net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42 #include "aosp.h"
  43
  44 #define MGMT_VERSION    1
  45 #define MGMT_REVISION   22
  46
  47 static const u16 mgmt_commands[] = {
  48         MGMT_OP_READ_INDEX_LIST,
  49         MGMT_OP_READ_INFO,
  50         MGMT_OP_SET_POWERED,
  51         MGMT_OP_SET_DISCOVERABLE,
  52         MGMT_OP_SET_CONNECTABLE,
  53         MGMT_OP_SET_FAST_CONNECTABLE,
  54         MGMT_OP_SET_BONDABLE,
  55         MGMT_OP_SET_LINK_SECURITY,
  56         MGMT_OP_SET_SSP,
  57         MGMT_OP_SET_HS,
  58         MGMT_OP_SET_LE,
  59         MGMT_OP_SET_DEV_CLASS,
  60         MGMT_OP_SET_LOCAL_NAME,
  61         MGMT_OP_ADD_UUID,
  62         MGMT_OP_REMOVE_UUID,
  63         MGMT_OP_LOAD_LINK_KEYS,
  64         MGMT_OP_LOAD_LONG_TERM_KEYS,
  65         MGMT_OP_DISCONNECT,
  66         MGMT_OP_GET_CONNECTIONS,
  67         MGMT_OP_PIN_CODE_REPLY,
  68         MGMT_OP_PIN_CODE_NEG_REPLY,
  69         MGMT_OP_SET_IO_CAPABILITY,
  70         MGMT_OP_PAIR_DEVICE,
  71         MGMT_OP_CANCEL_PAIR_DEVICE,
  72         MGMT_OP_UNPAIR_DEVICE,
  73         MGMT_OP_USER_CONFIRM_REPLY,
  74         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  75         MGMT_OP_USER_PASSKEY_REPLY,
  76         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  77         MGMT_OP_READ_LOCAL_OOB_DATA,
  78         MGMT_OP_ADD_REMOTE_OOB_DATA,
  79         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  80         MGMT_OP_START_DISCOVERY,
  81         MGMT_OP_STOP_DISCOVERY,
  82         MGMT_OP_CONFIRM_NAME,
  83         MGMT_OP_BLOCK_DEVICE,
  84         MGMT_OP_UNBLOCK_DEVICE,
  85         MGMT_OP_SET_DEVICE_ID,
  86         MGMT_OP_SET_ADVERTISING,
  87         MGMT_OP_SET_BREDR,
  88         MGMT_OP_SET_STATIC_ADDRESS,
  89         MGMT_OP_SET_SCAN_PARAMS,
  90         MGMT_OP_SET_SECURE_CONN,
  91         MGMT_OP_SET_DEBUG_KEYS,
  92         MGMT_OP_SET_PRIVACY,
  93         MGMT_OP_LOAD_IRKS,
  94         MGMT_OP_GET_CONN_INFO,
  95         MGMT_OP_GET_CLOCK_INFO,
  96         MGMT_OP_ADD_DEVICE,
  97         MGMT_OP_REMOVE_DEVICE,
  98         MGMT_OP_LOAD_CONN_PARAM,
  99         MGMT_OP_READ_UNCONF_INDEX_LIST,
 100         MGMT_OP_READ_CONFIG_INFO,
 101         MGMT_OP_SET_EXTERNAL_CONFIG,
 102         MGMT_OP_SET_PUBLIC_ADDRESS,
 103         MGMT_OP_START_SERVICE_DISCOVERY,
 104         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 105         MGMT_OP_READ_EXT_INDEX_LIST,
 106         MGMT_OP_READ_ADV_FEATURES,
 107         MGMT_OP_ADD_ADVERTISING,
 108         MGMT_OP_REMOVE_ADVERTISING,
 109         MGMT_OP_GET_ADV_SIZE_INFO,
 110         MGMT_OP_START_LIMITED_DISCOVERY,
 111         MGMT_OP_READ_EXT_INFO,
 112         MGMT_OP_SET_APPEARANCE,
 113         MGMT_OP_GET_PHY_CONFIGURATION,
 114         MGMT_OP_SET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_BLOCKED_KEYS,
 116         MGMT_OP_SET_WIDEBAND_SPEECH,
 117         MGMT_OP_READ_CONTROLLER_CAP,
 118         MGMT_OP_READ_EXP_FEATURES_INFO,
 119         MGMT_OP_SET_EXP_FEATURE,
 120         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_GET_DEVICE_FLAGS,
 125         MGMT_OP_SET_DEVICE_FLAGS,
 126         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 127         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 128         MGMT_OP_REMOVE_ADV_MONITOR,
 129         MGMT_OP_ADD_EXT_ADV_PARAMS,
 130         MGMT_OP_ADD_EXT_ADV_DATA,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 132         MGMT_OP_SET_MESH_RECEIVER,
 133         MGMT_OP_MESH_READ_FEATURES,
 134         MGMT_OP_MESH_SEND,
 135         MGMT_OP_MESH_SEND_CANCEL,
 136 };
 137
 138 static const u16 mgmt_events[] = {
 139         MGMT_EV_CONTROLLER_ERROR,
 140         MGMT_EV_INDEX_ADDED,
 141         MGMT_EV_INDEX_REMOVED,
 142         MGMT_EV_NEW_SETTINGS,
 143         MGMT_EV_CLASS_OF_DEV_CHANGED,
 144         MGMT_EV_LOCAL_NAME_CHANGED,
 145         MGMT_EV_NEW_LINK_KEY,
 146         MGMT_EV_NEW_LONG_TERM_KEY,
 147         MGMT_EV_DEVICE_CONNECTED,
 148         MGMT_EV_DEVICE_DISCONNECTED,
 149         MGMT_EV_CONNECT_FAILED,
 150         MGMT_EV_PIN_CODE_REQUEST,
 151         MGMT_EV_USER_CONFIRM_REQUEST,
 152         MGMT_EV_USER_PASSKEY_REQUEST,
 153         MGMT_EV_AUTH_FAILED,
 154         MGMT_EV_DEVICE_FOUND,
 155         MGMT_EV_DISCOVERING,
 156         MGMT_EV_DEVICE_BLOCKED,
 157         MGMT_EV_DEVICE_UNBLOCKED,
 158         MGMT_EV_DEVICE_UNPAIRED,
 159         MGMT_EV_PASSKEY_NOTIFY,
 160         MGMT_EV_NEW_IRK,
 161         MGMT_EV_NEW_CSRK,
 162         MGMT_EV_DEVICE_ADDED,
 163         MGMT_EV_DEVICE_REMOVED,
 164         MGMT_EV_NEW_CONN_PARAM,
 165         MGMT_EV_UNCONF_INDEX_ADDED,
 166         MGMT_EV_UNCONF_INDEX_REMOVED,
 167         MGMT_EV_NEW_CONFIG_OPTIONS,
 168         MGMT_EV_EXT_INDEX_ADDED,
 169         MGMT_EV_EXT_INDEX_REMOVED,
 170         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 171         MGMT_EV_ADVERTISING_ADDED,
 172         MGMT_EV_ADVERTISING_REMOVED,
 173         MGMT_EV_EXT_INFO_CHANGED,
 174         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 175         MGMT_EV_EXP_FEATURE_CHANGED,
 176         MGMT_EV_DEVICE_FLAGS_CHANGED,
 177         MGMT_EV_ADV_MONITOR_ADDED,
 178         MGMT_EV_ADV_MONITOR_REMOVED,
 179         MGMT_EV_CONTROLLER_SUSPEND,
 180         MGMT_EV_CONTROLLER_RESUME,
 181         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 182         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 183 };
 184
 185 static const u16 mgmt_untrusted_commands[] = {
 186         MGMT_OP_READ_INDEX_LIST,
 187         MGMT_OP_READ_INFO,
 188         MGMT_OP_READ_UNCONF_INDEX_LIST,
 189         MGMT_OP_READ_CONFIG_INFO,
 190         MGMT_OP_READ_EXT_INDEX_LIST,
 191         MGMT_OP_READ_EXT_INFO,
 192         MGMT_OP_READ_CONTROLLER_CAP,
 193         MGMT_OP_READ_EXP_FEATURES_INFO,
 194         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 195         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 196 };
 197
 198 static const u16 mgmt_untrusted_events[] = {
 199         MGMT_EV_INDEX_ADDED,
 200         MGMT_EV_INDEX_REMOVED,
 201         MGMT_EV_NEW_SETTINGS,
 202         MGMT_EV_CLASS_OF_DEV_CHANGED,
 203         MGMT_EV_LOCAL_NAME_CHANGED,
 204         MGMT_EV_UNCONF_INDEX_ADDED,
 205         MGMT_EV_UNCONF_INDEX_REMOVED,
 206         MGMT_EV_NEW_CONFIG_OPTIONS,
 207         MGMT_EV_EXT_INDEX_ADDED,
 208         MGMT_EV_EXT_INDEX_REMOVED,
 209         MGMT_EV_EXT_INFO_CHANGED,
 210         MGMT_EV_EXP_FEATURE_CHANGED,
 211 };
 212
 213 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 214
 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 216                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 217
 218 /* HCI to MGMT error code conversion table */
 219 static const u8 mgmt_status_table[] = {
 220         MGMT_STATUS_SUCCESS,
 221         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 222         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 223         MGMT_STATUS_FAILED,             /* Hardware Failure */
 224         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 225         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 226         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 227         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 228         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 229         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 230         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 231         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 232         MGMT_STATUS_BUSY,               /* Command Disallowed */
 233         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 234         MGMT_STATUS_REJECTED,           /* Rejected Security */
 235         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 236         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 237         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 239         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 240         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 241         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 242         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 243         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 244         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 245         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 246         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 247         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 248         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 249         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 250         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 251         MGMT_STATUS_FAILED,             /* Unspecified Error */
 252         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 253         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 254         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 255         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 256         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 257         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 258         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 259         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 260         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 262         MGMT_STATUS_FAILED,             /* Transaction Collision */
 263         MGMT_STATUS_FAILED,             /* Reserved for future use */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 265         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 266         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 267         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 269         MGMT_STATUS_FAILED,             /* Reserved for future use */
 270         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 271         MGMT_STATUS_FAILED,             /* Reserved for future use */
 272         MGMT_STATUS_FAILED,             /* Slot Violation */
 273         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 274         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 275         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 276         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 277         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 278         MGMT_STATUS_BUSY,               /* Controller Busy */
 279         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 280         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 281         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 282         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 283         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 284 };
 285
 286 static u8 mgmt_errno_status(int err)
 287 {
 288         switch (err) {
 289         case 0:
 290                 return MGMT_STATUS_SUCCESS;
 291         case -EPERM:
 292                 return MGMT_STATUS_REJECTED;
 293         case -EINVAL:
 294                 return MGMT_STATUS_INVALID_PARAMS;
 295         case -EOPNOTSUPP:
 296                 return MGMT_STATUS_NOT_SUPPORTED;
 297         case -EBUSY:
 298                 return MGMT_STATUS_BUSY;
 299         case -ETIMEDOUT:
 300                 return MGMT_STATUS_AUTH_FAILED;
 301         case -ENOMEM:
 302                 return MGMT_STATUS_NO_RESOURCES;
 303         case -EISCONN:
 304                 return MGMT_STATUS_ALREADY_CONNECTED;
 305         case -ENOTCONN:
 306                 return MGMT_STATUS_DISCONNECTED;
 307         }
 308
 309         return MGMT_STATUS_FAILED;
 310 }
 311
 312 static u8 mgmt_status(int err)
 313 {
 314         if (err < 0)
 315                 return mgmt_errno_status(err);
 316
 317         if (err < ARRAY_SIZE(mgmt_status_table))
 318                 return mgmt_status_table[err];
 319
 320         return MGMT_STATUS_FAILED;
 321 }
 322
 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 324                             u16 len, int flag)
 325 {
 326         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 327                                flag, NULL);
 328 }
 329
 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 331                               u16 len, int flag, struct sock *skip_sk)
 332 {
 333         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 334                                flag, skip_sk);
 335 }
 336
 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 338                       struct sock *skip_sk)
 339 {
 340         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 341                                HCI_SOCK_TRUSTED, skip_sk);
 342 }
 343
 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 345 {
 346         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 347                                    skip_sk);
 348 }
 349
 350 static u8 le_addr_type(u8 mgmt_addr_type)
 351 {
 352         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 353                 return ADDR_LE_DEV_PUBLIC;
 354         else
 355                 return ADDR_LE_DEV_RANDOM;
 356 }
 357
 358 void mgmt_fill_version_info(void *ver)
 359 {
 360         struct mgmt_rp_read_version *rp = ver;
 361
 362         rp->version = MGMT_VERSION;
 363         rp->revision = cpu_to_le16(MGMT_REVISION);
 364 }
 365
 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 367                         u16 data_len)
 368 {
 369         struct mgmt_rp_read_version rp;
 370
 371         bt_dev_dbg(hdev, "sock %p", sk);
 372
 373         mgmt_fill_version_info(&rp);
 374
 375         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 376                                  &rp, sizeof(rp));
 377 }
 378
 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 380                          u16 data_len)
 381 {
 382         struct mgmt_rp_read_commands *rp;
 383         u16 num_commands, num_events;
 384         size_t rp_size;
 385         int i, err;
 386
 387         bt_dev_dbg(hdev, "sock %p", sk);
 388
 389         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 390                 num_commands = ARRAY_SIZE(mgmt_commands);
 391                 num_events = ARRAY_SIZE(mgmt_events);
 392         } else {
 393                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 394                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 395         }
 396
 397         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 398
 399         rp = kmalloc(rp_size, GFP_KERNEL);
 400         if (!rp)
 401                 return -ENOMEM;
 402
 403         rp->num_commands = cpu_to_le16(num_commands);
 404         rp->num_events = cpu_to_le16(num_events);
 405
 406         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 407                 __le16 *opcode = rp->opcodes;
 408
 409                 for (i = 0; i < num_commands; i++, opcode++)
 410                         put_unaligned_le16(mgmt_commands[i], opcode);
 411
 412                 for (i = 0; i < num_events; i++, opcode++)
 413                         put_unaligned_le16(mgmt_events[i], opcode);
 414         } else {
 415                 __le16 *opcode = rp->opcodes;
 416
 417                 for (i = 0; i < num_commands; i++, opcode++)
 418                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 419
 420                 for (i = 0; i < num_events; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 422         }
 423
 424         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 425                                 rp, rp_size);
 426         kfree(rp);
 427
 428         return err;
 429 }
 430
 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 432                            u16 data_len)
 433 {
 434         struct mgmt_rp_read_index_list *rp;
 435         struct hci_dev *d;
 436         size_t rp_len;
 437         u16 count;
 438         int err;
 439
 440         bt_dev_dbg(hdev, "sock %p", sk);
 441
 442         read_lock(&hci_dev_list_lock);
 443
 444         count = 0;
 445         list_for_each_entry(d, &hci_dev_list, list) {
 446                 if (d->dev_type == HCI_PRIMARY &&
 447                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 448                         count++;
 449         }
 450
 451         rp_len = sizeof(*rp) + (2 * count);
 452         rp = kmalloc(rp_len, GFP_ATOMIC);
 453         if (!rp) {
 454                 read_unlock(&hci_dev_list_lock);
 455                 return -ENOMEM;
 456         }
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 461                     hci_dev_test_flag(d, HCI_CONFIG) ||
 462                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 463                         continue;
 464
 465                 /* Devices marked as raw-only are neither configured
 466                  * nor unconfigured controllers.
 467                  */
 468                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 469                         continue;
 470
 471                 if (d->dev_type == HCI_PRIMARY &&
 472                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 473                         rp->index[count++] = cpu_to_le16(d->id);
 474                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 475                 }
 476         }
 477
 478         rp->num_controllers = cpu_to_le16(count);
 479         rp_len = sizeof(*rp) + (2 * count);
 480
 481         read_unlock(&hci_dev_list_lock);
 482
 483         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 484                                 0, rp, rp_len);
 485
 486         kfree(rp);
 487
 488         return err;
 489 }
 490
 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 492                                   void *data, u16 data_len)
 493 {
 494         struct mgmt_rp_read_unconf_index_list *rp;
 495         struct hci_dev *d;
 496         size_t rp_len;
 497         u16 count;
 498         int err;
 499
 500         bt_dev_dbg(hdev, "sock %p", sk);
 501
 502         read_lock(&hci_dev_list_lock);
 503
 504         count = 0;
 505         list_for_each_entry(d, &hci_dev_list, list) {
 506                 if (d->dev_type == HCI_PRIMARY &&
 507                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 508                         count++;
 509         }
 510
 511         rp_len = sizeof(*rp) + (2 * count);
 512         rp = kmalloc(rp_len, GFP_ATOMIC);
 513         if (!rp) {
 514                 read_unlock(&hci_dev_list_lock);
 515                 return -ENOMEM;
 516         }
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 521                     hci_dev_test_flag(d, HCI_CONFIG) ||
 522                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 523                         continue;
 524
 525                 /* Devices marked as raw-only are neither configured
 526                  * nor unconfigured controllers.
 527                  */
 528                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 529                         continue;
 530
 531                 if (d->dev_type == HCI_PRIMARY &&
 532                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 533                         rp->index[count++] = cpu_to_le16(d->id);
 534                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 535                 }
 536         }
 537
 538         rp->num_controllers = cpu_to_le16(count);
 539         rp_len = sizeof(*rp) + (2 * count);
 540
 541         read_unlock(&hci_dev_list_lock);
 542
 543         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 544                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 545
 546         kfree(rp);
 547
 548         return err;
 549 }
 550
 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 552                                void *data, u16 data_len)
 553 {
 554         struct mgmt_rp_read_ext_index_list *rp;
 555         struct hci_dev *d;
 556         u16 count;
 557         int err;
 558
 559         bt_dev_dbg(hdev, "sock %p", sk);
 560
 561         read_lock(&hci_dev_list_lock);
 562
 563         count = 0;
 564         list_for_each_entry(d, &hci_dev_list, list) {
 565                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 566                         count++;
 567         }
 568
 569         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 570         if (!rp) {
 571                 read_unlock(&hci_dev_list_lock);
 572                 return -ENOMEM;
 573         }
 574
 575         count = 0;
 576         list_for_each_entry(d, &hci_dev_list, list) {
 577                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 578                     hci_dev_test_flag(d, HCI_CONFIG) ||
 579                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 580                         continue;
 581
 582                 /* Devices marked as raw-only are neither configured
 583                  * nor unconfigured controllers.
 584                  */
 585                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 586                         continue;
 587
 588                 if (d->dev_type == HCI_PRIMARY) {
 589                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 590                                 rp->entry[count].type = 0x01;
 591                         else
 592                                 rp->entry[count].type = 0x00;
 593                 } else if (d->dev_type == HCI_AMP) {
 594                         rp->entry[count].type = 0x02;
 595                 } else {
 596                         continue;
 597                 }
 598
 599                 rp->entry[count].bus = d->bus;
 600                 rp->entry[count++].index = cpu_to_le16(d->id);
 601                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 602         }
 603
 604         rp->num_controllers = cpu_to_le16(count);
 605
 606         read_unlock(&hci_dev_list_lock);
 607
 608         /* If this command is called at least once, then all the
 609          * default index and unconfigured index events are disabled
 610          * and from now on only extended index events are used.
 611          */
 612         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 613         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 614         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 615
 616         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 617                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 618                                 struct_size(rp, entry, count));
 619
 620         kfree(rp);
 621
 622         return err;
 623 }
 624
 625 static bool is_configured(struct hci_dev *hdev)
 626 {
 627         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 628             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 629                 return false;
 630
 631         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 632              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 633             !bacmp(&hdev->public_addr, BDADDR_ANY))
 634                 return false;
 635
 636         return true;
 637 }
 638
 639 static __le32 get_missing_options(struct hci_dev *hdev)
 640 {
 641         u32 options = 0;
 642
 643         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 644             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 648              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 649             !bacmp(&hdev->public_addr, BDADDR_ANY))
 650                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 651
 652         return cpu_to_le32(options);
 653 }
 654
 655 static int new_options(struct hci_dev *hdev, struct sock *skip)
 656 {
 657         __le32 options = get_missing_options(hdev);
 658
 659         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 660                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 661 }
 662
 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 664 {
 665         __le32 options = get_missing_options(hdev);
 666
 667         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 668                                  sizeof(options));
 669 }
 670
 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 672                             void *data, u16 data_len)
 673 {
 674         struct mgmt_rp_read_config_info rp;
 675         u32 options = 0;
 676
 677         bt_dev_dbg(hdev, "sock %p", sk);
 678
 679         hci_dev_lock(hdev);
 680
 681         memset(&rp, 0, sizeof(rp));
 682         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 683
 684         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 685                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 686
 687         if (hdev->set_bdaddr)
 688                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 689
 690         rp.supported_options = cpu_to_le32(options);
 691         rp.missing_options = get_missing_options(hdev);
 692
 693         hci_dev_unlock(hdev);
 694
 695         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 696                                  &rp, sizeof(rp));
 697 }
 698
 699 static u32 get_supported_phys(struct hci_dev *hdev)
 700 {
 701         u32 supported_phys = 0;
 702
 703         if (lmp_bredr_capable(hdev)) {
 704                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 705
 706                 if (hdev->features[0][0] & LMP_3SLOT)
 707                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_5SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 711
 712                 if (lmp_edr_2m_capable(hdev)) {
 713                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 714
 715                         if (lmp_edr_3slot_capable(hdev))
 716                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 717
 718                         if (lmp_edr_5slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 720
 721                         if (lmp_edr_3m_capable(hdev)) {
 722                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 723
 724                                 if (lmp_edr_3slot_capable(hdev))
 725                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 726
 727                                 if (lmp_edr_5slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 729                         }
 730                 }
 731         }
 732
 733         if (lmp_le_capable(hdev)) {
 734                 supported_phys |= MGMT_PHY_LE_1M_TX;
 735                 supported_phys |= MGMT_PHY_LE_1M_RX;
 736
 737                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 738                         supported_phys |= MGMT_PHY_LE_2M_TX;
 739                         supported_phys |= MGMT_PHY_LE_2M_RX;
 740                 }
 741
 742                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 743                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 744                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 745                 }
 746         }
 747
 748         return supported_phys;
 749 }
 750
 751 static u32 get_selected_phys(struct hci_dev *hdev)
 752 {
 753         u32 selected_phys = 0;
 754
 755         if (lmp_bredr_capable(hdev)) {
 756                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 757
 758                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 759                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 762                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 763
 764                 if (lmp_edr_2m_capable(hdev)) {
 765                         if (!(hdev->pkt_type & HCI_2DH1))
 766                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 767
 768                         if (lmp_edr_3slot_capable(hdev) &&
 769                             !(hdev->pkt_type & HCI_2DH3))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 771
 772                         if (lmp_edr_5slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH5))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 775
 776                         if (lmp_edr_3m_capable(hdev)) {
 777                                 if (!(hdev->pkt_type & HCI_3DH1))
 778                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 779
 780                                 if (lmp_edr_3slot_capable(hdev) &&
 781                                     !(hdev->pkt_type & HCI_3DH3))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 783
 784                                 if (lmp_edr_5slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH5))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 787                         }
 788                 }
 789         }
 790
 791         if (lmp_le_capable(hdev)) {
 792                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 793                         selected_phys |= MGMT_PHY_LE_1M_TX;
 794
 795                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_RX;
 797
 798                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 799                         selected_phys |= MGMT_PHY_LE_2M_TX;
 800
 801                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_RX;
 803
 804                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 805                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 806
 807                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 809         }
 810
 811         return selected_phys;
 812 }
 813
 814 static u32 get_configurable_phys(struct hci_dev *hdev)
 815 {
 816         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 817                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 818 }
 819
 820 static u32 get_supported_settings(struct hci_dev *hdev)
 821 {
 822         u32 settings = 0;
 823
 824         settings |= MGMT_SETTING_POWERED;
 825         settings |= MGMT_SETTING_BONDABLE;
 826         settings |= MGMT_SETTING_DEBUG_KEYS;
 827         settings |= MGMT_SETTING_CONNECTABLE;
 828         settings |= MGMT_SETTING_DISCOVERABLE;
 829
 830         if (lmp_bredr_capable(hdev)) {
 831                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 832                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 833                 settings |= MGMT_SETTING_BREDR;
 834                 settings |= MGMT_SETTING_LINK_SECURITY;
 835
 836                 if (lmp_ssp_capable(hdev)) {
 837                         settings |= MGMT_SETTING_SSP;
 838                         if (IS_ENABLED(CONFIG_BT_HS))
 839                                 settings |= MGMT_SETTING_HS;
 840                 }
 841
 842                 if (lmp_sc_capable(hdev))
 843                         settings |= MGMT_SETTING_SECURE_CONN;
 844
 845                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 846                              &hdev->quirks))
 847                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 848         }
 849
 850         if (lmp_le_capable(hdev)) {
 851                 settings |= MGMT_SETTING_LE;
 852                 settings |= MGMT_SETTING_SECURE_CONN;
 853                 settings |= MGMT_SETTING_PRIVACY;
 854                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 855                 settings |= MGMT_SETTING_ADVERTISING;
 856         }
 857
 858         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 859             hdev->set_bdaddr)
 860                 settings |= MGMT_SETTING_CONFIGURATION;
 861
 862         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 863
 864         return settings;
 865 }
 866
 867 static u32 get_current_settings(struct hci_dev *hdev)
 868 {
 869         u32 settings = 0;
 870
 871         if (hdev_is_powered(hdev))
 872                 settings |= MGMT_SETTING_POWERED;
 873
 874         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 875                 settings |= MGMT_SETTING_CONNECTABLE;
 876
 877         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 878                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 879
 880         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 881                 settings |= MGMT_SETTING_DISCOVERABLE;
 882
 883         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 884                 settings |= MGMT_SETTING_BONDABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 887                 settings |= MGMT_SETTING_BREDR;
 888
 889         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 890                 settings |= MGMT_SETTING_LE;
 891
 892         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 893                 settings |= MGMT_SETTING_LINK_SECURITY;
 894
 895         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 896                 settings |= MGMT_SETTING_SSP;
 897
 898         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 899                 settings |= MGMT_SETTING_HS;
 900
 901         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 902                 settings |= MGMT_SETTING_ADVERTISING;
 903
 904         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 905                 settings |= MGMT_SETTING_SECURE_CONN;
 906
 907         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 908                 settings |= MGMT_SETTING_DEBUG_KEYS;
 909
 910         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 911                 settings |= MGMT_SETTING_PRIVACY;
 912
 913         /* The current setting for static address has two purposes. The
 914          * first is to indicate if the static address will be used and
 915          * the second is to indicate if it is actually set.
 916          *
 917          * This means if the static address is not configured, this flag
 918          * will never be set. If the address is configured, then if the
 919          * address is actually used decides if the flag is set or not.
 920          *
 921          * For single mode LE only controllers and dual-mode controllers
 922          * with BR/EDR disabled, the existence of the static address will
 923          * be evaluated.
 924          */
 925         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 926             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 927             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 928                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 929                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 930         }
 931
 932         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 933                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 934
 935         return settings;
 936 }
 937
 938 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 939 {
 940         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 941 }
 942
 943 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 944 {
 945         struct mgmt_pending_cmd *cmd;
 946
 947         /* If there's a pending mgmt command the flags will not yet have
 948          * their final values, so check for this first.
 949          */
 950         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 951         if (cmd) {
 952                 struct mgmt_mode *cp = cmd->param;
 953                 if (cp->val == 0x01)
 954                         return LE_AD_GENERAL;
 955                 else if (cp->val == 0x02)
 956                         return LE_AD_LIMITED;
 957         } else {
 958                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 959                         return LE_AD_LIMITED;
 960                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 961                         return LE_AD_GENERAL;
 962         }
 963
 964         return 0;
 965 }
 966
 967 bool mgmt_get_connectable(struct hci_dev *hdev)
 968 {
 969         struct mgmt_pending_cmd *cmd;
 970
 971         /* If there's a pending mgmt command the flag will not yet have
 972          * it's final value, so check for this first.
 973          */
 974         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 975         if (cmd) {
 976                 struct mgmt_mode *cp = cmd->param;
 977
 978                 return cp->val;
 979         }
 980
 981         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 982 }
 983
 984 static int service_cache_sync(struct hci_dev *hdev, void *data)
 985 {
 986         hci_update_eir_sync(hdev);
 987         hci_update_class_sync(hdev);
 988
 989         return 0;
 990 }
 991
 992 static void service_cache_off(struct work_struct *work)
 993 {
 994         struct hci_dev *hdev = container_of(work, struct hci_dev,
 995                                             service_cache.work);
 996
 997         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 998                 return;
 999
1000         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1001 }
1002
1003 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1004 {
1005         /* The generation of a new RPA and programming it into the
1006          * controller happens in the hci_req_enable_advertising()
1007          * function.
1008          */
1009         if (ext_adv_capable(hdev))
1010                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1011         else
1012                 return hci_enable_advertising_sync(hdev);
1013 }
1014
1015 static void rpa_expired(struct work_struct *work)
1016 {
1017         struct hci_dev *hdev = container_of(work, struct hci_dev,
1018                                             rpa_expired.work);
1019
1020         bt_dev_dbg(hdev, "");
1021
1022         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1023
1024         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1025                 return;
1026
1027         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1028 }
1029
1030 static void discov_off(struct work_struct *work)
1031 {
1032         struct hci_dev *hdev = container_of(work, struct hci_dev,
1033                                             discov_off.work);
1034
1035         bt_dev_dbg(hdev, "");
1036
1037         hci_dev_lock(hdev);
1038
1039         /* When discoverable timeout triggers, then just make sure
1040          * the limited discoverable flag is cleared. Even in the case
1041          * of a timeout triggered from general discoverable, it is
1042          * safe to unconditionally clear the flag.
1043          */
1044         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1045         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1046         hdev->discov_timeout = 0;
1047
1048         hci_update_discoverable(hdev);
1049
1050         mgmt_new_settings(hdev);
1051
1052         hci_dev_unlock(hdev);
1053 }
1054
1055 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1056
1057 static void mesh_send_complete(struct hci_dev *hdev,
1058                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1059 {
1060         u8 handle = mesh_tx->handle;
1061
1062         if (!silent)
1063                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1064                            sizeof(handle), NULL);
1065
1066         mgmt_mesh_remove(mesh_tx);
1067 }
1068
1069 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1070 {
1071         struct mgmt_mesh_tx *mesh_tx;
1072
1073         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1074         hci_disable_advertising_sync(hdev);
1075         mesh_tx = mgmt_mesh_next(hdev, NULL);
1076
1077         if (mesh_tx)
1078                 mesh_send_complete(hdev, mesh_tx, false);
1079
1080         return 0;
1081 }
1082
1083 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1084 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1085 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1086 {
1087         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1088
1089         if (!mesh_tx)
1090                 return;
1091
1092         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1093                                  mesh_send_start_complete);
1094
1095         if (err < 0)
1096                 mesh_send_complete(hdev, mesh_tx, false);
1097         else
1098                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1099 }
1100
1101 static void mesh_send_done(struct work_struct *work)
1102 {
1103         struct hci_dev *hdev = container_of(work, struct hci_dev,
1104                                             mesh_send_done.work);
1105
1106         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1107                 return;
1108
1109         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1110 }
1111
1112 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1113 {
1114         if (hci_dev_test_flag(hdev, HCI_MGMT))
1115                 return;
1116
1117         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1118
1119         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1120         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1121         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1122         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1123
1124         /* Non-mgmt controlled devices get this bit set
1125          * implicitly so that pairing works for them, however
1126          * for mgmt we require user-space to explicitly enable
1127          * it
1128          */
1129         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1130
1131         hci_dev_set_flag(hdev, HCI_MGMT);
1132 }
1133
1134 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1135                                 void *data, u16 data_len)
1136 {
1137         struct mgmt_rp_read_info rp;
1138
1139         bt_dev_dbg(hdev, "sock %p", sk);
1140
1141         hci_dev_lock(hdev);
1142
1143         memset(&rp, 0, sizeof(rp));
1144
1145         bacpy(&rp.bdaddr, &hdev->bdaddr);
1146
1147         rp.version = hdev->hci_ver;
1148         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1149
1150         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1151         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1152
1153         memcpy(rp.dev_class, hdev->dev_class, 3);
1154
1155         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1156         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1157
1158         hci_dev_unlock(hdev);
1159
1160         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1161                                  sizeof(rp));
1162 }
1163
1164 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1165 {
1166         u16 eir_len = 0;
1167         size_t name_len;
1168
1169         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1170                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1171                                           hdev->dev_class, 3);
1172
1173         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1174                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1175                                           hdev->appearance);
1176
1177         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1178         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1179                                   hdev->dev_name, name_len);
1180
1181         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1182         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1183                                   hdev->short_name, name_len);
1184
1185         return eir_len;
1186 }
1187
1188 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1189                                     void *data, u16 data_len)
1190 {
1191         char buf[512];
1192         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1193         u16 eir_len;
1194
1195         bt_dev_dbg(hdev, "sock %p", sk);
1196
1197         memset(&buf, 0, sizeof(buf));
1198
1199         hci_dev_lock(hdev);
1200
1201         bacpy(&rp->bdaddr, &hdev->bdaddr);
1202
1203         rp->version = hdev->hci_ver;
1204         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1205
1206         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1207         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1208
1209
1210         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1211         rp->eir_len = cpu_to_le16(eir_len);
1212
1213         hci_dev_unlock(hdev);
1214
1215         /* If this command is called at least once, then the events
1216          * for class of device and local name changes are disabled
1217          * and only the new extended controller information event
1218          * is used.
1219          */
1220         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1221         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1222         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1223
1224         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1225                                  sizeof(*rp) + eir_len);
1226 }
1227
1228 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1229 {
1230         char buf[512];
1231         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1232         u16 eir_len;
1233
1234         memset(buf, 0, sizeof(buf));
1235
1236         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1237         ev->eir_len = cpu_to_le16(eir_len);
1238
1239         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1240                                   sizeof(*ev) + eir_len,
1241                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1242 }
1243
1244 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1245 {
1246         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1247
1248         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1249                                  sizeof(settings));
1250 }
1251
1252 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1253 {
1254         struct mgmt_ev_advertising_added ev;
1255
1256         ev.instance = instance;
1257
1258         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1259 }
1260
1261 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1262                               u8 instance)
1263 {
1264         struct mgmt_ev_advertising_removed ev;
1265
1266         ev.instance = instance;
1267
1268         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1269 }
1270
1271 static void cancel_adv_timeout(struct hci_dev *hdev)
1272 {
1273         if (hdev->adv_instance_timeout) {
1274                 hdev->adv_instance_timeout = 0;
1275                 cancel_delayed_work(&hdev->adv_instance_expire);
1276         }
1277 }
1278
1279 /* This function requires the caller holds hdev->lock */
1280 static void restart_le_actions(struct hci_dev *hdev)
1281 {
1282         struct hci_conn_params *p;
1283
1284         list_for_each_entry(p, &hdev->le_conn_params, list) {
1285                 /* Needed for AUTO_OFF case where might not "really"
1286                  * have been powered off.
