net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   19
  44
  45 static const u16 mgmt_commands[] = {
  46         MGMT_OP_READ_INDEX_LIST,
  47         MGMT_OP_READ_INFO,
  48         MGMT_OP_SET_POWERED,
  49         MGMT_OP_SET_DISCOVERABLE,
  50         MGMT_OP_SET_CONNECTABLE,
  51         MGMT_OP_SET_FAST_CONNECTABLE,
  52         MGMT_OP_SET_BONDABLE,
  53         MGMT_OP_SET_LINK_SECURITY,
  54         MGMT_OP_SET_SSP,
  55         MGMT_OP_SET_HS,
  56         MGMT_OP_SET_LE,
  57         MGMT_OP_SET_DEV_CLASS,
  58         MGMT_OP_SET_LOCAL_NAME,
  59         MGMT_OP_ADD_UUID,
  60         MGMT_OP_REMOVE_UUID,
  61         MGMT_OP_LOAD_LINK_KEYS,
  62         MGMT_OP_LOAD_LONG_TERM_KEYS,
  63         MGMT_OP_DISCONNECT,
  64         MGMT_OP_GET_CONNECTIONS,
  65         MGMT_OP_PIN_CODE_REPLY,
  66         MGMT_OP_PIN_CODE_NEG_REPLY,
  67         MGMT_OP_SET_IO_CAPABILITY,
  68         MGMT_OP_PAIR_DEVICE,
  69         MGMT_OP_CANCEL_PAIR_DEVICE,
  70         MGMT_OP_UNPAIR_DEVICE,
  71         MGMT_OP_USER_CONFIRM_REPLY,
  72         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  73         MGMT_OP_USER_PASSKEY_REPLY,
  74         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  75         MGMT_OP_READ_LOCAL_OOB_DATA,
  76         MGMT_OP_ADD_REMOTE_OOB_DATA,
  77         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  78         MGMT_OP_START_DISCOVERY,
  79         MGMT_OP_STOP_DISCOVERY,
  80         MGMT_OP_CONFIRM_NAME,
  81         MGMT_OP_BLOCK_DEVICE,
  82         MGMT_OP_UNBLOCK_DEVICE,
  83         MGMT_OP_SET_DEVICE_ID,
  84         MGMT_OP_SET_ADVERTISING,
  85         MGMT_OP_SET_BREDR,
  86         MGMT_OP_SET_STATIC_ADDRESS,
  87         MGMT_OP_SET_SCAN_PARAMS,
  88         MGMT_OP_SET_SECURE_CONN,
  89         MGMT_OP_SET_DEBUG_KEYS,
  90         MGMT_OP_SET_PRIVACY,
  91         MGMT_OP_LOAD_IRKS,
  92         MGMT_OP_GET_CONN_INFO,
  93         MGMT_OP_GET_CLOCK_INFO,
  94         MGMT_OP_ADD_DEVICE,
  95         MGMT_OP_REMOVE_DEVICE,
  96         MGMT_OP_LOAD_CONN_PARAM,
  97         MGMT_OP_READ_UNCONF_INDEX_LIST,
  98         MGMT_OP_READ_CONFIG_INFO,
  99         MGMT_OP_SET_EXTERNAL_CONFIG,
 100         MGMT_OP_SET_PUBLIC_ADDRESS,
 101         MGMT_OP_START_SERVICE_DISCOVERY,
 102         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 103         MGMT_OP_READ_EXT_INDEX_LIST,
 104         MGMT_OP_READ_ADV_FEATURES,
 105         MGMT_OP_ADD_ADVERTISING,
 106         MGMT_OP_REMOVE_ADVERTISING,
 107         MGMT_OP_GET_ADV_SIZE_INFO,
 108         MGMT_OP_START_LIMITED_DISCOVERY,
 109         MGMT_OP_READ_EXT_INFO,
 110         MGMT_OP_SET_APPEARANCE,
 111         MGMT_OP_GET_PHY_CONFIGURATION,
 112         MGMT_OP_SET_PHY_CONFIGURATION,
 113         MGMT_OP_SET_BLOCKED_KEYS,
 114         MGMT_OP_SET_WIDEBAND_SPEECH,
 115         MGMT_OP_READ_CONTROLLER_CAP,
 116         MGMT_OP_READ_EXP_FEATURES_INFO,
 117         MGMT_OP_SET_EXP_FEATURE,
 118         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 119         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 121         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_GET_DEVICE_FLAGS,
 123         MGMT_OP_SET_DEVICE_FLAGS,
 124         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 125         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 126         MGMT_OP_REMOVE_ADV_MONITOR,
 127         MGMT_OP_ADD_EXT_ADV_PARAMS,
 128         MGMT_OP_ADD_EXT_ADV_DATA,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 130 };
 131
 132 static const u16 mgmt_events[] = {
 133         MGMT_EV_CONTROLLER_ERROR,
 134         MGMT_EV_INDEX_ADDED,
 135         MGMT_EV_INDEX_REMOVED,
 136         MGMT_EV_NEW_SETTINGS,
 137         MGMT_EV_CLASS_OF_DEV_CHANGED,
 138         MGMT_EV_LOCAL_NAME_CHANGED,
 139         MGMT_EV_NEW_LINK_KEY,
 140         MGMT_EV_NEW_LONG_TERM_KEY,
 141         MGMT_EV_DEVICE_CONNECTED,
 142         MGMT_EV_DEVICE_DISCONNECTED,
 143         MGMT_EV_CONNECT_FAILED,
 144         MGMT_EV_PIN_CODE_REQUEST,
 145         MGMT_EV_USER_CONFIRM_REQUEST,
 146         MGMT_EV_USER_PASSKEY_REQUEST,
 147         MGMT_EV_AUTH_FAILED,
 148         MGMT_EV_DEVICE_FOUND,
 149         MGMT_EV_DISCOVERING,
 150         MGMT_EV_DEVICE_BLOCKED,
 151         MGMT_EV_DEVICE_UNBLOCKED,
 152         MGMT_EV_DEVICE_UNPAIRED,
 153         MGMT_EV_PASSKEY_NOTIFY,
 154         MGMT_EV_NEW_IRK,
 155         MGMT_EV_NEW_CSRK,
 156         MGMT_EV_DEVICE_ADDED,
 157         MGMT_EV_DEVICE_REMOVED,
 158         MGMT_EV_NEW_CONN_PARAM,
 159         MGMT_EV_UNCONF_INDEX_ADDED,
 160         MGMT_EV_UNCONF_INDEX_REMOVED,
 161         MGMT_EV_NEW_CONFIG_OPTIONS,
 162         MGMT_EV_EXT_INDEX_ADDED,
 163         MGMT_EV_EXT_INDEX_REMOVED,
 164         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 165         MGMT_EV_ADVERTISING_ADDED,
 166         MGMT_EV_ADVERTISING_REMOVED,
 167         MGMT_EV_EXT_INFO_CHANGED,
 168         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 169         MGMT_EV_EXP_FEATURE_CHANGED,
 170         MGMT_EV_DEVICE_FLAGS_CHANGED,
 171         MGMT_EV_ADV_MONITOR_ADDED,
 172         MGMT_EV_ADV_MONITOR_REMOVED,
 173         MGMT_EV_CONTROLLER_SUSPEND,
 174         MGMT_EV_CONTROLLER_RESUME,
 175 };
 176
 177 static const u16 mgmt_untrusted_commands[] = {
 178         MGMT_OP_READ_INDEX_LIST,
 179         MGMT_OP_READ_INFO,
 180         MGMT_OP_READ_UNCONF_INDEX_LIST,
 181         MGMT_OP_READ_CONFIG_INFO,
 182         MGMT_OP_READ_EXT_INDEX_LIST,
 183         MGMT_OP_READ_EXT_INFO,
 184         MGMT_OP_READ_CONTROLLER_CAP,
 185         MGMT_OP_READ_EXP_FEATURES_INFO,
 186         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 187         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 188 };
 189
 190 static const u16 mgmt_untrusted_events[] = {
 191         MGMT_EV_INDEX_ADDED,
 192         MGMT_EV_INDEX_REMOVED,
 193         MGMT_EV_NEW_SETTINGS,
 194         MGMT_EV_CLASS_OF_DEV_CHANGED,
 195         MGMT_EV_LOCAL_NAME_CHANGED,
 196         MGMT_EV_UNCONF_INDEX_ADDED,
 197         MGMT_EV_UNCONF_INDEX_REMOVED,
 198         MGMT_EV_NEW_CONFIG_OPTIONS,
 199         MGMT_EV_EXT_INDEX_ADDED,
 200         MGMT_EV_EXT_INDEX_REMOVED,
 201         MGMT_EV_EXT_INFO_CHANGED,
 202         MGMT_EV_EXP_FEATURE_CHANGED,
 203 };
 204
 205 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 206
 207 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 208                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 209
 210 /* HCI to MGMT error code conversion table */
 211 static const u8 mgmt_status_table[] = {
 212         MGMT_STATUS_SUCCESS,
 213         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 214         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 215         MGMT_STATUS_FAILED,             /* Hardware Failure */
 216         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 217         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 218         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 219         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 220         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 221         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 222         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 223         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 224         MGMT_STATUS_BUSY,               /* Command Disallowed */
 225         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 226         MGMT_STATUS_REJECTED,           /* Rejected Security */
 227         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 228         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 229         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 230         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 231         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 232         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 233         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 234         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 235         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 236         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 237         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 238         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 239         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 240         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 241         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 243         MGMT_STATUS_FAILED,             /* Unspecified Error */
 244         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 245         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 246         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 247         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 248         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 249         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 250         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 252         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 253         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 254         MGMT_STATUS_FAILED,             /* Transaction Collision */
 255         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 256         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 258         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 260         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 261         MGMT_STATUS_FAILED,             /* Slot Violation */
 262         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 263         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 265         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 266         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 267         MGMT_STATUS_BUSY,               /* Controller Busy */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 269         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 270         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 271         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 272         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 273 };
 274
 275 static u8 mgmt_status(u8 hci_status)
 276 {
 277         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 278                 return mgmt_status_table[hci_status];
 279
 280         return MGMT_STATUS_FAILED;
 281 }
 282
 283 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 284                             u16 len, int flag)
 285 {
 286         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 287                                flag, NULL);
 288 }
 289
 290 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 291                               u16 len, int flag, struct sock *skip_sk)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, skip_sk);
 295 }
 296
 297 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 298                       struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                HCI_SOCK_TRUSTED, skip_sk);
 302 }
 303
 304 static u8 le_addr_type(u8 mgmt_addr_type)
 305 {
 306         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 307                 return ADDR_LE_DEV_PUBLIC;
 308         else
 309                 return ADDR_LE_DEV_RANDOM;
 310 }
 311
 312 void mgmt_fill_version_info(void *ver)
 313 {
 314         struct mgmt_rp_read_version *rp = ver;
 315
 316         rp->version = MGMT_VERSION;
 317         rp->revision = cpu_to_le16(MGMT_REVISION);
 318 }
 319
 320 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 321                         u16 data_len)
 322 {
 323         struct mgmt_rp_read_version rp;
 324
 325         bt_dev_dbg(hdev, "sock %p", sk);
 326
 327         mgmt_fill_version_info(&rp);
 328
 329         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 330                                  &rp, sizeof(rp));
 331 }
 332
 333 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 334                          u16 data_len)
 335 {
 336         struct mgmt_rp_read_commands *rp;
 337         u16 num_commands, num_events;
 338         size_t rp_size;
 339         int i, err;
 340
 341         bt_dev_dbg(hdev, "sock %p", sk);
 342
 343         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 344                 num_commands = ARRAY_SIZE(mgmt_commands);
 345                 num_events = ARRAY_SIZE(mgmt_events);
 346         } else {
 347                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 348                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 349         }
 350
 351         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 352
 353         rp = kmalloc(rp_size, GFP_KERNEL);
 354         if (!rp)
 355                 return -ENOMEM;
 356
 357         rp->num_commands = cpu_to_le16(num_commands);
 358         rp->num_events = cpu_to_le16(num_events);
 359
 360         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 361                 __le16 *opcode = rp->opcodes;
 362
 363                 for (i = 0; i < num_commands; i++, opcode++)
 364                         put_unaligned_le16(mgmt_commands[i], opcode);
 365
 366                 for (i = 0; i < num_events; i++, opcode++)
 367                         put_unaligned_le16(mgmt_events[i], opcode);
 368         } else {
 369                 __le16 *opcode = rp->opcodes;
 370
 371                 for (i = 0; i < num_commands; i++, opcode++)
 372                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 373
 374                 for (i = 0; i < num_events; i++, opcode++)
 375                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 376         }
 377
 378         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 379                                 rp, rp_size);
 380         kfree(rp);
 381
 382         return err;
 383 }
 384
 385 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 386                            u16 data_len)
 387 {
 388         struct mgmt_rp_read_index_list *rp;
 389         struct hci_dev *d;
 390         size_t rp_len;
 391         u16 count;
 392         int err;
 393
 394         bt_dev_dbg(hdev, "sock %p", sk);
 395
 396         read_lock(&hci_dev_list_lock);
 397
 398         count = 0;
 399         list_for_each_entry(d, &hci_dev_list, list) {
 400                 if (d->dev_type == HCI_PRIMARY &&
 401                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 402                         count++;
 403         }
 404
 405         rp_len = sizeof(*rp) + (2 * count);
 406         rp = kmalloc(rp_len, GFP_ATOMIC);
 407         if (!rp) {
 408                 read_unlock(&hci_dev_list_lock);
 409                 return -ENOMEM;
 410         }
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 415                     hci_dev_test_flag(d, HCI_CONFIG) ||
 416                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 417                         continue;
 418
 419                 /* Devices marked as raw-only are neither configured
 420                  * nor unconfigured controllers.
