         mgmt_event_skb(skb, NULL);
10365 }
10366
10367 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10368                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10369                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10370                        u64 instant)
10371 {
10372         struct sk_buff *skb;
10373         struct mgmt_ev_device_found *ev;
10374         bool report_device = hci_discovery_active(hdev);
10375
10376         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10377                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10378                                   eir, eir_len, scan_rsp, scan_rsp_len,
10379                                   instant);
10380
10381         /* Don't send events for a non-kernel initiated discovery. With
10382          * LE one exception is if we have pend_le_reports > 0 in which
10383          * case we're doing passive scanning and want these events.
10384          */
10385         if (!hci_discovery_active(hdev)) {
10386                 if (link_type == ACL_LINK)
10387                         return;
10388                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10389                         report_device = true;
10390                 else if (!hci_is_adv_monitoring(hdev))
10391                         return;
10392         }
10393
10394         if (hdev->discovery.result_filtering) {
10395                 /* We are using service discovery */
10396                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10397                                      scan_rsp_len))
10398                         return;
10399         }
10400
10401         if (hdev->discovery.limited) {
10402                 /* Check for limited discoverable bit */
10403                 if (dev_class) {
10404                         if (!(dev_class[1] & 0x20))
10405                                 return;
10406                 } else {
10407                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10408                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10409                                 return;
10410                 }
10411         }
10412
10413         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10414         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10415                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
10416         if (!skb)
10417                 return;
10418
10419         ev = skb_put(skb, sizeof(*ev));
10420
10421         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10422          * RSSI value was reported as 0 when not available. This behavior
10423          * is kept when using device discovery. This is required for full
10424          * backwards compatibility with the API.
10425          *
10426          * However when using service discovery, the value 127 will be
10427          * returned when the RSSI is not available.
10428          */
10429         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10430             link_type == ACL_LINK)
10431                 rssi = 0;
10432
10433         bacpy(&ev->addr.bdaddr, bdaddr);
10434         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10435         ev->rssi = rssi;
10436         ev->flags = cpu_to_le32(flags);
10437
10438         if (eir_len > 0)
10439                 /* Copy EIR or advertising data into event */
10440                 skb_put_data(skb, eir, eir_len);
10441
10442         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10443                 u8 eir_cod[5];
10444
10445                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10446                                            dev_class, 3);
10447                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10448         }
10449
10450         if (scan_rsp_len > 0)
10451                 /* Append scan response data to event */
10452                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10453
10454         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10455
10456         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10457 }
10458
10459 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10460                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10461 {
10462         struct sk_buff *skb;
10463         struct mgmt_ev_device_found *ev;
10464         u16 eir_len = 0;
10465         u32 flags = 0;
10466
10467         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10468                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10469
10470         ev = skb_put(skb, sizeof(*ev));
10471         bacpy(&ev->addr.bdaddr, bdaddr);
10472         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10473         ev->rssi = rssi;
10474
10475         if (name)
10476                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10477         else
10478                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10479
10480         ev->eir_len = cpu_to_le16(eir_len);
10481         ev->flags = cpu_to_le32(flags);
10482
10483         mgmt_event_skb(skb, NULL);
10484 }
10485
10486 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10487 {
10488         struct mgmt_ev_discovering ev;
10489
10490         bt_dev_dbg(hdev, "discovering %u", discovering);
10491
10492         memset(&ev, 0, sizeof(ev));
10493         ev.type = hdev->discovery.type;
10494         ev.discovering = discovering;
10495
10496         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10497 }
10498
10499 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10500 {
10501         struct mgmt_ev_controller_suspend ev;
10502
10503         ev.suspend_state = state;
10504         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10505 }
10506
10507 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10508                    u8 addr_type)
10509 {
10510         struct mgmt_ev_controller_resume ev;
10511
10512         ev.wake_reason = reason;
10513         if (bdaddr) {
10514                 bacpy(&ev.addr.bdaddr, bdaddr);
10515                 ev.addr.type = addr_type;
10516         } else {
10517                 memset(&ev.addr, 0, sizeof(ev.addr));
10518         }
10519
10520         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10521 }
10522
10523 static struct hci_mgmt_chan chan = {
10524         .channel        = HCI_CHANNEL_CONTROL,
10525         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10526         .handlers       = mgmt_handlers,
10527         .hdev_init      = mgmt_init_hdev,
10528 };
10529
10530 int mgmt_init(void)
10531 {
10532         return hci_mgmt_chan_register(&chan);
10533 }
10534
10535 void mgmt_exit(void)
10536 {
10537         hci_mgmt_chan_unregister(&chan);
10538 }
10539
10540 void mgmt_cleanup(struct sock *sk)
10541 {
10542         struct mgmt_mesh_tx *mesh_tx;
10543         struct hci_dev *hdev;
10544
10545         read_lock(&hci_dev_list_lock);
10546
10547         list_for_each_entry(hdev, &hci_dev_list, list) {
10548                 do {
10549                         mesh_tx = mgmt_mesh_next(hdev, sk);
10550
10551                         if (mesh_tx)
10552                                 mesh_send_complete(hdev, mesh_tx, true);
10553                 } while (mesh_tx);
10554         }
10555
10556         read_unlock(&hci_dev_list_lock);
10557 }