1287                  */
1288                 list_del_init(&p->action);
1289
1290                 switch (p->auto_connect) {
1291                 case HCI_AUTO_CONN_DIRECT:
1292                 case HCI_AUTO_CONN_ALWAYS:
1293                         list_add(&p->action, &hdev->pend_le_conns);
1294                         break;
1295                 case HCI_AUTO_CONN_REPORT:
1296                         list_add(&p->action, &hdev->pend_le_reports);
1297                         break;
1298                 default:
1299                         break;
1300                 }
1301         }
1302 }
1303
1304 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1305 {
1306         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1307
1308         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1309                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1310 }
1311
1312 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1313 {
1314         struct mgmt_pending_cmd *cmd = data;
1315         struct mgmt_mode *cp;
1316
1317         /* Make sure cmd still outstanding. */
1318         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1319                 return;
1320
1321         cp = cmd->param;
1322
1323         bt_dev_dbg(hdev, "err %d", err);
1324
1325         if (!err) {
1326                 if (cp->val) {
1327                         hci_dev_lock(hdev);
1328                         restart_le_actions(hdev);
1329                         hci_update_passive_scan(hdev);
1330                         hci_dev_unlock(hdev);
1331                 }
1332
1333                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1334
1335                 /* Only call new_setting for power on as power off is deferred
1336                  * to hdev->power_off work which does call hci_dev_do_close.
1337                  */
1338                 if (cp->val)
1339                         new_settings(hdev, cmd->sk);
1340         } else {
1341                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1342                                 mgmt_status(err));
1343         }
1344
1345         mgmt_pending_remove(cmd);
1346 }
1347
1348 static int set_powered_sync(struct hci_dev *hdev, void *data)
1349 {
1350         struct mgmt_pending_cmd *cmd = data;
1351         struct mgmt_mode *cp = cmd->param;
1352
1353         BT_DBG("%s", hdev->name);
1354
1355         return hci_set_powered_sync(hdev, cp->val);
1356 }
1357
1358 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1359                        u16 len)
1360 {
1361         struct mgmt_mode *cp = data;
1362         struct mgmt_pending_cmd *cmd;
1363         int err;
1364
1365         bt_dev_dbg(hdev, "sock %p", sk);
1366
1367         if (cp->val != 0x00 && cp->val != 0x01)
1368                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1369                                        MGMT_STATUS_INVALID_PARAMS);
1370
1371         hci_dev_lock(hdev);
1372
1373         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1374                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1375                                       MGMT_STATUS_BUSY);
1376                 goto failed;
1377         }
1378
1379         if (!!cp->val == hdev_is_powered(hdev)) {
1380                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1381                 goto failed;
1382         }
1383
1384         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1385         if (!cmd) {
1386                 err = -ENOMEM;
1387                 goto failed;
1388         }
1389
1390         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1391                                  mgmt_set_powered_complete);
1392
1393         if (err < 0)
1394                 mgmt_pending_remove(cmd);
1395
1396 failed:
1397         hci_dev_unlock(hdev);
1398         return err;
1399 }
1400
1401 int mgmt_new_settings(struct hci_dev *hdev)
1402 {
1403         return new_settings(hdev, NULL);
1404 }
1405
1406 struct cmd_lookup {
1407         struct sock *sk;
1408         struct hci_dev *hdev;
1409         u8 mgmt_status;
1410 };
1411
1412 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1413 {
1414         struct cmd_lookup *match = data;
1415
1416         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1417
1418         list_del(&cmd->list);
1419
1420         if (match->sk == NULL) {
1421                 match->sk = cmd->sk;
1422                 sock_hold(match->sk);
1423         }
1424
1425         mgmt_pending_free(cmd);
1426 }
1427
1428 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1429 {
1430         u8 *status = data;
1431
1432         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1433         mgmt_pending_remove(cmd);
1434 }
1435
1436 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1437 {
1438         if (cmd->cmd_complete) {
1439                 u8 *status = data;
1440
1441                 cmd->cmd_complete(cmd, *status);
1442                 mgmt_pending_remove(cmd);
1443
1444                 return;
1445         }
1446
1447         cmd_status_rsp(cmd, data);
1448 }
1449
1450 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1451 {
1452         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1453                                  cmd->param, cmd->param_len);
1454 }
1455
1456 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1457 {
1458         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1459                                  cmd->param, sizeof(struct mgmt_addr_info));
1460 }
1461
1462 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1463 {
1464         if (!lmp_bredr_capable(hdev))
1465                 return MGMT_STATUS_NOT_SUPPORTED;
1466         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1467                 return MGMT_STATUS_REJECTED;
1468         else
1469                 return MGMT_STATUS_SUCCESS;
1470 }
1471
1472 static u8 mgmt_le_support(struct hci_dev *hdev)
1473 {
1474         if (!lmp_le_capable(hdev))
1475                 return MGMT_STATUS_NOT_SUPPORTED;
1476         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1477                 return MGMT_STATUS_REJECTED;
1478         else
1479                 return MGMT_STATUS_SUCCESS;
1480 }
1481
1482 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1483                                            int err)
1484 {
1485         struct mgmt_pending_cmd *cmd = data;
1486
1487         bt_dev_dbg(hdev, "err %d", err);
1488
1489         /* Make sure cmd still outstanding. */
1490         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1491                 return;
1492
1493         hci_dev_lock(hdev);
1494
1495         if (err) {
1496                 u8 mgmt_err = mgmt_status(err);
1497                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1498                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499                 goto done;
1500         }
1501
1502         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1503             hdev->discov_timeout > 0) {
1504                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1505                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1506         }
1507
1508         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1509         new_settings(hdev, cmd->sk);
1510
1511 done:
1512         mgmt_pending_remove(cmd);
1513         hci_dev_unlock(hdev);
1514 }
1515
1516 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1517 {
1518         BT_DBG("%s", hdev->name);
1519
1520         return hci_update_discoverable_sync(hdev);
1521 }
1522
1523 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1524                             u16 len)
1525 {
1526         struct mgmt_cp_set_discoverable *cp = data;
1527         struct mgmt_pending_cmd *cmd;
1528         u16 timeout;
1529         int err;
1530
1531         bt_dev_dbg(hdev, "sock %p", sk);
1532
1533         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1534             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1535                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1536                                        MGMT_STATUS_REJECTED);
1537
1538         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1539                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1540                                        MGMT_STATUS_INVALID_PARAMS);
1541
1542         timeout = __le16_to_cpu(cp->timeout);
1543
1544         /* Disabling discoverable requires that no timeout is set,
1545          * and enabling limited discoverable requires a timeout.
1546          */
1547         if ((cp->val == 0x00 && timeout > 0) ||
1548             (cp->val == 0x02 && timeout == 0))
1549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1550                                        MGMT_STATUS_INVALID_PARAMS);
1551
1552         hci_dev_lock(hdev);
1553
1554         if (!hdev_is_powered(hdev) && timeout > 0) {
1555                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1556                                       MGMT_STATUS_NOT_POWERED);
1557                 goto failed;
1558         }
1559
1560         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1561             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1562                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1563                                       MGMT_STATUS_BUSY);
1564                 goto failed;
1565         }
1566
1567         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1569                                       MGMT_STATUS_REJECTED);
1570                 goto failed;
1571         }
1572
1573         if (hdev->advertising_paused) {
1574                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1575                                       MGMT_STATUS_BUSY);
1576                 goto failed;
1577         }
1578
1579         if (!hdev_is_powered(hdev)) {
1580                 bool changed = false;
1581
1582                 /* Setting limited discoverable when powered off is
1583                  * not a valid operation since it requires a timeout
1584                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1585                  */
1586                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1587                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1588                         changed = true;
1589                 }
1590
1591                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1592                 if (err < 0)
1593                         goto failed;
1594
1595                 if (changed)
1596                         err = new_settings(hdev, sk);
1597
1598                 goto failed;
1599         }
1600
1601         /* If the current mode is the same, then just update the timeout
1602          * value with the new value. And if only the timeout gets updated,
1603          * then no need for any HCI transactions.
1604          */
1605         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1606             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1607                                                    HCI_LIMITED_DISCOVERABLE)) {
1608                 cancel_delayed_work(&hdev->discov_off);
1609                 hdev->discov_timeout = timeout;
1610
1611                 if (cp->val && hdev->discov_timeout > 0) {
1612                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1613                         queue_delayed_work(hdev->req_workqueue,
1614                                            &hdev->discov_off, to);
1615                 }
1616
1617                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1618                 goto failed;
1619         }
1620
1621         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1622         if (!cmd) {
1623                 err = -ENOMEM;
1624                 goto failed;
1625         }
1626
1627         /* Cancel any potential discoverable timeout that might be
1628          * still active and store new timeout value. The arming of
1629          * the timeout happens in the complete handler.
1630          */
1631         cancel_delayed_work(&hdev->discov_off);
1632         hdev->discov_timeout = timeout;
1633
1634         if (cp->val)
1635                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1636         else
1637                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1638
1639         /* Limited discoverable mode */
1640         if (cp->val == 0x02)
1641                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1642         else
1643                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1644
1645         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1646                                  mgmt_set_discoverable_complete);
1647
1648         if (err < 0)
1649                 mgmt_pending_remove(cmd);
1650
1651 failed:
1652         hci_dev_unlock(hdev);
1653         return err;
1654 }
1655
1656 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1657                                           int err)
1658 {
1659         struct mgmt_pending_cmd *cmd = data;
1660
1661         bt_dev_dbg(hdev, "err %d", err);
1662
1663         /* Make sure cmd still outstanding. */
1664         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1665                 return;
1666
1667         hci_dev_lock(hdev);
1668
1669         if (err) {
1670                 u8 mgmt_err = mgmt_status(err);
1671                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1672                 goto done;
1673         }
1674
1675         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1676         new_settings(hdev, cmd->sk);
1677
1678 done:
1679         if (cmd)
1680                 mgmt_pending_remove(cmd);
1681
1682         hci_dev_unlock(hdev);
1683 }
1684
1685 static int set_connectable_update_settings(struct hci_dev *hdev,
1686                                            struct sock *sk, u8 val)
1687 {
1688         bool changed = false;
1689         int err;
1690
1691         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1692                 changed = true;
1693
1694         if (val) {
1695                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1696         } else {
1697                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1698                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1699         }
1700
1701         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1702         if (err < 0)
1703                 return err;
1704
1705         if (changed) {
1706                 hci_update_scan(hdev);
1707                 hci_update_passive_scan(hdev);
1708                 return new_settings(hdev, sk);
1709         }
1710
1711         return 0;
1712 }
1713
1714 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1715 {
1716         BT_DBG("%s", hdev->name);
1717
1718         return hci_update_connectable_sync(hdev);
1719 }
1720
1721 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1722                            u16 len)
1723 {
1724         struct mgmt_mode *cp = data;
1725         struct mgmt_pending_cmd *cmd;
1726         int err;
1727
1728         bt_dev_dbg(hdev, "sock %p", sk);
1729
1730         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1731             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1732                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1733                                        MGMT_STATUS_REJECTED);
1734
1735         if (cp->val != 0x00 && cp->val != 0x01)
1736                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1737                                        MGMT_STATUS_INVALID_PARAMS);
1738
1739         hci_dev_lock(hdev);
1740
1741         if (!hdev_is_powered(hdev)) {
1742                 err = set_connectable_update_settings(hdev, sk, cp->val);
1743                 goto failed;
1744         }
1745
1746         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1747             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1748                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1749                                       MGMT_STATUS_BUSY);
1750                 goto failed;
1751         }
1752
1753         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1754         if (!cmd) {
1755                 err = -ENOMEM;
1756                 goto failed;
1757         }
1758
1759         if (cp->val) {
1760                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1761         } else {
1762                 if (hdev->discov_timeout > 0)
1763                         cancel_delayed_work(&hdev->discov_off);
1764
1765                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1766                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1767                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1768         }
1769
1770         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1771                                  mgmt_set_connectable_complete);
1772
1773         if (err < 0)
1774                 mgmt_pending_remove(cmd);
1775
1776 failed:
1777         hci_dev_unlock(hdev);
1778         return err;
1779 }
1780
1781 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1782                         u16 len)
1783 {
1784         struct mgmt_mode *cp = data;
1785         bool changed;
1786         int err;
1787
1788         bt_dev_dbg(hdev, "sock %p", sk);
1789
1790         if (cp->val != 0x00 && cp->val != 0x01)
1791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1792                                        MGMT_STATUS_INVALID_PARAMS);
1793
1794         hci_dev_lock(hdev);
1795
1796         if (cp->val)
1797                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1798         else
1799                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1800
1801         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1802         if (err < 0)
1803                 goto unlock;
1804
1805         if (changed) {
1806                 /* In limited privacy mode the change of bondable mode
1807                  * may affect the local advertising address.
1808                  */
1809                 hci_update_discoverable(hdev);
1810
1811                 err = new_settings(hdev, sk);
1812         }
1813
1814 unlock:
1815         hci_dev_unlock(hdev);
1816         return err;
1817 }
1818
1819 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1820                              u16 len)
1821 {
1822         struct mgmt_mode *cp = data;
1823         struct mgmt_pending_cmd *cmd;
1824         u8 val, status;
1825         int err;
1826
1827         bt_dev_dbg(hdev, "sock %p", sk);
1828
1829         status = mgmt_bredr_support(hdev);
1830         if (status)
1831                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1832                                        status);
1833
1834         if (cp->val != 0x00 && cp->val != 0x01)
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1836                                        MGMT_STATUS_INVALID_PARAMS);
1837
1838         hci_dev_lock(hdev);
1839
1840         if (!hdev_is_powered(hdev)) {
1841                 bool changed = false;
1842
1843                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1844                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1845                         changed = true;
1846                 }
1847
1848                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1849                 if (err < 0)
1850                         goto failed;
1851
1852                 if (changed)
1853                         err = new_settings(hdev, sk);
1854
1855                 goto failed;
1856         }
1857
1858         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1859                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1860                                       MGMT_STATUS_BUSY);
1861                 goto failed;
1862         }
1863
1864         val = !!cp->val;
1865
1866         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1867                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1868                 goto failed;
1869         }
1870
1871         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1872         if (!cmd) {
1873                 err = -ENOMEM;
1874                 goto failed;
1875         }
1876
1877         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1878         if (err < 0) {
1879                 mgmt_pending_remove(cmd);
1880                 goto failed;
1881         }
1882
1883 failed:
1884         hci_dev_unlock(hdev);
1885         return err;
1886 }
1887
1888 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1889 {
1890         struct cmd_lookup match = { NULL, hdev };
1891         struct mgmt_pending_cmd *cmd = data;
1892         struct mgmt_mode *cp = cmd->param;
1893         u8 enable = cp->val;
1894         bool changed;
1895
1896         /* Make sure cmd still outstanding. */
1897         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1898                 return;
1899
1900         if (err) {
1901                 u8 mgmt_err = mgmt_status(err);
1902
1903                 if (enable && hci_dev_test_and_clear_flag(hdev,
1904                                                           HCI_SSP_ENABLED)) {
1905                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1906                         new_settings(hdev, NULL);
1907                 }
1908
1909                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1910                                      &mgmt_err);
1911                 return;
1912         }
1913
1914         if (enable) {
1915                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1916         } else {
1917                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1918
1919                 if (!changed)
1920                         changed = hci_dev_test_and_clear_flag(hdev,
1921                                                               HCI_HS_ENABLED);
1922                 else
1923                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1924         }
1925
1926         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1927
1928         if (changed)
1929                 new_settings(hdev, match.sk);
1930
1931         if (match.sk)
1932                 sock_put(match.sk);
1933
1934         hci_update_eir_sync(hdev);
1935 }
1936
1937 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1938 {
1939         struct mgmt_pending_cmd *cmd = data;
1940         struct mgmt_mode *cp = cmd->param;
1941         bool changed = false;
1942         int err;
1943
1944         if (cp->val)
1945                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1946
1947         err = hci_write_ssp_mode_sync(hdev, cp->val);
1948
1949         if (!err && changed)
1950                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1951
1952         return err;
1953 }
1954
1955 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1956 {
1957         struct mgmt_mode *cp = data;
1958         struct mgmt_pending_cmd *cmd;
1959         u8 status;
1960         int err;
1961
1962         bt_dev_dbg(hdev, "sock %p", sk);
1963
1964         status = mgmt_bredr_support(hdev);
1965         if (status)
1966                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1967
1968         if (!lmp_ssp_capable(hdev))
1969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1970                                        MGMT_STATUS_NOT_SUPPORTED);
1971
1972         if (cp->val != 0x00 && cp->val != 0x01)
1973                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1974                                        MGMT_STATUS_INVALID_PARAMS);
1975
1976         hci_dev_lock(hdev);
1977
1978         if (!hdev_is_powered(hdev)) {
1979                 bool changed;
1980
1981                 if (cp->val) {
1982                         changed = !hci_dev_test_and_set_flag(hdev,
1983                                                              HCI_SSP_ENABLED);
1984                 } else {
1985                         changed = hci_dev_test_and_clear_flag(hdev,
1986                                                               HCI_SSP_ENABLED);
1987                         if (!changed)
1988                                 changed = hci_dev_test_and_clear_flag(hdev,
1989                                                                       HCI_HS_ENABLED);
1990                         else
1991                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1992                 }
1993
1994                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1995                 if (err < 0)
1996                         goto failed;
1997
1998                 if (changed)
1999                         err = new_settings(hdev, sk);
2000
2001                 goto failed;
2002         }
2003
2004         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2005                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2006                                       MGMT_STATUS_BUSY);
2007                 goto failed;
2008         }
2009
2010         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2011                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2012                 goto failed;
2013         }
2014
2015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2016         if (!cmd)
2017                 err = -ENOMEM;
2018         else
2019                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2020                                          set_ssp_complete);
2021
2022         if (err < 0) {
2023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2024                                       MGMT_STATUS_FAILED);
2025
2026                 if (cmd)
2027                         mgmt_pending_remove(cmd);
2028         }
2029
2030 failed:
2031         hci_dev_unlock(hdev);
2032         return err;
2033 }
2034
2035 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2036 {
2037         struct mgmt_mode *cp = data;
2038         bool changed;
2039         u8 status;
2040         int err;
2041
2042         bt_dev_dbg(hdev, "sock %p", sk);
2043
2044         if (!IS_ENABLED(CONFIG_BT_HS))
2045                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2046                                        MGMT_STATUS_NOT_SUPPORTED);
2047
2048         status = mgmt_bredr_support(hdev);
2049         if (status)
2050                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2051
2052         if (!lmp_ssp_capable(hdev))
2053                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2054                                        MGMT_STATUS_NOT_SUPPORTED);
2055
2056         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2057                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2058                                        MGMT_STATUS_REJECTED);
2059
2060         if (cp->val != 0x00 && cp->val != 0x01)
2061                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2062                                        MGMT_STATUS_INVALID_PARAMS);
2063
2064         hci_dev_lock(hdev);
2065
2066         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2067                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2068                                       MGMT_STATUS_BUSY);
2069                 goto unlock;
2070         }
2071
2072         if (cp->val) {
2073                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2074         } else {
2075                 if (hdev_is_powered(hdev)) {
2076                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2077                                               MGMT_STATUS_REJECTED);
2078                         goto unlock;
2079                 }
2080
2081                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2082         }
2083
2084         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2085         if (err < 0)
2086                 goto unlock;
2087
2088         if (changed)
2089                 err = new_settings(hdev, sk);
2090
2091 unlock:
2092         hci_dev_unlock(hdev);
2093         return err;
2094 }
2095
2096 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2097 {
2098         struct cmd_lookup match = { NULL, hdev };
2099         u8 status = mgmt_status(err);
2100
2101         bt_dev_dbg(hdev, "err %d", err);
2102
2103         if (status) {
2104                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2105                                                         &status);
2106                 return;
2107         }
2108
2109         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2110
2111         new_settings(hdev, match.sk);
2112
2113         if (match.sk)
2114                 sock_put(match.sk);
2115 }
2116
2117 static int set_le_sync(struct hci_dev *hdev, void *data)
2118 {
2119         struct mgmt_pending_cmd *cmd = data;
2120         struct mgmt_mode *cp = cmd->param;
2121         u8 val = !!cp->val;
2122         int err;
2123
2124         if (!val) {
2125                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2126
2127                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2128                         hci_disable_advertising_sync(hdev);
2129
2130                 if (ext_adv_capable(hdev))
2131                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2132         } else {
2133                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2134         }
2135
2136         err = hci_write_le_host_supported_sync(hdev, val, 0);
2137
2138         /* Make sure the controller has a good default for
2139          * advertising data. Restrict the update to when LE
2140          * has actually been enabled. During power on, the
2141          * update in powered_update_hci will take care of it.
2142          */
2143         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2144                 if (ext_adv_capable(hdev)) {
2145                         int status;
2146
2147                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2148                         if (!status)
2149                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2150                 } else {
2151                         hci_update_adv_data_sync(hdev, 0x00);
2152                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2153                 }
2154
2155                 hci_update_passive_scan(hdev);
2156         }
2157
2158         return err;
2159 }
2160
2161 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2162 {
2163         struct mgmt_pending_cmd *cmd = data;
2164         u8 status = mgmt_status(err);
2165         struct sock *sk = cmd->sk;
2166
2167         if (status) {
2168                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2169                                      cmd_status_rsp, &status);
2170                 return;
2171         }
2172
2173         mgmt_pending_remove(cmd);
2174         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2175 }
2176
2177 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2178 {
2179         struct mgmt_pending_cmd *cmd = data;
2180         struct mgmt_cp_set_mesh *cp = cmd->param;
2181         size_t len = cmd->param_len;
2182
2183         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2184
2185         if (cp->enable)
2186                 hci_dev_set_flag(hdev, HCI_MESH);
2187         else
2188                 hci_dev_clear_flag(hdev, HCI_MESH);
2189
2190         len -= sizeof(*cp);
2191
2192         /* If filters don't fit, forward all adv pkts */
2193         if (len <= sizeof(hdev->mesh_ad_types))
2194                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2195
2196         hci_update_passive_scan_sync(hdev);
2197         return 0;
2198 }
2199
2200 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2201 {
2202         struct mgmt_cp_set_mesh *cp = data;
2203         struct mgmt_pending_cmd *cmd;
2204         int err = 0;
2205
2206         bt_dev_dbg(hdev, "sock %p", sk);
2207
2208         if (!lmp_le_capable(hdev) ||
2209             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2210                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2211                                        MGMT_STATUS_NOT_SUPPORTED);
2212
2213         if (cp->enable != 0x00 && cp->enable != 0x01)
2214                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2215                                        MGMT_STATUS_INVALID_PARAMS);
2216
2217         hci_dev_lock(hdev);
2218
2219         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2220         if (!cmd)
2221                 err = -ENOMEM;
2222         else
2223                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2224                                          set_mesh_complete);
2225
2226         if (err < 0) {
2227                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2228                                       MGMT_STATUS_FAILED);
2229
2230                 if (cmd)
2231                         mgmt_pending_remove(cmd);
2232         }
2233
2234         hci_dev_unlock(hdev);
2235         return err;
2236 }
2237
2238 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2239 {
2240         struct mgmt_mesh_tx *mesh_tx = data;
2241         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2242         unsigned long mesh_send_interval;
2243         u8 mgmt_err = mgmt_status(err);
2244
2245         /* Report any errors here, but don't report completion */
2246
2247         if (mgmt_err) {
2248                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2249                 /* Send Complete Error Code for handle */
2250                 mesh_send_complete(hdev, mesh_tx, false);
2251                 return;
2252         }
2253
2254         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2255         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2256                            mesh_send_interval);
2257 }
2258
2259 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2260 {
2261         struct mgmt_mesh_tx *mesh_tx = data;
2262         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2263         struct adv_info *adv, *next_instance;
2264         u8 instance = hdev->le_num_of_adv_sets + 1;
2265         u16 timeout, duration;
2266         int err = 0;
2267
2268         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2269                 return MGMT_STATUS_BUSY;
2270
2271         timeout = 1000;
2272         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2273         adv = hci_add_adv_instance(hdev, instance, 0,
2274                                    send->adv_data_len, send->adv_data,
2275                                    0, NULL,
2276                                    timeout, duration,
2277                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2278                                    hdev->le_adv_min_interval,
2279                                    hdev->le_adv_max_interval,
2280                                    mesh_tx->handle);
2281
2282         if (!IS_ERR(adv))
2283                 mesh_tx->instance = instance;
2284         else
2285                 err = PTR_ERR(adv);
2286
2287         if (hdev->cur_adv_instance == instance) {
2288                 /* If the currently advertised instance is being changed then
2289                  * cancel the current advertising and schedule the next
2290                  * instance. If there is only one instance then the overridden
2291                  * advertising data will be visible right away.
2292                  */
2293                 cancel_adv_timeout(hdev);
2294
2295                 next_instance = hci_get_next_instance(hdev, instance);
2296                 if (next_instance)
2297                         instance = next_instance->instance;
2298                 else
2299                         instance = 0;
2300         } else if (hdev->adv_instance_timeout) {
2301                 /* Immediately advertise the new instance if no other, or
2302                  * let it go naturally from queue if ADV is already happening
2303                  */
2304                 instance = 0;
2305         }
2306
2307         if (instance)
2308                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2309
2310         return err;
2311 }
2312
2313 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2314 {
2315         struct mgmt_rp_mesh_read_features *rp = data;
2316
2317         if (rp->used_handles >= rp->max_handles)
2318                 return;
2319
2320         rp->handles[rp->used_handles++] = mesh_tx->handle;
2321 }
2322
2323 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2324                          void *data, u16 len)
2325 {
2326         struct mgmt_rp_mesh_read_features rp;
2327
2328         if (!lmp_le_capable(hdev) ||
2329             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2331                                        MGMT_STATUS_NOT_SUPPORTED);
2332
2333         memset(&rp, 0, sizeof(rp));
2334         rp.index = cpu_to_le16(hdev->id);
2335         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2336                 rp.max_handles = MESH_HANDLES_MAX;
2337
2338         hci_dev_lock(hdev);
2339
2340         if (rp.max_handles)
2341                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2342
2343         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2344                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2345
2346         hci_dev_unlock(hdev);
2347         return 0;
2348 }
2349
2350 static int send_cancel(struct hci_dev *hdev, void *data)
2351 {
2352         struct mgmt_pending_cmd *cmd = data;
2353         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2354         struct mgmt_mesh_tx *mesh_tx;
2355
2356         if (!cancel->handle) {
2357                 do {
2358                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2359
2360                         if (mesh_tx)
2361                                 mesh_send_complete(hdev, mesh_tx, false);
2362                 } while (mesh_tx);
2363         } else {
2364                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2365
2366                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2367                         mesh_send_complete(hdev, mesh_tx, false);
2368         }
2369
2370         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2371                           0, NULL, 0);
2372         mgmt_pending_free(cmd);
2373
2374         return 0;
2375 }
2376
2377 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2378                             void *data, u16 len)
2379 {
2380         struct mgmt_pending_cmd *cmd;
2381         int err;
2382
2383         if (!lmp_le_capable(hdev) ||
2384             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2385                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2386                                        MGMT_STATUS_NOT_SUPPORTED);
2387
2388         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2389                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2390                                        MGMT_STATUS_REJECTED);
2391
2392         hci_dev_lock(hdev);
2393         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2394         if (!cmd)
2395                 err = -ENOMEM;
2396         else
2397                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2398
2399         if (err < 0) {
2400                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2401                                       MGMT_STATUS_FAILED);
2402
2403                 if (cmd)
2404                         mgmt_pending_free(cmd);
2405         }
2406
2407         hci_dev_unlock(hdev);
2408         return err;
2409 }
2410
2411 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2412 {
2413         struct mgmt_mesh_tx *mesh_tx;
2414         struct mgmt_cp_mesh_send *send = data;
2415         struct mgmt_rp_mesh_read_features rp;
2416         bool sending;
2417         int err = 0;
2418
2419         if (!lmp_le_capable(hdev) ||
2420             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2421                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2422                                        MGMT_STATUS_NOT_SUPPORTED);
2423         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2424             len <= MGMT_MESH_SEND_SIZE ||
2425             len > (MGMT_MESH_SEND_SIZE + 31))
2426                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2427                                        MGMT_STATUS_REJECTED);
2428
2429         hci_dev_lock(hdev);
2430
2431         memset(&rp, 0, sizeof(rp));
2432         rp.max_handles = MESH_HANDLES_MAX;
2433
2434         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2435
2436         if (rp.max_handles <= rp.used_handles) {
2437                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2438                                       MGMT_STATUS_BUSY);
2439                 goto done;
2440         }
2441
2442         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2443         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2444
2445         if (!mesh_tx)
2446                 err = -ENOMEM;
2447         else if (!sending)
2448                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2449                                          mesh_send_start_complete);
2450
2451         if (err < 0) {
2452                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2454                                       MGMT_STATUS_FAILED);
2455
2456                 if (mesh_tx) {
2457                         if (sending)
2458                                 mgmt_mesh_remove(mesh_tx);
2459                 }
2460         } else {
2461                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2462
2463                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2464                                   &mesh_tx->handle, 1);
2465         }
2466
2467 done:
2468         hci_dev_unlock(hdev);
2469         return err;
2470 }
2471
2472 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2473 {
2474         struct mgmt_mode *cp = data;
2475         struct mgmt_pending_cmd *cmd;
2476         int err;
2477         u8 val, enabled;
2478
2479         bt_dev_dbg(hdev, "sock %p", sk);
2480
2481         if (!lmp_le_capable(hdev))
2482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2483                                        MGMT_STATUS_NOT_SUPPORTED);
2484
2485         if (cp->val != 0x00 && cp->val != 0x01)
2486                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2487                                        MGMT_STATUS_INVALID_PARAMS);
2488
2489         /* Bluetooth single mode LE only controllers or dual-mode
2490          * controllers configured as LE only devices, do not allow
2491          * switching LE off. These have either LE enabled explicitly
2492          * or BR/EDR has been previously switched off.
2493          *
2494          * When trying to enable an already enabled LE, then gracefully
2495          * send a positive response. Trying to disable it however will
2496          * result into rejection.
2497          */
2498         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2499                 if (cp->val == 0x01)
2500                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2501
2502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2503                                        MGMT_STATUS_REJECTED);
2504         }
2505
2506         hci_dev_lock(hdev);
2507
2508         val = !!cp->val;
2509         enabled = lmp_host_le_capable(hdev);
2510
2511         if (!hdev_is_powered(hdev) || val == enabled) {
2512                 bool changed = false;
2513
2514                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2515                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2516                         changed = true;
2517                 }
2518
2519                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2520                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2521                         changed = true;
2522                 }
2523
2524                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2525                 if (err < 0)
2526                         goto unlock;
2527
2528                 if (changed)
2529                         err = new_settings(hdev, sk);
2530
2531                 goto unlock;
2532         }
2533
2534         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2535             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2536                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2537                                       MGMT_STATUS_BUSY);
2538                 goto unlock;
2539         }
2540
2541         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2542         if (!cmd)
2543                 err = -ENOMEM;
2544         else
2545                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2546                                          set_le_complete);
2547
2548         if (err < 0) {
2549                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2550                                       MGMT_STATUS_FAILED);
2551
2552                 if (cmd)
2553                         mgmt_pending_remove(cmd);
2554         }
2555
2556 unlock:
2557         hci_dev_unlock(hdev);
2558         return err;
2559 }
2560
2561 /* This is a helper function to test for pending mgmt commands that can
2562  * cause CoD or EIR HCI commands. We can only allow one such pending
2563  * mgmt command at a time since otherwise we cannot easily track what
2564  * the current values are, will be, and based on that calculate if a new
2565  * HCI command needs to be sent and if yes with what value.