 421                  */
 422                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 423                         continue;
 424
 425                 if (d->dev_type == HCI_PRIMARY &&
 426                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 427                         rp->index[count++] = cpu_to_le16(d->id);
 428                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 429                 }
 430         }
 431
 432         rp->num_controllers = cpu_to_le16(count);
 433         rp_len = sizeof(*rp) + (2 * count);
 434
 435         read_unlock(&hci_dev_list_lock);
 436
 437         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 438                                 0, rp, rp_len);
 439
 440         kfree(rp);
 441
 442         return err;
 443 }
 444
 445 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 446                                   void *data, u16 data_len)
 447 {
 448         struct mgmt_rp_read_unconf_index_list *rp;
 449         struct hci_dev *d;
 450         size_t rp_len;
 451         u16 count;
 452         int err;
 453
 454         bt_dev_dbg(hdev, "sock %p", sk);
 455
 456         read_lock(&hci_dev_list_lock);
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (d->dev_type == HCI_PRIMARY &&
 461                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 462                         count++;
 463         }
 464
 465         rp_len = sizeof(*rp) + (2 * count);
 466         rp = kmalloc(rp_len, GFP_ATOMIC);
 467         if (!rp) {
 468                 read_unlock(&hci_dev_list_lock);
 469                 return -ENOMEM;
 470         }
 471
 472         count = 0;
 473         list_for_each_entry(d, &hci_dev_list, list) {
 474                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 475                     hci_dev_test_flag(d, HCI_CONFIG) ||
 476                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 477                         continue;
 478
 479                 /* Devices marked as raw-only are neither configured
 480                  * nor unconfigured controllers.
 481                  */
 482                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 483                         continue;
 484
 485                 if (d->dev_type == HCI_PRIMARY &&
 486                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 487                         rp->index[count++] = cpu_to_le16(d->id);
 488                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 489                 }
 490         }
 491
 492         rp->num_controllers = cpu_to_le16(count);
 493         rp_len = sizeof(*rp) + (2 * count);
 494
 495         read_unlock(&hci_dev_list_lock);
 496
 497         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 498                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 499
 500         kfree(rp);
 501
 502         return err;
 503 }
 504
 505 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 506                                void *data, u16 data_len)
 507 {
 508         struct mgmt_rp_read_ext_index_list *rp;
 509         struct hci_dev *d;
 510         u16 count;
 511         int err;
 512
 513         bt_dev_dbg(hdev, "sock %p", sk);
 514
 515         read_lock(&hci_dev_list_lock);
 516
 517         count = 0;
 518         list_for_each_entry(d, &hci_dev_list, list) {
 519                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 520                         count++;
 521         }
 522
 523         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 524         if (!rp) {
 525                 read_unlock(&hci_dev_list_lock);
 526                 return -ENOMEM;
 527         }
 528
 529         count = 0;
 530         list_for_each_entry(d, &hci_dev_list, list) {
 531                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 532                     hci_dev_test_flag(d, HCI_CONFIG) ||
 533                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 534                         continue;
 535
 536                 /* Devices marked as raw-only are neither configured
 537                  * nor unconfigured controllers.
 538                  */
 539                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 540                         continue;
 541
 542                 if (d->dev_type == HCI_PRIMARY) {
 543                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 544                                 rp->entry[count].type = 0x01;
 545                         else
 546                                 rp->entry[count].type = 0x00;
 547                 } else if (d->dev_type == HCI_AMP) {
 548                         rp->entry[count].type = 0x02;
 549                 } else {
 550                         continue;
 551                 }
 552
 553                 rp->entry[count].bus = d->bus;
 554                 rp->entry[count++].index = cpu_to_le16(d->id);
 555                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 556         }
 557
 558         rp->num_controllers = cpu_to_le16(count);
 559
 560         read_unlock(&hci_dev_list_lock);
 561
 562         /* If this command is called at least once, then all the
 563          * default index and unconfigured index events are disabled
 564          * and from now on only extended index events are used.
 565          */
 566         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 567         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 568         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 569
 570         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 571                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 572                                 struct_size(rp, entry, count));
 573
 574         kfree(rp);
 575
 576         return err;
 577 }
 578
 579 static bool is_configured(struct hci_dev *hdev)
 580 {
 581         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 582             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 583                 return false;
 584
 585         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 586              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 587             !bacmp(&hdev->public_addr, BDADDR_ANY))
 588                 return false;
 589
 590         return true;
 591 }
 592
 593 static __le32 get_missing_options(struct hci_dev *hdev)
 594 {
 595         u32 options = 0;
 596
 597         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 598             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 599                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 600
 601         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 602              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 603             !bacmp(&hdev->public_addr, BDADDR_ANY))
 604                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 605
 606         return cpu_to_le32(options);
 607 }
 608
 609 static int new_options(struct hci_dev *hdev, struct sock *skip)
 610 {
 611         __le32 options = get_missing_options(hdev);
 612
 613         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 614                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 615 }
 616
 617 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 618 {
 619         __le32 options = get_missing_options(hdev);
 620
 621         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 622                                  sizeof(options));
 623 }
 624
 625 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 626                             void *data, u16 data_len)
 627 {
 628         struct mgmt_rp_read_config_info rp;
 629         u32 options = 0;
 630
 631         bt_dev_dbg(hdev, "sock %p", sk);
 632
 633         hci_dev_lock(hdev);
 634
 635         memset(&rp, 0, sizeof(rp));
 636         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 639                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 640
 641         if (hdev->set_bdaddr)
 642                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 643
 644         rp.supported_options = cpu_to_le32(options);
 645         rp.missing_options = get_missing_options(hdev);
 646
 647         hci_dev_unlock(hdev);
 648
 649         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 650                                  &rp, sizeof(rp));
 651 }
 652
 653 static u32 get_supported_phys(struct hci_dev *hdev)
 654 {
 655         u32 supported_phys = 0;
 656
 657         if (lmp_bredr_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 659
 660                 if (hdev->features[0][0] & LMP_3SLOT)
 661                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 662
 663                 if (hdev->features[0][0] & LMP_5SLOT)
 664                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 665
 666                 if (lmp_edr_2m_capable(hdev)) {
 667                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 668
 669                         if (lmp_edr_3slot_capable(hdev))
 670                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 671
 672                         if (lmp_edr_5slot_capable(hdev))
 673                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 674
 675                         if (lmp_edr_3m_capable(hdev)) {
 676                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 677
 678                                 if (lmp_edr_3slot_capable(hdev))
 679                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 680
 681                                 if (lmp_edr_5slot_capable(hdev))
 682                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 683                         }
 684                 }
 685         }
 686
 687         if (lmp_le_capable(hdev)) {
 688                 supported_phys |= MGMT_PHY_LE_1M_TX;
 689                 supported_phys |= MGMT_PHY_LE_1M_RX;
 690
 691                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 692                         supported_phys |= MGMT_PHY_LE_2M_TX;
 693                         supported_phys |= MGMT_PHY_LE_2M_RX;
 694                 }
 695
 696                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 697                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 698                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 699                 }
 700         }
 701
 702         return supported_phys;
 703 }
 704
 705 static u32 get_selected_phys(struct hci_dev *hdev)
 706 {
 707         u32 selected_phys = 0;
 708
 709         if (lmp_bredr_capable(hdev)) {
 710                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 711
 712                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 713                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 714
 715                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 716                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 717
 718                 if (lmp_edr_2m_capable(hdev)) {
 719                         if (!(hdev->pkt_type & HCI_2DH1))
 720                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 721
 722                         if (lmp_edr_3slot_capable(hdev) &&
 723                             !(hdev->pkt_type & HCI_2DH3))
 724                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 725
 726                         if (lmp_edr_5slot_capable(hdev) &&
 727                             !(hdev->pkt_type & HCI_2DH5))
 728                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 729
 730                         if (lmp_edr_3m_capable(hdev)) {
 731                                 if (!(hdev->pkt_type & HCI_3DH1))
 732                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 733
 734                                 if (lmp_edr_3slot_capable(hdev) &&
 735                                     !(hdev->pkt_type & HCI_3DH3))
 736                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 737
 738                                 if (lmp_edr_5slot_capable(hdev) &&
 739                                     !(hdev->pkt_type & HCI_3DH5))
 740                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 741                         }
 742                 }
 743         }
 744
 745         if (lmp_le_capable(hdev)) {
 746                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 747                         selected_phys |= MGMT_PHY_LE_1M_TX;
 748
 749                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 750                         selected_phys |= MGMT_PHY_LE_1M_RX;
 751
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 753                         selected_phys |= MGMT_PHY_LE_2M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 756                         selected_phys |= MGMT_PHY_LE_2M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 759                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 762                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 763         }
 764
 765         return selected_phys;
 766 }
 767
 768 static u32 get_configurable_phys(struct hci_dev *hdev)
 769 {
 770         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 771                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 772 }
 773
 774 static u32 get_supported_settings(struct hci_dev *hdev)
 775 {
 776         u32 settings = 0;
 777
 778         settings |= MGMT_SETTING_POWERED;
 779         settings |= MGMT_SETTING_BONDABLE;
 780         settings |= MGMT_SETTING_DEBUG_KEYS;
 781         settings |= MGMT_SETTING_CONNECTABLE;
 782         settings |= MGMT_SETTING_DISCOVERABLE;
 783
 784         if (lmp_bredr_capable(hdev)) {
 785                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 786                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 787                 settings |= MGMT_SETTING_BREDR;
 788                 settings |= MGMT_SETTING_LINK_SECURITY;
 789
 790                 if (lmp_ssp_capable(hdev)) {
 791                         settings |= MGMT_SETTING_SSP;
 792                         if (IS_ENABLED(CONFIG_BT_HS))
 793                                 settings |= MGMT_SETTING_HS;
 794                 }
 795
 796                 if (lmp_sc_capable(hdev))
 797                         settings |= MGMT_SETTING_SECURE_CONN;
 798
 799                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 800                              &hdev->quirks))
 801                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 802         }
 803
 804         if (lmp_le_capable(hdev)) {
 805                 settings |= MGMT_SETTING_LE;
 806                 settings |= MGMT_SETTING_SECURE_CONN;
 807                 settings |= MGMT_SETTING_PRIVACY;
 808                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 809
 810                 /* When the experimental feature for LL Privacy support is
 811                  * enabled, then advertising is no longer supported.
 812                  */
 813                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 814                         settings |= MGMT_SETTING_ADVERTISING;
 815         }
 816
 817         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 818             hdev->set_bdaddr)
 819                 settings |= MGMT_SETTING_CONFIGURATION;
 820
 821         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 822
 823         return settings;
 824 }
 825
 826 static u32 get_current_settings(struct hci_dev *hdev)
 827 {
 828         u32 settings = 0;
 829
 830         if (hdev_is_powered(hdev))
 831                 settings |= MGMT_SETTING_POWERED;
 832
 833         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 834                 settings |= MGMT_SETTING_CONNECTABLE;
 835
 836         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 837                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 838
 839         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 840                 settings |= MGMT_SETTING_DISCOVERABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 843                 settings |= MGMT_SETTING_BONDABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 846                 settings |= MGMT_SETTING_BREDR;
 847
 848         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 849                 settings |= MGMT_SETTING_LE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 852                 settings |= MGMT_SETTING_LINK_SECURITY;
 853
 854         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 855                 settings |= MGMT_SETTING_SSP;
 856
 857         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 858                 settings |= MGMT_SETTING_HS;
 859
 860         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 861                 settings |= MGMT_SETTING_ADVERTISING;
 862
 863         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 864                 settings |= MGMT_SETTING_SECURE_CONN;
 865
 866         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 867                 settings |= MGMT_SETTING_DEBUG_KEYS;
 868
 869         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 870                 settings |= MGMT_SETTING_PRIVACY;
 871
 872         /* The current setting for static address has two purposes. The
 873          * first is to indicate if the static address will be used and
 874          * the second is to indicate if it is actually set.