2566  */
2567 static bool pending_eir_or_class(struct hci_dev *hdev)
2568 {
2569         struct mgmt_pending_cmd *cmd;
2570
2571         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2572                 switch (cmd->opcode) {
2573                 case MGMT_OP_ADD_UUID:
2574                 case MGMT_OP_REMOVE_UUID:
2575                 case MGMT_OP_SET_DEV_CLASS:
2576                 case MGMT_OP_SET_POWERED:
2577                         return true;
2578                 }
2579         }
2580
2581         return false;
2582 }
2583
2584 static const u8 bluetooth_base_uuid[] = {
2585                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2586                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2587 };
2588
2589 static u8 get_uuid_size(const u8 *uuid)
2590 {
2591         u32 val;
2592
2593         if (memcmp(uuid, bluetooth_base_uuid, 12))
2594                 return 128;
2595
2596         val = get_unaligned_le32(&uuid[12]);
2597         if (val > 0xffff)
2598                 return 32;
2599
2600         return 16;
2601 }
2602
2603 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2604 {
2605         struct mgmt_pending_cmd *cmd = data;
2606
2607         bt_dev_dbg(hdev, "err %d", err);
2608
2609         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2610                           mgmt_status(err), hdev->dev_class, 3);
2611
2612         mgmt_pending_free(cmd);
2613 }
2614
2615 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2616 {
2617         int err;
2618
2619         err = hci_update_class_sync(hdev);
2620         if (err)
2621                 return err;
2622
2623         return hci_update_eir_sync(hdev);
2624 }
2625
2626 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2627 {
2628         struct mgmt_cp_add_uuid *cp = data;
2629         struct mgmt_pending_cmd *cmd;
2630         struct bt_uuid *uuid;
2631         int err;
2632
2633         bt_dev_dbg(hdev, "sock %p", sk);
2634
2635         hci_dev_lock(hdev);
2636
2637         if (pending_eir_or_class(hdev)) {
2638                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2639                                       MGMT_STATUS_BUSY);
2640                 goto failed;
2641         }
2642
2643         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2644         if (!uuid) {
2645                 err = -ENOMEM;
2646                 goto failed;
2647         }
2648
2649         memcpy(uuid->uuid, cp->uuid, 16);
2650         uuid->svc_hint = cp->svc_hint;
2651         uuid->size = get_uuid_size(cp->uuid);
2652
2653         list_add_tail(&uuid->list, &hdev->uuids);
2654
2655         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2656         if (!cmd) {
2657                 err = -ENOMEM;
2658                 goto failed;
2659         }
2660
2661         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2662         if (err < 0) {
2663                 mgmt_pending_free(cmd);
2664                 goto failed;
2665         }
2666
2667 failed:
2668         hci_dev_unlock(hdev);
2669         return err;
2670 }
2671
2672 static bool enable_service_cache(struct hci_dev *hdev)
2673 {
2674         if (!hdev_is_powered(hdev))
2675                 return false;
2676
2677         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2678                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2679                                    CACHE_TIMEOUT);
2680                 return true;
2681         }
2682
2683         return false;
2684 }
2685
2686 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2687 {
2688         int err;
2689
2690         err = hci_update_class_sync(hdev);
2691         if (err)
2692                 return err;
2693
2694         return hci_update_eir_sync(hdev);
2695 }
2696
2697 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2698                        u16 len)
2699 {
2700         struct mgmt_cp_remove_uuid *cp = data;
2701         struct mgmt_pending_cmd *cmd;
2702         struct bt_uuid *match, *tmp;
2703         static const u8 bt_uuid_any[] = {
2704                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2705         };
2706         int err, found;
2707
2708         bt_dev_dbg(hdev, "sock %p", sk);
2709
2710         hci_dev_lock(hdev);
2711
2712         if (pending_eir_or_class(hdev)) {
2713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2714                                       MGMT_STATUS_BUSY);
2715                 goto unlock;
2716         }
2717
2718         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2719                 hci_uuids_clear(hdev);
2720
2721                 if (enable_service_cache(hdev)) {
2722                         err = mgmt_cmd_complete(sk, hdev->id,
2723                                                 MGMT_OP_REMOVE_UUID,
2724                                                 0, hdev->dev_class, 3);
2725                         goto unlock;
2726                 }
2727
2728                 goto update_class;
2729         }
2730
2731         found = 0;
2732
2733         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2734                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2735                         continue;
2736
2737                 list_del(&match->list);
2738                 kfree(match);
2739                 found++;
2740         }
2741
2742         if (found == 0) {
2743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2744                                       MGMT_STATUS_INVALID_PARAMS);
2745                 goto unlock;
2746         }
2747
2748 update_class:
2749         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2750         if (!cmd) {
2751                 err = -ENOMEM;
2752                 goto unlock;
2753         }
2754
2755         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2756                                  mgmt_class_complete);
2757         if (err < 0)
2758                 mgmt_pending_free(cmd);
2759
2760 unlock:
2761         hci_dev_unlock(hdev);
2762         return err;
2763 }
2764
2765 static int set_class_sync(struct hci_dev *hdev, void *data)
2766 {
2767         int err = 0;
2768
2769         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2770                 cancel_delayed_work_sync(&hdev->service_cache);
2771                 err = hci_update_eir_sync(hdev);
2772         }
2773
2774         if (err)
2775                 return err;
2776
2777         return hci_update_class_sync(hdev);
2778 }
2779
2780 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2781                          u16 len)
2782 {
2783         struct mgmt_cp_set_dev_class *cp = data;
2784         struct mgmt_pending_cmd *cmd;
2785         int err;
2786
2787         bt_dev_dbg(hdev, "sock %p", sk);
2788
2789         if (!lmp_bredr_capable(hdev))
2790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2791                                        MGMT_STATUS_NOT_SUPPORTED);
2792
2793         hci_dev_lock(hdev);
2794
2795         if (pending_eir_or_class(hdev)) {
2796                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2797                                       MGMT_STATUS_BUSY);
2798                 goto unlock;
2799         }
2800
2801         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2802                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2803                                       MGMT_STATUS_INVALID_PARAMS);
2804                 goto unlock;
2805         }
2806
2807         hdev->major_class = cp->major;
2808         hdev->minor_class = cp->minor;
2809
2810         if (!hdev_is_powered(hdev)) {
2811                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2812                                         hdev->dev_class, 3);
2813                 goto unlock;
2814         }
2815
2816         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2817         if (!cmd) {
2818                 err = -ENOMEM;
2819                 goto unlock;
2820         }
2821
2822         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2823                                  mgmt_class_complete);
2824         if (err < 0)
2825                 mgmt_pending_free(cmd);
2826
2827 unlock:
2828         hci_dev_unlock(hdev);
2829         return err;
2830 }
2831
2832 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2833                           u16 len)
2834 {
2835         struct mgmt_cp_load_link_keys *cp = data;
2836         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2837                                    sizeof(struct mgmt_link_key_info));
2838         u16 key_count, expected_len;
2839         bool changed;
2840         int i;
2841
2842         bt_dev_dbg(hdev, "sock %p", sk);
2843
2844         if (!lmp_bredr_capable(hdev))
2845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2846                                        MGMT_STATUS_NOT_SUPPORTED);
2847
2848         key_count = __le16_to_cpu(cp->key_count);
2849         if (key_count > max_key_count) {
2850                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2851                            key_count);
2852                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2853                                        MGMT_STATUS_INVALID_PARAMS);
2854         }
2855
2856         expected_len = struct_size(cp, keys, key_count);
2857         if (expected_len != len) {
2858                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2859                            expected_len, len);
2860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2861                                        MGMT_STATUS_INVALID_PARAMS);
2862         }
2863
2864         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2865                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2866                                        MGMT_STATUS_INVALID_PARAMS);
2867
2868         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2869                    key_count);
2870
2871         for (i = 0; i < key_count; i++) {
2872                 struct mgmt_link_key_info *key = &cp->keys[i];
2873
2874                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2875                         return mgmt_cmd_status(sk, hdev->id,
2876                                                MGMT_OP_LOAD_LINK_KEYS,
2877                                                MGMT_STATUS_INVALID_PARAMS);
2878         }
2879
2880         hci_dev_lock(hdev);
2881
2882         hci_link_keys_clear(hdev);
2883
2884         if (cp->debug_keys)
2885                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2886         else
2887                 changed = hci_dev_test_and_clear_flag(hdev,
2888                                                       HCI_KEEP_DEBUG_KEYS);
2889
2890         if (changed)
2891                 new_settings(hdev, NULL);
2892
2893         for (i = 0; i < key_count; i++) {
2894                 struct mgmt_link_key_info *key = &cp->keys[i];
2895
2896                 if (hci_is_blocked_key(hdev,
2897                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2898                                        key->val)) {
2899                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2900                                     &key->addr.bdaddr);
2901                         continue;
2902                 }
2903
2904                 /* Always ignore debug keys and require a new pairing if
2905                  * the user wants to use them.
2906                  */
2907                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2908                         continue;
2909
2910                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2911                                  key->type, key->pin_len, NULL);
2912         }
2913
2914         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2915
2916         hci_dev_unlock(hdev);
2917
2918         return 0;
2919 }
2920
2921 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2922                            u8 addr_type, struct sock *skip_sk)
2923 {
2924         struct mgmt_ev_device_unpaired ev;
2925
2926         bacpy(&ev.addr.bdaddr, bdaddr);
2927         ev.addr.type = addr_type;
2928
2929         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2930                           skip_sk);
2931 }
2932
2933 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2934 {
2935         struct mgmt_pending_cmd *cmd = data;
2936         struct mgmt_cp_unpair_device *cp = cmd->param;
2937
2938         if (!err)
2939                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2940
2941         cmd->cmd_complete(cmd, err);
2942         mgmt_pending_free(cmd);
2943 }
2944
2945 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2946 {
2947         struct mgmt_pending_cmd *cmd = data;
2948         struct mgmt_cp_unpair_device *cp = cmd->param;
2949         struct hci_conn *conn;
2950
2951         if (cp->addr.type == BDADDR_BREDR)
2952                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2953                                                &cp->addr.bdaddr);
2954         else
2955                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2956                                                le_addr_type(cp->addr.type));
2957
2958         if (!conn)
2959                 return 0;
2960
2961         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2962 }
2963
2964 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2965                          u16 len)
2966 {
2967         struct mgmt_cp_unpair_device *cp = data;
2968         struct mgmt_rp_unpair_device rp;
2969         struct hci_conn_params *params;
2970         struct mgmt_pending_cmd *cmd;
2971         struct hci_conn *conn;
2972         u8 addr_type;
2973         int err;
2974
2975         memset(&rp, 0, sizeof(rp));
2976         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2977         rp.addr.type = cp->addr.type;
2978
2979         if (!bdaddr_type_is_valid(cp->addr.type))
2980                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2981                                          MGMT_STATUS_INVALID_PARAMS,
2982                                          &rp, sizeof(rp));
2983
2984         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2985                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2986                                          MGMT_STATUS_INVALID_PARAMS,
2987                                          &rp, sizeof(rp));
2988
2989         hci_dev_lock(hdev);
2990
2991         if (!hdev_is_powered(hdev)) {
2992                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2993                                         MGMT_STATUS_NOT_POWERED, &rp,
2994                                         sizeof(rp));
2995                 goto unlock;
2996         }
2997
2998         if (cp->addr.type == BDADDR_BREDR) {
2999                 /* If disconnection is requested, then look up the
3000                  * connection. If the remote device is connected, it
3001                  * will be later used to terminate the link.
3002                  *
3003                  * Setting it to NULL explicitly will cause no
3004                  * termination of the link.
3005                  */
3006                 if (cp->disconnect)
3007                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3008                                                        &cp->addr.bdaddr);
3009                 else
3010                         conn = NULL;
3011
3012                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3013                 if (err < 0) {
3014                         err = mgmt_cmd_complete(sk, hdev->id,
3015                                                 MGMT_OP_UNPAIR_DEVICE,
3016                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3017                                                 sizeof(rp));
3018                         goto unlock;
3019                 }
3020
3021                 goto done;
3022         }
3023
3024         /* LE address type */
3025         addr_type = le_addr_type(cp->addr.type);
3026
3027         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3028         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3029         if (err < 0) {
3030                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3031                                         MGMT_STATUS_NOT_PAIRED, &rp,
3032                                         sizeof(rp));
3033                 goto unlock;
3034         }
3035
3036         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3037         if (!conn) {
3038                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3039                 goto done;
3040         }
3041
3042
3043         /* Defer clearing up the connection parameters until closing to
3044          * give a chance of keeping them if a repairing happens.
3045          */
3046         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3047
3048         /* Disable auto-connection parameters if present */
3049         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3050         if (params) {
3051                 if (params->explicit_connect)
3052                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3053                 else
3054                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3055         }
3056
3057         /* If disconnection is not requested, then clear the connection
3058          * variable so that the link is not terminated.
3059          */
3060         if (!cp->disconnect)
3061                 conn = NULL;
3062
3063 done:
3064         /* If the connection variable is set, then termination of the
3065          * link is requested.
3066          */
3067         if (!conn) {
3068                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3069                                         &rp, sizeof(rp));
3070                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3071                 goto unlock;
3072         }
3073
3074         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3075                                sizeof(*cp));
3076         if (!cmd) {
3077                 err = -ENOMEM;
3078                 goto unlock;
3079         }
3080
3081         cmd->cmd_complete = addr_cmd_complete;
3082
3083         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3084                                  unpair_device_complete);
3085         if (err < 0)
3086                 mgmt_pending_free(cmd);
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3094                       u16 len)
3095 {
3096         struct mgmt_cp_disconnect *cp = data;
3097         struct mgmt_rp_disconnect rp;
3098         struct mgmt_pending_cmd *cmd;
3099         struct hci_conn *conn;
3100         int err;
3101
3102         bt_dev_dbg(hdev, "sock %p", sk);
3103
3104         memset(&rp, 0, sizeof(rp));
3105         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3106         rp.addr.type = cp->addr.type;
3107
3108         if (!bdaddr_type_is_valid(cp->addr.type))
3109                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3110                                          MGMT_STATUS_INVALID_PARAMS,
3111                                          &rp, sizeof(rp));
3112
3113         hci_dev_lock(hdev);
3114
3115         if (!test_bit(HCI_UP, &hdev->flags)) {
3116                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3117                                         MGMT_STATUS_NOT_POWERED, &rp,
3118                                         sizeof(rp));
3119                 goto failed;
3120         }
3121
3122         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3124                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3125                 goto failed;
3126         }
3127
3128         if (cp->addr.type == BDADDR_BREDR)
3129                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3130                                                &cp->addr.bdaddr);
3131         else
3132                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3133                                                le_addr_type(cp->addr.type));
3134
3135         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3136                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3137                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3138                                         sizeof(rp));
3139                 goto failed;
3140         }
3141
3142         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto failed;
3146         }
3147
3148         cmd->cmd_complete = generic_cmd_complete;
3149
3150         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3151         if (err < 0)
3152                 mgmt_pending_remove(cmd);
3153
3154 failed:
3155         hci_dev_unlock(hdev);
3156         return err;
3157 }
3158
3159 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3160 {
3161         switch (link_type) {
3162         case LE_LINK:
3163                 switch (addr_type) {
3164                 case ADDR_LE_DEV_PUBLIC:
3165                         return BDADDR_LE_PUBLIC;
3166
3167                 default:
3168                         /* Fallback to LE Random address type */
3169                         return BDADDR_LE_RANDOM;
3170                 }
3171
3172         default:
3173                 /* Fallback to BR/EDR type */
3174                 return BDADDR_BREDR;
3175         }
3176 }
3177
3178 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3179                            u16 data_len)
3180 {
3181         struct mgmt_rp_get_connections *rp;
3182         struct hci_conn *c;
3183         int err;
3184         u16 i;
3185
3186         bt_dev_dbg(hdev, "sock %p", sk);
3187
3188         hci_dev_lock(hdev);
3189
3190         if (!hdev_is_powered(hdev)) {
3191                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3192                                       MGMT_STATUS_NOT_POWERED);
3193                 goto unlock;
3194         }
3195
3196         i = 0;
3197         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3198                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3199                         i++;
3200         }
3201
3202         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3203         if (!rp) {
3204                 err = -ENOMEM;
3205                 goto unlock;
3206         }
3207
3208         i = 0;
3209         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3210                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3211                         continue;
3212                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3213                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3214                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3215                         continue;
3216                 i++;
3217         }
3218
3219         rp->conn_count = cpu_to_le16(i);
3220
3221         /* Recalculate length in case of filtered SCO connections, etc */
3222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3223                                 struct_size(rp, addr, i));
3224
3225         kfree(rp);
3226
3227 unlock:
3228         hci_dev_unlock(hdev);
3229         return err;
3230 }
3231
3232 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3233                                    struct mgmt_cp_pin_code_neg_reply *cp)
3234 {
3235         struct mgmt_pending_cmd *cmd;
3236         int err;
3237
3238         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3239                                sizeof(*cp));
3240         if (!cmd)
3241                 return -ENOMEM;
3242
3243         cmd->cmd_complete = addr_cmd_complete;
3244
3245         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3246                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3247         if (err < 0)
3248                 mgmt_pending_remove(cmd);
3249
3250         return err;
3251 }
3252
3253 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3254                           u16 len)
3255 {
3256         struct hci_conn *conn;
3257         struct mgmt_cp_pin_code_reply *cp = data;
3258         struct hci_cp_pin_code_reply reply;
3259         struct mgmt_pending_cmd *cmd;
3260         int err;
3261
3262         bt_dev_dbg(hdev, "sock %p", sk);
3263
3264         hci_dev_lock(hdev);
3265
3266         if (!hdev_is_powered(hdev)) {
3267                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3268                                       MGMT_STATUS_NOT_POWERED);
3269                 goto failed;
3270         }
3271
3272         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3273         if (!conn) {
3274                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3275                                       MGMT_STATUS_NOT_CONNECTED);
3276                 goto failed;
3277         }
3278
3279         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3280                 struct mgmt_cp_pin_code_neg_reply ncp;
3281
3282                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3283
3284                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3285
3286                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3287                 if (err >= 0)
3288                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3289                                               MGMT_STATUS_INVALID_PARAMS);
3290
3291                 goto failed;
3292         }
3293
3294         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3295         if (!cmd) {
3296                 err = -ENOMEM;
3297                 goto failed;
3298         }
3299
3300         cmd->cmd_complete = addr_cmd_complete;
3301
3302         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3303         reply.pin_len = cp->pin_len;
3304         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3305
3306         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3307         if (err < 0)
3308                 mgmt_pending_remove(cmd);
3309
3310 failed:
3311         hci_dev_unlock(hdev);
3312         return err;
3313 }
3314
3315 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3316                              u16 len)
3317 {
3318         struct mgmt_cp_set_io_capability *cp = data;
3319
3320         bt_dev_dbg(hdev, "sock %p", sk);
3321
3322         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3323                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3324                                        MGMT_STATUS_INVALID_PARAMS);
3325
3326         hci_dev_lock(hdev);
3327
3328         hdev->io_capability = cp->io_capability;
3329
3330         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3331
3332         hci_dev_unlock(hdev);
3333
3334         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3335                                  NULL, 0);
3336 }
3337
3338 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3339 {
3340         struct hci_dev *hdev = conn->hdev;
3341         struct mgmt_pending_cmd *cmd;
3342
3343         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3344                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3345                         continue;
3346
3347                 if (cmd->user_data != conn)
3348                         continue;
3349
3350                 return cmd;
3351         }
3352
3353         return NULL;
3354 }
3355
3356 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3357 {
3358         struct mgmt_rp_pair_device rp;
3359         struct hci_conn *conn = cmd->user_data;
3360         int err;
3361
3362         bacpy(&rp.addr.bdaddr, &conn->dst);
3363         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3364
3365         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3366                                 status, &rp, sizeof(rp));
3367
3368         /* So we don't get further callbacks for this connection */
3369         conn->connect_cfm_cb = NULL;
3370         conn->security_cfm_cb = NULL;
3371         conn->disconn_cfm_cb = NULL;
3372
3373         hci_conn_drop(conn);
3374
3375         /* The device is paired so there is no need to remove
3376          * its connection parameters anymore.
3377          */
3378         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3379
3380         hci_conn_put(conn);
3381
3382         return err;
3383 }
3384
3385 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3386 {
3387         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3388         struct mgmt_pending_cmd *cmd;
3389
3390         cmd = find_pairing(conn);
3391         if (cmd) {
3392                 cmd->cmd_complete(cmd, status);
3393                 mgmt_pending_remove(cmd);
3394         }
3395 }
3396
3397 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3398 {
3399         struct mgmt_pending_cmd *cmd;
3400
3401         BT_DBG("status %u", status);
3402
3403         cmd = find_pairing(conn);
3404         if (!cmd) {
3405                 BT_DBG("Unable to find a pending command");
3406                 return;
3407         }
3408
3409         cmd->cmd_complete(cmd, mgmt_status(status));
3410         mgmt_pending_remove(cmd);
3411 }
3412
3413 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3414 {
3415         struct mgmt_pending_cmd *cmd;
3416
3417         BT_DBG("status %u", status);
3418
3419         if (!status)
3420                 return;
3421
3422         cmd = find_pairing(conn);
3423         if (!cmd) {
3424                 BT_DBG("Unable to find a pending command");
3425                 return;
3426         }
3427
3428         cmd->cmd_complete(cmd, mgmt_status(status));
3429         mgmt_pending_remove(cmd);
3430 }
3431
3432 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3433                        u16 len)
3434 {
3435         struct mgmt_cp_pair_device *cp = data;
3436         struct mgmt_rp_pair_device rp;
3437         struct mgmt_pending_cmd *cmd;
3438         u8 sec_level, auth_type;
3439         struct hci_conn *conn;
3440         int err;
3441
3442         bt_dev_dbg(hdev, "sock %p", sk);
3443
3444         memset(&rp, 0, sizeof(rp));
3445         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3446         rp.addr.type = cp->addr.type;
3447
3448         if (!bdaddr_type_is_valid(cp->addr.type))
3449                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3450                                          MGMT_STATUS_INVALID_PARAMS,
3451                                          &rp, sizeof(rp));
3452
3453         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3454                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3455                                          MGMT_STATUS_INVALID_PARAMS,
3456                                          &rp, sizeof(rp));
3457
3458         hci_dev_lock(hdev);
3459
3460         if (!hdev_is_powered(hdev)) {
3461                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3462                                         MGMT_STATUS_NOT_POWERED, &rp,
3463                                         sizeof(rp));
3464                 goto unlock;
3465         }
3466
3467         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3468                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3469                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3470                                         sizeof(rp));
3471                 goto unlock;
3472         }
3473
3474         sec_level = BT_SECURITY_MEDIUM;
3475         auth_type = HCI_AT_DEDICATED_BONDING;
3476
3477         if (cp->addr.type == BDADDR_BREDR) {
3478                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3479                                        auth_type, CONN_REASON_PAIR_DEVICE);
3480         } else {
3481                 u8 addr_type = le_addr_type(cp->addr.type);
3482                 struct hci_conn_params *p;
3483
3484                 /* When pairing a new device, it is expected to remember
3485                  * this device for future connections. Adding the connection
3486                  * parameter information ahead of time allows tracking
3487                  * of the peripheral preferred values and will speed up any
3488                  * further connection establishment.
3489                  *
3490                  * If connection parameters already exist, then they
3491                  * will be kept and this function does nothing.
3492                  */
3493                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3494
3495                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3496                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3497
3498                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3499                                            sec_level, HCI_LE_CONN_TIMEOUT,
3500                                            CONN_REASON_PAIR_DEVICE);
3501         }
3502
3503         if (IS_ERR(conn)) {
3504                 int status;
3505
3506                 if (PTR_ERR(conn) == -EBUSY)
3507                         status = MGMT_STATUS_BUSY;
3508                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3509                         status = MGMT_STATUS_NOT_SUPPORTED;
3510                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3511                         status = MGMT_STATUS_REJECTED;
3512                 else
3513                         status = MGMT_STATUS_CONNECT_FAILED;
3514
3515                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3516                                         status, &rp, sizeof(rp));
3517                 goto unlock;
3518         }
3519
3520         if (conn->connect_cfm_cb) {
3521                 hci_conn_drop(conn);
3522                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3523                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3524                 goto unlock;
3525         }
3526
3527         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3528         if (!cmd) {
3529                 err = -ENOMEM;
3530                 hci_conn_drop(conn);
3531                 goto unlock;
3532         }
3533
3534         cmd->cmd_complete = pairing_complete;
3535
3536         /* For LE, just connecting isn't a proof that the pairing finished */
3537         if (cp->addr.type == BDADDR_BREDR) {
3538                 conn->connect_cfm_cb = pairing_complete_cb;
3539                 conn->security_cfm_cb = pairing_complete_cb;
3540                 conn->disconn_cfm_cb = pairing_complete_cb;
3541         } else {
3542                 conn->connect_cfm_cb = le_pairing_complete_cb;
3543                 conn->security_cfm_cb = le_pairing_complete_cb;
3544                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3545         }
3546
3547         conn->io_capability = cp->io_cap;
3548         cmd->user_data = hci_conn_get(conn);
3549
3550         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3551             hci_conn_security(conn, sec_level, auth_type, true)) {
3552                 cmd->cmd_complete(cmd, 0);
3553                 mgmt_pending_remove(cmd);
3554         }
3555
3556         err = 0;
3557
3558 unlock:
3559         hci_dev_unlock(hdev);
3560         return err;
3561 }
3562
3563 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3564 {
3565         struct hci_conn *conn;
3566         u16 handle = PTR_ERR(data);
3567
3568         conn = hci_conn_hash_lookup_handle(hdev, handle);
3569         if (!conn)
3570                 return 0;
3571
3572         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3573 }
3574
3575 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3576                               u16 len)
3577 {
3578         struct mgmt_addr_info *addr = data;
3579         struct mgmt_pending_cmd *cmd;
3580         struct hci_conn *conn;
3581         int err;
3582
3583         bt_dev_dbg(hdev, "sock %p", sk);
3584
3585         hci_dev_lock(hdev);
3586
3587         if (!hdev_is_powered(hdev)) {
3588                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3589                                       MGMT_STATUS_NOT_POWERED);
3590                 goto unlock;
3591         }
3592
3593         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3594         if (!cmd) {
3595                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3596                                       MGMT_STATUS_INVALID_PARAMS);
3597                 goto unlock;
3598         }
3599
3600         conn = cmd->user_data;
3601
3602         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3604                                       MGMT_STATUS_INVALID_PARAMS);
3605                 goto unlock;
3606         }
3607
3608         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3609         mgmt_pending_remove(cmd);
3610
3611         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3612                                 addr, sizeof(*addr));
3613
3614         /* Since user doesn't want to proceed with the connection, abort any
3615          * ongoing pairing and then terminate the link if it was created
3616          * because of the pair device action.
3617          */
3618         if (addr->type == BDADDR_BREDR)
3619                 hci_remove_link_key(hdev, &addr->bdaddr);
3620         else
3621                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3622                                               le_addr_type(addr->type));
3623
3624         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3625                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3626                                    NULL);
3627
3628 unlock:
3629         hci_dev_unlock(hdev);
3630         return err;
3631 }
3632
3633 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3634                              struct mgmt_addr_info *addr, u16 mgmt_op,
3635                              u16 hci_op, __le32 passkey)
3636 {
3637         struct mgmt_pending_cmd *cmd;
3638         struct hci_conn *conn;
3639         int err;
3640
3641         hci_dev_lock(hdev);
3642
3643         if (!hdev_is_powered(hdev)) {
3644                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3645                                         MGMT_STATUS_NOT_POWERED, addr,
3646                                         sizeof(*addr));
3647                 goto done;
3648         }
3649
3650         if (addr->type == BDADDR_BREDR)
3651                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3652         else
3653                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3654                                                le_addr_type(addr->type));
3655
3656         if (!conn) {
3657                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3658                                         MGMT_STATUS_NOT_CONNECTED, addr,
3659                                         sizeof(*addr));
3660                 goto done;
3661         }
3662
3663         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3664                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3665                 if (!err)
3666                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3667                                                 MGMT_STATUS_SUCCESS, addr,
3668                                                 sizeof(*addr));
3669                 else
3670                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3671                                                 MGMT_STATUS_FAILED, addr,
3672                                                 sizeof(*addr));
3673
3674                 goto done;
3675         }
3676
3677         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3678         if (!cmd) {
3679                 err = -ENOMEM;
3680                 goto done;
3681         }
3682
3683         cmd->cmd_complete = addr_cmd_complete;
3684
3685         /* Continue with pairing via HCI */
3686         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3687                 struct hci_cp_user_passkey_reply cp;
3688
3689                 bacpy(&cp.bdaddr, &addr->bdaddr);
3690                 cp.passkey = passkey;
3691                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3692         } else
3693                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3694                                    &addr->bdaddr);
3695
3696         if (err < 0)
3697                 mgmt_pending_remove(cmd);
3698
3699 done:
3700         hci_dev_unlock(hdev);
3701         return err;
3702 }
3703
3704 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3705                               void *data, u16 len)
3706 {
3707         struct mgmt_cp_pin_code_neg_reply *cp = data;
3708
3709         bt_dev_dbg(hdev, "sock %p", sk);
3710
3711         return user_pairing_resp(sk, hdev, &cp->addr,
3712                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3713                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3714 }
3715
3716 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3717                               u16 len)
3718 {
3719         struct mgmt_cp_user_confirm_reply *cp = data;
3720
3721         bt_dev_dbg(hdev, "sock %p", sk);
3722
3723         if (len != sizeof(*cp))
3724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3725                                        MGMT_STATUS_INVALID_PARAMS);
3726
3727         return user_pairing_resp(sk, hdev, &cp->addr,
3728                                  MGMT_OP_USER_CONFIRM_REPLY,
3729                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3730 }
3731
3732 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3733                                   void *data, u16 len)
3734 {
3735         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3736
3737         bt_dev_dbg(hdev, "sock %p", sk);
3738
3739         return user_pairing_resp(sk, hdev, &cp->addr,
3740                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3741                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3742 }
3743
3744 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3745                               u16 len)
3746 {
3747         struct mgmt_cp_user_passkey_reply *cp = data;
3748
3749         bt_dev_dbg(hdev, "sock %p", sk);
3750
3751         return user_pairing_resp(sk, hdev, &cp->addr,
3752                                  MGMT_OP_USER_PASSKEY_REPLY,
3753                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3754 }
3755
3756 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3757                                   void *data, u16 len)
3758 {
3759         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3760
3761         bt_dev_dbg(hdev, "sock %p", sk);
3762
3763         return user_pairing_resp(sk, hdev, &cp->addr,
3764                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3765                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3766 }
3767
3768 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3769 {
3770         struct adv_info *adv_instance;
3771
3772         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3773         if (!adv_instance)
3774                 return 0;
3775
3776         /* stop if current instance doesn't need to be changed */
3777         if (!(adv_instance->flags & flags))
3778                 return 0;
3779
3780         cancel_adv_timeout(hdev);
3781
3782         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3783         if (!adv_instance)
3784                 return 0;
3785
3786         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3787
3788         return 0;
3789 }
3790
3791 static int name_changed_sync(struct hci_dev *hdev, void *data)
3792 {
3793         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3794 }
3795
3796 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3797 {
3798         struct mgmt_pending_cmd *cmd = data;
3799         struct mgmt_cp_set_local_name *cp = cmd->param;
3800         u8 status = mgmt_status(err);
3801
3802         bt_dev_dbg(hdev, "err %d", err);
3803
3804         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3805                 return;
3806
3807         if (status) {
3808                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3809                                 status);
3810         } else {
3811                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3812                                   cp, sizeof(*cp));
3813
3814                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3815                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3816         }
3817
3818         mgmt_pending_remove(cmd);
3819 }
3820
3821 static int set_name_sync(struct hci_dev *hdev, void *data)
3822 {
3823         if (lmp_bredr_capable(hdev)) {
3824                 hci_update_name_sync(hdev);
3825                 hci_update_eir_sync(hdev);
3826         }
3827
3828         /* The name is stored in the scan response data and so
3829          * no need to update the advertising data here.
3830          */
3831         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3832                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3833
3834         return 0;
3835 }
3836
3837 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3838                           u16 len)
3839 {
3840         struct mgmt_cp_set_local_name *cp = data;
3841         struct mgmt_pending_cmd *cmd;
3842         int err;
3843
3844         bt_dev_dbg(hdev, "sock %p", sk);
3845
3846         hci_dev_lock(hdev);
3847
3848         /* If the old values are the same as the new ones just return a
3849          * direct command complete event.
3850          */
3851         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3852             !memcmp(hdev->short_name, cp->short_name,
3853                     sizeof(hdev->short_name))) {
3854                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3855                                         data, len);
3856                 goto failed;
3857         }
3858
3859         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3860
3861         if (!hdev_is_powered(hdev)) {
3862                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3863
3864                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3865                                         data, len);
3866                 if (err < 0)
3867                         goto failed;
3868
3869                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3870                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3871                 ext_info_changed(hdev, sk);
3872
3873                 goto failed;
3874         }
3875
3876         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3877         if (!cmd)
3878                 err = -ENOMEM;
3879         else
3880                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3881                                          set_name_complete);
3882
3883         if (err < 0) {
3884                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3885                                       MGMT_STATUS_FAILED);
3886
3887                 if (cmd)
3888                         mgmt_pending_remove(cmd);
3889
3890                 goto failed;
3891         }
3892
3893         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3894
3895 failed:
3896         hci_dev_unlock(hdev);
3897         return err;
3898 }
3899
3900 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3901 {
3902         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3903 }
3904
3905 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3906                           u16 len)
3907 {
3908         struct mgmt_cp_set_appearance *cp = data;
3909         u16 appearance;
3910         int err;
3911
3912         bt_dev_dbg(hdev, "sock %p", sk);
3913
3914         if (!lmp_le_capable(hdev))
3915                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3916                                        MGMT_STATUS_NOT_SUPPORTED);
3917
3918         appearance = le16_to_cpu(cp->appearance);
3919
3920         hci_dev_lock(hdev);
3921
3922         if (hdev->appearance != appearance) {
3923                 hdev->appearance = appearance;
3924
3925                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3926                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3927                                            NULL);
3928
3929                 ext_info_changed(hdev, sk);
3930         }
3931
3932         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3933                                 0);
3934
3935         hci_dev_unlock(hdev);
3936
3937         return err;
3938 }
3939
3940 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3941                                  void *data, u16 len)
3942 {
3943         struct mgmt_rp_get_phy_configuration rp;
3944
3945         bt_dev_dbg(hdev, "sock %p", sk);
3946
3947         hci_dev_lock(hdev);
3948
3949         memset(&rp, 0, sizeof(rp));
3950
3951         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3952         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3953         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3954
3955         hci_dev_unlock(hdev);
3956
3957         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3958                                  &rp, sizeof(rp));
3959 }
3960
3961 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3962 {
3963         struct mgmt_ev_phy_configuration_changed ev;
3964
3965         memset(&ev, 0, sizeof(ev));
3966
3967         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3968
3969         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3970                           sizeof(ev), skip);
3971 }
3972
3973 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3974 {
3975         struct mgmt_pending_cmd *cmd = data;
3976         struct sk_buff *skb = cmd->skb;
3977         u8 status = mgmt_status(err);
3978
3979         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3980                 return;
3981
3982         if (!status) {
3983                 if (!skb)
3984                         status = MGMT_STATUS_FAILED;
3985                 else if (IS_ERR(skb))
3986                         status = mgmt_status(PTR_ERR(skb));
3987                 else
3988                         status = mgmt_status(skb->data[0]);
3989         }
3990
3991         bt_dev_dbg(hdev, "status %d", status);
3992
3993         if (status) {
3994                 mgmt_cmd_status(cmd->sk, hdev->id,
3995                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3996         } else {
3997                 mgmt_cmd_complete(cmd->sk, hdev->id,
3998                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3999                                   NULL, 0);
4000
4001                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4002         }
4003
4004         if (skb && !IS_ERR(skb))
4005                 kfree_skb(skb);
4006
4007         mgmt_pending_remove(cmd);
4008 }
4009
4010 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4011 {
4012         struct mgmt_pending_cmd *cmd = data;
4013         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4014         struct hci_cp_le_set_default_phy cp_phy;
4015         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4016
4017         memset(&cp_phy, 0, sizeof(cp_phy));
4018
4019         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4020                 cp_phy.all_phys |= 0x01;
4021
4022         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4023                 cp_phy.all_phys |= 0x02;
4024
4025         if (selected_phys & MGMT_PHY_LE_1M_TX)
4026                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4027
4028         if (selected_phys & MGMT_PHY_LE_2M_TX)
4029                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4030
4031         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4032                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4033
4034         if (selected_phys & MGMT_PHY_LE_1M_RX)
4035                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4036
4037         if (selected_phys & MGMT_PHY_LE_2M_RX)
4038                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4039
4040         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4041                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4042
4043         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4044                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4045
4046         return 0;
4047 }
4048
4049 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4050                                  void *data, u16 len)
4051 {
4052         struct mgmt_cp_set_phy_configuration *cp = data;
4053         struct mgmt_pending_cmd *cmd;
4054         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4055         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4056         bool changed = false;
4057         int err;
4058
4059         bt_dev_dbg(hdev, "sock %p", sk);
4060
4061         configurable_phys = get_configurable_phys(hdev);
4062         supported_phys = get_supported_phys(hdev);
4063         selected_phys = __le32_to_cpu(cp->selected_phys);
4064
4065         if (selected_phys & ~supported_phys)
4066                 return mgmt_cmd_status(sk, hdev->id,
4067                                        MGMT_OP_SET_PHY_CONFIGURATION,
4068                                        MGMT_STATUS_INVALID_PARAMS);
4069
4070         unconfigure_phys = supported_phys & ~configurable_phys;
4071
4072         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4073                 return mgmt_cmd_status(sk, hdev->id,
4074                                        MGMT_OP_SET_PHY_CONFIGURATION,
4075                                        MGMT_STATUS_INVALID_PARAMS);
4076
4077         if (selected_phys == get_selected_phys(hdev))
4078                 return mgmt_cmd_complete(sk, hdev->id,
4079                                          MGMT_OP_SET_PHY_CONFIGURATION,
4080                                          0, NULL, 0);
4081
4082         hci_dev_lock(hdev);
4083
4084         if (!hdev_is_powered(hdev)) {
4085                 err = mgmt_cmd_status(sk, hdev->id,
4086                                       MGMT_OP_SET_PHY_CONFIGURATION,
4087                                       MGMT_STATUS_REJECTED);
4088                 goto unlock;
4089         }
4090
4091         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4092                 err = mgmt_cmd_status(sk, hdev->id,
4093                                       MGMT_OP_SET_PHY_CONFIGURATION,
4094                                       MGMT_STATUS_BUSY);
4095                 goto unlock;
4096         }
4097
4098         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4099                 pkt_type |= (HCI_DH3 | HCI_DM3);
4100         else
4101                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4102
4103         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4104                 pkt_type |= (HCI_DH5 | HCI_DM5);
4105         else
4106                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4107
4108         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4109                 pkt_type &= ~HCI_2DH1;
4110         else
4111                 pkt_type |= HCI_2DH1;
4112
4113         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4114                 pkt_type &= ~HCI_2DH3;
4115         else
4116                 pkt_type |= HCI_2DH3;
4117
4118         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4119                 pkt_type &= ~HCI_2DH5;
4120         else
4121                 pkt_type |= HCI_2DH5;
4122
4123         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4124                 pkt_type &= ~HCI_3DH1;
4125         else
4126                 pkt_type |= HCI_3DH1;
4127
4128         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4129                 pkt_type &= ~HCI_3DH3;
4130         else
4131                 pkt_type |= HCI_3DH3;
4132
4133         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4134                 pkt_type &= ~HCI_3DH5;
4135         else
4136                 pkt_type |= HCI_3DH5;
4137
4138         if (pkt_type != hdev->pkt_type) {
4139                 hdev->pkt_type = pkt_type;
4140                 changed = true;
4141         }
4142
4143         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4144             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4145                 if (changed)
4146                         mgmt_phy_configuration_changed(hdev, sk);
4147
4148                 err = mgmt_cmd_complete(sk, hdev->id,
4149                                         MGMT_OP_SET_PHY_CONFIGURATION,
4150                                         0, NULL, 0);
4151
4152                 goto unlock;
4153         }
4154
4155         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4156                                len);
4157         if (!cmd)
4158                 err = -ENOMEM;
4159         else
4160                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4161                                          set_default_phy_complete);
4162
4163         if (err < 0) {
4164                 err = mgmt_cmd_status(sk, hdev->id,
4165                                       MGMT_OP_SET_PHY_CONFIGURATION,
4166                                       MGMT_STATUS_FAILED);
4167
4168                 if (cmd)
4169                         mgmt_pending_remove(cmd);
4170         }
4171
4172 unlock:
4173         hci_dev_unlock(hdev);
4174
4175         return err;
4176 }
4177
4178 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4179                             u16 len)
4180 {
4181         int err = MGMT_STATUS_SUCCESS;
4182         struct mgmt_cp_set_blocked_keys *keys = data;
4183         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4184                                    sizeof(struct mgmt_blocked_key_info));
4185         u16 key_count, expected_len;
4186         int i;
4187
4188         bt_dev_dbg(hdev, "sock %p", sk);
4189
4190         key_count = __le16_to_cpu(keys->key_count);
4191         if (key_count > max_key_count) {
4192                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4193                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4194                                        MGMT_STATUS_INVALID_PARAMS);
4195         }
4196
4197         expected_len = struct_size(keys, keys, key_count);
4198         if (expected_len != len) {
4199                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4200                            expected_len, len);
4201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4202                                        MGMT_STATUS_INVALID_PARAMS);
4203         }
4204
4205         hci_dev_lock(hdev);
4206
4207         hci_blocked_keys_clear(hdev);
4208
4209         for (i = 0; i < key_count; ++i) {
4210                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4211
4212                 if (!b) {
4213                         err = MGMT_STATUS_NO_RESOURCES;
4214                         break;
4215                 }
4216
4217                 b->type = keys->keys[i].type;
4218                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4219                 list_add_rcu(&b->list, &hdev->blocked_keys);
4220         }
4221         hci_dev_unlock(hdev);
4222
4223         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4224                                 err, NULL, 0);
4225 }
4226
4227 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4228                                void *data, u16 len)
4229 {
4230         struct mgmt_mode *cp = data;
4231         int err;
4232         bool changed = false;
4233
4234         bt_dev_dbg(hdev, "sock %p", sk);
4235
4236         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4237                 return mgmt_cmd_status(sk, hdev->id,
4238                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4239                                        MGMT_STATUS_NOT_SUPPORTED);
4240
4241         if (cp->val != 0x00 && cp->val != 0x01)
4242                 return mgmt_cmd_status(sk, hdev->id,
4243                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4244                                        MGMT_STATUS_INVALID_PARAMS);
4245
4246         hci_dev_lock(hdev);
4247
4248         if (hdev_is_powered(hdev) &&
4249             !!cp->val != hci_dev_test_flag(hdev,
4250                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4251                 err = mgmt_cmd_status(sk, hdev->id,
4252                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4253                                       MGMT_STATUS_REJECTED);
4254                 goto unlock;
4255         }
4256
4257         if (cp->val)
4258                 changed = !hci_dev_test_and_set_flag(hdev,
4259                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4260         else
4261                 changed = hci_dev_test_and_clear_flag(hdev,
4262                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4263
4264         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4265         if (err < 0)
4266                 goto unlock;
4267
4268         if (changed)
4269                 err = new_settings(hdev, sk);
4270
4271 unlock:
4272         hci_dev_unlock(hdev);
4273         return err;
4274 }
4275
4276 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4277                                void *data, u16 data_len)
4278 {
4279         char buf[20];
4280         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4281         u16 cap_len = 0;
4282         u8 flags = 0;
4283         u8 tx_power_range[2];
4284
4285         bt_dev_dbg(hdev, "sock %p", sk);
4286
4287         memset(&buf, 0, sizeof(buf));
4288
4289         hci_dev_lock(hdev);
4290
4291         /* When the Read Simple Pairing Options command is supported, then
4292          * the remote public key validation is supported.
4293          *
4294          * Alternatively, when Microsoft extensions are available, they can
4295          * indicate support for public key validation as well.
4296          */
4297         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4298                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4299
4300         flags |= 0x02;          /* Remote public key validation (LE) */
4301
4302         /* When the Read Encryption Key Size command is supported, then the
4303          * encryption key size is enforced.
4304          */
4305         if (hdev->commands[20] & 0x10)
4306                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4307
4308         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4309
4310         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4311                                   &flags, 1);
4312
4313         /* When the Read Simple Pairing Options command is supported, then
4314          * also max encryption key size information is provided.
4315          */
4316         if (hdev->commands[41] & 0x08)
4317                 cap_len = eir_append_le16(rp->cap, cap_len,
4318                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4319                                           hdev->max_enc_key_size);
4320
4321         cap_len = eir_append_le16(rp->cap, cap_len,
4322                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4323                                   SMP_MAX_ENC_KEY_SIZE);
4324
4325         /* Append the min/max LE tx power parameters if we were able to fetch
4326          * it from the controller
4327          */
4328         if (hdev->commands[38] & 0x80) {
4329                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4330                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4331                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4332                                           tx_power_range, 2);
4333         }
4334
4335         rp->cap_len = cpu_to_le16(cap_len);
4336
4337         hci_dev_unlock(hdev);
4338
4339         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4340                                  rp, sizeof(*rp) + cap_len);
4341 }
4342
4343 #ifdef CONFIG_BT_FEATURE_DEBUG
4344 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4345 static const u8 debug_uuid[16] = {
4346         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4347         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4348 };
4349 #endif
4350
4351 /* 330859bc-7506-492d-9370-9a6f0614037f */
4352 static const u8 quality_report_uuid[16] = {
4353         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4354         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4355 };
4356
4357 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4358 static const u8 offload_codecs_uuid[16] = {
4359         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4360         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4361 };
4362
4363 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4364 static const u8 le_simultaneous_roles_uuid[16] = {
4365         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4366         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4367 };
4368
4369 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4370 static const u8 rpa_resolution_uuid[16] = {
4371         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4372         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4373 };
4374
4375 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4376 static const u8 iso_socket_uuid[16] = {
4377         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4378         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4379 };
4380
4381 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4382 static const u8 mgmt_mesh_uuid[16] = {
4383         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4384         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4385 };
4386
4387 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4388                                   void *data, u16 data_len)
4389 {
4390         struct mgmt_rp_read_exp_features_info *rp;
4391         size_t len;
4392         u16 idx = 0;
4393         u32 flags;
4394         int status;
4395
4396         bt_dev_dbg(hdev, "sock %p", sk);
4397
4398         /* Enough space for 7 features */
4399         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4400         rp = kzalloc(len, GFP_KERNEL);
4401         if (!rp)
4402                 return -ENOMEM;
4403
4404 #ifdef CONFIG_BT_FEATURE_DEBUG
4405         if (!hdev) {
4406                 flags = bt_dbg_get() ? BIT(0) : 0;
4407
4408                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4409                 rp->features[idx].flags = cpu_to_le32(flags);
4410                 idx++;
4411         }
4412 #endif
4413
4414         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4415                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4416                         flags = BIT(0);
4417                 else
4418                         flags = 0;
4419
4420                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4421                 rp->features[idx].flags = cpu_to_le32(flags);
4422                 idx++;
4423         }
4424
4425         if (hdev && ll_privacy_capable(hdev)) {
4426                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4427                         flags = BIT(0) | BIT(1);
4428                 else
4429                         flags = BIT(1);
4430
4431                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4432                 rp->features[idx].flags = cpu_to_le32(flags);
4433                 idx++;
4434         }
4435
4436         if (hdev && (aosp_has_quality_report(hdev) ||
4437                      hdev->set_quality_report)) {
4438                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4439                         flags = BIT(0);
4440                 else
4441                         flags = 0;
4442
4443                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4444                 rp->features[idx].flags = cpu_to_le32(flags);
4445                 idx++;
4446         }
4447
4448         if (hdev && hdev->get_data_path_id) {
4449                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4450                         flags = BIT(0);
4451                 else
4452                         flags = 0;
4453
4454                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4455                 rp->features[idx].flags = cpu_to_le32(flags);
4456                 idx++;
4457         }
4458
4459         if (IS_ENABLED(CONFIG_BT_LE)) {
4460                 flags = iso_enabled() ? BIT(0) : 0;
4461                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4462                 rp->features[idx].flags = cpu_to_le32(flags);
4463                 idx++;
4464         }
4465
4466         if (hdev && lmp_le_capable(hdev)) {
4467                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4468                         flags = BIT(0);
4469                 else
4470                         flags = 0;
4471
4472                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4473                 rp->features[idx].flags = cpu_to_le32(flags);
4474                 idx++;
4475         }
4476
4477         rp->feature_count = cpu_to_le16(idx);
4478
4479         /* After reading the experimental features information, enable
4480          * the events to update client on any future change.
4481          */
4482         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4483
4484         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4485                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4486                                    0, rp, sizeof(*rp) + (20 * idx));
4487
4488         kfree(rp);
4489         return status;
4490 }
4491
4492 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4493                                           struct sock *skip)
4494 {
4495         struct mgmt_ev_exp_feature_changed ev;
4496
4497         memset(&ev, 0, sizeof(ev));
4498         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4499         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4500
4501         // Do we need to be atomic with the conn_flags?
4502         if (enabled && privacy_mode_capable(hdev))
4503                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4504         else
4505                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4506
4507         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4508                                   &ev, sizeof(ev),
4509                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4510
4511 }
4512
4513 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4514                                bool enabled, struct sock *skip)
4515 {
4516         struct mgmt_ev_exp_feature_changed ev;
4517
4518         memset(&ev, 0, sizeof(ev));
4519         memcpy(ev.uuid, uuid, 16);
4520         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4521
4522         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4523                                   &ev, sizeof(ev),
4524                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4525 }
4526
4527 #define EXP_FEAT(_uuid, _set_func)      \
4528 {                                       \
4529         .uuid = _uuid,                  \
4530         .set_func = _set_func,          \
4531 }
4532
4533 /* The zero key uuid is special. Multiple exp features are set through it. */
4534 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4535                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4536 {
4537         struct mgmt_rp_set_exp_feature rp;
4538
4539         memset(rp.uuid, 0, 16);
4540         rp.flags = cpu_to_le32(0);
4541
4542 #ifdef CONFIG_BT_FEATURE_DEBUG
4543         if (!hdev) {
4544                 bool changed = bt_dbg_get();
4545
4546                 bt_dbg_set(false);
4547
4548                 if (changed)
4549                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4550         }
4551 #endif
4552
4553         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4554                 bool changed;
4555
4556                 changed = hci_dev_test_and_clear_flag(hdev,
4557                                                       HCI_ENABLE_LL_PRIVACY);
4558                 if (changed)
4559                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4560                                             sk);
4561         }
4562
4563         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4564
4565         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4566                                  MGMT_OP_SET_EXP_FEATURE, 0,
4567                                  &rp, sizeof(rp));
4568 }
4569
4570 #ifdef CONFIG_BT_FEATURE_DEBUG
4571 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4572                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4573 {
4574         struct mgmt_rp_set_exp_feature rp;
4575
4576         bool val, changed;
4577         int err;
4578
4579         /* Command requires to use the non-controller index */
4580         if (hdev)
4581                 return mgmt_cmd_status(sk, hdev->id,
4582                                        MGMT_OP_SET_EXP_FEATURE,
4583                                        MGMT_STATUS_INVALID_INDEX);
4584
4585         /* Parameters are limited to a single octet */
4586         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4587                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4588                                        MGMT_OP_SET_EXP_FEATURE,
4589                                        MGMT_STATUS_INVALID_PARAMS);
4590
4591         /* Only boolean on/off is supported */
4592         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4593                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4594                                        MGMT_OP_SET_EXP_FEATURE,
4595                                        MGMT_STATUS_INVALID_PARAMS);
4596
4597         val = !!cp->param[0];
4598         changed = val ? !bt_dbg_get() : bt_dbg_get();
4599         bt_dbg_set(val);
4600
4601         memcpy(rp.uuid, debug_uuid, 16);
4602         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4603
4604         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4605
4606         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4607                                 MGMT_OP_SET_EXP_FEATURE, 0,
4608                                 &rp, sizeof(rp));
4609
4610         if (changed)
4611                 exp_feature_changed(hdev, debug_uuid, val, sk);
4612
4613         return err;
4614 }
4615 #endif
4616
4617 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4618                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4619 {
4620         struct mgmt_rp_set_exp_feature rp;
4621         bool val, changed;
4622         int err;
4623
4624         /* Command requires to use the controller index */
4625         if (!hdev)
4626                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4627                                        MGMT_OP_SET_EXP_FEATURE,
4628                                        MGMT_STATUS_INVALID_INDEX);
4629
4630         /* Changes can only be made when controller is powered down */
4631         if (hdev_is_powered(hdev))
4632                 return mgmt_cmd_status(sk, hdev->id,
4633                                        MGMT_OP_SET_EXP_FEATURE,
4634                                        MGMT_STATUS_REJECTED);
4635
4636         /* Parameters are limited to a single octet */
4637         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4638                 return mgmt_cmd_status(sk, hdev->id,
4639                                        MGMT_OP_SET_EXP_FEATURE,
4640                                        MGMT_STATUS_INVALID_PARAMS);
4641
4642         /* Only boolean on/off is supported */
4643         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4644                 return mgmt_cmd_status(sk, hdev->id,
4645                                        MGMT_OP_SET_EXP_FEATURE,
4646                                        MGMT_STATUS_INVALID_PARAMS);
4647
4648         val = !!cp->param[0];
4649
4650         if (val) {
4651                 changed = !hci_dev_test_and_set_flag(hdev,
4652                                                      HCI_MESH_EXPERIMENTAL);
4653         } else {
4654                 hci_dev_clear_flag(hdev, HCI_MESH);
4655                 changed = hci_dev_test_and_clear_flag(hdev,
4656                                                       HCI_MESH_EXPERIMENTAL);
4657         }
4658
4659         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4660         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4661
4662         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4663
4664         err = mgmt_cmd_complete(sk, hdev->id,
4665                                 MGMT_OP_SET_EXP_FEATURE, 0,
4666                                 &rp, sizeof(rp));
4667
4668         if (changed)
4669                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4670
4671         return err;
4672 }
4673
4674 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4675                                    struct mgmt_cp_set_exp_feature *cp,
4676                                    u16 data_len)
4677 {
4678         struct mgmt_rp_set_exp_feature rp;
4679         bool val, changed;
4680         int err;
4681         u32 flags;
4682
4683         /* Command requires to use the controller index */
4684         if (!hdev)
4685                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4686                                        MGMT_OP_SET_EXP_FEATURE,
4687                                        MGMT_STATUS_INVALID_INDEX);
4688
4689         /* Changes can only be made when controller is powered down */
4690         if (hdev_is_powered(hdev))
4691                 return mgmt_cmd_status(sk, hdev->id,
4692                                        MGMT_OP_SET_EXP_FEATURE,
4693                                        MGMT_STATUS_REJECTED);
4694
4695         /* Parameters are limited to a single octet */
4696         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4697                 return mgmt_cmd_status(sk, hdev->id,
4698                                        MGMT_OP_SET_EXP_FEATURE,
4699                                        MGMT_STATUS_INVALID_PARAMS);
4700
4701         /* Only boolean on/off is supported */
4702         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4703                 return mgmt_cmd_status(sk, hdev->id,
4704                                        MGMT_OP_SET_EXP_FEATURE,
4705                                        MGMT_STATUS_INVALID_PARAMS);
4706
4707         val = !!cp->param[0];
4708
4709         if (val) {
4710                 changed = !hci_dev_test_and_set_flag(hdev,
4711                                                      HCI_ENABLE_LL_PRIVACY);
4712                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4713
4714                 /* Enable LL privacy + supported settings changed */
4715                 flags = BIT(0) | BIT(1);
4716         } else {
4717                 changed = hci_dev_test_and_clear_flag(hdev,
4718                                                       HCI_ENABLE_LL_PRIVACY);
4719
4720                 /* Disable LL privacy + supported settings changed */
4721                 flags = BIT(1);
4722         }
4723
4724         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4725         rp.flags = cpu_to_le32(flags);
4726
4727         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4728
4729         err = mgmt_cmd_complete(sk, hdev->id,
4730                                 MGMT_OP_SET_EXP_FEATURE, 0,
4731                                 &rp, sizeof(rp));
4732
4733         if (changed)
4734                 exp_ll_privacy_feature_changed(val, hdev, sk);
4735
4736         return err;
4737 }
4738
4739 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4740                                    struct mgmt_cp_set_exp_feature *cp,
4741                                    u16 data_len)
4742 {
4743         struct mgmt_rp_set_exp_feature rp;
4744         bool val, changed;
4745         int err;
4746
4747         /* Command requires to use a valid controller index */
4748         if (!hdev)
4749                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4750                                        MGMT_OP_SET_EXP_FEATURE,
4751                                        MGMT_STATUS_INVALID_INDEX);
4752
4753         /* Parameters are limited to a single octet */
4754         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4755                 return mgmt_cmd_status(sk, hdev->id,
4756                                        MGMT_OP_SET_EXP_FEATURE,
4757                                        MGMT_STATUS_INVALID_PARAMS);
4758
4759         /* Only boolean on/off is supported */
4760         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4761                 return mgmt_cmd_status(sk, hdev->id,
4762                                        MGMT_OP_SET_EXP_FEATURE,
4763                                        MGMT_STATUS_INVALID_PARAMS);
4764
4765         hci_req_sync_lock(hdev);
4766
4767         val = !!cp->param[0];
4768         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4769
4770         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4771                 err = mgmt_cmd_status(sk, hdev->id,
4772                                       MGMT_OP_SET_EXP_FEATURE,
4773                                       MGMT_STATUS_NOT_SUPPORTED);
4774                 goto unlock_quality_report;
4775         }
4776
4777         if (changed) {
4778                 if (hdev->set_quality_report)
4779                         err = hdev->set_quality_report(hdev, val);
4780                 else
4781                         err = aosp_set_quality_report(hdev, val);
4782
4783                 if (err) {
4784                         err = mgmt_cmd_status(sk, hdev->id,
4785                                               MGMT_OP_SET_EXP_FEATURE,
4786                                               MGMT_STATUS_FAILED);
4787                         goto unlock_quality_report;
4788                 }
4789
4790                 if (val)
4791                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4792                 else
4793                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4794         }
4795
4796         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4797
4798         memcpy(rp.uuid, quality_report_uuid, 16);
4799         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4800         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4801
4802         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4803                                 &rp, sizeof(rp));
4804
4805         if (changed)
4806                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4807
4808 unlock_quality_report:
4809         hci_req_sync_unlock(hdev);
4810         return err;
4811 }
4812
4813 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4814                                   struct mgmt_cp_set_exp_feature *cp,
4815                                   u16 data_len)
4816 {
4817         bool val, changed;
4818         int err;
4819         struct mgmt_rp_set_exp_feature rp;
4820
4821         /* Command requires to use a valid controller index */
4822         if (!hdev)
4823                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4824                                        MGMT_OP_SET_EXP_FEATURE,
4825                                        MGMT_STATUS_INVALID_INDEX);
4826
4827         /* Parameters are limited to a single octet */
4828         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4829                 return mgmt_cmd_status(sk, hdev->id,
4830                                        MGMT_OP_SET_EXP_FEATURE,
4831                                        MGMT_STATUS_INVALID_PARAMS);
4832
4833         /* Only boolean on/off is supported */
4834         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4835                 return mgmt_cmd_status(sk, hdev->id,
4836                                        MGMT_OP_SET_EXP_FEATURE,
4837                                        MGMT_STATUS_INVALID_PARAMS);
4838
4839         val = !!cp->param[0];
4840         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4841
4842         if (!hdev->get_data_path_id) {
4843                 return mgmt_cmd_status(sk, hdev->id,
4844                                        MGMT_OP_SET_EXP_FEATURE,
4845                                        MGMT_STATUS_NOT_SUPPORTED);
4846         }
4847
4848         if (changed) {
4849                 if (val)
4850                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4851                 else
4852                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4853         }
4854
4855         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4856                     val, changed);
4857
4858         memcpy(rp.uuid, offload_codecs_uuid, 16);
4859         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4860         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4861         err = mgmt_cmd_complete(sk, hdev->id,
4862                                 MGMT_OP_SET_EXP_FEATURE, 0,
4863                                 &rp, sizeof(rp));
4864
4865         if (changed)
4866                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4867
4868         return err;
4869 }
4870
4871 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4872                                           struct mgmt_cp_set_exp_feature *cp,
4873                                           u16 data_len)
4874 {
4875         bool val, changed;
4876         int err;
4877         struct mgmt_rp_set_exp_feature rp;
4878
4879         /* Command requires to use a valid controller index */
4880         if (!hdev)
4881                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4882                                        MGMT_OP_SET_EXP_FEATURE,
4883                                        MGMT_STATUS_INVALID_INDEX);
4884
4885         /* Parameters are limited to a single octet */
4886         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4887                 return mgmt_cmd_status(sk, hdev->id,
4888                                        MGMT_OP_SET_EXP_FEATURE,
4889                                        MGMT_STATUS_INVALID_PARAMS);
4890
4891         /* Only boolean on/off is supported */
4892         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4893                 return mgmt_cmd_status(sk, hdev->id,
4894                                        MGMT_OP_SET_EXP_FEATURE,
4895                                        MGMT_STATUS_INVALID_PARAMS);
4896
4897         val = !!cp->param[0];
4898         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4899
4900         if (!hci_dev_le_state_simultaneous(hdev)) {
4901                 return mgmt_cmd_status(sk, hdev->id,
4902                                        MGMT_OP_SET_EXP_FEATURE,
4903                                        MGMT_STATUS_NOT_SUPPORTED);
4904         }
4905
4906         if (changed) {
4907                 if (val)
4908                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4909                 else
4910                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4911         }
4912
4913         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4914                     val, changed);
4915
4916         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4917         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4918         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4919         err = mgmt_cmd_complete(sk, hdev->id,
4920                                 MGMT_OP_SET_EXP_FEATURE, 0,
4921                                 &rp, sizeof(rp));
4922
4923         if (changed)
4924                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4925
4926         return err;
4927 }
4928
4929 #ifdef CONFIG_BT_LE
4930 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4931                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4932 {
4933         struct mgmt_rp_set_exp_feature rp;
4934         bool val, changed = false;
4935         int err;
4936
4937         /* Command requires to use the non-controller index */
4938         if (hdev)
4939                 return mgmt_cmd_status(sk, hdev->id,
4940                                        MGMT_OP_SET_EXP_FEATURE,
4941                                        MGMT_STATUS_INVALID_INDEX);
4942
4943         /* Parameters are limited to a single octet */
4944         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4945                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4946                                        MGMT_OP_SET_EXP_FEATURE,
4947                                        MGMT_STATUS_INVALID_PARAMS);
4948
4949         /* Only boolean on/off is supported */
4950         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4951                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4952                                        MGMT_OP_SET_EXP_FEATURE,
4953                                        MGMT_STATUS_INVALID_PARAMS);
4954
4955         val = cp->param[0] ? true : false;
4956         if (val)
4957                 err = iso_init();
4958         else
4959                 err = iso_exit();
4960
4961         if (!err)
4962                 changed = true;
4963
4964         memcpy(rp.uuid, iso_socket_uuid, 16);
4965         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4966
4967         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4968
4969         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4970                                 MGMT_OP_SET_EXP_FEATURE, 0,
4971                                 &rp, sizeof(rp));
4972
4973         if (changed)
4974                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4975
4976         return err;
4977 }
4978 #endif
4979
4980 static const struct mgmt_exp_feature {
4981         const u8 *uuid;
4982         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4983                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4984 } exp_features[] = {
4985         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4986 #ifdef CONFIG_BT_FEATURE_DEBUG
4987         EXP_FEAT(debug_uuid, set_debug_func),
4988 #endif
4989         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4990         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4991         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4992         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4993         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4994 #ifdef CONFIG_BT_LE
4995         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4996 #endif
4997
4998         /* end with a null feature */
4999         EXP_FEAT(NULL, NULL)
5000 };
5001
5002 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5003                            void *data, u16 data_len)
5004 {
5005         struct mgmt_cp_set_exp_feature *cp = data;
5006         size_t i = 0;
5007
5008         bt_dev_dbg(hdev, "sock %p", sk);
5009
5010         for (i = 0; exp_features[i].uuid; i++) {
5011                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5012                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5013         }
5014
5015         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5016                                MGMT_OP_SET_EXP_FEATURE,
5017                                MGMT_STATUS_NOT_SUPPORTED);
5018 }
5019
5020 static u32 get_params_flags(struct hci_dev *hdev,
5021                             struct hci_conn_params *params)
5022 {
5023         u32 flags = hdev->conn_flags;
5024
5025         /* Devices using RPAs can only be programmed in the acceptlist if
5026          * LL Privacy has been enable otherwise they cannot mark
5027          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5028          */
5029         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5030             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5031                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5032
5033         return flags;
5034 }
5035
5036 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5037                             u16 data_len)
5038 {
5039         struct mgmt_cp_get_device_flags *cp = data;
5040         struct mgmt_rp_get_device_flags rp;
5041         struct bdaddr_list_with_flags *br_params;
5042         struct hci_conn_params *params;
5043         u32 supported_flags;
5044         u32 current_flags = 0;
5045         u8 status = MGMT_STATUS_INVALID_PARAMS;
5046
5047         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5048                    &cp->addr.bdaddr, cp->addr.type);
5049
5050         hci_dev_lock(hdev);
5051
5052         supported_flags = hdev->conn_flags;
5053
5054         memset(&rp, 0, sizeof(rp));
5055
5056         if (cp->addr.type == BDADDR_BREDR) {
5057                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5058                                                               &cp->addr.bdaddr,
5059                                                               cp->addr.type);
5060                 if (!br_params)
5061                         goto done;
5062
5063                 current_flags = br_params->flags;
5064         } else {
5065                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5066                                                 le_addr_type(cp->addr.type));
5067                 if (!params)
5068                         goto done;
5069
5070                 supported_flags = get_params_flags(hdev, params);
5071                 current_flags = params->flags;
5072         }
5073
5074         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5075         rp.addr.type = cp->addr.type;
5076         rp.supported_flags = cpu_to_le32(supported_flags);
5077         rp.current_flags = cpu_to_le32(current_flags);
5078
5079         status = MGMT_STATUS_SUCCESS;
5080
5081 done:
5082         hci_dev_unlock(hdev);
5083
5084         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5085                                 &rp, sizeof(rp));
5086 }
5087
5088 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5089                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5090                                  u32 supported_flags, u32 current_flags)
5091 {
5092         struct mgmt_ev_device_flags_changed ev;
5093
5094         bacpy(&ev.addr.bdaddr, bdaddr);
5095         ev.addr.type = bdaddr_type;
5096         ev.supported_flags = cpu_to_le32(supported_flags);
5097         ev.current_flags = cpu_to_le32(current_flags);
5098
5099         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5100 }
5101
5102 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5103                             u16 len)
5104 {
5105         struct mgmt_cp_set_device_flags *cp = data;
5106         struct bdaddr_list_with_flags *br_params;
5107         struct hci_conn_params *params;
5108         u8 status = MGMT_STATUS_INVALID_PARAMS;
5109         u32 supported_flags;
5110         u32 current_flags = __le32_to_cpu(cp->current_flags);
5111
5112         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5113                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5114
5115         // We should take hci_dev_lock() early, I think.. conn_flags can change
5116         supported_flags = hdev->conn_flags;
5117
5118         if ((supported_flags | current_flags) != supported_flags) {
5119                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5120                             current_flags, supported_flags);
5121                 goto done;
5122         }
5123
5124         hci_dev_lock(hdev);
5125
5126         if (cp->addr.type == BDADDR_BREDR) {
5127                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5128                                                               &cp->addr.bdaddr,
5129                                                               cp->addr.type);
5130
5131                 if (br_params) {
5132                         br_params->flags = current_flags;
5133                         status = MGMT_STATUS_SUCCESS;
5134                 } else {
5135                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5136                                     &cp->addr.bdaddr, cp->addr.type);
5137                 }
5138
5139                 goto unlock;
5140         }
5141
5142         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5143                                         le_addr_type(cp->addr.type));
5144         if (!params) {
5145                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5146                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5147                 goto unlock;
5148         }
5149
5150         supported_flags = get_params_flags(hdev, params);
5151
5152         if ((supported_flags | current_flags) != supported_flags) {
5153                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5154                             current_flags, supported_flags);
5155                 goto unlock;
5156         }
5157
5158         params->flags = current_flags;
5159         status = MGMT_STATUS_SUCCESS;
5160
5161         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5162          * has been set.
5163          */
5164         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5165                 hci_update_passive_scan(hdev);
5166
5167 unlock:
5168         hci_dev_unlock(hdev);
5169
5170 done:
5171         if (status == MGMT_STATUS_SUCCESS)
5172                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5173                                      supported_flags, current_flags);
5174
5175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5176                                  &cp->addr, sizeof(cp->addr));
5177 }
5178
5179 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5180                                    u16 handle)
5181 {
5182         struct mgmt_ev_adv_monitor_added ev;
5183
5184         ev.monitor_handle = cpu_to_le16(handle);
5185
5186         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5187 }
5188
5189 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5190 {
5191         struct mgmt_ev_adv_monitor_removed ev;
5192         struct mgmt_pending_cmd *cmd;
5193         struct sock *sk_skip = NULL;
5194         struct mgmt_cp_remove_adv_monitor *cp;
5195
5196         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5197         if (cmd) {
5198                 cp = cmd->param;
5199
5200                 if (cp->monitor_handle)
5201                         sk_skip = cmd->sk;
5202         }
5203
5204         ev.monitor_handle = cpu_to_le16(handle);
5205
5206         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5207 }
5208
5209 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5210                                  void *data, u16 len)
5211 {
5212         struct adv_monitor *monitor = NULL;
5213         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5214         int handle, err;
5215         size_t rp_size = 0;
5216         __u32 supported = 0;
5217         __u32 enabled = 0;
5218         __u16 num_handles = 0;
5219         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5220
5221         BT_DBG("request for %s", hdev->name);
5222
5223         hci_dev_lock(hdev);
5224
5225         if (msft_monitor_supported(hdev))
5226                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5227
5228         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5229                 handles[num_handles++] = monitor->handle;
5230
5231         hci_dev_unlock(hdev);
5232
5233         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5234         rp = kmalloc(rp_size, GFP_KERNEL);
5235         if (!rp)
5236                 return -ENOMEM;
5237
5238         /* All supported features are currently enabled */
5239         enabled = supported;
5240
5241         rp->supported_features = cpu_to_le32(supported);
5242         rp->enabled_features = cpu_to_le32(enabled);
5243         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5244         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5245         rp->num_handles = cpu_to_le16(num_handles);
5246         if (num_handles)
5247                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5248
5249         err = mgmt_cmd_complete(sk, hdev->id,
5250                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5251                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5252
5253         kfree(rp);
5254
5255         return err;
5256 }
5257
5258 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5259                                                    void *data, int status)
5260 {
5261         struct mgmt_rp_add_adv_patterns_monitor rp;
5262         struct mgmt_pending_cmd *cmd = data;
5263         struct adv_monitor *monitor = cmd->user_data;
5264
5265         hci_dev_lock(hdev);
5266
5267         rp.monitor_handle = cpu_to_le16(monitor->handle);
5268
5269         if (!status) {
5270                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5271                 hdev->adv_monitors_cnt++;
5272                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5273                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5274                 hci_update_passive_scan(hdev);
5275         }
5276
5277         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5278                           mgmt_status(status), &rp, sizeof(rp));
5279         mgmt_pending_remove(cmd);
5280
5281         hci_dev_unlock(hdev);
5282         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5283                    rp.monitor_handle, status);
5284 }
5285
5286 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5287 {
5288         struct mgmt_pending_cmd *cmd = data;
5289         struct adv_monitor *monitor = cmd->user_data;
5290
5291         return hci_add_adv_monitor(hdev, monitor);
5292 }
5293
5294 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5295                                       struct adv_monitor *m, u8 status,
5296                                       void *data, u16 len, u16 op)
5297 {
5298         struct mgmt_pending_cmd *cmd;
5299         int err;
5300
5301         hci_dev_lock(hdev);
5302
5303         if (status)
5304                 goto unlock;
5305
5306         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5307             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5308             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5309             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5310                 status = MGMT_STATUS_BUSY;
5311                 goto unlock;
5312         }
5313
5314         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5315         if (!cmd) {
5316                 status = MGMT_STATUS_NO_RESOURCES;
5317                 goto unlock;
5318         }
5319
5320         cmd->user_data = m;
5321         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5322                                  mgmt_add_adv_patterns_monitor_complete);
5323         if (err) {
5324                 if (err == -ENOMEM)
5325                         status = MGMT_STATUS_NO_RESOURCES;
5326                 else
5327                         status = MGMT_STATUS_FAILED;
5328
5329                 goto unlock;
5330         }
5331
5332         hci_dev_unlock(hdev);
5333
5334         return 0;
5335
5336 unlock:
5337         hci_free_adv_monitor(hdev, m);
5338         hci_dev_unlock(hdev);
5339         return mgmt_cmd_status(sk, hdev->id, op, status);
5340 }
5341
5342 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5343                                    struct mgmt_adv_rssi_thresholds *rssi)
5344 {
5345         if (rssi) {
5346                 m->rssi.low_threshold = rssi->low_threshold;
5347                 m->rssi.low_threshold_timeout =
5348                     __le16_to_cpu(rssi->low_threshold_timeout);
5349                 m->rssi.high_threshold = rssi->high_threshold;
5350                 m->rssi.high_threshold_timeout =
5351                     __le16_to_cpu(rssi->high_threshold_timeout);
5352                 m->rssi.sampling_period = rssi->sampling_period;
5353         } else {
5354                 /* Default values. These numbers are the least constricting
5355                  * parameters for MSFT API to work, so it behaves as if there
5356                  * are no rssi parameter to consider. May need to be changed
5357                  * if other API are to be supported.