 875          *
 876          * This means if the static address is not configured, this flag
 877          * will never be set. If the address is configured, then if the
 878          * address is actually used decides if the flag is set or not.
 879          *
 880          * For single mode LE only controllers and dual-mode controllers
 881          * with BR/EDR disabled, the existence of the static address will
 882          * be evaluated.
 883          */
 884         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 885             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 886             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 887                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 888                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 889         }
 890
 891         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 892                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 893
 894         return settings;
 895 }
 896
 897 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 898 {
 899         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 900 }
 901
 902 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 903                                                   struct hci_dev *hdev,
 904                                                   const void *data)
 905 {
 906         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 907 }
 908
 909 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 910 {
 911         struct mgmt_pending_cmd *cmd;
 912
 913         /* If there's a pending mgmt command the flags will not yet have
 914          * their final values, so check for this first.
 915          */
 916         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 917         if (cmd) {
 918                 struct mgmt_mode *cp = cmd->param;
 919                 if (cp->val == 0x01)
 920                         return LE_AD_GENERAL;
 921                 else if (cp->val == 0x02)
 922                         return LE_AD_LIMITED;
 923         } else {
 924                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 925                         return LE_AD_LIMITED;
 926                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 927                         return LE_AD_GENERAL;
 928         }
 929
 930         return 0;
 931 }
 932
 933 bool mgmt_get_connectable(struct hci_dev *hdev)
 934 {
 935         struct mgmt_pending_cmd *cmd;
 936
 937         /* If there's a pending mgmt command the flag will not yet have
 938          * it's final value, so check for this first.
 939          */
 940         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 941         if (cmd) {
 942                 struct mgmt_mode *cp = cmd->param;
 943
 944                 return cp->val;
 945         }
 946
 947         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 948 }
 949
 950 static void service_cache_off(struct work_struct *work)
 951 {
 952         struct hci_dev *hdev = container_of(work, struct hci_dev,
 953                                             service_cache.work);
 954         struct hci_request req;
 955
 956         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 957                 return;
 958
 959         hci_req_init(&req, hdev);
 960
 961         hci_dev_lock(hdev);
 962
 963         __hci_req_update_eir(&req);
 964         __hci_req_update_class(&req);
 965
 966         hci_dev_unlock(hdev);
 967
 968         hci_req_run(&req, NULL);
 969 }
 970
 971 static void rpa_expired(struct work_struct *work)
 972 {
 973         struct hci_dev *hdev = container_of(work, struct hci_dev,
 974                                             rpa_expired.work);
 975         struct hci_request req;
 976
 977         bt_dev_dbg(hdev, "");
 978
 979         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 980
 981         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 982                 return;
 983
 984         /* The generation of a new RPA and programming it into the
 985          * controller happens in the hci_req_enable_advertising()
 986          * function.
 987          */
 988         hci_req_init(&req, hdev);
 989         if (ext_adv_capable(hdev))
 990                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 991         else
 992                 __hci_req_enable_advertising(&req);
 993         hci_req_run(&req, NULL);
 994 }
 995
 996 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 997 {
 998         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 999                 return;
1000
1001         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1002         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1003
1004         /* Non-mgmt controlled devices get this bit set
1005          * implicitly so that pairing works for them, however
1006          * for mgmt we require user-space to explicitly enable
1007          * it
1008          */
1009         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1010 }
1011
1012 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1013                                 void *data, u16 data_len)
1014 {
1015         struct mgmt_rp_read_info rp;
1016
1017         bt_dev_dbg(hdev, "sock %p", sk);
1018
1019         hci_dev_lock(hdev);
1020
1021         memset(&rp, 0, sizeof(rp));
1022
1023         bacpy(&rp.bdaddr, &hdev->bdaddr);
1024
1025         rp.version = hdev->hci_ver;
1026         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1027
1028         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1029         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1030
1031         memcpy(rp.dev_class, hdev->dev_class, 3);
1032
1033         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1034         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1035
1036         hci_dev_unlock(hdev);
1037
1038         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1039                                  sizeof(rp));
1040 }
1041
1042 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1043 {
1044         u16 eir_len = 0;
1045         size_t name_len;
1046
1047         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1048                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1049                                           hdev->dev_class, 3);
1050
1051         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1052                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1053                                           hdev->appearance);
1054
1055         name_len = strlen(hdev->dev_name);
1056         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1057                                   hdev->dev_name, name_len);
1058
1059         name_len = strlen(hdev->short_name);
1060         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1061                                   hdev->short_name, name_len);
1062
1063         return eir_len;
1064 }
1065
1066 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1067                                     void *data, u16 data_len)
1068 {
1069         char buf[512];
1070         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1071         u16 eir_len;
1072
1073         bt_dev_dbg(hdev, "sock %p", sk);
1074
1075         memset(&buf, 0, sizeof(buf));
1076
1077         hci_dev_lock(hdev);
1078
1079         bacpy(&rp->bdaddr, &hdev->bdaddr);
1080
1081         rp->version = hdev->hci_ver;
1082         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1083
1084         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1085         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1086
1087
1088         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1089         rp->eir_len = cpu_to_le16(eir_len);
1090
1091         hci_dev_unlock(hdev);
1092
1093         /* If this command is called at least once, then the events
1094          * for class of device and local name changes are disabled
1095          * and only the new extended controller information event
1096          * is used.
1097          */
1098         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1099         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1100         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1101
1102         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1103                                  sizeof(*rp) + eir_len);
1104 }
1105
1106 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1107 {
1108         char buf[512];
1109         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1110         u16 eir_len;
1111
1112         memset(buf, 0, sizeof(buf));
1113
1114         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1115         ev->eir_len = cpu_to_le16(eir_len);
1116
1117         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1118                                   sizeof(*ev) + eir_len,
1119                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1120 }
1121
1122 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1123 {
1124         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1125
1126         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1127                                  sizeof(settings));
1128 }
1129
1130 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1131 {
1132         bt_dev_dbg(hdev, "status 0x%02x", status);
1133
1134         if (hci_conn_count(hdev) == 0) {
1135                 cancel_delayed_work(&hdev->power_off);
1136                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1137         }
1138 }
1139
1140 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1141 {
1142         struct mgmt_ev_advertising_added ev;
1143
1144         ev.instance = instance;
1145
1146         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1147 }
1148
1149 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1150                               u8 instance)
1151 {
1152         struct mgmt_ev_advertising_removed ev;
1153
1154         ev.instance = instance;
1155
1156         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1157 }
1158
1159 static void cancel_adv_timeout(struct hci_dev *hdev)
1160 {
1161         if (hdev->adv_instance_timeout) {
1162                 hdev->adv_instance_timeout = 0;
1163                 cancel_delayed_work(&hdev->adv_instance_expire);
1164         }
1165 }
1166
1167 static int clean_up_hci_state(struct hci_dev *hdev)
1168 {
1169         struct hci_request req;
1170         struct hci_conn *conn;
1171         bool discov_stopped;
1172         int err;
1173
1174         hci_req_init(&req, hdev);
1175
1176         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1177             test_bit(HCI_PSCAN, &hdev->flags)) {
1178                 u8 scan = 0x00;
1179                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1180         }
1181
1182         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1183
1184         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1185                 __hci_req_disable_advertising(&req);
1186
1187         discov_stopped = hci_req_stop_discovery(&req);
1188
1189         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1190                 /* 0x15 == Terminated due to Power Off */
1191                 __hci_abort_conn(&req, conn, 0x15);
1192         }
1193
1194         err = hci_req_run(&req, clean_up_hci_complete);
1195         if (!err && discov_stopped)
1196                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1197
1198         return err;
1199 }
1200
1201 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1202                        u16 len)
1203 {
1204         struct mgmt_mode *cp = data;
1205         struct mgmt_pending_cmd *cmd;
1206         int err;
1207
1208         bt_dev_dbg(hdev, "sock %p", sk);
1209
1210         if (cp->val != 0x00 && cp->val != 0x01)
1211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1212                                        MGMT_STATUS_INVALID_PARAMS);
1213
1214         hci_dev_lock(hdev);
1215
1216         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1217                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                       MGMT_STATUS_BUSY);
1219                 goto failed;
1220         }
1221
1222         if (!!cp->val == hdev_is_powered(hdev)) {
1223                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1224                 goto failed;
1225         }
1226
1227         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1228         if (!cmd) {
1229                 err = -ENOMEM;
1230                 goto failed;
1231         }
1232
1233         if (cp->val) {
1234                 queue_work(hdev->req_workqueue, &hdev->power_on);
1235                 err = 0;
1236         } else {
1237                 /* Disconnect connections, stop scans, etc */
1238                 err = clean_up_hci_state(hdev);
1239                 if (!err)
1240                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1241                                            HCI_POWER_OFF_TIMEOUT);
1242
1243                 /* ENODATA means there were no HCI commands queued */
1244                 if (err == -ENODATA) {
1245                         cancel_delayed_work(&hdev->power_off);
1246                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1247                         err = 0;
1248                 }
1249         }
1250
1251 failed:
1252         hci_dev_unlock(hdev);
1253         return err;
1254 }
1255
1256 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1257 {
1258         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1259
1260         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1261                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1262 }
1263
1264 int mgmt_new_settings(struct hci_dev *hdev)
1265 {
1266         return new_settings(hdev, NULL);
1267 }
1268
1269 struct cmd_lookup {
1270         struct sock *sk;
1271         struct hci_dev *hdev;
1272         u8 mgmt_status;
1273 };
1274
1275 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1276 {
1277         struct cmd_lookup *match = data;
1278
1279         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1280
1281         list_del(&cmd->list);
1282
1283         if (match->sk == NULL) {
1284                 match->sk = cmd->sk;
1285                 sock_hold(match->sk);
1286         }
1287
1288         mgmt_pending_free(cmd);
1289 }
1290
1291 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1292 {
1293         u8 *status = data;
1294
1295         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1296         mgmt_pending_remove(cmd);
1297 }
1298
1299 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1300 {
1301         if (cmd->cmd_complete) {
1302                 u8 *status = data;
1303
1304                 cmd->cmd_complete(cmd, *status);
1305                 mgmt_pending_remove(cmd);
1306
1307                 return;
1308         }
1309
1310         cmd_status_rsp(cmd, data);
1311 }
1312
1313 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1314 {
1315         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1316                                  cmd->param, cmd->param_len);
1317 }
1318
1319 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, sizeof(struct mgmt_addr_info));
1323 }
1324
1325 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1326 {
1327         if (!lmp_bredr_capable(hdev))
1328                 return MGMT_STATUS_NOT_SUPPORTED;
1329         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1330                 return MGMT_STATUS_REJECTED;
1331         else
1332                 return MGMT_STATUS_SUCCESS;
1333 }
1334
1335 static u8 mgmt_le_support(struct hci_dev *hdev)
1336 {
1337         if (!lmp_le_capable(hdev))
1338                 return MGMT_STATUS_NOT_SUPPORTED;
1339         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1340                 return MGMT_STATUS_REJECTED;
1341         else
1342                 return MGMT_STATUS_SUCCESS;
1343 }
1344
1345 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1346 {
1347         struct mgmt_pending_cmd *cmd;
1348
1349         bt_dev_dbg(hdev, "status 0x%02x", status);
1350
1351         hci_dev_lock(hdev);
1352
1353         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1354         if (!cmd)
1355                 goto unlock;
1356
1357         if (status) {
1358                 u8 mgmt_err = mgmt_status(status);
1359                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1360                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1361                 goto remove_cmd;
1362         }
1363
1364         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1365             hdev->discov_timeout > 0) {
1366                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1367                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1368         }
1369
1370         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1371         new_settings(hdev, cmd->sk);
1372
1373 remove_cmd:
1374         mgmt_pending_remove(cmd);
1375
1376 unlock:
1377         hci_dev_unlock(hdev);
1378 }
1379
1380 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1381                             u16 len)
1382 {
1383         struct mgmt_cp_set_discoverable *cp = data;
1384         struct mgmt_pending_cmd *cmd;
1385         u16 timeout;
1386         int err;
1387
1388         bt_dev_dbg(hdev, "sock %p", sk);
1389
1390         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1391             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1393                                        MGMT_STATUS_REJECTED);
1394
1395         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1396                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1397                                        MGMT_STATUS_INVALID_PARAMS);
1398
1399         timeout = __le16_to_cpu(cp->timeout);
1400
1401         /* Disabling discoverable requires that no timeout is set,
1402          * and enabling limited discoverable requires a timeout.
1403          */
1404         if ((cp->val == 0x00 && timeout > 0) ||
1405             (cp->val == 0x02 && timeout == 0))
1406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1407                                        MGMT_STATUS_INVALID_PARAMS);
1408
1409         hci_dev_lock(hdev);
1410
1411         if (!hdev_is_powered(hdev) && timeout > 0) {
1412                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                       MGMT_STATUS_NOT_POWERED);
1414                 goto failed;
1415         }
1416
1417         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1418             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_BUSY);
1421                 goto failed;
1422         }
1423
1424         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_REJECTED);
1427                 goto failed;
1428         }
1429
1430         if (hdev->advertising_paused) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_BUSY);
1433                 goto failed;
1434         }
1435
1436         if (!hdev_is_powered(hdev)) {
1437                 bool changed = false;
1438
1439                 /* Setting limited discoverable when powered off is
1440                  * not a valid operation since it requires a timeout
1441                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1442                  */
1443                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1444                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1445                         changed = true;
1446                 }
1447
1448                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1449                 if (err < 0)
1450                         goto failed;
1451
1452                 if (changed)
1453                         err = new_settings(hdev, sk);
1454
1455                 goto failed;
1456         }
1457
1458         /* If the current mode is the same, then just update the timeout
1459          * value with the new value. And if only the timeout gets updated,
1460          * then no need for any HCI transactions.
1461          */
1462         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1463             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1464                                                    HCI_LIMITED_DISCOVERABLE)) {
1465                 cancel_delayed_work(&hdev->discov_off);
1466                 hdev->discov_timeout = timeout;
1467
1468                 if (cp->val && hdev->discov_timeout > 0) {
1469                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1470                         queue_delayed_work(hdev->req_workqueue,
1471                                            &hdev->discov_off, to);
1472                 }
1473
1474                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1475                 goto failed;
1476         }
1477
1478         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1479         if (!cmd) {
1480                 err = -ENOMEM;
1481                 goto failed;
1482         }
1483
1484         /* Cancel any potential discoverable timeout that might be
1485          * still active and store new timeout value. The arming of
1486          * the timeout happens in the complete handler.
1487          */
1488         cancel_delayed_work(&hdev->discov_off);
1489         hdev->discov_timeout = timeout;
1490
1491         if (cp->val)
1492                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1493         else
1494                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1495
1496         /* Limited discoverable mode */
1497         if (cp->val == 0x02)
1498                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1501
1502         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1503         err = 0;
1504
1505 failed:
1506         hci_dev_unlock(hdev);
1507         return err;
1508 }
1509
1510 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1511 {
1512         struct mgmt_pending_cmd *cmd;
1513
1514         bt_dev_dbg(hdev, "status 0x%02x", status);
1515
1516         hci_dev_lock(hdev);
1517
1518         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1519         if (!cmd)
1520                 goto unlock;
1521
1522         if (status) {
1523                 u8 mgmt_err = mgmt_status(status);
1524                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1525                 goto remove_cmd;
1526         }
1527
1528         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1529         new_settings(hdev, cmd->sk);
1530
1531 remove_cmd:
1532         mgmt_pending_remove(cmd);
1533
1534 unlock:
1535         hci_dev_unlock(hdev);
1536 }
1537
1538 static int set_connectable_update_settings(struct hci_dev *hdev,
1539                                            struct sock *sk, u8 val)
1540 {
1541         bool changed = false;
1542         int err;
1543
1544         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1545                 changed = true;
1546
1547         if (val) {
1548                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1549         } else {
1550                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1551                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1552         }
1553
1554         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1555         if (err < 0)
1556                 return err;
1557
1558         if (changed) {
1559                 hci_req_update_scan(hdev);
1560                 hci_update_background_scan(hdev);
1561                 return new_settings(hdev, sk);
1562         }
1563
1564         return 0;
1565 }
1566
1567 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1568                            u16 len)
1569 {
1570         struct mgmt_mode *cp = data;
1571         struct mgmt_pending_cmd *cmd;
1572         int err;
1573
1574         bt_dev_dbg(hdev, "sock %p", sk);
1575
1576         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1577             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1579                                        MGMT_STATUS_REJECTED);
1580
1581         if (cp->val != 0x00 && cp->val != 0x01)
1582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1583                                        MGMT_STATUS_INVALID_PARAMS);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (!hdev_is_powered(hdev)) {
1588                 err = set_connectable_update_settings(hdev, sk, cp->val);
1589                 goto failed;
1590         }
1591
1592         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1593             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1594                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1595                                       MGMT_STATUS_BUSY);
1596                 goto failed;
1597         }
1598
1599         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1600         if (!cmd) {
1601                 err = -ENOMEM;
1602                 goto failed;
1603         }
1604
1605         if (cp->val) {
1606                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1607         } else {
1608                 if (hdev->discov_timeout > 0)
1609                         cancel_delayed_work(&hdev->discov_off);
1610
1611                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1612                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1613                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1614         }
1615
1616         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1617         err = 0;
1618
1619 failed:
1620         hci_dev_unlock(hdev);
1621         return err;
1622 }
1623
1624 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1625                         u16 len)
1626 {
1627         struct mgmt_mode *cp = data;
1628         bool changed;
1629         int err;
1630
1631         bt_dev_dbg(hdev, "sock %p", sk);
1632
1633         if (cp->val != 0x00 && cp->val != 0x01)
1634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1635                                        MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (cp->val)
1640                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1641         else
1642                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1643
1644         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1645         if (err < 0)
1646                 goto unlock;
1647
1648         if (changed) {
1649                 /* In limited privacy mode the change of bondable mode
1650                  * may affect the local advertising address.
1651                  */
1652                 if (hdev_is_powered(hdev) &&
1653                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1654                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1655                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1656                         queue_work(hdev->req_workqueue,
1657                                    &hdev->discoverable_update);
1658
1659                 err = new_settings(hdev, sk);
1660         }
1661
1662 unlock:
1663         hci_dev_unlock(hdev);
1664         return err;
1665 }
1666
1667 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1668                              u16 len)
1669 {
1670         struct mgmt_mode *cp = data;
1671         struct mgmt_pending_cmd *cmd;
1672         u8 val, status;
1673         int err;
1674
1675         bt_dev_dbg(hdev, "sock %p", sk);
1676
1677         status = mgmt_bredr_support(hdev);
1678         if (status)
1679                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1680                                        status);
1681
1682         if (cp->val != 0x00 && cp->val != 0x01)
1683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1684                                        MGMT_STATUS_INVALID_PARAMS);
1685
1686         hci_dev_lock(hdev);
1687
1688         if (!hdev_is_powered(hdev)) {
1689                 bool changed = false;
1690
1691                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1692                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1693                         changed = true;
1694                 }
1695
1696                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1697                 if (err < 0)
1698                         goto failed;
1699
1700                 if (changed)
1701                         err = new_settings(hdev, sk);
1702
1703                 goto failed;
1704         }
1705
1706         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1708                                       MGMT_STATUS_BUSY);
1709                 goto failed;
1710         }
1711
1712         val = !!cp->val;
1713
1714         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1715                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1716                 goto failed;
1717         }
1718
1719         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1720         if (!cmd) {
1721                 err = -ENOMEM;
1722                 goto failed;
1723         }
1724
1725         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1726         if (err < 0) {
1727                 mgmt_pending_remove(cmd);
1728                 goto failed;
1729         }
1730
1731 failed:
1732         hci_dev_unlock(hdev);
1733         return err;
1734 }
1735
1736 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738         struct mgmt_mode *cp = data;
1739         struct mgmt_pending_cmd *cmd;
1740         u8 status;
1741         int err;
1742
1743         bt_dev_dbg(hdev, "sock %p", sk);
1744
1745         status = mgmt_bredr_support(hdev);
1746         if (status)
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1748
1749         if (!lmp_ssp_capable(hdev))
1750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1751                                        MGMT_STATUS_NOT_SUPPORTED);
1752
1753         if (cp->val != 0x00 && cp->val != 0x01)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1755                                        MGMT_STATUS_INVALID_PARAMS);
1756
1757         hci_dev_lock(hdev);
1758
1759         if (!hdev_is_powered(hdev)) {
1760                 bool changed;
1761
1762                 if (cp->val) {
1763                         changed = !hci_dev_test_and_set_flag(hdev,
1764                                                              HCI_SSP_ENABLED);
1765                 } else {
1766                         changed = hci_dev_test_and_clear_flag(hdev,
1767                                                               HCI_SSP_ENABLED);
1768                         if (!changed)
1769                                 changed = hci_dev_test_and_clear_flag(hdev,
1770                                                                       HCI_HS_ENABLED);
1771                         else
1772                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1773                 }
1774
1775                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1776                 if (err < 0)
1777                         goto failed;
1778
1779                 if (changed)
1780                         err = new_settings(hdev, sk);
1781
1782                 goto failed;
1783         }
1784
1785         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1787                                       MGMT_STATUS_BUSY);
1788                 goto failed;
1789         }
1790
1791         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1792                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1793                 goto failed;
1794         }
1795
1796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1797         if (!cmd) {
1798                 err = -ENOMEM;
1799                 goto failed;
1800         }
1801
1802         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1803                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1804                              sizeof(cp->val), &cp->val);
1805
1806         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1807         if (err < 0) {
1808                 mgmt_pending_remove(cmd);
1809                 goto failed;
1810         }
1811
1812 failed:
1813         hci_dev_unlock(hdev);
1814         return err;
1815 }
1816
1817 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1818 {
1819         struct mgmt_mode *cp = data;
1820         bool changed;
1821         u8 status;
1822         int err;
1823
1824         bt_dev_dbg(hdev, "sock %p", sk);
1825
1826         if (!IS_ENABLED(CONFIG_BT_HS))
1827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1828                                        MGMT_STATUS_NOT_SUPPORTED);
1829
1830         status = mgmt_bredr_support(hdev);
1831         if (status)
1832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1833
1834         if (!lmp_ssp_capable(hdev))
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1836                                        MGMT_STATUS_NOT_SUPPORTED);
1837
1838         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1840                                        MGMT_STATUS_REJECTED);
1841
1842         if (cp->val != 0x00 && cp->val != 0x01)
1843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1844                                        MGMT_STATUS_INVALID_PARAMS);
1845
1846         hci_dev_lock(hdev);
1847
1848         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1849                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                       MGMT_STATUS_BUSY);
1851                 goto unlock;
1852         }
1853
1854         if (cp->val) {
1855                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1856         } else {
1857                 if (hdev_is_powered(hdev)) {
1858                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1859                                               MGMT_STATUS_REJECTED);
1860                         goto unlock;
1861                 }
1862
1863                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1864         }
1865
1866         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1867         if (err < 0)
1868                 goto unlock;
1869
1870         if (changed)
1871                 err = new_settings(hdev, sk);
1872
1873 unlock:
1874         hci_dev_unlock(hdev);
1875         return err;
1876 }
1877
1878 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1879 {
1880         struct cmd_lookup match = { NULL, hdev };
1881
1882         hci_dev_lock(hdev);
1883
1884         if (status) {
1885                 u8 mgmt_err = mgmt_status(status);
1886
1887                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1888                                      &mgmt_err);
1889                 goto unlock;
1890         }
1891
1892         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1893
1894         new_settings(hdev, match.sk);
1895
1896         if (match.sk)
1897                 sock_put(match.sk);
1898
1899         /* Make sure the controller has a good default for
1900          * advertising data. Restrict the update to when LE
1901          * has actually been enabled. During power on, the
1902          * update in powered_update_hci will take care of it.