5358                  */
5359                 m->rssi.low_threshold = -127;
5360                 m->rssi.low_threshold_timeout = 60;
5361                 m->rssi.high_threshold = -127;
5362                 m->rssi.high_threshold_timeout = 0;
5363                 m->rssi.sampling_period = 0;
5364         }
5365 }
5366
5367 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5368                                     struct mgmt_adv_pattern *patterns)
5369 {
5370         u8 offset = 0, length = 0;
5371         struct adv_pattern *p = NULL;
5372         int i;
5373
5374         for (i = 0; i < pattern_count; i++) {
5375                 offset = patterns[i].offset;
5376                 length = patterns[i].length;
5377                 if (offset >= HCI_MAX_AD_LENGTH ||
5378                     length > HCI_MAX_AD_LENGTH ||
5379                     (offset + length) > HCI_MAX_AD_LENGTH)
5380                         return MGMT_STATUS_INVALID_PARAMS;
5381
5382                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5383                 if (!p)
5384                         return MGMT_STATUS_NO_RESOURCES;
5385
5386                 p->ad_type = patterns[i].ad_type;
5387                 p->offset = patterns[i].offset;
5388                 p->length = patterns[i].length;
5389                 memcpy(p->value, patterns[i].value, p->length);
5390
5391                 INIT_LIST_HEAD(&p->list);
5392                 list_add(&p->list, &m->patterns);
5393         }
5394
5395         return MGMT_STATUS_SUCCESS;
5396 }
5397
5398 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5399                                     void *data, u16 len)
5400 {
5401         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5402         struct adv_monitor *m = NULL;
5403         u8 status = MGMT_STATUS_SUCCESS;
5404         size_t expected_size = sizeof(*cp);
5405
5406         BT_DBG("request for %s", hdev->name);
5407
5408         if (len <= sizeof(*cp)) {
5409                 status = MGMT_STATUS_INVALID_PARAMS;
5410                 goto done;
5411         }
5412
5413         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5414         if (len != expected_size) {
5415                 status = MGMT_STATUS_INVALID_PARAMS;
5416                 goto done;
5417         }
5418
5419         m = kzalloc(sizeof(*m), GFP_KERNEL);
5420         if (!m) {
5421                 status = MGMT_STATUS_NO_RESOURCES;
5422                 goto done;
5423         }
5424
5425         INIT_LIST_HEAD(&m->patterns);
5426
5427         parse_adv_monitor_rssi(m, NULL);
5428         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5429
5430 done:
5431         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5432                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5433 }
5434
5435 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5436                                          void *data, u16 len)
5437 {
5438         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5439         struct adv_monitor *m = NULL;
5440         u8 status = MGMT_STATUS_SUCCESS;
5441         size_t expected_size = sizeof(*cp);
5442
5443         BT_DBG("request for %s", hdev->name);
5444
5445         if (len <= sizeof(*cp)) {
5446                 status = MGMT_STATUS_INVALID_PARAMS;
5447                 goto done;
5448         }
5449
5450         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5451         if (len != expected_size) {
5452                 status = MGMT_STATUS_INVALID_PARAMS;
5453                 goto done;
5454         }
5455
5456         m = kzalloc(sizeof(*m), GFP_KERNEL);
5457         if (!m) {
5458                 status = MGMT_STATUS_NO_RESOURCES;
5459                 goto done;
5460         }
5461
5462         INIT_LIST_HEAD(&m->patterns);
5463
5464         parse_adv_monitor_rssi(m, &cp->rssi);
5465         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5466
5467 done:
5468         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5469                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5470 }
5471
5472 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5473                                              void *data, int status)
5474 {
5475         struct mgmt_rp_remove_adv_monitor rp;
5476         struct mgmt_pending_cmd *cmd = data;
5477         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5478
5479         hci_dev_lock(hdev);
5480
5481         rp.monitor_handle = cp->monitor_handle;
5482
5483         if (!status)
5484                 hci_update_passive_scan(hdev);
5485
5486         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5487                           mgmt_status(status), &rp, sizeof(rp));
5488         mgmt_pending_remove(cmd);
5489
5490         hci_dev_unlock(hdev);
5491         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5492                    rp.monitor_handle, status);
5493 }
5494
5495 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5496 {
5497         struct mgmt_pending_cmd *cmd = data;
5498         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5499         u16 handle = __le16_to_cpu(cp->monitor_handle);
5500
5501         if (!handle)
5502                 return hci_remove_all_adv_monitor(hdev);
5503
5504         return hci_remove_single_adv_monitor(hdev, handle);
5505 }
5506
5507 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5508                               void *data, u16 len)
5509 {
5510         struct mgmt_pending_cmd *cmd;
5511         int err, status;
5512
5513         hci_dev_lock(hdev);
5514
5515         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5516             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5517             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5518             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5519                 status = MGMT_STATUS_BUSY;
5520                 goto unlock;
5521         }
5522
5523         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5524         if (!cmd) {
5525                 status = MGMT_STATUS_NO_RESOURCES;
5526                 goto unlock;
5527         }
5528
5529         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5530                                  mgmt_remove_adv_monitor_complete);
5531
5532         if (err) {
5533                 mgmt_pending_remove(cmd);
5534
5535                 if (err == -ENOMEM)
5536                         status = MGMT_STATUS_NO_RESOURCES;
5537                 else
5538                         status = MGMT_STATUS_FAILED;
5539
5540                 goto unlock;
5541         }
5542
5543         hci_dev_unlock(hdev);
5544
5545         return 0;
5546
5547 unlock:
5548         hci_dev_unlock(hdev);
5549         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5550                                status);
5551 }
5552
5553 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5554 {
5555         struct mgmt_rp_read_local_oob_data mgmt_rp;
5556         size_t rp_size = sizeof(mgmt_rp);
5557         struct mgmt_pending_cmd *cmd = data;
5558         struct sk_buff *skb = cmd->skb;
5559         u8 status = mgmt_status(err);
5560
5561         if (!status) {
5562                 if (!skb)
5563                         status = MGMT_STATUS_FAILED;
5564                 else if (IS_ERR(skb))
5565                         status = mgmt_status(PTR_ERR(skb));
5566                 else
5567                         status = mgmt_status(skb->data[0]);
5568         }
5569
5570         bt_dev_dbg(hdev, "status %d", status);
5571
5572         if (status) {
5573                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5574                 goto remove;
5575         }
5576
5577         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5578
5579         if (!bredr_sc_enabled(hdev)) {
5580                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5581
5582                 if (skb->len < sizeof(*rp)) {
5583                         mgmt_cmd_status(cmd->sk, hdev->id,
5584                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5585                                         MGMT_STATUS_FAILED);
5586                         goto remove;
5587                 }
5588
5589                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5590                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5591
5592                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5593         } else {
5594                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5595
5596                 if (skb->len < sizeof(*rp)) {
5597                         mgmt_cmd_status(cmd->sk, hdev->id,
5598                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5599                                         MGMT_STATUS_FAILED);
5600                         goto remove;
5601                 }
5602
5603                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5604                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5605
5606                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5607                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5608         }
5609
5610         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5611                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5612
5613 remove:
5614         if (skb && !IS_ERR(skb))
5615                 kfree_skb(skb);
5616
5617         mgmt_pending_free(cmd);
5618 }
5619
5620 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5621 {
5622         struct mgmt_pending_cmd *cmd = data;
5623
5624         if (bredr_sc_enabled(hdev))
5625                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5626         else
5627                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5628
5629         if (IS_ERR(cmd->skb))
5630                 return PTR_ERR(cmd->skb);
5631         else
5632                 return 0;
5633 }
5634
5635 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5636                                void *data, u16 data_len)
5637 {
5638         struct mgmt_pending_cmd *cmd;
5639         int err;
5640
5641         bt_dev_dbg(hdev, "sock %p", sk);
5642
5643         hci_dev_lock(hdev);
5644
5645         if (!hdev_is_powered(hdev)) {
5646                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5647                                       MGMT_STATUS_NOT_POWERED);
5648                 goto unlock;
5649         }
5650
5651         if (!lmp_ssp_capable(hdev)) {
5652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5653                                       MGMT_STATUS_NOT_SUPPORTED);
5654                 goto unlock;
5655         }
5656
5657         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5658         if (!cmd)
5659                 err = -ENOMEM;
5660         else
5661                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5662                                          read_local_oob_data_complete);
5663
5664         if (err < 0) {
5665                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5666                                       MGMT_STATUS_FAILED);
5667
5668                 if (cmd)
5669                         mgmt_pending_free(cmd);
5670         }
5671
5672 unlock:
5673         hci_dev_unlock(hdev);
5674         return err;
5675 }
5676
5677 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5678                                void *data, u16 len)
5679 {
5680         struct mgmt_addr_info *addr = data;
5681         int err;
5682
5683         bt_dev_dbg(hdev, "sock %p", sk);
5684
5685         if (!bdaddr_type_is_valid(addr->type))
5686                 return mgmt_cmd_complete(sk, hdev->id,
5687                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5688                                          MGMT_STATUS_INVALID_PARAMS,
5689                                          addr, sizeof(*addr));
5690
5691         hci_dev_lock(hdev);
5692
5693         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5694                 struct mgmt_cp_add_remote_oob_data *cp = data;
5695                 u8 status;
5696
5697                 if (cp->addr.type != BDADDR_BREDR) {
5698                         err = mgmt_cmd_complete(sk, hdev->id,
5699                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5700                                                 MGMT_STATUS_INVALID_PARAMS,
5701                                                 &cp->addr, sizeof(cp->addr));
5702                         goto unlock;
5703                 }
5704
5705                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5706                                               cp->addr.type, cp->hash,
5707                                               cp->rand, NULL, NULL);
5708                 if (err < 0)
5709                         status = MGMT_STATUS_FAILED;
5710                 else
5711                         status = MGMT_STATUS_SUCCESS;
5712
5713                 err = mgmt_cmd_complete(sk, hdev->id,
5714                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5715                                         &cp->addr, sizeof(cp->addr));
5716         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5717                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5718                 u8 *rand192, *hash192, *rand256, *hash256;
5719                 u8 status;
5720
5721                 if (bdaddr_type_is_le(cp->addr.type)) {
5722                         /* Enforce zero-valued 192-bit parameters as
5723                          * long as legacy SMP OOB isn't implemented.
5724                          */
5725                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5726                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5727                                 err = mgmt_cmd_complete(sk, hdev->id,
5728                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5729                                                         MGMT_STATUS_INVALID_PARAMS,
5730                                                         addr, sizeof(*addr));
5731                                 goto unlock;
5732                         }
5733
5734                         rand192 = NULL;
5735                         hash192 = NULL;
5736                 } else {
5737                         /* In case one of the P-192 values is set to zero,
5738                          * then just disable OOB data for P-192.
5739                          */
5740                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5741                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5742                                 rand192 = NULL;
5743                                 hash192 = NULL;
5744                         } else {
5745                                 rand192 = cp->rand192;
5746                                 hash192 = cp->hash192;
5747                         }
5748                 }
5749
5750                 /* In case one of the P-256 values is set to zero, then just
5751                  * disable OOB data for P-256.
5752                  */
5753                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5754                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5755                         rand256 = NULL;
5756                         hash256 = NULL;
5757                 } else {
5758                         rand256 = cp->rand256;
5759                         hash256 = cp->hash256;
5760                 }
5761
5762                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5763                                               cp->addr.type, hash192, rand192,
5764                                               hash256, rand256);
5765                 if (err < 0)
5766                         status = MGMT_STATUS_FAILED;
5767                 else
5768                         status = MGMT_STATUS_SUCCESS;
5769
5770                 err = mgmt_cmd_complete(sk, hdev->id,
5771                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5772                                         status, &cp->addr, sizeof(cp->addr));
5773         } else {
5774                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5775                            len);
5776                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5777                                       MGMT_STATUS_INVALID_PARAMS);
5778         }
5779
5780 unlock:
5781         hci_dev_unlock(hdev);
5782         return err;
5783 }
5784
5785 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5786                                   void *data, u16 len)
5787 {
5788         struct mgmt_cp_remove_remote_oob_data *cp = data;
5789         u8 status;
5790         int err;
5791
5792         bt_dev_dbg(hdev, "sock %p", sk);
5793
5794         if (cp->addr.type != BDADDR_BREDR)
5795                 return mgmt_cmd_complete(sk, hdev->id,
5796                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5797                                          MGMT_STATUS_INVALID_PARAMS,
5798                                          &cp->addr, sizeof(cp->addr));
5799
5800         hci_dev_lock(hdev);
5801
5802         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5803                 hci_remote_oob_data_clear(hdev);
5804                 status = MGMT_STATUS_SUCCESS;
5805                 goto done;
5806         }
5807
5808         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5809         if (err < 0)
5810                 status = MGMT_STATUS_INVALID_PARAMS;
5811         else
5812                 status = MGMT_STATUS_SUCCESS;
5813
5814 done:
5815         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5816                                 status, &cp->addr, sizeof(cp->addr));
5817
5818         hci_dev_unlock(hdev);
5819         return err;
5820 }
5821
5822 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5823 {
5824         struct mgmt_pending_cmd *cmd;
5825
5826         bt_dev_dbg(hdev, "status %u", status);
5827
5828         hci_dev_lock(hdev);
5829
5830         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5831         if (!cmd)
5832                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5833
5834         if (!cmd)
5835                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5836
5837         if (cmd) {
5838                 cmd->cmd_complete(cmd, mgmt_status(status));
5839                 mgmt_pending_remove(cmd);
5840         }
5841
5842         hci_dev_unlock(hdev);
5843 }
5844
5845 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5846                                     uint8_t *mgmt_status)
5847 {
5848         switch (type) {
5849         case DISCOV_TYPE_LE:
5850                 *mgmt_status = mgmt_le_support(hdev);
5851                 if (*mgmt_status)
5852                         return false;
5853                 break;
5854         case DISCOV_TYPE_INTERLEAVED:
5855                 *mgmt_status = mgmt_le_support(hdev);
5856                 if (*mgmt_status)
5857                         return false;
5858                 fallthrough;
5859         case DISCOV_TYPE_BREDR:
5860                 *mgmt_status = mgmt_bredr_support(hdev);
5861                 if (*mgmt_status)
5862                         return false;
5863                 break;
5864         default:
5865                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5866                 return false;
5867         }
5868
5869         return true;
5870 }
5871
5872 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5873 {
5874         struct mgmt_pending_cmd *cmd = data;
5875
5876         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5877             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5878             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5879                 return;
5880
5881         bt_dev_dbg(hdev, "err %d", err);
5882
5883         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5884                           cmd->param, 1);
5885         mgmt_pending_remove(cmd);
5886
5887         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5888                                 DISCOVERY_FINDING);
5889 }
5890
5891 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5892 {
5893         return hci_start_discovery_sync(hdev);
5894 }
5895
5896 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5897                                     u16 op, void *data, u16 len)
5898 {
5899         struct mgmt_cp_start_discovery *cp = data;
5900         struct mgmt_pending_cmd *cmd;
5901         u8 status;
5902         int err;
5903
5904         bt_dev_dbg(hdev, "sock %p", sk);
5905
5906         hci_dev_lock(hdev);
5907
5908         if (!hdev_is_powered(hdev)) {
5909                 err = mgmt_cmd_complete(sk, hdev->id, op,
5910                                         MGMT_STATUS_NOT_POWERED,
5911                                         &cp->type, sizeof(cp->type));
5912                 goto failed;
5913         }
5914
5915         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5916             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5917                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5918                                         &cp->type, sizeof(cp->type));
5919                 goto failed;
5920         }
5921
5922         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5923                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5924                                         &cp->type, sizeof(cp->type));
5925                 goto failed;
5926         }
5927
5928         /* Can't start discovery when it is paused */
5929         if (hdev->discovery_paused) {
5930                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5931                                         &cp->type, sizeof(cp->type));
5932                 goto failed;
5933         }
5934
5935         /* Clear the discovery filter first to free any previously
5936          * allocated memory for the UUID list.
5937          */
5938         hci_discovery_filter_clear(hdev);
5939
5940         hdev->discovery.type = cp->type;
5941         hdev->discovery.report_invalid_rssi = false;
5942         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5943                 hdev->discovery.limited = true;
5944         else
5945                 hdev->discovery.limited = false;
5946
5947         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5948         if (!cmd) {
5949                 err = -ENOMEM;
5950                 goto failed;
5951         }
5952
5953         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5954                                  start_discovery_complete);
5955         if (err < 0) {
5956                 mgmt_pending_remove(cmd);
5957                 goto failed;
5958         }
5959
5960         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5961
5962 failed:
5963         hci_dev_unlock(hdev);
5964         return err;
5965 }
5966
5967 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5968                            void *data, u16 len)
5969 {
5970         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5971                                         data, len);
5972 }
5973
5974 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5975                                    void *data, u16 len)
5976 {
5977         return start_discovery_internal(sk, hdev,
5978                                         MGMT_OP_START_LIMITED_DISCOVERY,
5979                                         data, len);
5980 }
5981
5982 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5983                                    void *data, u16 len)
5984 {
5985         struct mgmt_cp_start_service_discovery *cp = data;
5986         struct mgmt_pending_cmd *cmd;
5987         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5988         u16 uuid_count, expected_len;
5989         u8 status;
5990         int err;
5991
5992         bt_dev_dbg(hdev, "sock %p", sk);
5993
5994         hci_dev_lock(hdev);
5995
5996         if (!hdev_is_powered(hdev)) {
5997                 err = mgmt_cmd_complete(sk, hdev->id,
5998                                         MGMT_OP_START_SERVICE_DISCOVERY,
5999                                         MGMT_STATUS_NOT_POWERED,
6000                                         &cp->type, sizeof(cp->type));
6001                 goto failed;
6002         }
6003
6004         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6005             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6006                 err = mgmt_cmd_complete(sk, hdev->id,
6007                                         MGMT_OP_START_SERVICE_DISCOVERY,
6008                                         MGMT_STATUS_BUSY, &cp->type,
6009                                         sizeof(cp->type));
6010                 goto failed;
6011         }
6012
6013         if (hdev->discovery_paused) {
6014                 err = mgmt_cmd_complete(sk, hdev->id,
6015                                         MGMT_OP_START_SERVICE_DISCOVERY,
6016                                         MGMT_STATUS_BUSY, &cp->type,
6017                                         sizeof(cp->type));
6018                 goto failed;
6019         }
6020
6021         uuid_count = __le16_to_cpu(cp->uuid_count);
6022         if (uuid_count > max_uuid_count) {
6023                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6024                            uuid_count);
6025                 err = mgmt_cmd_complete(sk, hdev->id,
6026                                         MGMT_OP_START_SERVICE_DISCOVERY,
6027                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6028                                         sizeof(cp->type));
6029                 goto failed;
6030         }
6031
6032         expected_len = sizeof(*cp) + uuid_count * 16;
6033         if (expected_len != len) {
6034                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6035                            expected_len, len);
6036                 err = mgmt_cmd_complete(sk, hdev->id,
6037                                         MGMT_OP_START_SERVICE_DISCOVERY,
6038                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6039                                         sizeof(cp->type));
6040                 goto failed;
6041         }
6042
6043         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6044                 err = mgmt_cmd_complete(sk, hdev->id,
6045                                         MGMT_OP_START_SERVICE_DISCOVERY,
6046                                         status, &cp->type, sizeof(cp->type));
6047                 goto failed;
6048         }
6049
6050         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6051                                hdev, data, len);
6052         if (!cmd) {
6053                 err = -ENOMEM;
6054                 goto failed;
6055         }
6056
6057         /* Clear the discovery filter first to free any previously
6058          * allocated memory for the UUID list.
6059          */
6060         hci_discovery_filter_clear(hdev);
6061
6062         hdev->discovery.result_filtering = true;
6063         hdev->discovery.type = cp->type;
6064         hdev->discovery.rssi = cp->rssi;
6065         hdev->discovery.uuid_count = uuid_count;
6066
6067         if (uuid_count > 0) {
6068                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6069                                                 GFP_KERNEL);
6070                 if (!hdev->discovery.uuids) {
6071                         err = mgmt_cmd_complete(sk, hdev->id,
6072                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6073                                                 MGMT_STATUS_FAILED,
6074                                                 &cp->type, sizeof(cp->type));
6075                         mgmt_pending_remove(cmd);
6076                         goto failed;
6077                 }
6078         }
6079
6080         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6081                                  start_discovery_complete);
6082         if (err < 0) {
6083                 mgmt_pending_remove(cmd);
6084                 goto failed;
6085         }
6086
6087         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6088
6089 failed:
6090         hci_dev_unlock(hdev);
6091         return err;
6092 }
6093
6094 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6095 {
6096         struct mgmt_pending_cmd *cmd;
6097
6098         bt_dev_dbg(hdev, "status %u", status);
6099
6100         hci_dev_lock(hdev);
6101
6102         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6103         if (cmd) {
6104                 cmd->cmd_complete(cmd, mgmt_status(status));
6105                 mgmt_pending_remove(cmd);
6106         }
6107
6108         hci_dev_unlock(hdev);
6109 }
6110
6111 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6112 {
6113         struct mgmt_pending_cmd *cmd = data;
6114
6115         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6116                 return;
6117
6118         bt_dev_dbg(hdev, "err %d", err);
6119
6120         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6121                           cmd->param, 1);
6122         mgmt_pending_remove(cmd);
6123
6124         if (!err)
6125                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6126 }
6127
6128 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6129 {
6130         return hci_stop_discovery_sync(hdev);
6131 }
6132
6133 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6134                           u16 len)
6135 {
6136         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6137         struct mgmt_pending_cmd *cmd;
6138         int err;
6139
6140         bt_dev_dbg(hdev, "sock %p", sk);
6141
6142         hci_dev_lock(hdev);
6143
6144         if (!hci_discovery_active(hdev)) {
6145                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6146                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6147                                         sizeof(mgmt_cp->type));
6148                 goto unlock;
6149         }
6150
6151         if (hdev->discovery.type != mgmt_cp->type) {
6152                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6153                                         MGMT_STATUS_INVALID_PARAMS,
6154                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6155                 goto unlock;
6156         }
6157
6158         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6159         if (!cmd) {
6160                 err = -ENOMEM;
6161                 goto unlock;
6162         }
6163
6164         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6165                                  stop_discovery_complete);
6166         if (err < 0) {
6167                 mgmt_pending_remove(cmd);
6168                 goto unlock;
6169         }
6170
6171         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6172
6173 unlock:
6174         hci_dev_unlock(hdev);
6175         return err;
6176 }
6177
6178 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6179                         u16 len)
6180 {
6181         struct mgmt_cp_confirm_name *cp = data;
6182         struct inquiry_entry *e;
6183         int err;
6184
6185         bt_dev_dbg(hdev, "sock %p", sk);
6186
6187         hci_dev_lock(hdev);
6188
6189         if (!hci_discovery_active(hdev)) {
6190                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6191                                         MGMT_STATUS_FAILED, &cp->addr,
6192                                         sizeof(cp->addr));
6193                 goto failed;
6194         }
6195
6196         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6197         if (!e) {
6198                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6199                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6200                                         sizeof(cp->addr));
6201                 goto failed;
6202         }
6203
6204         if (cp->name_known) {
6205                 e->name_state = NAME_KNOWN;
6206                 list_del(&e->list);
6207         } else {
6208                 e->name_state = NAME_NEEDED;
6209                 hci_inquiry_cache_update_resolve(hdev, e);
6210         }
6211
6212         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6213                                 &cp->addr, sizeof(cp->addr));
6214
6215 failed:
6216         hci_dev_unlock(hdev);
6217         return err;
6218 }
6219
6220 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6221                         u16 len)
6222 {
6223         struct mgmt_cp_block_device *cp = data;
6224         u8 status;
6225         int err;
6226
6227         bt_dev_dbg(hdev, "sock %p", sk);
6228
6229         if (!bdaddr_type_is_valid(cp->addr.type))
6230                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6231                                          MGMT_STATUS_INVALID_PARAMS,
6232                                          &cp->addr, sizeof(cp->addr));
6233
6234         hci_dev_lock(hdev);
6235
6236         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6237                                   cp->addr.type);
6238         if (err < 0) {
6239                 status = MGMT_STATUS_FAILED;
6240                 goto done;
6241         }
6242
6243         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6244                    sk);
6245         status = MGMT_STATUS_SUCCESS;
6246
6247 done:
6248         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6249                                 &cp->addr, sizeof(cp->addr));
6250
6251         hci_dev_unlock(hdev);
6252
6253         return err;
6254 }
6255
6256 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6257                           u16 len)
6258 {
6259         struct mgmt_cp_unblock_device *cp = data;
6260         u8 status;
6261         int err;
6262
6263         bt_dev_dbg(hdev, "sock %p", sk);
6264
6265         if (!bdaddr_type_is_valid(cp->addr.type))
6266                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6267                                          MGMT_STATUS_INVALID_PARAMS,
6268                                          &cp->addr, sizeof(cp->addr));
6269
6270         hci_dev_lock(hdev);
6271
6272         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6273                                   cp->addr.type);
6274         if (err < 0) {
6275                 status = MGMT_STATUS_INVALID_PARAMS;
6276                 goto done;
6277         }
6278
6279         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6280                    sk);
6281         status = MGMT_STATUS_SUCCESS;
6282
6283 done:
6284         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6285                                 &cp->addr, sizeof(cp->addr));
6286
6287         hci_dev_unlock(hdev);
6288
6289         return err;
6290 }
6291
6292 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6293 {
6294         return hci_update_eir_sync(hdev);
6295 }
6296
6297 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6298                          u16 len)
6299 {
6300         struct mgmt_cp_set_device_id *cp = data;
6301         int err;
6302         __u16 source;
6303
6304         bt_dev_dbg(hdev, "sock %p", sk);
6305
6306         source = __le16_to_cpu(cp->source);
6307
6308         if (source > 0x0002)
6309                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6310                                        MGMT_STATUS_INVALID_PARAMS);
6311
6312         hci_dev_lock(hdev);
6313
6314         hdev->devid_source = source;
6315         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6316         hdev->devid_product = __le16_to_cpu(cp->product);
6317         hdev->devid_version = __le16_to_cpu(cp->version);
6318
6319         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6320                                 NULL, 0);
6321
6322         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6323
6324         hci_dev_unlock(hdev);
6325
6326         return err;
6327 }
6328
6329 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6330 {
6331         if (err)
6332                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6333         else
6334                 bt_dev_dbg(hdev, "status %d", err);
6335 }
6336
6337 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6338 {
6339         struct cmd_lookup match = { NULL, hdev };
6340         u8 instance;
6341         struct adv_info *adv_instance;
6342         u8 status = mgmt_status(err);
6343
6344         if (status) {
6345                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6346                                      cmd_status_rsp, &status);
6347                 return;
6348         }
6349
6350         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6351                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6352         else
6353                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6354
6355         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6356                              &match);
6357
6358         new_settings(hdev, match.sk);
6359
6360         if (match.sk)
6361                 sock_put(match.sk);
6362
6363         /* If "Set Advertising" was just disabled and instance advertising was
6364          * set up earlier, then re-enable multi-instance advertising.
6365          */
6366         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6367             list_empty(&hdev->adv_instances))
6368                 return;
6369
6370         instance = hdev->cur_adv_instance;
6371         if (!instance) {
6372                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6373                                                         struct adv_info, list);
6374                 if (!adv_instance)
6375                         return;
6376
6377                 instance = adv_instance->instance;
6378         }
6379
6380         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6381
6382         enable_advertising_instance(hdev, err);
6383 }
6384
6385 static int set_adv_sync(struct hci_dev *hdev, void *data)
6386 {
6387         struct mgmt_pending_cmd *cmd = data;
6388         struct mgmt_mode *cp = cmd->param;
6389         u8 val = !!cp->val;
6390
6391         if (cp->val == 0x02)
6392                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6393         else
6394                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6395
6396         cancel_adv_timeout(hdev);
6397
6398         if (val) {
6399                 /* Switch to instance "0" for the Set Advertising setting.
6400                  * We cannot use update_[adv|scan_rsp]_data() here as the
6401                  * HCI_ADVERTISING flag is not yet set.
6402                  */
6403                 hdev->cur_adv_instance = 0x00;
6404
6405                 if (ext_adv_capable(hdev)) {
6406                         hci_start_ext_adv_sync(hdev, 0x00);
6407                 } else {
6408                         hci_update_adv_data_sync(hdev, 0x00);
6409                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6410                         hci_enable_advertising_sync(hdev);
6411                 }
6412         } else {
6413                 hci_disable_advertising_sync(hdev);
6414         }
6415
6416         return 0;
6417 }
6418
6419 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6420                            u16 len)
6421 {
6422         struct mgmt_mode *cp = data;
6423         struct mgmt_pending_cmd *cmd;
6424         u8 val, status;
6425         int err;
6426
6427         bt_dev_dbg(hdev, "sock %p", sk);
6428
6429         status = mgmt_le_support(hdev);
6430         if (status)
6431                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6432                                        status);
6433
6434         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6436                                        MGMT_STATUS_INVALID_PARAMS);
6437
6438         if (hdev->advertising_paused)
6439                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6440                                        MGMT_STATUS_BUSY);
6441
6442         hci_dev_lock(hdev);
6443
6444         val = !!cp->val;
6445
6446         /* The following conditions are ones which mean that we should
6447          * not do any HCI communication but directly send a mgmt
6448          * response to user space (after toggling the flag if
6449          * necessary).
6450          */
6451         if (!hdev_is_powered(hdev) ||
6452             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6453              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6454             hci_dev_test_flag(hdev, HCI_MESH) ||
6455             hci_conn_num(hdev, LE_LINK) > 0 ||
6456             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6457              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6458                 bool changed;
6459
6460                 if (cp->val) {
6461                         hdev->cur_adv_instance = 0x00;
6462                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6463                         if (cp->val == 0x02)
6464                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6465                         else
6466                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6467                 } else {
6468                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6469                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6470                 }
6471
6472                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6473                 if (err < 0)
6474                         goto unlock;
6475
6476                 if (changed)
6477                         err = new_settings(hdev, sk);
6478
6479                 goto unlock;
6480         }
6481
6482         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6483             pending_find(MGMT_OP_SET_LE, hdev)) {
6484                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6485                                       MGMT_STATUS_BUSY);
6486                 goto unlock;
6487         }
6488
6489         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6490         if (!cmd)
6491                 err = -ENOMEM;
6492         else
6493                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6494                                          set_advertising_complete);
6495
6496         if (err < 0 && cmd)
6497                 mgmt_pending_remove(cmd);
6498
6499 unlock:
6500         hci_dev_unlock(hdev);
6501         return err;
6502 }
6503
6504 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6505                               void *data, u16 len)
6506 {
6507         struct mgmt_cp_set_static_address *cp = data;
6508         int err;
6509
6510         bt_dev_dbg(hdev, "sock %p", sk);
6511
6512         if (!lmp_le_capable(hdev))
6513                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6514                                        MGMT_STATUS_NOT_SUPPORTED);
6515
6516         if (hdev_is_powered(hdev))
6517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6518                                        MGMT_STATUS_REJECTED);
6519
6520         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6521                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6522                         return mgmt_cmd_status(sk, hdev->id,
6523                                                MGMT_OP_SET_STATIC_ADDRESS,
6524                                                MGMT_STATUS_INVALID_PARAMS);
6525
6526                 /* Two most significant bits shall be set */
6527                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6528                         return mgmt_cmd_status(sk, hdev->id,
6529                                                MGMT_OP_SET_STATIC_ADDRESS,
6530                                                MGMT_STATUS_INVALID_PARAMS);
6531         }
6532
6533         hci_dev_lock(hdev);
6534
6535         bacpy(&hdev->static_addr, &cp->bdaddr);
6536
6537         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6538         if (err < 0)
6539                 goto unlock;
6540
6541         err = new_settings(hdev, sk);
6542
6543 unlock:
6544         hci_dev_unlock(hdev);
6545         return err;
6546 }
6547
6548 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6549                            void *data, u16 len)
6550 {
6551         struct mgmt_cp_set_scan_params *cp = data;
6552         __u16 interval, window;
6553         int err;
6554
6555         bt_dev_dbg(hdev, "sock %p", sk);
6556
6557         if (!lmp_le_capable(hdev))
6558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6559                                        MGMT_STATUS_NOT_SUPPORTED);
6560
6561         interval = __le16_to_cpu(cp->interval);
6562
6563         if (interval < 0x0004 || interval > 0x4000)
6564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6565                                        MGMT_STATUS_INVALID_PARAMS);
6566
6567         window = __le16_to_cpu(cp->window);
6568
6569         if (window < 0x0004 || window > 0x4000)
6570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6571                                        MGMT_STATUS_INVALID_PARAMS);
6572
6573         if (window > interval)
6574                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6575                                        MGMT_STATUS_INVALID_PARAMS);
6576
6577         hci_dev_lock(hdev);
6578
6579         hdev->le_scan_interval = interval;
6580         hdev->le_scan_window = window;
6581
6582         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6583                                 NULL, 0);
6584
6585         /* If background scan is running, restart it so new parameters are
6586          * loaded.
6587          */
6588         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6589             hdev->discovery.state == DISCOVERY_STOPPED)
6590                 hci_update_passive_scan(hdev);
6591
6592         hci_dev_unlock(hdev);
6593
6594         return err;
6595 }
6596
6597 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6598 {
6599         struct mgmt_pending_cmd *cmd = data;
6600
6601         bt_dev_dbg(hdev, "err %d", err);
6602
6603         if (err) {
6604                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6605                                 mgmt_status(err));
6606         } else {
6607                 struct mgmt_mode *cp = cmd->param;
6608
6609                 if (cp->val)
6610                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6611                 else
6612                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6613
6614                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6615                 new_settings(hdev, cmd->sk);
6616         }
6617
6618         mgmt_pending_free(cmd);
6619 }
6620
6621 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6622 {
6623         struct mgmt_pending_cmd *cmd = data;
6624         struct mgmt_mode *cp = cmd->param;
6625
6626         return hci_write_fast_connectable_sync(hdev, cp->val);
6627 }
6628
6629 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6630                                 void *data, u16 len)
6631 {
6632         struct mgmt_mode *cp = data;
6633         struct mgmt_pending_cmd *cmd;
6634         int err;
6635
6636         bt_dev_dbg(hdev, "sock %p", sk);
6637
6638         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6639             hdev->hci_ver < BLUETOOTH_VER_1_2)
6640                 return mgmt_cmd_status(sk, hdev->id,
6641                                        MGMT_OP_SET_FAST_CONNECTABLE,
6642                                        MGMT_STATUS_NOT_SUPPORTED);
6643
6644         if (cp->val != 0x00 && cp->val != 0x01)
6645                 return mgmt_cmd_status(sk, hdev->id,
6646                                        MGMT_OP_SET_FAST_CONNECTABLE,
6647                                        MGMT_STATUS_INVALID_PARAMS);
6648
6649         hci_dev_lock(hdev);
6650
6651         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6652                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6653                 goto unlock;
6654         }
6655
6656         if (!hdev_is_powered(hdev)) {
6657                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6658                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6659                 new_settings(hdev, sk);
6660                 goto unlock;
6661         }
6662
6663         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6664                                len);
6665         if (!cmd)
6666                 err = -ENOMEM;
6667         else
6668                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6669                                          fast_connectable_complete);
6670
6671         if (err < 0) {
6672                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6673                                 MGMT_STATUS_FAILED);
6674
6675                 if (cmd)
6676                         mgmt_pending_free(cmd);
6677         }
6678
6679 unlock:
6680         hci_dev_unlock(hdev);
6681
6682         return err;
6683 }
6684
6685 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6686 {
6687         struct mgmt_pending_cmd *cmd = data;
6688
6689         bt_dev_dbg(hdev, "err %d", err);
6690
6691         if (err) {
6692                 u8 mgmt_err = mgmt_status(err);
6693
6694                 /* We need to restore the flag if related HCI commands
6695                  * failed.