1903          */
1904         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1905                 struct hci_request req;
1906                 hci_req_init(&req, hdev);
1907                 if (ext_adv_capable(hdev)) {
1908                         int err;
1909
1910                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1911                         if (!err)
1912                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1913                 } else {
1914                         __hci_req_update_adv_data(&req, 0x00);
1915                         __hci_req_update_scan_rsp_data(&req, 0x00);
1916                 }
1917                 hci_req_run(&req, NULL);
1918                 hci_update_background_scan(hdev);
1919         }
1920
1921 unlock:
1922         hci_dev_unlock(hdev);
1923 }
1924
1925 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1926 {
1927         struct mgmt_mode *cp = data;
1928         struct hci_cp_write_le_host_supported hci_cp;
1929         struct mgmt_pending_cmd *cmd;
1930         struct hci_request req;
1931         int err;
1932         u8 val, enabled;
1933
1934         bt_dev_dbg(hdev, "sock %p", sk);
1935
1936         if (!lmp_le_capable(hdev))
1937                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1938                                        MGMT_STATUS_NOT_SUPPORTED);
1939
1940         if (cp->val != 0x00 && cp->val != 0x01)
1941                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1942                                        MGMT_STATUS_INVALID_PARAMS);
1943
1944         /* Bluetooth single mode LE only controllers or dual-mode
1945          * controllers configured as LE only devices, do not allow
1946          * switching LE off. These have either LE enabled explicitly
1947          * or BR/EDR has been previously switched off.
1948          *
1949          * When trying to enable an already enabled LE, then gracefully
1950          * send a positive response. Trying to disable it however will
1951          * result into rejection.
1952          */
1953         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1954                 if (cp->val == 0x01)
1955                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1956
1957                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1958                                        MGMT_STATUS_REJECTED);
1959         }
1960
1961         hci_dev_lock(hdev);
1962
1963         val = !!cp->val;
1964         enabled = lmp_host_le_capable(hdev);
1965
1966         if (!val)
1967                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1968
1969         if (!hdev_is_powered(hdev) || val == enabled) {
1970                 bool changed = false;
1971
1972                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1973                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1974                         changed = true;
1975                 }
1976
1977                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1978                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1979                         changed = true;
1980                 }
1981
1982                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1983                 if (err < 0)
1984                         goto unlock;
1985
1986                 if (changed)
1987                         err = new_settings(hdev, sk);
1988
1989                 goto unlock;
1990         }
1991
1992         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1993             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1995                                       MGMT_STATUS_BUSY);
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2000         if (!cmd) {
2001                 err = -ENOMEM;
2002                 goto unlock;
2003         }
2004
2005         hci_req_init(&req, hdev);
2006
2007         memset(&hci_cp, 0, sizeof(hci_cp));
2008
2009         if (val) {
2010                 hci_cp.le = val;
2011                 hci_cp.simul = 0x00;
2012         } else {
2013                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2014                         __hci_req_disable_advertising(&req);
2015
2016                 if (ext_adv_capable(hdev))
2017                         __hci_req_clear_ext_adv_sets(&req);
2018         }
2019
2020         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2021                     &hci_cp);
2022
2023         err = hci_req_run(&req, le_enable_complete);
2024         if (err < 0)
2025                 mgmt_pending_remove(cmd);
2026
2027 unlock:
2028         hci_dev_unlock(hdev);
2029         return err;
2030 }
2031
2032 /* This is a helper function to test for pending mgmt commands that can
2033  * cause CoD or EIR HCI commands. We can only allow one such pending
2034  * mgmt command at a time since otherwise we cannot easily track what
2035  * the current values are, will be, and based on that calculate if a new
2036  * HCI command needs to be sent and if yes with what value.
2037  */
2038 static bool pending_eir_or_class(struct hci_dev *hdev)
2039 {
2040         struct mgmt_pending_cmd *cmd;
2041
2042         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2043                 switch (cmd->opcode) {
2044                 case MGMT_OP_ADD_UUID:
2045                 case MGMT_OP_REMOVE_UUID:
2046                 case MGMT_OP_SET_DEV_CLASS:
2047                 case MGMT_OP_SET_POWERED:
2048                         return true;
2049                 }
2050         }
2051
2052         return false;
2053 }
2054
2055 static const u8 bluetooth_base_uuid[] = {
2056                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2057                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2058 };
2059
2060 static u8 get_uuid_size(const u8 *uuid)
2061 {
2062         u32 val;
2063
2064         if (memcmp(uuid, bluetooth_base_uuid, 12))
2065                 return 128;
2066
2067         val = get_unaligned_le32(&uuid[12]);
2068         if (val > 0xffff)
2069                 return 32;
2070
2071         return 16;
2072 }
2073
2074 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2075 {
2076         struct mgmt_pending_cmd *cmd;
2077
2078         hci_dev_lock(hdev);
2079
2080         cmd = pending_find(mgmt_op, hdev);
2081         if (!cmd)
2082                 goto unlock;
2083
2084         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2085                           mgmt_status(status), hdev->dev_class, 3);
2086
2087         mgmt_pending_remove(cmd);
2088
2089 unlock:
2090         hci_dev_unlock(hdev);
2091 }
2092
2093 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2094 {
2095         bt_dev_dbg(hdev, "status 0x%02x", status);
2096
2097         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2098 }
2099
2100 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2101 {
2102         struct mgmt_cp_add_uuid *cp = data;
2103         struct mgmt_pending_cmd *cmd;
2104         struct hci_request req;
2105         struct bt_uuid *uuid;
2106         int err;
2107
2108         bt_dev_dbg(hdev, "sock %p", sk);
2109
2110         hci_dev_lock(hdev);
2111
2112         if (pending_eir_or_class(hdev)) {
2113                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2114                                       MGMT_STATUS_BUSY);
2115                 goto failed;
2116         }
2117
2118         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2119         if (!uuid) {
2120                 err = -ENOMEM;
2121                 goto failed;
2122         }
2123
2124         memcpy(uuid->uuid, cp->uuid, 16);
2125         uuid->svc_hint = cp->svc_hint;
2126         uuid->size = get_uuid_size(cp->uuid);
2127
2128         list_add_tail(&uuid->list, &hdev->uuids);
2129
2130         hci_req_init(&req, hdev);
2131
2132         __hci_req_update_class(&req);
2133         __hci_req_update_eir(&req);
2134
2135         err = hci_req_run(&req, add_uuid_complete);
2136         if (err < 0) {
2137                 if (err != -ENODATA)
2138                         goto failed;
2139
2140                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2141                                         hdev->dev_class, 3);
2142                 goto failed;
2143         }
2144
2145         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2146         if (!cmd) {
2147                 err = -ENOMEM;
2148                 goto failed;
2149         }
2150
2151         err = 0;
2152
2153 failed:
2154         hci_dev_unlock(hdev);
2155         return err;
2156 }
2157
2158 static bool enable_service_cache(struct hci_dev *hdev)
2159 {
2160         if (!hdev_is_powered(hdev))
2161                 return false;
2162
2163         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2164                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2165                                    CACHE_TIMEOUT);
2166                 return true;
2167         }
2168
2169         return false;
2170 }
2171
2172 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2173 {
2174         bt_dev_dbg(hdev, "status 0x%02x", status);
2175
2176         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2177 }
2178
2179 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2180                        u16 len)
2181 {
2182         struct mgmt_cp_remove_uuid *cp = data;
2183         struct mgmt_pending_cmd *cmd;
2184         struct bt_uuid *match, *tmp;
2185         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2186         struct hci_request req;
2187         int err, found;
2188
2189         bt_dev_dbg(hdev, "sock %p", sk);
2190
2191         hci_dev_lock(hdev);
2192
2193         if (pending_eir_or_class(hdev)) {
2194                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2195                                       MGMT_STATUS_BUSY);
2196                 goto unlock;
2197         }
2198
2199         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2200                 hci_uuids_clear(hdev);
2201
2202                 if (enable_service_cache(hdev)) {
2203                         err = mgmt_cmd_complete(sk, hdev->id,
2204                                                 MGMT_OP_REMOVE_UUID,
2205                                                 0, hdev->dev_class, 3);
2206                         goto unlock;
2207                 }
2208
2209                 goto update_class;
2210         }
2211
2212         found = 0;
2213
2214         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2215                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2216                         continue;
2217
2218                 list_del(&match->list);
2219                 kfree(match);
2220                 found++;
2221         }
2222
2223         if (found == 0) {
2224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2225                                       MGMT_STATUS_INVALID_PARAMS);
2226                 goto unlock;
2227         }
2228
2229 update_class:
2230         hci_req_init(&req, hdev);
2231
2232         __hci_req_update_class(&req);
2233         __hci_req_update_eir(&req);
2234
2235         err = hci_req_run(&req, remove_uuid_complete);
2236         if (err < 0) {
2237                 if (err != -ENODATA)
2238                         goto unlock;
2239
2240                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2241                                         hdev->dev_class, 3);
2242                 goto unlock;
2243         }
2244
2245         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2246         if (!cmd) {
2247                 err = -ENOMEM;
2248                 goto unlock;
2249         }
2250
2251         err = 0;
2252
2253 unlock:
2254         hci_dev_unlock(hdev);
2255         return err;
2256 }
2257
2258 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2259 {
2260         bt_dev_dbg(hdev, "status 0x%02x", status);
2261
2262         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2263 }
2264
2265 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2266                          u16 len)
2267 {
2268         struct mgmt_cp_set_dev_class *cp = data;
2269         struct mgmt_pending_cmd *cmd;
2270         struct hci_request req;
2271         int err;
2272
2273         bt_dev_dbg(hdev, "sock %p", sk);
2274
2275         if (!lmp_bredr_capable(hdev))
2276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2277                                        MGMT_STATUS_NOT_SUPPORTED);
2278
2279         hci_dev_lock(hdev);
2280
2281         if (pending_eir_or_class(hdev)) {
2282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                       MGMT_STATUS_BUSY);
2284                 goto unlock;
2285         }
2286
2287         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_INVALID_PARAMS);
2290                 goto unlock;
2291         }
2292
2293         hdev->major_class = cp->major;
2294         hdev->minor_class = cp->minor;
2295
2296         if (!hdev_is_powered(hdev)) {
2297                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2298                                         hdev->dev_class, 3);
2299                 goto unlock;
2300         }
2301
2302         hci_req_init(&req, hdev);
2303
2304         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2305                 hci_dev_unlock(hdev);
2306                 cancel_delayed_work_sync(&hdev->service_cache);
2307                 hci_dev_lock(hdev);
2308                 __hci_req_update_eir(&req);
2309         }
2310
2311         __hci_req_update_class(&req);
2312
2313         err = hci_req_run(&req, set_class_complete);
2314         if (err < 0) {
2315                 if (err != -ENODATA)
2316                         goto unlock;
2317
2318                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2319                                         hdev->dev_class, 3);
2320                 goto unlock;
2321         }
2322
2323         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2324         if (!cmd) {
2325                 err = -ENOMEM;
2326                 goto unlock;
2327         }
2328
2329         err = 0;
2330
2331 unlock:
2332         hci_dev_unlock(hdev);
2333         return err;
2334 }
2335
2336 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2337                           u16 len)
2338 {
2339         struct mgmt_cp_load_link_keys *cp = data;
2340         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2341                                    sizeof(struct mgmt_link_key_info));
2342         u16 key_count, expected_len;
2343         bool changed;
2344         int i;
2345
2346         bt_dev_dbg(hdev, "sock %p", sk);
2347
2348         if (!lmp_bredr_capable(hdev))
2349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2350                                        MGMT_STATUS_NOT_SUPPORTED);
2351
2352         key_count = __le16_to_cpu(cp->key_count);
2353         if (key_count > max_key_count) {
2354                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2355                            key_count);
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_INVALID_PARAMS);
2358         }
2359
2360         expected_len = struct_size(cp, keys, key_count);
2361         if (expected_len != len) {
2362                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2363                            expected_len, len);
2364                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2365                                        MGMT_STATUS_INVALID_PARAMS);
2366         }
2367
2368         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2369                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2370                                        MGMT_STATUS_INVALID_PARAMS);
2371
2372         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2373                    key_count);
2374
2375         for (i = 0; i < key_count; i++) {
2376                 struct mgmt_link_key_info *key = &cp->keys[i];
2377
2378                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2379                         return mgmt_cmd_status(sk, hdev->id,
2380                                                MGMT_OP_LOAD_LINK_KEYS,
2381                                                MGMT_STATUS_INVALID_PARAMS);
2382         }
2383
2384         hci_dev_lock(hdev);
2385
2386         hci_link_keys_clear(hdev);
2387
2388         if (cp->debug_keys)
2389                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2390         else
2391                 changed = hci_dev_test_and_clear_flag(hdev,
2392                                                       HCI_KEEP_DEBUG_KEYS);
2393
2394         if (changed)
2395                 new_settings(hdev, NULL);
2396
2397         for (i = 0; i < key_count; i++) {
2398                 struct mgmt_link_key_info *key = &cp->keys[i];
2399
2400                 if (hci_is_blocked_key(hdev,
2401                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2402                                        key->val)) {
2403                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2404                                     &key->addr.bdaddr);
2405                         continue;
2406                 }
2407
2408                 /* Always ignore debug keys and require a new pairing if
2409                  * the user wants to use them.
2410                  */
2411                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2412                         continue;
2413
2414                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2415                                  key->type, key->pin_len, NULL);
2416         }
2417
2418         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2419
2420         hci_dev_unlock(hdev);
2421
2422         return 0;
2423 }
2424
2425 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2426                            u8 addr_type, struct sock *skip_sk)
2427 {
2428         struct mgmt_ev_device_unpaired ev;
2429
2430         bacpy(&ev.addr.bdaddr, bdaddr);
2431         ev.addr.type = addr_type;
2432
2433         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2434                           skip_sk);
2435 }
2436
2437 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2438                          u16 len)
2439 {
2440         struct mgmt_cp_unpair_device *cp = data;
2441         struct mgmt_rp_unpair_device rp;
2442         struct hci_conn_params *params;
2443         struct mgmt_pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         u8 addr_type;
2446         int err;
2447
2448         memset(&rp, 0, sizeof(rp));
2449         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2450         rp.addr.type = cp->addr.type;
2451
2452         if (!bdaddr_type_is_valid(cp->addr.type))
2453                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2454                                          MGMT_STATUS_INVALID_PARAMS,
2455                                          &rp, sizeof(rp));
2456
2457         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2458                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2459                                          MGMT_STATUS_INVALID_PARAMS,
2460                                          &rp, sizeof(rp));
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hdev_is_powered(hdev)) {
2465                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                         MGMT_STATUS_NOT_POWERED, &rp,
2467                                         sizeof(rp));
2468                 goto unlock;
2469         }
2470
2471         if (cp->addr.type == BDADDR_BREDR) {
2472                 /* If disconnection is requested, then look up the
2473                  * connection. If the remote device is connected, it
2474                  * will be later used to terminate the link.
2475                  *
2476                  * Setting it to NULL explicitly will cause no
2477                  * termination of the link.
2478                  */
2479                 if (cp->disconnect)
2480                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2481                                                        &cp->addr.bdaddr);
2482                 else
2483                         conn = NULL;
2484
2485                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2486                 if (err < 0) {
2487                         err = mgmt_cmd_complete(sk, hdev->id,
2488                                                 MGMT_OP_UNPAIR_DEVICE,
2489                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2490                                                 sizeof(rp));
2491                         goto unlock;
2492                 }
2493
2494                 goto done;
2495         }
2496
2497         /* LE address type */
2498         addr_type = le_addr_type(cp->addr.type);
2499
2500         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2501         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2502         if (err < 0) {
2503                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2504                                         MGMT_STATUS_NOT_PAIRED, &rp,
2505                                         sizeof(rp));
2506                 goto unlock;
2507         }
2508
2509         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2510         if (!conn) {
2511                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2512                 goto done;
2513         }
2514
2515
2516         /* Defer clearing up the connection parameters until closing to
2517          * give a chance of keeping them if a repairing happens.
2518          */
2519         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2520
2521         /* Disable auto-connection parameters if present */
2522         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2523         if (params) {
2524                 if (params->explicit_connect)
2525                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2526                 else
2527                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2528         }
2529
2530         /* If disconnection is not requested, then clear the connection
2531          * variable so that the link is not terminated.
2532          */
2533         if (!cp->disconnect)
2534                 conn = NULL;
2535
2536 done:
2537         /* If the connection variable is set, then termination of the
2538          * link is requested.
2539          */
2540         if (!conn) {
2541                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2542                                         &rp, sizeof(rp));
2543                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2544                 goto unlock;
2545         }
2546
2547         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2548                                sizeof(*cp));
2549         if (!cmd) {
2550                 err = -ENOMEM;
2551                 goto unlock;
2552         }
2553
2554         cmd->cmd_complete = addr_cmd_complete;
2555
2556         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2557         if (err < 0)
2558                 mgmt_pending_remove(cmd);
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562         return err;
2563 }
2564
2565 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2566                       u16 len)
2567 {
2568         struct mgmt_cp_disconnect *cp = data;
2569         struct mgmt_rp_disconnect rp;
2570         struct mgmt_pending_cmd *cmd;
2571         struct hci_conn *conn;
2572         int err;
2573
2574         bt_dev_dbg(hdev, "sock %p", sk);
2575
2576         memset(&rp, 0, sizeof(rp));
2577         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2578         rp.addr.type = cp->addr.type;
2579
2580         if (!bdaddr_type_is_valid(cp->addr.type))
2581                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2582                                          MGMT_STATUS_INVALID_PARAMS,
2583                                          &rp, sizeof(rp));
2584
2585         hci_dev_lock(hdev);
2586
2587         if (!test_bit(HCI_UP, &hdev->flags)) {
2588                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                         MGMT_STATUS_NOT_POWERED, &rp,
2590                                         sizeof(rp));
2591                 goto failed;
2592         }
2593
2594         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (cp->addr.type == BDADDR_BREDR)
2601                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2602                                                &cp->addr.bdaddr);
2603         else
2604                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2605                                                le_addr_type(cp->addr.type));
2606
2607         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2608                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2609                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2610                                         sizeof(rp));
2611                 goto failed;
2612         }
2613
2614         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2615         if (!cmd) {
2616                 err = -ENOMEM;
2617                 goto failed;
2618         }
2619
2620         cmd->cmd_complete = generic_cmd_complete;
2621
2622         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2623         if (err < 0)
2624                 mgmt_pending_remove(cmd);
2625
2626 failed:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2632 {
2633         switch (link_type) {
2634         case LE_LINK:
2635                 switch (addr_type) {
2636                 case ADDR_LE_DEV_PUBLIC:
2637                         return BDADDR_LE_PUBLIC;
2638
2639                 default:
2640                         /* Fallback to LE Random address type */
2641                         return BDADDR_LE_RANDOM;
2642                 }
2643
2644         default:
2645                 /* Fallback to BR/EDR type */
2646                 return BDADDR_BREDR;
2647         }
2648 }
2649
2650 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2651                            u16 data_len)
2652 {
2653         struct mgmt_rp_get_connections *rp;
2654         struct hci_conn *c;
2655         int err;
2656         u16 i;
2657
2658         bt_dev_dbg(hdev, "sock %p", sk);
2659
2660         hci_dev_lock(hdev);
2661
2662         if (!hdev_is_powered(hdev)) {
2663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2664                                       MGMT_STATUS_NOT_POWERED);
2665                 goto unlock;
2666         }
2667
2668         i = 0;
2669         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2670                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2671                         i++;
2672         }
2673
2674         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2675         if (!rp) {
2676                 err = -ENOMEM;
2677                 goto unlock;
2678         }
2679
2680         i = 0;
2681         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2682                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2683                         continue;
2684                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2685                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2686                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2687                         continue;
2688                 i++;
2689         }
2690
2691         rp->conn_count = cpu_to_le16(i);
2692
2693         /* Recalculate length in case of filtered SCO connections, etc */
2694         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2695                                 struct_size(rp, addr, i));
2696
2697         kfree(rp);
2698
2699 unlock:
2700         hci_dev_unlock(hdev);
2701         return err;
2702 }
2703
2704 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2705                                    struct mgmt_cp_pin_code_neg_reply *cp)
2706 {
2707         struct mgmt_pending_cmd *cmd;
2708         int err;
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2711                                sizeof(*cp));
2712         if (!cmd)
2713                 return -ENOMEM;
2714
2715         cmd->cmd_complete = addr_cmd_complete;
2716
2717         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2718                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721
2722         return err;
2723 }
2724
2725 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2726                           u16 len)
2727 {
2728         struct hci_conn *conn;
2729         struct mgmt_cp_pin_code_reply *cp = data;
2730         struct hci_cp_pin_code_reply reply;
2731         struct mgmt_pending_cmd *cmd;
2732         int err;
2733
2734         bt_dev_dbg(hdev, "sock %p", sk);
2735
2736         hci_dev_lock(hdev);
2737
2738         if (!hdev_is_powered(hdev)) {
2739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2740                                       MGMT_STATUS_NOT_POWERED);
2741                 goto failed;
2742         }
2743
2744         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2745         if (!conn) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_CONNECTED);
2748                 goto failed;
2749         }
2750
2751         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2752                 struct mgmt_cp_pin_code_neg_reply ncp;
2753
2754                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2755
2756                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2757
2758                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2759                 if (err >= 0)
2760                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2761                                               MGMT_STATUS_INVALID_PARAMS);
2762
2763                 goto failed;
2764         }
2765
2766         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2767         if (!cmd) {
2768                 err = -ENOMEM;
2769                 goto failed;
2770         }
2771
2772         cmd->cmd_complete = addr_cmd_complete;
2773
2774         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2775         reply.pin_len = cp->pin_len;
2776         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2777
2778         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2779         if (err < 0)
2780                 mgmt_pending_remove(cmd);
2781
2782 failed:
2783         hci_dev_unlock(hdev);
2784         return err;
2785 }
2786
2787 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2788                              u16 len)
2789 {
2790         struct mgmt_cp_set_io_capability *cp = data;
2791
2792         bt_dev_dbg(hdev, "sock %p", sk);
2793
2794         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2796                                        MGMT_STATUS_INVALID_PARAMS);
2797
2798         hci_dev_lock(hdev);
2799
2800         hdev->io_capability = cp->io_capability;
2801
2802         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2803
2804         hci_dev_unlock(hdev);
2805
2806         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2807                                  NULL, 0);
2808 }
2809
2810 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2811 {
2812         struct hci_dev *hdev = conn->hdev;
2813         struct mgmt_pending_cmd *cmd;
2814
2815         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2816                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2817                         continue;
2818
2819                 if (cmd->user_data != conn)
2820                         continue;
2821
2822                 return cmd;
2823         }
2824
2825         return NULL;
2826 }
2827
2828 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2829 {
2830         struct mgmt_rp_pair_device rp;
2831         struct hci_conn *conn = cmd->user_data;
2832         int err;
2833
2834         bacpy(&rp.addr.bdaddr, &conn->dst);
2835         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2836
2837         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2838                                 status, &rp, sizeof(rp));
2839
2840         /* So we don't get further callbacks for this connection */
2841         conn->connect_cfm_cb = NULL;
2842         conn->security_cfm_cb = NULL;
2843         conn->disconn_cfm_cb = NULL;
2844
2845         hci_conn_drop(conn);
2846
2847         /* The device is paired so there is no need to remove
2848          * its connection parameters anymore.