6696                  */
6697                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6698
6699                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6700         } else {
6701                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6702                 new_settings(hdev, cmd->sk);
6703         }
6704
6705         mgmt_pending_free(cmd);
6706 }
6707
6708 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6709 {
6710         int status;
6711
6712         status = hci_write_fast_connectable_sync(hdev, false);
6713
6714         if (!status)
6715                 status = hci_update_scan_sync(hdev);
6716
6717         /* Since only the advertising data flags will change, there
6718          * is no need to update the scan response data.
6719          */
6720         if (!status)
6721                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6722
6723         return status;
6724 }
6725
6726 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6727 {
6728         struct mgmt_mode *cp = data;
6729         struct mgmt_pending_cmd *cmd;
6730         int err;
6731
6732         bt_dev_dbg(hdev, "sock %p", sk);
6733
6734         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6735                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6736                                        MGMT_STATUS_NOT_SUPPORTED);
6737
6738         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6740                                        MGMT_STATUS_REJECTED);
6741
6742         if (cp->val != 0x00 && cp->val != 0x01)
6743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6744                                        MGMT_STATUS_INVALID_PARAMS);
6745
6746         hci_dev_lock(hdev);
6747
6748         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6749                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6750                 goto unlock;
6751         }
6752
6753         if (!hdev_is_powered(hdev)) {
6754                 if (!cp->val) {
6755                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6756                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6757                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6758                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6759                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6760                 }
6761
6762                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6763
6764                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6765                 if (err < 0)
6766                         goto unlock;
6767
6768                 err = new_settings(hdev, sk);
6769                 goto unlock;
6770         }
6771
6772         /* Reject disabling when powered on */
6773         if (!cp->val) {
6774                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6775                                       MGMT_STATUS_REJECTED);
6776                 goto unlock;
6777         } else {
6778                 /* When configuring a dual-mode controller to operate
6779                  * with LE only and using a static address, then switching
6780                  * BR/EDR back on is not allowed.
6781                  *
6782                  * Dual-mode controllers shall operate with the public
6783                  * address as its identity address for BR/EDR and LE. So
6784                  * reject the attempt to create an invalid configuration.
6785                  *
6786                  * The same restrictions applies when secure connections
6787                  * has been enabled. For BR/EDR this is a controller feature
6788                  * while for LE it is a host stack feature. This means that
6789                  * switching BR/EDR back on when secure connections has been
6790                  * enabled is not a supported transaction.
6791                  */
6792                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6793                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6794                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6795                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6796                                               MGMT_STATUS_REJECTED);
6797                         goto unlock;
6798                 }
6799         }
6800
6801         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6802         if (!cmd)
6803                 err = -ENOMEM;
6804         else
6805                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6806                                          set_bredr_complete);
6807
6808         if (err < 0) {
6809                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6810                                 MGMT_STATUS_FAILED);
6811                 if (cmd)
6812                         mgmt_pending_free(cmd);
6813
6814                 goto unlock;
6815         }
6816
6817         /* We need to flip the bit already here so that
6818          * hci_req_update_adv_data generates the correct flags.
6819          */
6820         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6821
6822 unlock:
6823         hci_dev_unlock(hdev);
6824         return err;
6825 }
6826
6827 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6828 {
6829         struct mgmt_pending_cmd *cmd = data;
6830         struct mgmt_mode *cp;
6831
6832         bt_dev_dbg(hdev, "err %d", err);
6833
6834         if (err) {
6835                 u8 mgmt_err = mgmt_status(err);
6836
6837                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6838                 goto done;
6839         }
6840
6841         cp = cmd->param;
6842
6843         switch (cp->val) {
6844         case 0x00:
6845                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6846                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6847                 break;
6848         case 0x01:
6849                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6850                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6851                 break;
6852         case 0x02:
6853                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6854                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6855                 break;
6856         }
6857
6858         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6859         new_settings(hdev, cmd->sk);
6860
6861 done:
6862         mgmt_pending_free(cmd);
6863 }
6864
6865 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6866 {
6867         struct mgmt_pending_cmd *cmd = data;
6868         struct mgmt_mode *cp = cmd->param;
6869         u8 val = !!cp->val;
6870
6871         /* Force write of val */
6872         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6873
6874         return hci_write_sc_support_sync(hdev, val);
6875 }
6876
6877 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6878                            void *data, u16 len)
6879 {
6880         struct mgmt_mode *cp = data;
6881         struct mgmt_pending_cmd *cmd;
6882         u8 val;
6883         int err;
6884
6885         bt_dev_dbg(hdev, "sock %p", sk);
6886
6887         if (!lmp_sc_capable(hdev) &&
6888             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6890                                        MGMT_STATUS_NOT_SUPPORTED);
6891
6892         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6893             lmp_sc_capable(hdev) &&
6894             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6895                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6896                                        MGMT_STATUS_REJECTED);
6897
6898         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6900                                        MGMT_STATUS_INVALID_PARAMS);
6901
6902         hci_dev_lock(hdev);
6903
6904         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6905             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6906                 bool changed;
6907
6908                 if (cp->val) {
6909                         changed = !hci_dev_test_and_set_flag(hdev,
6910                                                              HCI_SC_ENABLED);
6911                         if (cp->val == 0x02)
6912                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6913                         else
6914                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6915                 } else {
6916                         changed = hci_dev_test_and_clear_flag(hdev,
6917                                                               HCI_SC_ENABLED);
6918                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6919                 }
6920
6921                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6922                 if (err < 0)
6923                         goto failed;
6924
6925                 if (changed)
6926                         err = new_settings(hdev, sk);
6927
6928                 goto failed;
6929         }
6930
6931         val = !!cp->val;
6932
6933         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6934             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6935                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6936                 goto failed;
6937         }
6938
6939         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6940         if (!cmd)
6941                 err = -ENOMEM;
6942         else
6943                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6944                                          set_secure_conn_complete);
6945
6946         if (err < 0) {
6947                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6948                                 MGMT_STATUS_FAILED);
6949                 if (cmd)
6950                         mgmt_pending_free(cmd);
6951         }
6952
6953 failed:
6954         hci_dev_unlock(hdev);
6955         return err;
6956 }
6957
6958 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6959                           void *data, u16 len)
6960 {
6961         struct mgmt_mode *cp = data;
6962         bool changed, use_changed;
6963         int err;
6964
6965         bt_dev_dbg(hdev, "sock %p", sk);
6966
6967         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6968                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6969                                        MGMT_STATUS_INVALID_PARAMS);
6970
6971         hci_dev_lock(hdev);
6972
6973         if (cp->val)
6974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6975         else
6976                 changed = hci_dev_test_and_clear_flag(hdev,
6977                                                       HCI_KEEP_DEBUG_KEYS);
6978
6979         if (cp->val == 0x02)
6980                 use_changed = !hci_dev_test_and_set_flag(hdev,
6981                                                          HCI_USE_DEBUG_KEYS);
6982         else
6983                 use_changed = hci_dev_test_and_clear_flag(hdev,
6984                                                           HCI_USE_DEBUG_KEYS);
6985
6986         if (hdev_is_powered(hdev) && use_changed &&
6987             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6988                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6989                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6990                              sizeof(mode), &mode);
6991         }
6992
6993         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6994         if (err < 0)
6995                 goto unlock;
6996
6997         if (changed)
6998                 err = new_settings(hdev, sk);
6999
7000 unlock:
7001         hci_dev_unlock(hdev);
7002         return err;
7003 }
7004
7005 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7006                        u16 len)
7007 {
7008         struct mgmt_cp_set_privacy *cp = cp_data;
7009         bool changed;
7010         int err;
7011
7012         bt_dev_dbg(hdev, "sock %p", sk);
7013
7014         if (!lmp_le_capable(hdev))
7015                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7016                                        MGMT_STATUS_NOT_SUPPORTED);
7017
7018         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7019                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7020                                        MGMT_STATUS_INVALID_PARAMS);
7021
7022         if (hdev_is_powered(hdev))
7023                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7024                                        MGMT_STATUS_REJECTED);
7025
7026         hci_dev_lock(hdev);
7027
7028         /* If user space supports this command it is also expected to
7029          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7030          */
7031         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7032
7033         if (cp->privacy) {
7034                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7035                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7036                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7037                 hci_adv_instances_set_rpa_expired(hdev, true);
7038                 if (cp->privacy == 0x02)
7039                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7040                 else
7041                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7042         } else {
7043                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7044                 memset(hdev->irk, 0, sizeof(hdev->irk));
7045                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7046                 hci_adv_instances_set_rpa_expired(hdev, false);
7047                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7048         }
7049
7050         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7051         if (err < 0)
7052                 goto unlock;
7053
7054         if (changed)
7055                 err = new_settings(hdev, sk);
7056
7057 unlock:
7058         hci_dev_unlock(hdev);
7059         return err;
7060 }
7061
7062 static bool irk_is_valid(struct mgmt_irk_info *irk)
7063 {
7064         switch (irk->addr.type) {
7065         case BDADDR_LE_PUBLIC:
7066                 return true;
7067
7068         case BDADDR_LE_RANDOM:
7069                 /* Two most significant bits shall be set */
7070                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7071                         return false;
7072                 return true;
7073         }
7074
7075         return false;
7076 }
7077
7078 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7079                      u16 len)
7080 {
7081         struct mgmt_cp_load_irks *cp = cp_data;
7082         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7083                                    sizeof(struct mgmt_irk_info));
7084         u16 irk_count, expected_len;
7085         int i, err;
7086
7087         bt_dev_dbg(hdev, "sock %p", sk);
7088
7089         if (!lmp_le_capable(hdev))
7090                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7091                                        MGMT_STATUS_NOT_SUPPORTED);
7092
7093         irk_count = __le16_to_cpu(cp->irk_count);
7094         if (irk_count > max_irk_count) {
7095                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7096                            irk_count);
7097                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7098                                        MGMT_STATUS_INVALID_PARAMS);
7099         }
7100
7101         expected_len = struct_size(cp, irks, irk_count);
7102         if (expected_len != len) {
7103                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7104                            expected_len, len);
7105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7106                                        MGMT_STATUS_INVALID_PARAMS);
7107         }
7108
7109         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7110
7111         for (i = 0; i < irk_count; i++) {
7112                 struct mgmt_irk_info *key = &cp->irks[i];
7113
7114                 if (!irk_is_valid(key))
7115                         return mgmt_cmd_status(sk, hdev->id,
7116                                                MGMT_OP_LOAD_IRKS,
7117                                                MGMT_STATUS_INVALID_PARAMS);
7118         }
7119
7120         hci_dev_lock(hdev);
7121
7122         hci_smp_irks_clear(hdev);
7123
7124         for (i = 0; i < irk_count; i++) {
7125                 struct mgmt_irk_info *irk = &cp->irks[i];
7126
7127                 if (hci_is_blocked_key(hdev,
7128                                        HCI_BLOCKED_KEY_TYPE_IRK,
7129                                        irk->val)) {
7130                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7131                                     &irk->addr.bdaddr);
7132                         continue;
7133                 }
7134
7135                 hci_add_irk(hdev, &irk->addr.bdaddr,
7136                             le_addr_type(irk->addr.type), irk->val,
7137                             BDADDR_ANY);
7138         }
7139
7140         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7141
7142         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7143
7144         hci_dev_unlock(hdev);
7145
7146         return err;
7147 }
7148
7149 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7150 {
7151         if (key->initiator != 0x00 && key->initiator != 0x01)
7152                 return false;
7153
7154         switch (key->addr.type) {
7155         case BDADDR_LE_PUBLIC:
7156                 return true;
7157
7158         case BDADDR_LE_RANDOM:
7159                 /* Two most significant bits shall be set */
7160                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7161                         return false;
7162                 return true;
7163         }
7164
7165         return false;
7166 }
7167
7168 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7169                                void *cp_data, u16 len)
7170 {
7171         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7172         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7173                                    sizeof(struct mgmt_ltk_info));
7174         u16 key_count, expected_len;
7175         int i, err;
7176
7177         bt_dev_dbg(hdev, "sock %p", sk);
7178
7179         if (!lmp_le_capable(hdev))
7180                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7181                                        MGMT_STATUS_NOT_SUPPORTED);
7182
7183         key_count = __le16_to_cpu(cp->key_count);
7184         if (key_count > max_key_count) {
7185                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7186                            key_count);
7187                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7188                                        MGMT_STATUS_INVALID_PARAMS);
7189         }
7190
7191         expected_len = struct_size(cp, keys, key_count);
7192         if (expected_len != len) {
7193                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7194                            expected_len, len);
7195                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7196                                        MGMT_STATUS_INVALID_PARAMS);
7197         }
7198
7199         bt_dev_dbg(hdev, "key_count %u", key_count);
7200
7201         for (i = 0; i < key_count; i++) {
7202                 struct mgmt_ltk_info *key = &cp->keys[i];
7203
7204                 if (!ltk_is_valid(key))
7205                         return mgmt_cmd_status(sk, hdev->id,
7206                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7207                                                MGMT_STATUS_INVALID_PARAMS);
7208         }
7209
7210         hci_dev_lock(hdev);
7211
7212         hci_smp_ltks_clear(hdev);
7213
7214         for (i = 0; i < key_count; i++) {
7215                 struct mgmt_ltk_info *key = &cp->keys[i];
7216                 u8 type, authenticated;
7217
7218                 if (hci_is_blocked_key(hdev,
7219                                        HCI_BLOCKED_KEY_TYPE_LTK,
7220                                        key->val)) {
7221                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7222                                     &key->addr.bdaddr);
7223                         continue;
7224                 }
7225
7226                 switch (key->type) {
7227                 case MGMT_LTK_UNAUTHENTICATED:
7228                         authenticated = 0x00;
7229                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7230                         break;
7231                 case MGMT_LTK_AUTHENTICATED:
7232                         authenticated = 0x01;
7233                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7234                         break;
7235                 case MGMT_LTK_P256_UNAUTH:
7236                         authenticated = 0x00;
7237                         type = SMP_LTK_P256;
7238                         break;
7239                 case MGMT_LTK_P256_AUTH:
7240                         authenticated = 0x01;
7241                         type = SMP_LTK_P256;
7242                         break;
7243                 case MGMT_LTK_P256_DEBUG:
7244                         authenticated = 0x00;
7245                         type = SMP_LTK_P256_DEBUG;
7246                         fallthrough;
7247                 default:
7248                         continue;
7249                 }
7250
7251                 hci_add_ltk(hdev, &key->addr.bdaddr,
7252                             le_addr_type(key->addr.type), type, authenticated,
7253                             key->val, key->enc_size, key->ediv, key->rand);
7254         }
7255
7256         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7257                            NULL, 0);
7258
7259         hci_dev_unlock(hdev);
7260
7261         return err;
7262 }
7263
7264 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7265 {
7266         struct mgmt_pending_cmd *cmd = data;
7267         struct hci_conn *conn = cmd->user_data;
7268         struct mgmt_cp_get_conn_info *cp = cmd->param;
7269         struct mgmt_rp_get_conn_info rp;
7270         u8 status;
7271
7272         bt_dev_dbg(hdev, "err %d", err);
7273
7274         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
7275
7276         status = mgmt_status(err);
7277         if (status == MGMT_STATUS_SUCCESS) {
7278                 rp.rssi = conn->rssi;
7279                 rp.tx_power = conn->tx_power;
7280                 rp.max_tx_power = conn->max_tx_power;
7281         } else {
7282                 rp.rssi = HCI_RSSI_INVALID;
7283                 rp.tx_power = HCI_TX_POWER_INVALID;
7284                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7285         }
7286
7287         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7288                           &rp, sizeof(rp));
7289
7290         mgmt_pending_free(cmd);
7291 }
7292
7293 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7294 {
7295         struct mgmt_pending_cmd *cmd = data;
7296         struct mgmt_cp_get_conn_info *cp = cmd->param;
7297         struct hci_conn *conn;
7298         int err;
7299         __le16   handle;
7300
7301         /* Make sure we are still connected */
7302         if (cp->addr.type == BDADDR_BREDR)
7303                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7304                                                &cp->addr.bdaddr);
7305         else
7306                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7307
7308         if (!conn || conn->state != BT_CONNECTED)
7309                 return MGMT_STATUS_NOT_CONNECTED;
7310
7311         cmd->user_data = conn;
7312         handle = cpu_to_le16(conn->handle);
7313
7314         /* Refresh RSSI each time */
7315         err = hci_read_rssi_sync(hdev, handle);
7316
7317         /* For LE links TX power does not change thus we don't need to
7318          * query for it once value is known.
7319          */
7320         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7321                      conn->tx_power == HCI_TX_POWER_INVALID))
7322                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7323
7324         /* Max TX power needs to be read only once per connection */
7325         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7326                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7327
7328         return err;
7329 }
7330
7331 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7332                          u16 len)
7333 {
7334         struct mgmt_cp_get_conn_info *cp = data;
7335         struct mgmt_rp_get_conn_info rp;
7336         struct hci_conn *conn;
7337         unsigned long conn_info_age;
7338         int err = 0;
7339
7340         bt_dev_dbg(hdev, "sock %p", sk);
7341
7342         memset(&rp, 0, sizeof(rp));
7343         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7344         rp.addr.type = cp->addr.type;
7345
7346         if (!bdaddr_type_is_valid(cp->addr.type))
7347                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7348                                          MGMT_STATUS_INVALID_PARAMS,
7349                                          &rp, sizeof(rp));
7350
7351         hci_dev_lock(hdev);
7352
7353         if (!hdev_is_powered(hdev)) {
7354                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7355                                         MGMT_STATUS_NOT_POWERED, &rp,
7356                                         sizeof(rp));
7357                 goto unlock;
7358         }
7359
7360         if (cp->addr.type == BDADDR_BREDR)
7361                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7362                                                &cp->addr.bdaddr);
7363         else
7364                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7365
7366         if (!conn || conn->state != BT_CONNECTED) {
7367                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7368                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7369                                         sizeof(rp));
7370                 goto unlock;
7371         }
7372
7373         /* To avoid client trying to guess when to poll again for information we
7374          * calculate conn info age as random value between min/max set in hdev.
7375          */
7376         conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7377                                                  hdev->conn_info_max_age - 1);
7378
7379         /* Query controller to refresh cached values if they are too old or were
7380          * never read.
7381          */
7382         if (time_after(jiffies, conn->conn_info_timestamp +
7383                        msecs_to_jiffies(conn_info_age)) ||
7384             !conn->conn_info_timestamp) {
7385                 struct mgmt_pending_cmd *cmd;
7386
7387                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7388                                        len);
7389                 if (!cmd) {
7390                         err = -ENOMEM;
7391                 } else {
7392                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7393                                                  cmd, get_conn_info_complete);
7394                 }
7395
7396                 if (err < 0) {
7397                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7398                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
7399
7400                         if (cmd)
7401                                 mgmt_pending_free(cmd);
7402
7403                         goto unlock;
7404                 }
7405
7406                 conn->conn_info_timestamp = jiffies;
7407         } else {
7408                 /* Cache is valid, just reply with values cached in hci_conn */
7409                 rp.rssi = conn->rssi;
7410                 rp.tx_power = conn->tx_power;
7411                 rp.max_tx_power = conn->max_tx_power;
7412
7413                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7414                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7415         }
7416
7417 unlock:
7418         hci_dev_unlock(hdev);
7419         return err;
7420 }
7421
7422 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7423 {
7424         struct mgmt_pending_cmd *cmd = data;
7425         struct mgmt_cp_get_clock_info *cp = cmd->param;
7426         struct mgmt_rp_get_clock_info rp;
7427         struct hci_conn *conn = cmd->user_data;
7428         u8 status = mgmt_status(err);
7429
7430         bt_dev_dbg(hdev, "err %d", err);
7431
7432         memset(&rp, 0, sizeof(rp));
7433         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7434         rp.addr.type = cp->addr.type;
7435
7436         if (err)
7437                 goto complete;
7438
7439         rp.local_clock = cpu_to_le32(hdev->clock);
7440
7441         if (conn) {
7442                 rp.piconet_clock = cpu_to_le32(conn->clock);
7443                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7444         }
7445
7446 complete:
7447         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7448                           sizeof(rp));
7449
7450         mgmt_pending_free(cmd);
7451 }
7452
7453 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7454 {
7455         struct mgmt_pending_cmd *cmd = data;
7456         struct mgmt_cp_get_clock_info *cp = cmd->param;
7457         struct hci_cp_read_clock hci_cp;
7458         struct hci_conn *conn;
7459
7460         memset(&hci_cp, 0, sizeof(hci_cp));
7461         hci_read_clock_sync(hdev, &hci_cp);
7462
7463         /* Make sure connection still exists */
7464         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7465         if (!conn || conn->state != BT_CONNECTED)
7466                 return MGMT_STATUS_NOT_CONNECTED;
7467
7468         cmd->user_data = conn;
7469         hci_cp.handle = cpu_to_le16(conn->handle);
7470         hci_cp.which = 0x01; /* Piconet clock */
7471
7472         return hci_read_clock_sync(hdev, &hci_cp);
7473 }
7474
7475 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7476                                                                 u16 len)
7477 {
7478         struct mgmt_cp_get_clock_info *cp = data;
7479         struct mgmt_rp_get_clock_info rp;
7480         struct mgmt_pending_cmd *cmd;
7481         struct hci_conn *conn;
7482         int err;
7483
7484         bt_dev_dbg(hdev, "sock %p", sk);
7485
7486         memset(&rp, 0, sizeof(rp));
7487         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7488         rp.addr.type = cp->addr.type;
7489
7490         if (cp->addr.type != BDADDR_BREDR)
7491                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7492                                          MGMT_STATUS_INVALID_PARAMS,
7493                                          &rp, sizeof(rp));
7494
7495         hci_dev_lock(hdev);
7496
7497         if (!hdev_is_powered(hdev)) {
7498                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7499                                         MGMT_STATUS_NOT_POWERED, &rp,
7500                                         sizeof(rp));
7501                 goto unlock;
7502         }
7503
7504         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7505                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7506                                                &cp->addr.bdaddr);
7507                 if (!conn || conn->state != BT_CONNECTED) {
7508                         err = mgmt_cmd_complete(sk, hdev->id,
7509                                                 MGMT_OP_GET_CLOCK_INFO,
7510                                                 MGMT_STATUS_NOT_CONNECTED,
7511                                                 &rp, sizeof(rp));
7512                         goto unlock;
7513                 }
7514         } else {
7515                 conn = NULL;
7516         }
7517
7518         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7519         if (!cmd)
7520                 err = -ENOMEM;
7521         else
7522                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7523                                          get_clock_info_complete);
7524
7525         if (err < 0) {
7526                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7527                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
7528
7529                 if (cmd)
7530                         mgmt_pending_free(cmd);
7531         }
7532
7533
7534 unlock:
7535         hci_dev_unlock(hdev);
7536         return err;
7537 }
7538
7539 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7540 {
7541         struct hci_conn *conn;
7542
7543         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7544         if (!conn)
7545                 return false;
7546
7547         if (conn->dst_type != type)
7548                 return false;
7549
7550         if (conn->state != BT_CONNECTED)
7551                 return false;
7552
7553         return true;
7554 }
7555
7556 /* This function requires the caller holds hdev->lock */
7557 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7558                                u8 addr_type, u8 auto_connect)
7559 {
7560         struct hci_conn_params *params;
7561
7562         params = hci_conn_params_add(hdev, addr, addr_type);
7563         if (!params)
7564                 return -EIO;
7565
7566         if (params->auto_connect == auto_connect)
7567                 return 0;
7568
7569         list_del_init(&params->action);
7570
7571         switch (auto_connect) {
7572         case HCI_AUTO_CONN_DISABLED:
7573         case HCI_AUTO_CONN_LINK_LOSS:
7574                 /* If auto connect is being disabled when we're trying to
7575                  * connect to device, keep connecting.
7576                  */
7577                 if (params->explicit_connect)
7578                         list_add(&params->action, &hdev->pend_le_conns);
7579                 break;
7580         case HCI_AUTO_CONN_REPORT:
7581                 if (params->explicit_connect)
7582                         list_add(&params->action, &hdev->pend_le_conns);
7583                 else
7584                         list_add(&params->action, &hdev->pend_le_reports);
7585                 break;
7586         case HCI_AUTO_CONN_DIRECT:
7587         case HCI_AUTO_CONN_ALWAYS:
7588                 if (!is_connected(hdev, addr, addr_type))
7589                         list_add(&params->action, &hdev->pend_le_conns);
7590                 break;
7591         }
7592
7593         params->auto_connect = auto_connect;
7594
7595         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7596                    addr, addr_type, auto_connect);
7597
7598         return 0;
7599 }
7600
7601 static void device_added(struct sock *sk, struct hci_dev *hdev,
7602                          bdaddr_t *bdaddr, u8 type, u8 action)
7603 {
7604         struct mgmt_ev_device_added ev;
7605
7606         bacpy(&ev.addr.bdaddr, bdaddr);
7607         ev.addr.type = type;
7608         ev.action = action;
7609
7610         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7611 }
7612
7613 static int add_device_sync(struct hci_dev *hdev, void *data)
7614 {
7615         return hci_update_passive_scan_sync(hdev);
7616 }
7617
7618 static int add_device(struct sock *sk, struct hci_dev *hdev,
7619                       void *data, u16 len)
7620 {
7621         struct mgmt_cp_add_device *cp = data;
7622         u8 auto_conn, addr_type;
7623         struct hci_conn_params *params;
7624         int err;
7625         u32 current_flags = 0;
7626         u32 supported_flags;
7627
7628         bt_dev_dbg(hdev, "sock %p", sk);
7629
7630         if (!bdaddr_type_is_valid(cp->addr.type) ||
7631             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7632                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7633                                          MGMT_STATUS_INVALID_PARAMS,
7634                                          &cp->addr, sizeof(cp->addr));
7635
7636         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7637                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7638                                          MGMT_STATUS_INVALID_PARAMS,
7639                                          &cp->addr, sizeof(cp->addr));
7640
7641         hci_dev_lock(hdev);
7642
7643         if (cp->addr.type == BDADDR_BREDR) {
7644                 /* Only incoming connections action is supported for now */
7645                 if (cp->action != 0x01) {
7646                         err = mgmt_cmd_complete(sk, hdev->id,
7647                                                 MGMT_OP_ADD_DEVICE,
7648                                                 MGMT_STATUS_INVALID_PARAMS,
7649                                                 &cp->addr, sizeof(cp->addr));
7650                         goto unlock;
7651                 }
7652
7653                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7654                                                      &cp->addr.bdaddr,
7655                                                      cp->addr.type, 0);
7656                 if (err)
7657                         goto unlock;
7658
7659                 hci_update_scan(hdev);
7660
7661                 goto added;
7662         }
7663
7664         addr_type = le_addr_type(cp->addr.type);
7665
7666         if (cp->action == 0x02)
7667                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7668         else if (cp->action == 0x01)
7669                 auto_conn = HCI_AUTO_CONN_DIRECT;
7670         else
7671                 auto_conn = HCI_AUTO_CONN_REPORT;
7672
7673         /* Kernel internally uses conn_params with resolvable private
7674          * address, but Add Device allows only identity addresses.
7675          * Make sure it is enforced before calling
7676          * hci_conn_params_lookup.
7677          */
7678         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7679                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7680                                         MGMT_STATUS_INVALID_PARAMS,
7681                                         &cp->addr, sizeof(cp->addr));
7682                 goto unlock;
7683         }
7684
7685         /* If the connection parameters don't exist for this device,
7686          * they will be created and configured with defaults.
7687          */
7688         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7689                                 auto_conn) < 0) {
7690                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7691                                         MGMT_STATUS_FAILED, &cp->addr,
7692                                         sizeof(cp->addr));
7693                 goto unlock;
7694         } else {
7695                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7696                                                 addr_type);
7697                 if (params)
7698                         current_flags = params->flags;
7699         }
7700
7701         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7702         if (err < 0)
7703                 goto unlock;
7704
7705 added:
7706         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7707         supported_flags = hdev->conn_flags;
7708         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7709                              supported_flags, current_flags);
7710
7711         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7712                                 MGMT_STATUS_SUCCESS, &cp->addr,
7713                                 sizeof(cp->addr));
7714
7715 unlock:
7716         hci_dev_unlock(hdev);
7717         return err;
7718 }
7719
7720 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7721                            bdaddr_t *bdaddr, u8 type)
7722 {
7723         struct mgmt_ev_device_removed ev;
7724
7725         bacpy(&ev.addr.bdaddr, bdaddr);
7726         ev.addr.type = type;
7727
7728         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7729 }
7730
7731 static int remove_device_sync(struct hci_dev *hdev, void *data)
7732 {
7733         return hci_update_passive_scan_sync(hdev);
7734 }
7735
7736 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7737                          void *data, u16 len)
7738 {
7739         struct mgmt_cp_remove_device *cp = data;
7740         int err;
7741
7742         bt_dev_dbg(hdev, "sock %p", sk);
7743
7744         hci_dev_lock(hdev);
7745
7746         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7747                 struct hci_conn_params *params;
7748                 u8 addr_type;
7749
7750                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7751                         err = mgmt_cmd_complete(sk, hdev->id,
7752                                                 MGMT_OP_REMOVE_DEVICE,
7753                                                 MGMT_STATUS_INVALID_PARAMS,
7754                                                 &cp->addr, sizeof(cp->addr));
7755                         goto unlock;
7756                 }
7757
7758                 if (cp->addr.type == BDADDR_BREDR) {
7759                         err = hci_bdaddr_list_del(&hdev->accept_list,
7760                                                   &cp->addr.bdaddr,
7761                                                   cp->addr.type);
7762                         if (err) {
7763                                 err = mgmt_cmd_complete(sk, hdev->id,
7764                                                         MGMT_OP_REMOVE_DEVICE,
7765                                                         MGMT_STATUS_INVALID_PARAMS,
7766                                                         &cp->addr,
7767                                                         sizeof(cp->addr));
7768                                 goto unlock;
7769                         }
7770
7771                         hci_update_scan(hdev);
7772
7773                         device_removed(sk, hdev, &cp->addr.bdaddr,
7774                                        cp->addr.type);
7775                         goto complete;
7776                 }
7777
7778                 addr_type = le_addr_type(cp->addr.type);
7779
7780                 /* Kernel internally uses conn_params with resolvable private
7781                  * address, but Remove Device allows only identity addresses.
7782                  * Make sure it is enforced before calling
7783                  * hci_conn_params_lookup.