2849          */
2850         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2851
2852         hci_conn_put(conn);
2853
2854         return err;
2855 }
2856
2857 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2858 {
2859         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2860         struct mgmt_pending_cmd *cmd;
2861
2862         cmd = find_pairing(conn);
2863         if (cmd) {
2864                 cmd->cmd_complete(cmd, status);
2865                 mgmt_pending_remove(cmd);
2866         }
2867 }
2868
2869 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2870 {
2871         struct mgmt_pending_cmd *cmd;
2872
2873         BT_DBG("status %u", status);
2874
2875         cmd = find_pairing(conn);
2876         if (!cmd) {
2877                 BT_DBG("Unable to find a pending command");
2878                 return;
2879         }
2880
2881         cmd->cmd_complete(cmd, mgmt_status(status));
2882         mgmt_pending_remove(cmd);
2883 }
2884
2885 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2886 {
2887         struct mgmt_pending_cmd *cmd;
2888
2889         BT_DBG("status %u", status);
2890
2891         if (!status)
2892                 return;
2893
2894         cmd = find_pairing(conn);
2895         if (!cmd) {
2896                 BT_DBG("Unable to find a pending command");
2897                 return;
2898         }
2899
2900         cmd->cmd_complete(cmd, mgmt_status(status));
2901         mgmt_pending_remove(cmd);
2902 }
2903
2904 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2905                        u16 len)
2906 {
2907         struct mgmt_cp_pair_device *cp = data;
2908         struct mgmt_rp_pair_device rp;
2909         struct mgmt_pending_cmd *cmd;
2910         u8 sec_level, auth_type;
2911         struct hci_conn *conn;
2912         int err;
2913
2914         bt_dev_dbg(hdev, "sock %p", sk);
2915
2916         memset(&rp, 0, sizeof(rp));
2917         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2918         rp.addr.type = cp->addr.type;
2919
2920         if (!bdaddr_type_is_valid(cp->addr.type))
2921                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2922                                          MGMT_STATUS_INVALID_PARAMS,
2923                                          &rp, sizeof(rp));
2924
2925         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2926                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2927                                          MGMT_STATUS_INVALID_PARAMS,
2928                                          &rp, sizeof(rp));
2929
2930         hci_dev_lock(hdev);
2931
2932         if (!hdev_is_powered(hdev)) {
2933                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                         MGMT_STATUS_NOT_POWERED, &rp,
2935                                         sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         sec_level = BT_SECURITY_MEDIUM;
2947         auth_type = HCI_AT_DEDICATED_BONDING;
2948
2949         if (cp->addr.type == BDADDR_BREDR) {
2950                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2951                                        auth_type, CONN_REASON_PAIR_DEVICE);
2952         } else {
2953                 u8 addr_type = le_addr_type(cp->addr.type);
2954                 struct hci_conn_params *p;
2955
2956                 /* When pairing a new device, it is expected to remember
2957                  * this device for future connections. Adding the connection
2958                  * parameter information ahead of time allows tracking
2959                  * of the slave preferred values and will speed up any
2960                  * further connection establishment.
2961                  *
2962                  * If connection parameters already exist, then they
2963                  * will be kept and this function does nothing.
2964                  */
2965                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2966
2967                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2968                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2969
2970                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2971                                            sec_level, HCI_LE_CONN_TIMEOUT,
2972                                            CONN_REASON_PAIR_DEVICE);
2973         }
2974
2975         if (IS_ERR(conn)) {
2976                 int status;
2977
2978                 if (PTR_ERR(conn) == -EBUSY)
2979                         status = MGMT_STATUS_BUSY;
2980                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2981                         status = MGMT_STATUS_NOT_SUPPORTED;
2982                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2983                         status = MGMT_STATUS_REJECTED;
2984                 else
2985                         status = MGMT_STATUS_CONNECT_FAILED;
2986
2987                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2988                                         status, &rp, sizeof(rp));
2989                 goto unlock;
2990         }
2991
2992         if (conn->connect_cfm_cb) {
2993                 hci_conn_drop(conn);
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 hci_conn_drop(conn);
3003                 goto unlock;
3004         }
3005
3006         cmd->cmd_complete = pairing_complete;
3007
3008         /* For LE, just connecting isn't a proof that the pairing finished */
3009         if (cp->addr.type == BDADDR_BREDR) {
3010                 conn->connect_cfm_cb = pairing_complete_cb;
3011                 conn->security_cfm_cb = pairing_complete_cb;
3012                 conn->disconn_cfm_cb = pairing_complete_cb;
3013         } else {
3014                 conn->connect_cfm_cb = le_pairing_complete_cb;
3015                 conn->security_cfm_cb = le_pairing_complete_cb;
3016                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3017         }
3018
3019         conn->io_capability = cp->io_cap;
3020         cmd->user_data = hci_conn_get(conn);
3021
3022         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3023             hci_conn_security(conn, sec_level, auth_type, true)) {
3024                 cmd->cmd_complete(cmd, 0);
3025                 mgmt_pending_remove(cmd);
3026         }
3027
3028         err = 0;
3029
3030 unlock:
3031         hci_dev_unlock(hdev);
3032         return err;
3033 }
3034
3035 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3036                               u16 len)
3037 {
3038         struct mgmt_addr_info *addr = data;
3039         struct mgmt_pending_cmd *cmd;
3040         struct hci_conn *conn;
3041         int err;
3042
3043         bt_dev_dbg(hdev, "sock %p", sk);
3044
3045         hci_dev_lock(hdev);
3046
3047         if (!hdev_is_powered(hdev)) {
3048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3049                                       MGMT_STATUS_NOT_POWERED);
3050                 goto unlock;
3051         }
3052
3053         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3054         if (!cmd) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_INVALID_PARAMS);
3057                 goto unlock;
3058         }
3059
3060         conn = cmd->user_data;
3061
3062         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3063                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3064                                       MGMT_STATUS_INVALID_PARAMS);
3065                 goto unlock;
3066         }
3067
3068         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3069         mgmt_pending_remove(cmd);
3070
3071         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3072                                 addr, sizeof(*addr));
3073
3074         /* Since user doesn't want to proceed with the connection, abort any
3075          * ongoing pairing and then terminate the link if it was created
3076          * because of the pair device action.
3077          */
3078         if (addr->type == BDADDR_BREDR)
3079                 hci_remove_link_key(hdev, &addr->bdaddr);
3080         else
3081                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3082                                               le_addr_type(addr->type));
3083
3084         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3085                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3086
3087 unlock:
3088         hci_dev_unlock(hdev);
3089         return err;
3090 }
3091
3092 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3093                              struct mgmt_addr_info *addr, u16 mgmt_op,
3094                              u16 hci_op, __le32 passkey)
3095 {
3096         struct mgmt_pending_cmd *cmd;
3097         struct hci_conn *conn;
3098         int err;
3099
3100         hci_dev_lock(hdev);
3101
3102         if (!hdev_is_powered(hdev)) {
3103                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3104                                         MGMT_STATUS_NOT_POWERED, addr,
3105                                         sizeof(*addr));
3106                 goto done;
3107         }
3108
3109         if (addr->type == BDADDR_BREDR)
3110                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3111         else
3112                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3113                                                le_addr_type(addr->type));
3114
3115         if (!conn) {
3116                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3117                                         MGMT_STATUS_NOT_CONNECTED, addr,
3118                                         sizeof(*addr));
3119                 goto done;
3120         }
3121
3122         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3123                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3124                 if (!err)
3125                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3126                                                 MGMT_STATUS_SUCCESS, addr,
3127                                                 sizeof(*addr));
3128                 else
3129                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3130                                                 MGMT_STATUS_FAILED, addr,
3131                                                 sizeof(*addr));
3132
3133                 goto done;
3134         }
3135
3136         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3137         if (!cmd) {
3138                 err = -ENOMEM;
3139                 goto done;
3140         }
3141
3142         cmd->cmd_complete = addr_cmd_complete;
3143
3144         /* Continue with pairing via HCI */
3145         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3146                 struct hci_cp_user_passkey_reply cp;
3147
3148                 bacpy(&cp.bdaddr, &addr->bdaddr);
3149                 cp.passkey = passkey;
3150                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3151         } else
3152                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3153                                    &addr->bdaddr);
3154
3155         if (err < 0)
3156                 mgmt_pending_remove(cmd);
3157
3158 done:
3159         hci_dev_unlock(hdev);
3160         return err;
3161 }
3162
3163 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3164                               void *data, u16 len)
3165 {
3166         struct mgmt_cp_pin_code_neg_reply *cp = data;
3167
3168         bt_dev_dbg(hdev, "sock %p", sk);
3169
3170         return user_pairing_resp(sk, hdev, &cp->addr,
3171                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3172                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3173 }
3174
3175 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3176                               u16 len)
3177 {
3178         struct mgmt_cp_user_confirm_reply *cp = data;
3179
3180         bt_dev_dbg(hdev, "sock %p", sk);
3181
3182         if (len != sizeof(*cp))
3183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3184                                        MGMT_STATUS_INVALID_PARAMS);
3185
3186         return user_pairing_resp(sk, hdev, &cp->addr,
3187                                  MGMT_OP_USER_CONFIRM_REPLY,
3188                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3189 }
3190
3191 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3192                                   void *data, u16 len)
3193 {
3194         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3195
3196         bt_dev_dbg(hdev, "sock %p", sk);
3197
3198         return user_pairing_resp(sk, hdev, &cp->addr,
3199                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3200                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3201 }
3202
3203 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3204                               u16 len)
3205 {
3206         struct mgmt_cp_user_passkey_reply *cp = data;
3207
3208         bt_dev_dbg(hdev, "sock %p", sk);
3209
3210         return user_pairing_resp(sk, hdev, &cp->addr,
3211                                  MGMT_OP_USER_PASSKEY_REPLY,
3212                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3213 }
3214
3215 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3216                                   void *data, u16 len)
3217 {
3218         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3219
3220         bt_dev_dbg(hdev, "sock %p", sk);
3221
3222         return user_pairing_resp(sk, hdev, &cp->addr,
3223                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3224                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3225 }
3226
3227 static void adv_expire(struct hci_dev *hdev, u32 flags)
3228 {
3229         struct adv_info *adv_instance;
3230         struct hci_request req;
3231         int err;
3232
3233         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3234         if (!adv_instance)
3235                 return;
3236
3237         /* stop if current instance doesn't need to be changed */
3238         if (!(adv_instance->flags & flags))
3239                 return;
3240
3241         cancel_adv_timeout(hdev);
3242
3243         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3244         if (!adv_instance)
3245                 return;
3246
3247         hci_req_init(&req, hdev);
3248         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3249                                               true);
3250         if (err)
3251                 return;
3252
3253         hci_req_run(&req, NULL);
3254 }
3255
3256 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3257 {
3258         struct mgmt_cp_set_local_name *cp;
3259         struct mgmt_pending_cmd *cmd;
3260
3261         bt_dev_dbg(hdev, "status 0x%02x", status);
3262
3263         hci_dev_lock(hdev);
3264
3265         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3266         if (!cmd)
3267                 goto unlock;
3268
3269         cp = cmd->param;
3270
3271         if (status) {
3272                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3273                                 mgmt_status(status));
3274         } else {
3275                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3276                                   cp, sizeof(*cp));
3277
3278                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3279                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3280         }
3281
3282         mgmt_pending_remove(cmd);
3283
3284 unlock:
3285         hci_dev_unlock(hdev);
3286 }
3287
3288 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3289                           u16 len)
3290 {
3291         struct mgmt_cp_set_local_name *cp = data;
3292         struct mgmt_pending_cmd *cmd;
3293         struct hci_request req;
3294         int err;
3295
3296         bt_dev_dbg(hdev, "sock %p", sk);
3297
3298         hci_dev_lock(hdev);
3299
3300         /* If the old values are the same as the new ones just return a
3301          * direct command complete event.
3302          */
3303         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3304             !memcmp(hdev->short_name, cp->short_name,
3305                     sizeof(hdev->short_name))) {
3306                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3307                                         data, len);
3308                 goto failed;
3309         }
3310
3311         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3312
3313         if (!hdev_is_powered(hdev)) {
3314                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3315
3316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3317                                         data, len);
3318                 if (err < 0)
3319                         goto failed;
3320
3321                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3322                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3323                 ext_info_changed(hdev, sk);
3324
3325                 goto failed;
3326         }
3327
3328         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3329         if (!cmd) {
3330                 err = -ENOMEM;
3331                 goto failed;
3332         }
3333
3334         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3335
3336         hci_req_init(&req, hdev);
3337
3338         if (lmp_bredr_capable(hdev)) {
3339                 __hci_req_update_name(&req);
3340                 __hci_req_update_eir(&req);
3341         }
3342
3343         /* The name is stored in the scan response data and so
3344          * no need to udpate the advertising data here.