7784                  */
7785                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7786                         err = mgmt_cmd_complete(sk, hdev->id,
7787                                                 MGMT_OP_REMOVE_DEVICE,
7788                                                 MGMT_STATUS_INVALID_PARAMS,
7789                                                 &cp->addr, sizeof(cp->addr));
7790                         goto unlock;
7791                 }
7792
7793                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7794                                                 addr_type);
7795                 if (!params) {
7796                         err = mgmt_cmd_complete(sk, hdev->id,
7797                                                 MGMT_OP_REMOVE_DEVICE,
7798                                                 MGMT_STATUS_INVALID_PARAMS,
7799                                                 &cp->addr, sizeof(cp->addr));
7800                         goto unlock;
7801                 }
7802
7803                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7804                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7805                         err = mgmt_cmd_complete(sk, hdev->id,
7806                                                 MGMT_OP_REMOVE_DEVICE,
7807                                                 MGMT_STATUS_INVALID_PARAMS,
7808                                                 &cp->addr, sizeof(cp->addr));
7809                         goto unlock;
7810                 }
7811
7812                 list_del(&params->action);
7813                 list_del(&params->list);
7814                 kfree(params);
7815
7816                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7817         } else {
7818                 struct hci_conn_params *p, *tmp;
7819                 struct bdaddr_list *b, *btmp;
7820
7821                 if (cp->addr.type) {
7822                         err = mgmt_cmd_complete(sk, hdev->id,
7823                                                 MGMT_OP_REMOVE_DEVICE,
7824                                                 MGMT_STATUS_INVALID_PARAMS,
7825                                                 &cp->addr, sizeof(cp->addr));
7826                         goto unlock;
7827                 }
7828
7829                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7830                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7831                         list_del(&b->list);
7832                         kfree(b);
7833                 }
7834
7835                 hci_update_scan(hdev);
7836
7837                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7838                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7839                                 continue;
7840                         device_removed(sk, hdev, &p->addr, p->addr_type);
7841                         if (p->explicit_connect) {
7842                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7843                                 continue;
7844                         }
7845                         list_del(&p->action);
7846                         list_del(&p->list);
7847                         kfree(p);
7848                 }
7849
7850                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
7851         }
7852
7853         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7854
7855 complete:
7856         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7857                                 MGMT_STATUS_SUCCESS, &cp->addr,
7858                                 sizeof(cp->addr));
7859 unlock:
7860         hci_dev_unlock(hdev);
7861         return err;
7862 }
7863
7864 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7865                            u16 len)
7866 {
7867         struct mgmt_cp_load_conn_param *cp = data;
7868         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7869                                      sizeof(struct mgmt_conn_param));
7870         u16 param_count, expected_len;
7871         int i;
7872
7873         if (!lmp_le_capable(hdev))
7874                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7875                                        MGMT_STATUS_NOT_SUPPORTED);
7876
7877         param_count = __le16_to_cpu(cp->param_count);
7878         if (param_count > max_param_count) {
7879                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7880                            param_count);
7881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7882                                        MGMT_STATUS_INVALID_PARAMS);
7883         }
7884
7885         expected_len = struct_size(cp, params, param_count);
7886         if (expected_len != len) {
7887                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7888                            expected_len, len);
7889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7890                                        MGMT_STATUS_INVALID_PARAMS);
7891         }
7892
7893         bt_dev_dbg(hdev, "param_count %u", param_count);
7894
7895         hci_dev_lock(hdev);
7896
7897         hci_conn_params_clear_disabled(hdev);
7898
7899         for (i = 0; i < param_count; i++) {
7900                 struct mgmt_conn_param *param = &cp->params[i];
7901                 struct hci_conn_params *hci_param;
7902                 u16 min, max, latency, timeout;
7903                 u8 addr_type;
7904
7905                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7906                            param->addr.type);
7907
7908                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7909                         addr_type = ADDR_LE_DEV_PUBLIC;
7910                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7911                         addr_type = ADDR_LE_DEV_RANDOM;
7912                 } else {
7913                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7914                         continue;
7915                 }
7916
7917                 min = le16_to_cpu(param->min_interval);
7918                 max = le16_to_cpu(param->max_interval);
7919                 latency = le16_to_cpu(param->latency);
7920                 timeout = le16_to_cpu(param->timeout);
7921
7922                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7923                            min, max, latency, timeout);
7924
7925                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7926                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7927                         continue;
7928                 }
7929
7930                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7931                                                 addr_type);
7932                 if (!hci_param) {
7933                         bt_dev_err(hdev, "failed to add connection parameters");
7934                         continue;
7935                 }
7936
7937                 hci_param->conn_min_interval = min;
7938                 hci_param->conn_max_interval = max;
7939                 hci_param->conn_latency = latency;
7940                 hci_param->supervision_timeout = timeout;
7941         }
7942
7943         hci_dev_unlock(hdev);
7944
7945         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7946                                  NULL, 0);
7947 }
7948
7949 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7950                                void *data, u16 len)
7951 {
7952         struct mgmt_cp_set_external_config *cp = data;
7953         bool changed;
7954         int err;
7955
7956         bt_dev_dbg(hdev, "sock %p", sk);
7957
7958         if (hdev_is_powered(hdev))
7959                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7960                                        MGMT_STATUS_REJECTED);
7961
7962         if (cp->config != 0x00 && cp->config != 0x01)
7963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7964                                          MGMT_STATUS_INVALID_PARAMS);
7965
7966         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7967                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7968                                        MGMT_STATUS_NOT_SUPPORTED);
7969
7970         hci_dev_lock(hdev);
7971
7972         if (cp->config)
7973                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7974         else
7975                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7976
7977         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7978         if (err < 0)
7979                 goto unlock;
7980
7981         if (!changed)
7982                 goto unlock;
7983
7984         err = new_options(hdev, sk);
7985
7986         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7987                 mgmt_index_removed(hdev);
7988
7989                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7990                         hci_dev_set_flag(hdev, HCI_CONFIG);
7991                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7992
7993                         queue_work(hdev->req_workqueue, &hdev->power_on);
7994                 } else {
7995                         set_bit(HCI_RAW, &hdev->flags);
7996                         mgmt_index_added(hdev);
7997                 }
7998         }
7999
8000 unlock:
8001         hci_dev_unlock(hdev);
8002         return err;
8003 }
8004
8005 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8006                               void *data, u16 len)
8007 {
8008         struct mgmt_cp_set_public_address *cp = data;
8009         bool changed;
8010         int err;
8011
8012         bt_dev_dbg(hdev, "sock %p", sk);
8013
8014         if (hdev_is_powered(hdev))
8015                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8016                                        MGMT_STATUS_REJECTED);
8017
8018         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8019                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8020                                        MGMT_STATUS_INVALID_PARAMS);
8021
8022         if (!hdev->set_bdaddr)
8023                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8024                                        MGMT_STATUS_NOT_SUPPORTED);
8025
8026         hci_dev_lock(hdev);
8027
8028         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8029         bacpy(&hdev->public_addr, &cp->bdaddr);
8030
8031         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8032         if (err < 0)
8033                 goto unlock;
8034
8035         if (!changed)
8036                 goto unlock;
8037
8038         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8039                 err = new_options(hdev, sk);
8040
8041         if (is_configured(hdev)) {
8042                 mgmt_index_removed(hdev);
8043
8044                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8045
8046                 hci_dev_set_flag(hdev, HCI_CONFIG);
8047                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8048
8049                 queue_work(hdev->req_workqueue, &hdev->power_on);
8050         }
8051
8052 unlock:
8053         hci_dev_unlock(hdev);
8054         return err;
8055 }
8056
8057 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8058                                              int err)
8059 {
8060         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8061         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8062         u8 *h192, *r192, *h256, *r256;
8063         struct mgmt_pending_cmd *cmd = data;
8064         struct sk_buff *skb = cmd->skb;
8065         u8 status = mgmt_status(err);
8066         u16 eir_len;
8067
8068         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
8069                 return;
8070
8071         if (!status) {
8072                 if (!skb)
8073                         status = MGMT_STATUS_FAILED;
8074                 else if (IS_ERR(skb))
8075                         status = mgmt_status(PTR_ERR(skb));
8076                 else
8077                         status = mgmt_status(skb->data[0]);
8078         }
8079
8080         bt_dev_dbg(hdev, "status %u", status);
8081
8082         mgmt_cp = cmd->param;
8083
8084         if (status) {
8085                 status = mgmt_status(status);
8086                 eir_len = 0;
8087
8088                 h192 = NULL;
8089                 r192 = NULL;
8090                 h256 = NULL;
8091                 r256 = NULL;
8092         } else if (!bredr_sc_enabled(hdev)) {
8093                 struct hci_rp_read_local_oob_data *rp;
8094
8095                 if (skb->len != sizeof(*rp)) {
8096                         status = MGMT_STATUS_FAILED;
8097                         eir_len = 0;
8098                 } else {
8099                         status = MGMT_STATUS_SUCCESS;
8100                         rp = (void *)skb->data;
8101
8102                         eir_len = 5 + 18 + 18;
8103                         h192 = rp->hash;
8104                         r192 = rp->rand;
8105                         h256 = NULL;
8106                         r256 = NULL;
8107                 }
8108         } else {
8109                 struct hci_rp_read_local_oob_ext_data *rp;
8110
8111                 if (skb->len != sizeof(*rp)) {
8112                         status = MGMT_STATUS_FAILED;
8113                         eir_len = 0;
8114                 } else {
8115                         status = MGMT_STATUS_SUCCESS;
8116                         rp = (void *)skb->data;
8117
8118                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8119                                 eir_len = 5 + 18 + 18;
8120                                 h192 = NULL;
8121                                 r192 = NULL;
8122                         } else {
8123                                 eir_len = 5 + 18 + 18 + 18 + 18;
8124                                 h192 = rp->hash192;
8125                                 r192 = rp->rand192;
8126                         }
8127
8128                         h256 = rp->hash256;
8129                         r256 = rp->rand256;
8130                 }
8131         }
8132
8133         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8134         if (!mgmt_rp)
8135                 goto done;
8136
8137         if (eir_len == 0)
8138                 goto send_rsp;
8139
8140         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8141                                   hdev->dev_class, 3);
8142
8143         if (h192 && r192) {
8144                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8145                                           EIR_SSP_HASH_C192, h192, 16);
8146                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8147                                           EIR_SSP_RAND_R192, r192, 16);
8148         }
8149
8150         if (h256 && r256) {
8151                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8152                                           EIR_SSP_HASH_C256, h256, 16);
8153                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8154                                           EIR_SSP_RAND_R256, r256, 16);
8155         }
8156
8157 send_rsp:
8158         mgmt_rp->type = mgmt_cp->type;
8159         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8160
8161         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8162                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8163                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8164         if (err < 0 || status)
8165                 goto done;
8166
8167         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8168
8169         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8170                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8171                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8172 done:
8173         if (skb && !IS_ERR(skb))
8174                 kfree_skb(skb);
8175
8176         kfree(mgmt_rp);
8177         mgmt_pending_remove(cmd);
8178 }
8179
8180 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8181                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8182 {
8183         struct mgmt_pending_cmd *cmd;
8184         int err;
8185
8186         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8187                                cp, sizeof(*cp));
8188         if (!cmd)
8189                 return -ENOMEM;
8190
8191         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8192                                  read_local_oob_ext_data_complete);
8193
8194         if (err < 0) {
8195                 mgmt_pending_remove(cmd);
8196                 return err;
8197         }
8198
8199         return 0;
8200 }
8201
8202 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8203                                    void *data, u16 data_len)
8204 {
8205         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8206         struct mgmt_rp_read_local_oob_ext_data *rp;
8207         size_t rp_len;
8208         u16 eir_len;
8209         u8 status, flags, role, addr[7], hash[16], rand[16];
8210         int err;
8211
8212         bt_dev_dbg(hdev, "sock %p", sk);
8213
8214         if (hdev_is_powered(hdev)) {
8215                 switch (cp->type) {
8216                 case BIT(BDADDR_BREDR):
8217                         status = mgmt_bredr_support(hdev);
8218                         if (status)
8219                                 eir_len = 0;
8220                         else
8221                                 eir_len = 5;
8222                         break;
8223                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8224                         status = mgmt_le_support(hdev);
8225                         if (status)
8226                                 eir_len = 0;
8227                         else
8228                                 eir_len = 9 + 3 + 18 + 18 + 3;
8229                         break;
8230                 default:
8231                         status = MGMT_STATUS_INVALID_PARAMS;
8232                         eir_len = 0;
8233                         break;
8234                 }
8235         } else {
8236                 status = MGMT_STATUS_NOT_POWERED;
8237                 eir_len = 0;
8238         }
8239
8240         rp_len = sizeof(*rp) + eir_len;
8241         rp = kmalloc(rp_len, GFP_ATOMIC);
8242         if (!rp)
8243                 return -ENOMEM;
8244
8245         if (!status && !lmp_ssp_capable(hdev)) {
8246                 status = MGMT_STATUS_NOT_SUPPORTED;
8247                 eir_len = 0;
8248         }
8249
8250         if (status)
8251                 goto complete;
8252
8253         hci_dev_lock(hdev);
8254
8255         eir_len = 0;
8256         switch (cp->type) {
8257         case BIT(BDADDR_BREDR):
8258                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8259                         err = read_local_ssp_oob_req(hdev, sk, cp);
8260                         hci_dev_unlock(hdev);
8261                         if (!err)
8262                                 goto done;
8263
8264                         status = MGMT_STATUS_FAILED;
8265                         goto complete;
8266                 } else {
8267                         eir_len = eir_append_data(rp->eir, eir_len,
8268                                                   EIR_CLASS_OF_DEV,
8269                                                   hdev->dev_class, 3);
8270                 }
8271                 break;
8272         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8273                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8274                     smp_generate_oob(hdev, hash, rand) < 0) {
8275                         hci_dev_unlock(hdev);
8276                         status = MGMT_STATUS_FAILED;
8277                         goto complete;
8278                 }
8279
8280                 /* This should return the active RPA, but since the RPA
8281                  * is only programmed on demand, it is really hard to fill
8282                  * this in at the moment. For now disallow retrieving
8283                  * local out-of-band data when privacy is in use.
8284                  *
8285                  * Returning the identity address will not help here since
8286                  * pairing happens before the identity resolving key is
8287                  * known and thus the connection establishment happens
8288                  * based on the RPA and not the identity address.
8289                  */
8290                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8291                         hci_dev_unlock(hdev);
8292                         status = MGMT_STATUS_REJECTED;
8293                         goto complete;
8294                 }
8295
8296                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8297                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8298                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8299                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8300                         memcpy(addr, &hdev->static_addr, 6);
8301                         addr[6] = 0x01;
8302                 } else {
8303                         memcpy(addr, &hdev->bdaddr, 6);
8304                         addr[6] = 0x00;
8305                 }
8306
8307                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8308                                           addr, sizeof(addr));
8309
8310                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8311                         role = 0x02;
8312                 else
8313                         role = 0x01;
8314
8315                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8316                                           &role, sizeof(role));
8317
8318                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8319                         eir_len = eir_append_data(rp->eir, eir_len,
8320                                                   EIR_LE_SC_CONFIRM,
8321                                                   hash, sizeof(hash));
8322
8323                         eir_len = eir_append_data(rp->eir, eir_len,
8324                                                   EIR_LE_SC_RANDOM,
8325                                                   rand, sizeof(rand));
8326                 }
8327
8328                 flags = mgmt_get_adv_discov_flags(hdev);
8329
8330                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8331                         flags |= LE_AD_NO_BREDR;
8332
8333                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8334                                           &flags, sizeof(flags));
8335                 break;
8336         }
8337
8338         hci_dev_unlock(hdev);
8339
8340         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8341
8342         status = MGMT_STATUS_SUCCESS;
8343
8344 complete:
8345         rp->type = cp->type;
8346         rp->eir_len = cpu_to_le16(eir_len);
8347
8348         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8349                                 status, rp, sizeof(*rp) + eir_len);
8350         if (err < 0 || status)
8351                 goto done;
8352
8353         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8354                                  rp, sizeof(*rp) + eir_len,
8355                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8356
8357 done:
8358         kfree(rp);
8359
8360         return err;
8361 }
8362
8363 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8364 {
8365         u32 flags = 0;
8366
8367         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8368         flags |= MGMT_ADV_FLAG_DISCOV;
8369         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8370         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8371         flags |= MGMT_ADV_FLAG_APPEARANCE;
8372         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8373         flags |= MGMT_ADV_PARAM_DURATION;
8374         flags |= MGMT_ADV_PARAM_TIMEOUT;
8375         flags |= MGMT_ADV_PARAM_INTERVALS;
8376         flags |= MGMT_ADV_PARAM_TX_POWER;
8377         flags |= MGMT_ADV_PARAM_SCAN_RSP;
8378
8379         /* In extended adv TX_POWER returned from Set Adv Param
8380          * will be always valid.
8381          */
8382         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8383                 flags |= MGMT_ADV_FLAG_TX_POWER;
8384
8385         if (ext_adv_capable(hdev)) {
8386                 flags |= MGMT_ADV_FLAG_SEC_1M;
8387                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8388                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8389
8390                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
8391                         flags |= MGMT_ADV_FLAG_SEC_2M;
8392
8393                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
8394                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8395         }
8396
8397         return flags;
8398 }
8399
8400 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8401                              void *data, u16 data_len)
8402 {
8403         struct mgmt_rp_read_adv_features *rp;
8404         size_t rp_len;
8405         int err;
8406         struct adv_info *adv_instance;
8407         u32 supported_flags;
8408         u8 *instance;
8409
8410         bt_dev_dbg(hdev, "sock %p", sk);
8411
8412         if (!lmp_le_capable(hdev))
8413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8414                                        MGMT_STATUS_REJECTED);
8415
8416         hci_dev_lock(hdev);
8417
8418         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8419         rp = kmalloc(rp_len, GFP_ATOMIC);
8420         if (!rp) {
8421                 hci_dev_unlock(hdev);
8422                 return -ENOMEM;
8423         }
8424
8425         supported_flags = get_supported_adv_flags(hdev);
8426
8427         rp->supported_flags = cpu_to_le32(supported_flags);
8428         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
8429         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
8430         rp->max_instances = hdev->le_num_of_adv_sets;
8431         rp->num_instances = hdev->adv_instance_cnt;
8432
8433         instance = rp->instance;
8434         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8435                 /* Only instances 1-le_num_of_adv_sets are externally visible */
8436                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8437                         *instance = adv_instance->instance;
8438                         instance++;
8439                 } else {
8440                         rp->num_instances--;
8441                         rp_len--;
8442                 }
8443         }
8444
8445         hci_dev_unlock(hdev);
8446
8447         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8448                                 MGMT_STATUS_SUCCESS, rp, rp_len);
8449
8450         kfree(rp);
8451
8452         return err;
8453 }
8454
8455 static u8 calculate_name_len(struct hci_dev *hdev)
8456 {
8457         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
8458
8459         return eir_append_local_name(hdev, buf, 0);
8460 }
8461
8462 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8463                            bool is_adv_data)
8464 {
8465         u8 max_len = HCI_MAX_AD_LENGTH;
8466
8467         if (is_adv_data) {
8468                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8469                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
8470                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
8471                         max_len -= 3;
8472
8473                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8474                         max_len -= 3;
8475         } else {
8476                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8477                         max_len -= calculate_name_len(hdev);
8478
8479                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8480                         max_len -= 4;
8481         }
8482
8483         return max_len;
8484 }
8485
8486 static bool flags_managed(u32 adv_flags)
8487 {
8488         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8489                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8490                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8491 }
8492
8493 static bool tx_power_managed(u32 adv_flags)
8494 {
8495         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8496 }
8497
8498 static bool name_managed(u32 adv_flags)
8499 {
8500         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8501 }
8502
8503 static bool appearance_managed(u32 adv_flags)
8504 {
8505         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8506 }
8507
8508 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8509                               u8 len, bool is_adv_data)
8510 {
8511         int i, cur_len;
8512         u8 max_len;
8513
8514         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8515
8516         if (len > max_len)
8517                 return false;
8518
8519         /* Make sure that the data is correctly formatted. */
8520         for (i = 0; i < len; i += (cur_len + 1)) {
8521                 cur_len = data[i];
8522
8523                 if (!cur_len)
8524                         continue;
8525
8526                 if (data[i + 1] == EIR_FLAGS &&
8527                     (!is_adv_data || flags_managed(adv_flags)))
8528                         return false;
8529
8530                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8531                         return false;
8532
8533                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8534                         return false;
8535
8536                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8537                         return false;
8538
8539                 if (data[i + 1] == EIR_APPEARANCE &&
8540                     appearance_managed(adv_flags))
8541                         return false;
8542
8543                 /* If the current field length would exceed the total data
8544                  * length, then it's invalid.
8545                  */
8546                 if (i + cur_len >= len)
8547                         return false;
8548         }
8549
8550         return true;
8551 }
8552
8553 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8554 {
8555         u32 supported_flags, phy_flags;
8556
8557         /* The current implementation only supports a subset of the specified
8558          * flags. Also need to check mutual exclusiveness of sec flags.
8559          */
8560         supported_flags = get_supported_adv_flags(hdev);
8561         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8562         if (adv_flags & ~supported_flags ||
8563             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8564                 return false;
8565
8566         return true;
8567 }
8568
8569 static bool adv_busy(struct hci_dev *hdev)
8570 {
8571         return pending_find(MGMT_OP_SET_LE, hdev);
8572 }
8573
8574 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8575                              int err)
8576 {
8577         struct adv_info *adv, *n;
8578
8579         bt_dev_dbg(hdev, "err %d", err);
8580
8581         hci_dev_lock(hdev);
8582
8583         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8584                 u8 instance;
8585
8586                 if (!adv->pending)
8587                         continue;
8588
8589                 if (!err) {
8590                         adv->pending = false;
8591                         continue;
8592                 }
8593
8594                 instance = adv->instance;
8595
8596                 if (hdev->cur_adv_instance == instance)
8597                         cancel_adv_timeout(hdev);
8598
8599                 hci_remove_adv_instance(hdev, instance);
8600                 mgmt_advertising_removed(sk, hdev, instance);
8601         }
8602
8603         hci_dev_unlock(hdev);
8604 }
8605
8606 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8607 {
8608         struct mgmt_pending_cmd *cmd = data;
8609         struct mgmt_cp_add_advertising *cp = cmd->param;
8610         struct mgmt_rp_add_advertising rp;
8611
8612         memset(&rp, 0, sizeof(rp));
8613
8614         rp.instance = cp->instance;
8615
8616         if (err)
8617                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8618                                 mgmt_status(err));
8619         else
8620                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8621                                   mgmt_status(err), &rp, sizeof(rp));
8622
8623         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8624
8625         mgmt_pending_free(cmd);
8626 }
8627
8628 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8629 {
8630         struct mgmt_pending_cmd *cmd = data;
8631         struct mgmt_cp_add_advertising *cp = cmd->param;
8632
8633         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8634 }
8635
8636 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8637                            void *data, u16 data_len)
8638 {
8639         struct mgmt_cp_add_advertising *cp = data;
8640         struct mgmt_rp_add_advertising rp;
8641         u32 flags;
8642         u8 status;
8643         u16 timeout, duration;
8644         unsigned int prev_instance_cnt;
8645         u8 schedule_instance = 0;
8646         struct adv_info *adv, *next_instance;
8647         int err;
8648         struct mgmt_pending_cmd *cmd;
8649
8650         bt_dev_dbg(hdev, "sock %p", sk);
8651
8652         status = mgmt_le_support(hdev);
8653         if (status)
8654                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8655                                        status);
8656
8657         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8658                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8659                                        MGMT_STATUS_INVALID_PARAMS);
8660
8661         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8662                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8663                                        MGMT_STATUS_INVALID_PARAMS);
8664
8665         flags = __le32_to_cpu(cp->flags);
8666         timeout = __le16_to_cpu(cp->timeout);
8667         duration = __le16_to_cpu(cp->duration);
8668
8669         if (!requested_adv_flags_are_valid(hdev, flags))
8670                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8671                                        MGMT_STATUS_INVALID_PARAMS);
8672
8673         hci_dev_lock(hdev);
8674
8675         if (timeout && !hdev_is_powered(hdev)) {
8676                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8677                                       MGMT_STATUS_REJECTED);
8678                 goto unlock;
8679         }
8680
8681         if (adv_busy(hdev)) {
8682                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8683                                       MGMT_STATUS_BUSY);
8684                 goto unlock;
8685         }
8686
8687         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8688             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8689                                cp->scan_rsp_len, false)) {
8690                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8691                                       MGMT_STATUS_INVALID_PARAMS);
8692                 goto unlock;
8693         }
8694
8695         prev_instance_cnt = hdev->adv_instance_cnt;
8696
8697         adv = hci_add_adv_instance(hdev, cp->instance, flags,
8698                                    cp->adv_data_len, cp->data,
8699                                    cp->scan_rsp_len,
8700                                    cp->data + cp->adv_data_len,
8701                                    timeout, duration,
8702                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8703                                    hdev->le_adv_min_interval,
8704                                    hdev->le_adv_max_interval, 0);
8705         if (IS_ERR(adv)) {
8706                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8707                                       MGMT_STATUS_FAILED);
8708                 goto unlock;
8709         }
8710
8711         /* Only trigger an advertising added event if a new instance was
8712          * actually added.
8713          */
8714         if (hdev->adv_instance_cnt > prev_instance_cnt)
8715                 mgmt_advertising_added(sk, hdev, cp->instance);
8716
8717         if (hdev->cur_adv_instance == cp->instance) {
8718                 /* If the currently advertised instance is being changed then
8719                  * cancel the current advertising and schedule the next
8720                  * instance. If there is only one instance then the overridden
8721                  * advertising data will be visible right away.
8722                  */
8723                 cancel_adv_timeout(hdev);
8724
8725                 next_instance = hci_get_next_instance(hdev, cp->instance);
8726                 if (next_instance)
8727                         schedule_instance = next_instance->instance;
8728         } else if (!hdev->adv_instance_timeout) {
8729                 /* Immediately advertise the new instance if no other
8730                  * instance is currently being advertised.
8731                  */
8732                 schedule_instance = cp->instance;
8733         }
8734
8735         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8736          * there is no instance to be advertised then we have no HCI
8737          * communication to make. Simply return.
8738          */
8739         if (!hdev_is_powered(hdev) ||
8740             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8741             !schedule_instance) {
8742                 rp.instance = cp->instance;
8743                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8744                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8745                 goto unlock;
8746         }
8747
8748         /* We're good to go, update advertising data, parameters, and start
8749          * advertising.
8750          */
8751         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8752                                data_len);
8753         if (!cmd) {
8754                 err = -ENOMEM;
8755                 goto unlock;
8756         }
8757
8758         cp->instance = schedule_instance;
8759
8760         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8761                                  add_advertising_complete);
8762         if (err < 0)
8763                 mgmt_pending_free(cmd);
8764
8765 unlock:
8766         hci_dev_unlock(hdev);
8767
8768         return err;
8769 }
8770
8771 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8772                                         int err)
8773 {
8774         struct mgmt_pending_cmd *cmd = data;
8775         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8776         struct mgmt_rp_add_ext_adv_params rp;
8777         struct adv_info *adv;
8778         u32 flags;
8779
8780         BT_DBG("%s", hdev->name);
8781
8782         hci_dev_lock(hdev);
8783
8784         adv = hci_find_adv_instance(hdev, cp->instance);
8785         if (!adv)
8786                 goto unlock;
8787
8788         rp.instance = cp->instance;
8789         rp.tx_power = adv->tx_power;
8790
8791         /* While we're at it, inform userspace of the available space for this
8792          * advertisement, given the flags that will be used.
8793          */
8794         flags = __le32_to_cpu(cp->flags);
8795         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8796         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8797
8798         if (err) {
8799                 /* If this advertisement was previously advertising and we
8800                  * failed to update it, we signal that it has been removed and
8801                  * delete its structure
8802                  */
8803                 if (!adv->pending)
8804                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8805
8806                 hci_remove_adv_instance(hdev, cp->instance);
8807
8808                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8809                                 mgmt_status(err));
8810         } else {
8811                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8812                                   mgmt_status(err), &rp, sizeof(rp));
8813         }
8814
8815 unlock:
8816         if (cmd)
8817                 mgmt_pending_free(cmd);
8818
8819         hci_dev_unlock(hdev);
8820 }
8821
8822 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8823 {
8824         struct mgmt_pending_cmd *cmd = data;
8825         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8826
8827         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8828 }
8829
8830 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8831                               void *data, u16 data_len)
8832 {
8833         struct mgmt_cp_add_ext_adv_params *cp = data;
8834         struct mgmt_rp_add_ext_adv_params rp;
8835         struct mgmt_pending_cmd *cmd = NULL;
8836         struct adv_info *adv;
8837         u32 flags, min_interval, max_interval;
8838         u16 timeout, duration;
8839         u8 status;
8840         s8 tx_power;
8841         int err;
8842
8843         BT_DBG("%s", hdev->name);
8844
8845         status = mgmt_le_support(hdev);
8846         if (status)
8847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8848                                        status);
8849
8850         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8852                                        MGMT_STATUS_INVALID_PARAMS);
8853
8854         /* The purpose of breaking add_advertising into two separate MGMT calls
8855          * for params and data is to allow more parameters to be added to this
8856          * structure in the future. For this reason, we verify that we have the
8857          * bare minimum structure we know of when the interface was defined. Any
8858          * extra parameters we don't know about will be ignored in this request.
8859          */
8860         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8862                                        MGMT_STATUS_INVALID_PARAMS);
8863
8864         flags = __le32_to_cpu(cp->flags);
8865
8866         if (!requested_adv_flags_are_valid(hdev, flags))
8867                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8868                                        MGMT_STATUS_INVALID_PARAMS);
8869
8870         hci_dev_lock(hdev);
8871
8872         /* In new interface, we require that we are powered to register */
8873         if (!hdev_is_powered(hdev)) {
8874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8875                                       MGMT_STATUS_REJECTED);
8876                 goto unlock;
8877         }
8878
8879         if (adv_busy(hdev)) {
8880                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8881                                       MGMT_STATUS_BUSY);
8882                 goto unlock;
8883         }
8884
8885         /* Parse defined parameters from request, use defaults otherwise */
8886         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8887                   __le16_to_cpu(cp->timeout) : 0;
8888
8889         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8890                    __le16_to_cpu(cp->duration) :
8891                    hdev->def_multi_adv_rotation_duration;
8892
8893         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8894                        __le32_to_cpu(cp->min_interval) :
8895                        hdev->le_adv_min_interval;
8896
8897         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8898                        __le32_to_cpu(cp->max_interval) :
8899                        hdev->le_adv_max_interval;
8900
8901         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8902                    cp->tx_power :
8903                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8904
8905         /* Create advertising instance with no advertising or response data */
8906         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8907                                    timeout, duration, tx_power, min_interval,
8908                                    max_interval, 0);
8909
8910         if (IS_ERR(adv)) {
8911                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8912                                       MGMT_STATUS_FAILED);
8913                 goto unlock;
8914         }
8915
8916         /* Submit request for advertising params if ext adv available */
8917         if (ext_adv_capable(hdev)) {
8918                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8919                                        data, data_len);
8920                 if (!cmd) {
8921                         err = -ENOMEM;
8922                         hci_remove_adv_instance(hdev, cp->instance);
8923                         goto unlock;
8924                 }
8925
8926                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8927                                          add_ext_adv_params_complete);
8928                 if (err < 0)
8929                         mgmt_pending_free(cmd);
8930         } else {
8931                 rp.instance = cp->instance;
8932                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8933                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8934                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8935                 err = mgmt_cmd_complete(sk, hdev->id,
8936                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8937                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8938         }
8939
8940 unlock:
8941         hci_dev_unlock(hdev);
8942
8943         return err;
8944 }
8945
8946 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8947 {
8948         struct mgmt_pending_cmd *cmd = data;
8949         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8950         struct mgmt_rp_add_advertising rp;
8951
8952         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8953
8954         memset(&rp, 0, sizeof(rp));
8955
8956         rp.instance = cp->instance;
8957
8958         if (err)
8959                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8960                                 mgmt_status(err));
8961         else
8962                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8963                                   mgmt_status(err), &rp, sizeof(rp));
8964
8965         mgmt_pending_free(cmd);
8966 }
8967
8968 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8969 {
8970         struct mgmt_pending_cmd *cmd = data;
8971         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8972         int err;
8973
8974         if (ext_adv_capable(hdev)) {
8975                 err = hci_update_adv_data_sync(hdev, cp->instance);
8976                 if (err)
8977                         return err;
8978
8979                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8980                 if (err)
8981                         return err;
8982
8983                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8984         }
8985
8986         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8987 }
8988
8989 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8990                             u16 data_len)
8991 {
8992         struct mgmt_cp_add_ext_adv_data *cp = data;
8993         struct mgmt_rp_add_ext_adv_data rp;
8994         u8 schedule_instance = 0;
8995         struct adv_info *next_instance;
8996         struct adv_info *adv_instance;
8997         int err = 0;
8998         struct mgmt_pending_cmd *cmd;
8999
9000         BT_DBG("%s", hdev->name);
9001
9002         hci_dev_lock(hdev);
9003
9004         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9005
9006         if (!adv_instance) {
9007                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9008                                       MGMT_STATUS_INVALID_PARAMS);
9009                 goto unlock;
9010         }
9011
9012         /* In new interface, we require that we are powered to register */
9013         if (!hdev_is_powered(hdev)) {
9014                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9015                                       MGMT_STATUS_REJECTED);
9016                 goto clear_new_instance;
9017         }
9018
9019         if (adv_busy(hdev)) {
9020                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9021                                       MGMT_STATUS_BUSY);
9022                 goto clear_new_instance;
9023         }
9024
9025         /* Validate new data */
9026         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9027                                cp->adv_data_len, true) ||
9028             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9029                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9030                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9031                                       MGMT_STATUS_INVALID_PARAMS);
9032                 goto clear_new_instance;
9033         }
9034
9035         /* Set the data in the advertising instance */
9036         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9037                                   cp->data, cp->scan_rsp_len,
9038                                   cp->data + cp->adv_data_len);
9039
9040         /* If using software rotation, determine next instance to use */
9041         if (hdev->cur_adv_instance == cp->instance) {
9042                 /* If the currently advertised instance is being changed
9043                  * then cancel the current advertising and schedule the
9044                  * next instance. If there is only one instance then the
9045                  * overridden advertising data will be visible right
9046                  * away
9047                  */
9048                 cancel_adv_timeout(hdev);
9049
9050                 next_instance = hci_get_next_instance(hdev, cp->instance);
9051                 if (next_instance)
9052                         schedule_instance = next_instance->instance;
9053         } else if (!hdev->adv_instance_timeout) {
9054                 /* Immediately advertise the new instance if no other
9055                  * instance is currently being advertised.
9056                  */
9057                 schedule_instance = cp->instance;
9058         }
9059
9060         /* If the HCI_ADVERTISING flag is set or there is no instance to
9061          * be advertised then we have no HCI communication to make.
9062          * Simply return.
9063          */
9064         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9065                 if (adv_instance->pending) {
9066                         mgmt_advertising_added(sk, hdev, cp->instance);
9067                         adv_instance->pending = false;
9068                 }
9069                 rp.instance = cp->instance;
9070                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9071                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9072                 goto unlock;
9073         }
9074
9075         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9076                                data_len);
9077         if (!cmd) {
9078                 err = -ENOMEM;
9079                 goto clear_new_instance;
9080         }
9081
9082         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9083                                  add_ext_adv_data_complete);
9084         if (err < 0) {
9085                 mgmt_pending_free(cmd);
9086                 goto clear_new_instance;
9087         }
9088
9089         /* We were successful in updating data, so trigger advertising_added
9090          * event if this is an instance that wasn't previously advertising. If
9091          * a failure occurs in the requests we initiated, we will remove the
9092          * instance again in add_advertising_complete
9093          */
9094         if (adv_instance->pending)
9095                 mgmt_advertising_added(sk, hdev, cp->instance);
9096
9097         goto unlock;
9098
9099 clear_new_instance:
9100         hci_remove_adv_instance(hdev, cp->instance);
9101
9102 unlock:
9103         hci_dev_unlock(hdev);
9104
9105         return err;
9106 }
9107
9108 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9109                                         int err)
9110 {
9111         struct mgmt_pending_cmd *cmd = data;
9112         struct mgmt_cp_remove_advertising *cp = cmd->param;
9113         struct mgmt_rp_remove_advertising rp;
9114
9115         bt_dev_dbg(hdev, "err %d", err);
9116
9117         memset(&rp, 0, sizeof(rp));
9118         rp.instance = cp->instance;
9119
9120         if (err)
9121                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9122                                 mgmt_status(err));
9123         else
9124                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9125                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9126
9127         mgmt_pending_free(cmd);
9128 }
9129
9130 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9131 {
9132         struct mgmt_pending_cmd *cmd = data;
9133         struct mgmt_cp_remove_advertising *cp = cmd->param;
9134         int err;
9135
9136         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9137         if (err)
9138                 return err;
9139
9140         if (list_empty(&hdev->adv_instances))
9141                 err = hci_disable_advertising_sync(hdev);
9142
9143         return err;
9144 }
9145
9146 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9147                               void *data, u16 data_len)
9148 {
9149         struct mgmt_cp_remove_advertising *cp = data;
9150         struct mgmt_pending_cmd *cmd;
9151         int err;
9152
9153         bt_dev_dbg(hdev, "sock %p", sk);
9154
9155         hci_dev_lock(hdev);
9156
9157         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9158                 err = mgmt_cmd_status(sk, hdev->id,
9159                                       MGMT_OP_REMOVE_ADVERTISING,
9160                                       MGMT_STATUS_INVALID_PARAMS);
9161                 goto unlock;
9162         }
9163
9164         if (pending_find(MGMT_OP_SET_LE, hdev)) {
9165                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9166                                       MGMT_STATUS_BUSY);
9167                 goto unlock;
9168         }
9169
9170         if (list_empty(&hdev->adv_instances)) {
9171                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9172                                       MGMT_STATUS_INVALID_PARAMS);
9173                 goto unlock;
9174         }
9175
9176         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9177                                data_len);
9178         if (!cmd) {
9179                 err = -ENOMEM;
9180                 goto unlock;
9181         }
9182
9183         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9184                                  remove_advertising_complete);
9185         if (err < 0)
9186                 mgmt_pending_free(cmd);
9187
9188 unlock:
9189         hci_dev_unlock(hdev);
9190
9191         return err;
9192 }
9193
9194 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9195                              void *data, u16 data_len)
9196 {
9197         struct mgmt_cp_get_adv_size_info *cp = data;
9198         struct mgmt_rp_get_adv_size_info rp;
9199         u32 flags, supported_flags;
9200
9201         bt_dev_dbg(hdev, "sock %p", sk);
9202
9203         if (!lmp_le_capable(hdev))
9204                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9205                                        MGMT_STATUS_REJECTED);
9206
9207         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9209                                        MGMT_STATUS_INVALID_PARAMS);
9210
9211         flags = __le32_to_cpu(cp->flags);
9212
9213         /* The current implementation only supports a subset of the specified
9214          * flags.
9215          */
9216         supported_flags = get_supported_adv_flags(hdev);
9217         if (flags & ~supported_flags)
9218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9219                                        MGMT_STATUS_INVALID_PARAMS);
9220
9221         rp.instance = cp->instance;
9222         rp.flags = cp->flags;
9223         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9224         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9225
9226         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9227                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9228 }
9229
9230 static const struct hci_mgmt_handler mgmt_handlers[] = {
9231         { NULL }, /* 0x0000 (no command) */
9232         { read_version,            MGMT_READ_VERSION_SIZE,
9233                                                 HCI_MGMT_NO_HDEV |
9234                                                 HCI_MGMT_UNTRUSTED },
9235         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9236                                                 HCI_MGMT_NO_HDEV |
9237                                                 HCI_MGMT_UNTRUSTED },
9238         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9239                                                 HCI_MGMT_NO_HDEV |
9240                                                 HCI_MGMT_UNTRUSTED },
9241         { read_controller_info,    MGMT_READ_INFO_SIZE,
9242                                                 HCI_MGMT_UNTRUSTED },
9243         { set_powered,             MGMT_SETTING_SIZE },
9244         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9245         { set_connectable,         MGMT_SETTING_SIZE },
9246         { set_fast_connectable,    MGMT_SETTING_SIZE },
9247         { set_bondable,            MGMT_SETTING_SIZE },
9248         { set_link_security,       MGMT_SETTING_SIZE },
9249         { set_ssp,                 MGMT_SETTING_SIZE },
9250         { set_hs,                  MGMT_SETTING_SIZE },
9251         { set_le,                  MGMT_SETTING_SIZE },
9252         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9253         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9254         { add_uuid,                MGMT_ADD_UUID_SIZE },
9255         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9256         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9257                                                 HCI_MGMT_VAR_LEN },
9258         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9259                                                 HCI_MGMT_VAR_LEN },
9260         { disconnect,              MGMT_DISCONNECT_SIZE },
9261         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9262         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9263         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9264         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9265         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9266         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9267         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9268         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9269         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9270         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9271         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9272         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9273         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9274                                                 HCI_MGMT_VAR_LEN },
9275         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9276         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9277         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9278         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9279         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9280         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9281         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9282         { set_advertising,         MGMT_SETTING_SIZE },
9283         { set_bredr,               MGMT_SETTING_SIZE },
9284         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9285         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9286         { set_secure_conn,         MGMT_SETTING_SIZE },
9287         { set_debug_keys,          MGMT_SETTING_SIZE },
9288         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9289         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9290                                                 HCI_MGMT_VAR_LEN },
9291         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9292         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9293         { add_device,              MGMT_ADD_DEVICE_SIZE },
9294         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9295         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9296                                                 HCI_MGMT_VAR_LEN },
9297         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9298                                                 HCI_MGMT_NO_HDEV |
9299                                                 HCI_MGMT_UNTRUSTED },
9300         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9301                                                 HCI_MGMT_UNCONFIGURED |
9302                                                 HCI_MGMT_UNTRUSTED },
9303         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9304                                                 HCI_MGMT_UNCONFIGURED },
9305         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9306                                                 HCI_MGMT_UNCONFIGURED },
9307         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9308                                                 HCI_MGMT_VAR_LEN },
9309         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9310         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9311                                                 HCI_MGMT_NO_HDEV |
9312                                                 HCI_MGMT_UNTRUSTED },
9313         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9314         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9315                                                 HCI_MGMT_VAR_LEN },
9316         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9317         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9318         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9319         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9320                                                 HCI_MGMT_UNTRUSTED },
9321         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9322         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9323         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9324         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9325                                                 HCI_MGMT_VAR_LEN },
9326         { set_wideband_speech,     MGMT_SETTING_SIZE },
9327         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
9328                                                 HCI_MGMT_UNTRUSTED },
9329         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9330                                                 HCI_MGMT_UNTRUSTED |
9331                                                 HCI_MGMT_HDEV_OPTIONAL },
9332         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9333                                                 HCI_MGMT_VAR_LEN |
9334                                                 HCI_MGMT_HDEV_OPTIONAL },
9335         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9336                                                 HCI_MGMT_UNTRUSTED },
9337         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9338                                                 HCI_MGMT_VAR_LEN },
9339         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9340                                                 HCI_MGMT_UNTRUSTED },
9341         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9342                                                 HCI_MGMT_VAR_LEN },
9343         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9344         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9345         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9346         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9347                                                 HCI_MGMT_VAR_LEN },
9348         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9349         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9350                                                 HCI_MGMT_VAR_LEN },
9351         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
9352                                                 HCI_MGMT_VAR_LEN },
9353         { add_adv_patterns_monitor_rssi,
9354                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE },
9355         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
9356                                                 HCI_MGMT_VAR_LEN },
9357         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
9358         { mesh_send,               MGMT_MESH_SEND_SIZE,
9359                                                 HCI_MGMT_VAR_LEN },
9360         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
9361 };
9362
9363 void mgmt_index_added(struct hci_dev *hdev)
9364 {
9365         struct mgmt_ev_ext_index ev;
9366
9367         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9368                 return;
9369
9370         switch (hdev->dev_type) {
9371         case HCI_PRIMARY:
9372                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9373                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9374                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9375                         ev.type = 0x01;
9376                 } else {
9377                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9378                                          HCI_MGMT_INDEX_EVENTS);
9379                         ev.type = 0x00;
9380                 }
9381                 break;
9382         case HCI_AMP:
9383                 ev.type = 0x02;
9384                 break;
9385         default:
9386                 return;
9387         }
9388
9389         ev.bus = hdev->bus;
9390
9391         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9392                          HCI_MGMT_EXT_INDEX_EVENTS);
9393 }
9394
9395 void mgmt_index_removed(struct hci_dev *hdev)
9396 {
9397         struct mgmt_ev_ext_index ev;
9398         u8 status = MGMT_STATUS_INVALID_INDEX;
9399
9400         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9401                 return;
9402
9403         switch (hdev->dev_type) {
9404         case HCI_PRIMARY:
9405                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9406
9407                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9408                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9409                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9410                         ev.type = 0x01;
9411                 } else {
9412                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9413                                          HCI_MGMT_INDEX_EVENTS);
9414                         ev.type = 0x00;
9415                 }
9416                 break;
9417         case HCI_AMP:
9418                 ev.type = 0x02;
9419                 break;
9420         default:
9421                 return;
9422         }
9423
9424         ev.bus = hdev->bus;
9425
9426         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9427                          HCI_MGMT_EXT_INDEX_EVENTS);
9428
9429         /* Cancel any remaining timed work */
9430         if (!hci_dev_test_flag(hdev, HCI_MGMT))
9431                 return;
9432         cancel_delayed_work_sync(&hdev->discov_off);
9433         cancel_delayed_work_sync(&hdev->service_cache);
9434         cancel_delayed_work_sync(&hdev->rpa_expired);
9435 }
9436
9437 void mgmt_power_on(struct hci_dev *hdev, int err)
9438 {
9439         struct cmd_lookup match = { NULL, hdev };
9440
9441         bt_dev_dbg(hdev, "err %d", err);
9442
9443         hci_dev_lock(hdev);
9444
9445         if (!err) {
9446                 restart_le_actions(hdev);
9447                 hci_update_passive_scan(hdev);
9448         }
9449
9450         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9451
9452         new_settings(hdev, match.sk);
9453
9454         if (match.sk)
9455                 sock_put(match.sk);
9456
9457         hci_dev_unlock(hdev);
9458 }
9459
9460 void __mgmt_power_off(struct hci_dev *hdev)
9461 {
9462         struct cmd_lookup match = { NULL, hdev };
9463         u8 status, zero_cod[] = { 0, 0, 0 };
9464
9465         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9466
9467         /* If the power off is because of hdev unregistration let
9468          * use the appropriate INVALID_INDEX status. Otherwise use
9469          * NOT_POWERED. We cover both scenarios here since later in
9470          * mgmt_index_removed() any hci_conn callbacks will have already
9471          * been triggered, potentially causing misleading DISCONNECTED
9472          * status responses.
9473          */
9474         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9475                 status = MGMT_STATUS_INVALID_INDEX;
9476         else
9477                 status = MGMT_STATUS_NOT_POWERED;
9478
9479         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9480
9481         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9482                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9483                                    zero_cod, sizeof(zero_cod),
9484                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9485                 ext_info_changed(hdev, NULL);
9486         }
9487
9488         new_settings(hdev, match.sk);
9489
9490         if (match.sk)
9491                 sock_put(match.sk);
9492 }
9493
9494 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9495 {
9496         struct mgmt_pending_cmd *cmd;
9497         u8 status;
9498
9499         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9500         if (!cmd)
9501                 return;
9502
9503         if (err == -ERFKILL)
9504                 status = MGMT_STATUS_RFKILLED;
9505         else
9506                 status = MGMT_STATUS_FAILED;
9507
9508         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9509
9510         mgmt_pending_remove(cmd);
9511 }
9512
9513 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9514                        bool persistent)
9515 {
9516         struct mgmt_ev_new_link_key ev;
9517
9518         memset(&ev, 0, sizeof(ev));
9519
9520         ev.store_hint = persistent;
9521         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9522         ev.key.addr.type = BDADDR_BREDR;
9523         ev.key.type = key->type;
9524         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9525         ev.key.pin_len = key->pin_len;
9526
9527         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9528 }
9529
9530 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9531 {
9532         switch (ltk->type) {
9533         case SMP_LTK:
9534         case SMP_LTK_RESPONDER:
9535                 if (ltk->authenticated)
9536                         return MGMT_LTK_AUTHENTICATED;
9537                 return MGMT_LTK_UNAUTHENTICATED;
9538         case SMP_LTK_P256:
9539                 if (ltk->authenticated)
9540                         return MGMT_LTK_P256_AUTH;
9541                 return MGMT_LTK_P256_UNAUTH;
9542         case SMP_LTK_P256_DEBUG:
9543                 return MGMT_LTK_P256_DEBUG;
9544         }
9545
9546         return MGMT_LTK_UNAUTHENTICATED;
9547 }
9548
9549 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9550 {
9551         struct mgmt_ev_new_long_term_key ev;
9552
9553         memset(&ev, 0, sizeof(ev));
9554
9555         /* Devices using resolvable or non-resolvable random addresses
9556          * without providing an identity resolving key don't require
9557          * to store long term keys. Their addresses will change the
9558          * next time around.
9559          *
9560          * Only when a remote device provides an identity address
9561          * make sure the long term key is stored. If the remote
9562          * identity is known, the long term keys are internally
9563          * mapped to the identity address. So allow static random
9564          * and public addresses here.
9565          */
9566         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9567             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9568                 ev.store_hint = 0x00;
9569         else
9570                 ev.store_hint = persistent;
9571
9572         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9573         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9574         ev.key.type = mgmt_ltk_type(key);
9575         ev.key.enc_size = key->enc_size;
9576         ev.key.ediv = key->ediv;
9577         ev.key.rand = key->rand;
9578
9579         if (key->type == SMP_LTK)
9580                 ev.key.initiator = 1;
9581
9582         /* Make sure we copy only the significant bytes based on the
9583          * encryption key size, and set the rest of the value to zeroes.
9584          */
9585         memcpy(ev.key.val, key->val, key->enc_size);
9586         memset(ev.key.val + key->enc_size, 0,
9587                sizeof(ev.key.val) - key->enc_size);
9588
9589         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9590 }
9591
9592 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9593 {
9594         struct mgmt_ev_new_irk ev;
9595
9596         memset(&ev, 0, sizeof(ev));
9597
9598         ev.store_hint = persistent;
9599
9600         bacpy(&ev.rpa, &irk->rpa);
9601         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9602         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9603         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9604
9605         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9606 }
9607
9608 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9609                    bool persistent)
9610 {
9611         struct mgmt_ev_new_csrk ev;
9612
9613         memset(&ev, 0, sizeof(ev));
9614
9615         /* Devices using resolvable or non-resolvable random addresses
9616          * without providing an identity resolving key don't require
9617          * to store signature resolving keys. Their addresses will change
9618          * the next time around.
9619          *
9620          * Only when a remote device provides an identity address
9621          * make sure the signature resolving key is stored. So allow
9622          * static random and public addresses here.
9623          */
9624         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9625             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9626                 ev.store_hint = 0x00;
9627         else
9628                 ev.store_hint = persistent;
9629
9630         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9631         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9632         ev.key.type = csrk->type;
9633         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9634
9635         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9636 }
9637
9638 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9639                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9640                          u16 max_interval, u16 latency, u16 timeout)
9641 {
9642         struct mgmt_ev_new_conn_param ev;
9643
9644         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9645                 return;
9646
9647         memset(&ev, 0, sizeof(ev));
9648         bacpy(&ev.addr.bdaddr, bdaddr);
9649         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9650         ev.store_hint = store_hint;
9651         ev.min_interval = cpu_to_le16(min_interval);
9652         ev.max_interval = cpu_to_le16(max_interval);
9653         ev.latency = cpu_to_le16(latency);
9654         ev.timeout = cpu_to_le16(timeout);
9655
9656         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9657 }
9658
9659 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9660                            u8 *name, u8 name_len)
9661 {
9662         struct sk_buff *skb;
9663         struct mgmt_ev_device_connected *ev;
9664         u16 eir_len = 0;
9665         u32 flags = 0;
9666
9667         /* allocate buff for LE or BR/EDR adv */
9668         if (conn->le_adv_data_len > 0)
9669                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9670                                      sizeof(*ev) + conn->le_adv_data_len);
9671         else
9672                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9673                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9674                                      eir_precalc_len(sizeof(conn->dev_class)));
9675
9676         ev = skb_put(skb, sizeof(*ev));
9677         bacpy(&ev->addr.bdaddr, &conn->dst);
9678         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9679
9680         if (conn->out)
9681                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9682
9683         ev->flags = __cpu_to_le32(flags);
9684
9685         /* We must ensure that the EIR Data fields are ordered and
9686          * unique. Keep it simple for now and avoid the problem by not
9687          * adding any BR/EDR data to the LE adv.
9688          */
9689         if (conn->le_adv_data_len > 0) {
9690                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9691                 eir_len = conn->le_adv_data_len;
9692         } else {
9693                 if (name)
9694                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9695
9696                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9697                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9698                                                     conn->dev_class, sizeof(conn->dev_class));
9699         }
9700
9701         ev->eir_len = cpu_to_le16(eir_len);
9702
9703         mgmt_event_skb(skb, NULL);
9704 }
9705
9706 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9707 {
9708         struct sock **sk = data;
9709
9710         cmd->cmd_complete(cmd, 0);
9711
9712         *sk = cmd->sk;
9713         sock_hold(*sk);
9714
9715         mgmt_pending_remove(cmd);
9716 }
9717
9718 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9719 {
9720         struct hci_dev *hdev = data;
9721         struct mgmt_cp_unpair_device *cp = cmd->param;
9722
9723         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9724
9725         cmd->cmd_complete(cmd, 0);
9726         mgmt_pending_remove(cmd);
9727 }
9728
9729 bool mgmt_powering_down(struct hci_dev *hdev)
9730 {
9731         struct mgmt_pending_cmd *cmd;
9732         struct mgmt_mode *cp;
9733
9734         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9735         if (!cmd)
9736                 return false;
9737
9738         cp = cmd->param;
9739         if (!cp->val)
9740                 return true;
9741
9742         return false;
9743 }
9744
9745 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9746                               u8 link_type, u8 addr_type, u8 reason,
9747                               bool mgmt_connected)
9748 {
9749         struct mgmt_ev_device_disconnected ev;
9750         struct sock *sk = NULL;
9751
9752         /* The connection is still in hci_conn_hash so test for 1
9753          * instead of 0 to know if this is the last one.
9754          */
9755         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9756                 cancel_delayed_work(&hdev->power_off);
9757                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9758         }
9759
9760         if (!mgmt_connected)
9761                 return;
9762
9763         if (link_type != ACL_LINK && link_type != LE_LINK)
9764                 return;
9765
9766         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9767
9768         bacpy(&ev.addr.bdaddr, bdaddr);
9769         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9770         ev.reason = reason;
9771
9772         /* Report disconnects due to suspend */
9773         if (hdev->suspended)
9774                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9775
9776         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9777
9778         if (sk)
9779                 sock_put(sk);
9780
9781         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9782                              hdev);
9783 }
9784
9785 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9786                             u8 link_type, u8 addr_type, u8 status)
9787 {
9788         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9789         struct mgmt_cp_disconnect *cp;
9790         struct mgmt_pending_cmd *cmd;
9791
9792         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9793                              hdev);
9794
9795         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9796         if (!cmd)
9797                 return;
9798
9799         cp = cmd->param;
9800
9801         if (bacmp(bdaddr, &cp->addr.bdaddr))
9802                 return;
9803
9804         if (cp->addr.type != bdaddr_type)
9805                 return;
9806
9807         cmd->cmd_complete(cmd, mgmt_status(status));
9808         mgmt_pending_remove(cmd);
9809 }
9810
9811 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9812                          u8 addr_type, u8 status)
9813 {
9814         struct mgmt_ev_connect_failed ev;
9815
9816         /* The connection is still in hci_conn_hash so test for 1
9817          * instead of 0 to know if this is the last one.
9818          */
9819         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9820                 cancel_delayed_work(&hdev->power_off);
9821                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9822         }
9823
9824         bacpy(&ev.addr.bdaddr, bdaddr);
9825         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9826         ev.status = mgmt_status(status);
9827
9828         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9829 }
9830
9831 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9832 {
9833         struct mgmt_ev_pin_code_request ev;
9834
9835         bacpy(&ev.addr.bdaddr, bdaddr);
9836         ev.addr.type = BDADDR_BREDR;
9837         ev.secure = secure;
9838
9839         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9840 }
9841
9842 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9843                                   u8 status)
9844 {
9845         struct mgmt_pending_cmd *cmd;
9846
9847         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9848         if (!cmd)
9849                 return;
9850
9851         cmd->cmd_complete(cmd, mgmt_status(status));
9852         mgmt_pending_remove(cmd);
9853 }
9854
9855 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9856                                       u8 status)
9857 {
9858         struct mgmt_pending_cmd *cmd;
9859
9860         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9861         if (!cmd)
9862                 return;
9863
9864         cmd->cmd_complete(cmd, mgmt_status(status));
9865         mgmt_pending_remove(cmd);
9866 }
9867
9868 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9869                               u8 link_type, u8 addr_type, u32 value,
9870                               u8 confirm_hint)
9871 {
9872         struct mgmt_ev_user_confirm_request ev;
9873
9874         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9875
9876         bacpy(&ev.addr.bdaddr, bdaddr);
9877         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9878         ev.confirm_hint = confirm_hint;
9879         ev.value = cpu_to_le32(value);
9880
9881         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9882                           NULL);
9883 }
9884
9885 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9886                               u8 link_type, u8 addr_type)
9887 {
9888         struct mgmt_ev_user_passkey_request ev;
9889
9890         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9891
9892         bacpy(&ev.addr.bdaddr, bdaddr);
9893         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9894
9895         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9896                           NULL);
9897 }
9898
9899 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9900                                       u8 link_type, u8 addr_type, u8 status,
9901                                       u8 opcode)
9902 {
9903         struct mgmt_pending_cmd *cmd;
9904
9905         cmd = pending_find(opcode, hdev);
9906         if (!cmd)
9907                 return -ENOENT;
9908
9909         cmd->cmd_complete(cmd, mgmt_status(status));
9910         mgmt_pending_remove(cmd);
9911
9912         return 0;
9913 }
9914
9915 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9916                                      u8 link_type, u8 addr_type, u8 status)
9917 {
9918         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9919                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9920 }
9921
9922 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9923                                          u8 link_type, u8 addr_type, u8 status)
9924 {
9925         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9926                                           status,
9927                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9928 }
9929
9930 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9931                                      u8 link_type, u8 addr_type, u8 status)
9932 {
9933         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9934                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9935 }
9936
9937 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9938                                          u8 link_type, u8 addr_type, u8 status)
9939 {
9940         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9941                                           status,
9942                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9943 }
9944
9945 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9946                              u8 link_type, u8 addr_type, u32 passkey,
9947                              u8 entered)
9948 {
9949         struct mgmt_ev_passkey_notify ev;
9950
9951         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9952
9953         bacpy(&ev.addr.bdaddr, bdaddr);
9954         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9955         ev.passkey = __cpu_to_le32(passkey);
9956         ev.entered = entered;
9957
9958         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9959 }
9960
9961 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9962 {
9963         struct mgmt_ev_auth_failed ev;
9964         struct mgmt_pending_cmd *cmd;
9965         u8 status = mgmt_status(hci_status);
9966
9967         bacpy(&ev.addr.bdaddr, &conn->dst);
9968         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9969         ev.status = status;
9970
9971         cmd = find_pairing(conn);
9972
9973         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9974                     cmd ? cmd->sk : NULL);
9975
9976         if (cmd) {
9977                 cmd->cmd_complete(cmd, status);
9978                 mgmt_pending_remove(cmd);
9979         }
9980 }
9981
9982 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9983 {
9984         struct cmd_lookup match = { NULL, hdev };
9985         bool changed;
9986
9987         if (status) {
9988                 u8 mgmt_err = mgmt_status(status);
9989                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9990                                      cmd_status_rsp, &mgmt_err);
9991                 return;
9992         }
9993
9994         if (test_bit(HCI_AUTH, &hdev->flags))
9995                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9996         else
9997                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9998
9999         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10000                              &match);
10001
10002         if (changed)
10003                 new_settings(hdev, match.sk);
10004
10005         if (match.sk)
10006                 sock_put(match.sk);
10007 }
10008
10009 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10010 {
10011         struct cmd_lookup *match = data;
10012
10013         if (match->sk == NULL) {
10014                 match->sk = cmd->sk;
10015                 sock_hold(match->sk);
10016         }
10017 }
10018
10019 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10020                                     u8 status)
10021 {
10022         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10023
10024         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
10025         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
10026         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
10027
10028         if (!status) {
10029                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10030                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10031                 ext_info_changed(hdev, NULL);
10032         }
10033
10034         if (match.sk)
10035                 sock_put(match.sk);
10036 }
10037
10038 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10039 {
10040         struct mgmt_cp_set_local_name ev;
10041         struct mgmt_pending_cmd *cmd;
10042
10043         if (status)
10044                 return;
10045
10046         memset(&ev, 0, sizeof(ev));
10047         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10048         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10049
10050         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10051         if (!cmd) {
10052                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10053
10054                 /* If this is a HCI command related to powering on the
10055                  * HCI dev don't send any mgmt signals.
10056                  */
10057                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10058                         return;
10059         }
10060
10061         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10062                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10063         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10064 }
10065
10066 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10067 {
10068         int i;
10069
10070         for (i = 0; i < uuid_count; i++) {
10071                 if (!memcmp(uuid, uuids[i], 16))
10072                         return true;
10073         }
10074
10075         return false;
10076 }
10077
10078 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10079 {
10080         u16 parsed = 0;
10081
10082         while (parsed < eir_len) {
10083                 u8 field_len = eir[0];
10084                 u8 uuid[16];
10085                 int i;
10086
10087                 if (field_len == 0)
10088                         break;
10089
10090                 if (eir_len - parsed < field_len + 1)
10091                         break;
10092
10093                 switch (eir[1]) {
10094                 case EIR_UUID16_ALL:
10095                 case EIR_UUID16_SOME:
10096                         for (i = 0; i + 3 <= field_len; i += 2) {
10097                                 memcpy(uuid, bluetooth_base_uuid, 16);
10098                                 uuid[13] = eir[i + 3];
10099                                 uuid[12] = eir[i + 2];
10100                                 if (has_uuid(uuid, uuid_count, uuids))
10101                                         return true;
10102                         }
10103                         break;
10104                 case EIR_UUID32_ALL:
10105                 case EIR_UUID32_SOME:
10106                         for (i = 0; i + 5 <= field_len; i += 4) {
10107                                 memcpy(uuid, bluetooth_base_uuid, 16);
10108                                 uuid[15] = eir[i + 5];
10109                                 uuid[14] = eir[i + 4];
10110                                 uuid[13] = eir[i + 3];
10111                                 uuid[12] = eir[i + 2];
10112                                 if (has_uuid(uuid, uuid_count, uuids))
10113                                         return true;
10114                         }
10115                         break;
10116                 case EIR_UUID128_ALL:
10117                 case EIR_UUID128_SOME:
10118                         for (i = 0; i + 17 <= field_len; i += 16) {
10119                                 memcpy(uuid, eir + i + 2, 16);
10120                                 if (has_uuid(uuid, uuid_count, uuids))
10121                                         return true;
10122                         }
10123                         break;
10124                 }
10125
10126                 parsed += field_len + 1;
10127                 eir += field_len + 1;
10128         }
10129
10130         return false;
10131 }
10132
10133 static void restart_le_scan(struct hci_dev *hdev)
10134 {
10135         /* If controller is not scanning we are done. */
10136         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
10137                 return;
10138
10139         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
10140                        hdev->discovery.scan_start +
10141                        hdev->discovery.scan_duration))
10142                 return;
10143
10144         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
10145                            DISCOV_LE_RESTART_DELAY);
10146 }
10147
10148 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10149                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10150 {
10151         /* If a RSSI threshold has been specified, and
10152          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10153          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10154          * is set, let it through for further processing, as we might need to
10155          * restart the scan.
10156          *
10157          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10158          * the results are also dropped.
10159          */
10160         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10161             (rssi == HCI_RSSI_INVALID ||
10162             (rssi < hdev->discovery.rssi &&
10163              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10164                 return  false;
10165
10166         if (hdev->discovery.uuid_count != 0) {
10167                 /* If a list of UUIDs is provided in filter, results with no
10168                  * matching UUID should be dropped.
10169                  */
10170                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10171                                    hdev->discovery.uuids) &&
10172                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10173                                    hdev->discovery.uuid_count,
10174                                    hdev->discovery.uuids))
10175                         return false;
10176         }
10177
10178         /* If duplicate filtering does not report RSSI changes, then restart
10179          * scanning to ensure updated result with updated RSSI values.
10180          */
10181         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10182                 restart_le_scan(hdev);
10183
10184                 /* Validate RSSI value against the RSSI threshold once more. */
10185                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10186                     rssi < hdev->discovery.rssi)
10187                         return false;
10188         }
10189
10190         return true;
10191 }
10192
10193 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10194                                   bdaddr_t *bdaddr, u8 addr_type)
10195 {
10196         struct mgmt_ev_adv_monitor_device_lost ev;
10197
10198         ev.monitor_handle = cpu_to_le16(handle);
10199         bacpy(&ev.addr.bdaddr, bdaddr);
10200         ev.addr.type = addr_type;
10201
10202         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10203                    NULL);
10204 }
10205
10206 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10207                                                struct sk_buff *skb,
10208                                                struct sock *skip_sk,
10209                                                u16 handle)
10210 {
10211         struct sk_buff *advmon_skb;
10212         size_t advmon_skb_len;
10213         __le16 *monitor_handle;
10214
10215         if (!skb)
10216                 return;
10217
10218         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10219                           sizeof(struct mgmt_ev_device_found)) + skb->len;
10220         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10221                                     advmon_skb_len);
10222         if (!advmon_skb)
10223                 return;
10224
10225         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10226          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10227          * store monitor_handle of the matched monitor.
10228          */
10229         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10230         *monitor_handle = cpu_to_le16(handle);
10231         skb_put_data(advmon_skb, skb->data, skb->len);
10232
10233         mgmt_event_skb(advmon_skb, skip_sk);
10234 }
10235
10236 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10237                                           bdaddr_t *bdaddr, bool report_device,
10238                                           struct sk_buff *skb,
10239                                           struct sock *skip_sk)
10240 {
10241         struct monitored_device *dev, *tmp;
10242         bool matched = false;
10243         bool notified = false;
10244
10245         /* We have received the Advertisement Report because:
10246          * 1. the kernel has initiated active discovery
10247          * 2. if not, we have pend_le_reports > 0 in which case we are doing
10248          *    passive scanning
10249          * 3. if none of the above is true, we have one or more active
10250          *    Advertisement Monitor
10251          *
10252          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10253          * and report ONLY one advertisement per device for the matched Monitor
10254          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10255          *
10256          * For case 3, since we are not active scanning and all advertisements
10257          * received are due to a matched Advertisement Monitor, report all
10258          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10259          */
10260         if (report_device && !hdev->advmon_pend_notify) {
10261                 mgmt_event_skb(skb, skip_sk);
10262                 return;
10263         }
10264
10265         hdev->advmon_pend_notify = false;
10266
10267         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10268                 if (!bacmp(&dev->bdaddr, bdaddr)) {
10269                         matched = true;
10270
10271                         if (!dev->notified) {
10272                                 mgmt_send_adv_monitor_device_found(hdev, skb,
10273                                                                    skip_sk,
10274                                                                    dev->handle);
10275                                 notified = true;
10276                                 dev->notified = true;
10277                         }
10278                 }
10279
10280                 if (!dev->notified)
10281                         hdev->advmon_pend_notify = true;
10282         }
10283
10284         if (!report_device &&
10285             ((matched && !notified) || !msft_monitor_supported(hdev))) {
10286                 /* Handle 0 indicates that we are not active scanning and this
10287                  * is a subsequent advertisement report for an already matched
10288                  * Advertisement Monitor or the controller offloading support
10289                  * is not available.
10290                  */
10291                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10292         }
10293
10294         if (report_device)
10295                 mgmt_event_skb(skb, skip_sk);
10296         else
10297                 kfree_skb(skb);
10298 }
10299
10300 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10301                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10302                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10303                               u64 instant)
10304 {
10305         struct sk_buff *skb;
10306         struct mgmt_ev_mesh_device_found *ev;
10307         int i, j;
10308
10309         if (!hdev->mesh_ad_types[0])
10310                 goto accepted;
10311
10312         /* Scan for requested AD types */
10313         if (eir_len > 0) {
10314                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10315                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10316                                 if (!hdev->mesh_ad_types[j])
10317                                         break;
10318
10319                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
10320                                         goto accepted;
10321                         }
10322                 }
10323         }
10324
10325         if (scan_rsp_len > 0) {
10326                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10327                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10328                                 if (!hdev->mesh_ad_types[j])
10329                                         break;
10330
10331                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10332                                         goto accepted;
10333                         }
10334                 }
10335         }
10336
10337         return;
10338
10339 accepted:
10340         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10341                              sizeof(*ev) + eir_len + scan_rsp_len);
10342         if (!skb)
10343                 return;
10344
10345         ev = skb_put(skb, sizeof(*ev));
10346
10347         bacpy(&ev->addr.bdaddr, bdaddr);
10348         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10349         ev->rssi = rssi;
10350         ev->flags = cpu_to_le32(flags);
10351         ev->instant = cpu_to_le64(instant);
10352
10353         if (eir_len > 0)
10354                 /* Copy EIR or advertising data into event */
10355                 skb_put_data(skb, eir, eir_len);
10356
10357         if (scan_rsp_len > 0)
10358                 /* Append scan response data to event */
10359                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10360
10361         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10362
10363         mgmt_event_skb(skb, NULL);
10364 }
10365
10366 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10367                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10368                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10369                        u64 instant)
10370 {
10371         struct sk_buff *skb;
10372         struct mgmt_ev_device_found *ev;
10373         bool report_device = hci_discovery_active(hdev);
10374
10375         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10376                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10377                                   eir, eir_len, scan_rsp, scan_rsp_len,
10378                                   instant);
10379
10380         /* Don't send events for a non-kernel initiated discovery. With
10381          * LE one exception is if we have pend_le_reports > 0 in which
10382          * case we're doing passive scanning and want these events.
10383          */
10384         if (!hci_discovery_active(hdev)) {
10385                 if (link_type == ACL_LINK)
10386                         return;
10387                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10388                         report_device = true;
10389                 else if (!hci_is_adv_monitoring(hdev))
10390                         return;
10391         }
10392
10393         if (hdev->discovery.result_filtering) {
10394                 /* We are using service discovery */
10395                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10396                                      scan_rsp_len))
10397                         return;
10398         }
10399
10400         if (hdev->discovery.limited) {
10401                 /* Check for limited discoverable bit */
10402                 if (dev_class) {
10403                         if (!(dev_class[1] & 0x20))
10404                                 return;
10405                 } else {
10406                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10407                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10408                                 return;
10409                 }
10410         }
10411
10412         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10413         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10414                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
10415         if (!skb)
10416                 return;
10417
10418         ev = skb_put(skb, sizeof(*ev));
10419
10420         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10421          * RSSI value was reported as 0 when not available. This behavior
10422          * is kept when using device discovery. This is required for full
10423          * backwards compatibility with the API.
10424          *
10425          * However when using service discovery, the value 127 will be
10426          * returned when the RSSI is not available.
10427          */
10428         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10429             link_type == ACL_LINK)
10430                 rssi = 0;
10431
10432         bacpy(&ev->addr.bdaddr, bdaddr);
10433         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10434         ev->rssi = rssi;
10435         ev->flags = cpu_to_le32(flags);
10436
10437         if (eir_len > 0)
10438                 /* Copy EIR or advertising data into event */
10439                 skb_put_data(skb, eir, eir_len);
10440
10441         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10442                 u8 eir_cod[5];
10443
10444                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10445                                            dev_class, 3);
10446                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10447         }
10448
10449         if (scan_rsp_len > 0)
10450                 /* Append scan response data to event */
10451                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10452
10453         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10454
10455         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10456 }
10457
10458 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10459                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10460 {
10461         struct sk_buff *skb;
10462         struct mgmt_ev_device_found *ev;
10463         u16 eir_len = 0;
10464         u32 flags = 0;
10465
10466         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10467                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10468
10469         ev = skb_put(skb, sizeof(*ev));
10470         bacpy(&ev->addr.bdaddr, bdaddr);
10471         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10472         ev->rssi = rssi;
10473
10474         if (name)
10475                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10476         else
10477                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10478
10479         ev->eir_len = cpu_to_le16(eir_len);
10480         ev->flags = cpu_to_le32(flags);
10481
10482         mgmt_event_skb(skb, NULL);
10483 }
10484
10485 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10486 {
10487         struct mgmt_ev_discovering ev;
10488
10489         bt_dev_dbg(hdev, "discovering %u", discovering);
10490
10491         memset(&ev, 0, sizeof(ev));
10492         ev.type = hdev->discovery.type;
10493         ev.discovering = discovering;
10494
10495         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10496 }
10497
10498 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10499 {
10500         struct mgmt_ev_controller_suspend ev;
10501
10502         ev.suspend_state = state;
10503         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10504 }
10505
10506 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10507                    u8 addr_type)
10508 {
10509         struct mgmt_ev_controller_resume ev;
10510
10511         ev.wake_reason = reason;
10512         if (bdaddr) {
10513                 bacpy(&ev.addr.bdaddr, bdaddr);
10514                 ev.addr.type = addr_type;
10515         } else {
10516                 memset(&ev.addr, 0, sizeof(ev.addr));
10517         }
10518
10519         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10520 }
10521
10522 static struct hci_mgmt_chan chan = {
10523         .channel        = HCI_CHANNEL_CONTROL,
10524         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10525         .handlers       = mgmt_handlers,
10526         .hdev_init      = mgmt_init_hdev,
10527 };
10528
10529 int mgmt_init(void)
10530 {
10531         return hci_mgmt_chan_register(&chan);
10532 }
10533
10534 void mgmt_exit(void)
10535 {
10536         hci_mgmt_chan_unregister(&chan);
10537 }
10538
10539 void mgmt_cleanup(struct sock *sk)
10540 {
10541         struct mgmt_mesh_tx *mesh_tx;
10542         struct hci_dev *hdev;
10543
10544         read_lock(&hci_dev_list_lock);
10545
10546         list_for_each_entry(hdev, &hci_dev_list, list) {
10547                 do {
10548                         mesh_tx = mgmt_mesh_next(hdev, sk);
10549
10550                         if (mesh_tx)
10551                                 mesh_send_complete(hdev, mesh_tx, true);
10552                 } while (mesh_tx);
10553         }
10554
10555         read_unlock(&hci_dev_list_lock);
10556 }