3345          */
3346         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3347                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3348
3349         err = hci_req_run(&req, set_name_complete);
3350         if (err < 0)
3351                 mgmt_pending_remove(cmd);
3352
3353 failed:
3354         hci_dev_unlock(hdev);
3355         return err;
3356 }
3357
3358 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3359                           u16 len)
3360 {
3361         struct mgmt_cp_set_appearance *cp = data;
3362         u16 appearance;
3363         int err;
3364
3365         bt_dev_dbg(hdev, "sock %p", sk);
3366
3367         if (!lmp_le_capable(hdev))
3368                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3369                                        MGMT_STATUS_NOT_SUPPORTED);
3370
3371         appearance = le16_to_cpu(cp->appearance);
3372
3373         hci_dev_lock(hdev);
3374
3375         if (hdev->appearance != appearance) {
3376                 hdev->appearance = appearance;
3377
3378                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3379                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3380
3381                 ext_info_changed(hdev, sk);
3382         }
3383
3384         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3385                                 0);
3386
3387         hci_dev_unlock(hdev);
3388
3389         return err;
3390 }
3391
3392 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3393                                  void *data, u16 len)
3394 {
3395         struct mgmt_rp_get_phy_configuration rp;
3396
3397         bt_dev_dbg(hdev, "sock %p", sk);
3398
3399         hci_dev_lock(hdev);
3400
3401         memset(&rp, 0, sizeof(rp));
3402
3403         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3404         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3405         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3406
3407         hci_dev_unlock(hdev);
3408
3409         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3410                                  &rp, sizeof(rp));
3411 }
3412
3413 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3414 {
3415         struct mgmt_ev_phy_configuration_changed ev;
3416
3417         memset(&ev, 0, sizeof(ev));
3418
3419         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3420
3421         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3422                           sizeof(ev), skip);
3423 }
3424
3425 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3426                                      u16 opcode, struct sk_buff *skb)
3427 {
3428         struct mgmt_pending_cmd *cmd;
3429
3430         bt_dev_dbg(hdev, "status 0x%02x", status);
3431
3432         hci_dev_lock(hdev);
3433
3434         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3435         if (!cmd)
3436                 goto unlock;
3437
3438         if (status) {
3439                 mgmt_cmd_status(cmd->sk, hdev->id,
3440                                 MGMT_OP_SET_PHY_CONFIGURATION,
3441                                 mgmt_status(status));
3442         } else {
3443                 mgmt_cmd_complete(cmd->sk, hdev->id,
3444                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3445                                   NULL, 0);
3446
3447                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3448         }
3449
3450         mgmt_pending_remove(cmd);
3451
3452 unlock:
3453         hci_dev_unlock(hdev);
3454 }
3455
3456 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3457                                  void *data, u16 len)
3458 {
3459         struct mgmt_cp_set_phy_configuration *cp = data;
3460         struct hci_cp_le_set_default_phy cp_phy;
3461         struct mgmt_pending_cmd *cmd;
3462         struct hci_request req;
3463         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3464         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3465         bool changed = false;
3466         int err;
3467
3468         bt_dev_dbg(hdev, "sock %p", sk);
3469
3470         configurable_phys = get_configurable_phys(hdev);
3471         supported_phys = get_supported_phys(hdev);
3472         selected_phys = __le32_to_cpu(cp->selected_phys);
3473
3474         if (selected_phys & ~supported_phys)
3475                 return mgmt_cmd_status(sk, hdev->id,
3476                                        MGMT_OP_SET_PHY_CONFIGURATION,
3477                                        MGMT_STATUS_INVALID_PARAMS);
3478
3479         unconfigure_phys = supported_phys & ~configurable_phys;
3480
3481         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         if (selected_phys == get_selected_phys(hdev))
3487                 return mgmt_cmd_complete(sk, hdev->id,
3488                                          MGMT_OP_SET_PHY_CONFIGURATION,
3489                                          0, NULL, 0);
3490
3491         hci_dev_lock(hdev);
3492
3493         if (!hdev_is_powered(hdev)) {
3494                 err = mgmt_cmd_status(sk, hdev->id,
3495                                       MGMT_OP_SET_PHY_CONFIGURATION,
3496                                       MGMT_STATUS_REJECTED);
3497                 goto unlock;
3498         }
3499
3500         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_BUSY);
3504                 goto unlock;
3505         }
3506
3507         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3508                 pkt_type |= (HCI_DH3 | HCI_DM3);
3509         else
3510                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3511
3512         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3513                 pkt_type |= (HCI_DH5 | HCI_DM5);
3514         else
3515                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3516
3517         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3518                 pkt_type &= ~HCI_2DH1;
3519         else
3520                 pkt_type |= HCI_2DH1;
3521
3522         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3523                 pkt_type &= ~HCI_2DH3;
3524         else
3525                 pkt_type |= HCI_2DH3;
3526
3527         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3528                 pkt_type &= ~HCI_2DH5;
3529         else
3530                 pkt_type |= HCI_2DH5;
3531
3532         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3533                 pkt_type &= ~HCI_3DH1;
3534         else
3535                 pkt_type |= HCI_3DH1;
3536
3537         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3538                 pkt_type &= ~HCI_3DH3;
3539         else
3540                 pkt_type |= HCI_3DH3;
3541
3542         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3543                 pkt_type &= ~HCI_3DH5;
3544         else
3545                 pkt_type |= HCI_3DH5;
3546
3547         if (pkt_type != hdev->pkt_type) {
3548                 hdev->pkt_type = pkt_type;
3549                 changed = true;
3550         }
3551
3552         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3553             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3554                 if (changed)
3555                         mgmt_phy_configuration_changed(hdev, sk);
3556
3557                 err = mgmt_cmd_complete(sk, hdev->id,
3558                                         MGMT_OP_SET_PHY_CONFIGURATION,
3559                                         0, NULL, 0);
3560
3561                 goto unlock;
3562         }
3563
3564         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3565                                len);
3566         if (!cmd) {
3567                 err = -ENOMEM;
3568                 goto unlock;
3569         }
3570
3571         hci_req_init(&req, hdev);
3572
3573         memset(&cp_phy, 0, sizeof(cp_phy));
3574
3575         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3576                 cp_phy.all_phys |= 0x01;
3577
3578         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3579                 cp_phy.all_phys |= 0x02;
3580
3581         if (selected_phys & MGMT_PHY_LE_1M_TX)
3582                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3583
3584         if (selected_phys & MGMT_PHY_LE_2M_TX)
3585                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3586
3587         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3589
3590         if (selected_phys & MGMT_PHY_LE_1M_RX)
3591                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3592
3593         if (selected_phys & MGMT_PHY_LE_2M_RX)
3594                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3595
3596         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3598
3599         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3600
3601         err = hci_req_run_skb(&req, set_default_phy_complete);
3602         if (err < 0)
3603                 mgmt_pending_remove(cmd);
3604
3605 unlock:
3606         hci_dev_unlock(hdev);
3607
3608         return err;
3609 }
3610
3611 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3612                             u16 len)
3613 {
3614         int err = MGMT_STATUS_SUCCESS;
3615         struct mgmt_cp_set_blocked_keys *keys = data;
3616         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3617                                    sizeof(struct mgmt_blocked_key_info));
3618         u16 key_count, expected_len;
3619         int i;
3620
3621         bt_dev_dbg(hdev, "sock %p", sk);
3622
3623         key_count = __le16_to_cpu(keys->key_count);
3624         if (key_count > max_key_count) {
3625                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3627                                        MGMT_STATUS_INVALID_PARAMS);
3628         }
3629
3630         expected_len = struct_size(keys, keys, key_count);
3631         if (expected_len != len) {
3632                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3633                            expected_len, len);
3634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3635                                        MGMT_STATUS_INVALID_PARAMS);
3636         }
3637
3638         hci_dev_lock(hdev);
3639
3640         hci_blocked_keys_clear(hdev);
3641
3642         for (i = 0; i < keys->key_count; ++i) {
3643                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3644
3645                 if (!b) {
3646                         err = MGMT_STATUS_NO_RESOURCES;
3647                         break;
3648                 }
3649
3650                 b->type = keys->keys[i].type;
3651                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3652                 list_add_rcu(&b->list, &hdev->blocked_keys);
3653         }
3654         hci_dev_unlock(hdev);
3655
3656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3657                                 err, NULL, 0);
3658 }
3659
3660 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3661                                void *data, u16 len)
3662 {
3663         struct mgmt_mode *cp = data;
3664         int err;
3665         bool changed = false;
3666
3667         bt_dev_dbg(hdev, "sock %p", sk);
3668
3669         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3670                 return mgmt_cmd_status(sk, hdev->id,
3671                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3672                                        MGMT_STATUS_NOT_SUPPORTED);
3673
3674         if (cp->val != 0x00 && cp->val != 0x01)
3675                 return mgmt_cmd_status(sk, hdev->id,
3676                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3677                                        MGMT_STATUS_INVALID_PARAMS);
3678
3679         hci_dev_lock(hdev);
3680
3681         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3682                 err = mgmt_cmd_status(sk, hdev->id,
3683                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                       MGMT_STATUS_BUSY);
3685                 goto unlock;
3686         }
3687
3688         if (hdev_is_powered(hdev) &&
3689             !!cp->val != hci_dev_test_flag(hdev,
3690                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3691                 err = mgmt_cmd_status(sk, hdev->id,
3692                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3693                                       MGMT_STATUS_REJECTED);
3694                 goto unlock;
3695         }
3696
3697         if (cp->val)
3698                 changed = !hci_dev_test_and_set_flag(hdev,
3699                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3700         else
3701                 changed = hci_dev_test_and_clear_flag(hdev,
3702                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3703
3704         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3705         if (err < 0)
3706                 goto unlock;
3707
3708         if (changed)
3709                 err = new_settings(hdev, sk);
3710
3711 unlock:
3712         hci_dev_unlock(hdev);
3713         return err;
3714 }
3715
3716 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3717                                void *data, u16 data_len)
3718 {
3719         char buf[20];
3720         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3721         u16 cap_len = 0;
3722         u8 flags = 0;
3723         u8 tx_power_range[2];
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         memset(&buf, 0, sizeof(buf));
3728
3729         hci_dev_lock(hdev);
3730
3731         /* When the Read Simple Pairing Options command is supported, then
3732          * the remote public key validation is supported.
3733          */
3734         if (hdev->commands[41] & 0x08)
3735                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3736
3737         flags |= 0x02;          /* Remote public key validation (LE) */
3738
3739         /* When the Read Encryption Key Size command is supported, then the
3740          * encryption key size is enforced.
3741          */
3742         if (hdev->commands[20] & 0x10)
3743                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3744
3745         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3746
3747         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3748                                   &flags, 1);
3749
3750         /* When the Read Simple Pairing Options command is supported, then
3751          * also max encryption key size information is provided.
3752          */
3753         if (hdev->commands[41] & 0x08)
3754                 cap_len = eir_append_le16(rp->cap, cap_len,
3755                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3756                                           hdev->max_enc_key_size);
3757
3758         cap_len = eir_append_le16(rp->cap, cap_len,
3759                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3760                                   SMP_MAX_ENC_KEY_SIZE);
3761
3762         /* Append the min/max LE tx power parameters if we were able to fetch
3763          * it from the controller
3764          */
3765         if (hdev->commands[38] & 0x80) {
3766                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3767                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3768                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3769                                           tx_power_range, 2);
3770         }
3771
3772         rp->cap_len = cpu_to_le16(cap_len);
3773
3774         hci_dev_unlock(hdev);
3775
3776         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3777                                  rp, sizeof(*rp) + cap_len);
3778 }
3779
3780 #ifdef CONFIG_BT_FEATURE_DEBUG
3781 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3782 static const u8 debug_uuid[16] = {
3783         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3784         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3785 };
3786 #endif
3787
3788 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3789 static const u8 simult_central_periph_uuid[16] = {
3790         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3791         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3792 };
3793
3794 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3795 static const u8 rpa_resolution_uuid[16] = {
3796         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3797         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3798 };
3799
3800 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3801                                   void *data, u16 data_len)
3802 {
3803         char buf[62];   /* Enough space for 3 features */
3804         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3805         u16 idx = 0;
3806         u32 flags;
3807
3808         bt_dev_dbg(hdev, "sock %p", sk);
3809
3810         memset(&buf, 0, sizeof(buf));
3811
3812 #ifdef CONFIG_BT_FEATURE_DEBUG
3813         if (!hdev) {
3814                 flags = bt_dbg_get() ? BIT(0) : 0;
3815
3816                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3817                 rp->features[idx].flags = cpu_to_le32(flags);
3818                 idx++;
3819         }
3820 #endif
3821
3822         if (hdev) {
3823                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3824                     (hdev->le_states[4] & 0x08) &&      /* Central */
3825                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3826                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3827                         flags = BIT(0);
3828                 else
3829                         flags = 0;
3830
3831                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3832                 rp->features[idx].flags = cpu_to_le32(flags);
3833                 idx++;
3834         }
3835
3836         if (hdev && use_ll_privacy(hdev)) {
3837                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3838                         flags = BIT(0) | BIT(1);
3839                 else
3840                         flags = BIT(1);
3841
3842                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3843                 rp->features[idx].flags = cpu_to_le32(flags);
3844                 idx++;
3845         }
3846
3847         rp->feature_count = cpu_to_le16(idx);
3848
3849         /* After reading the experimental features information, enable
3850          * the events to update client on any future change.
3851          */
3852         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3853
3854         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3855                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3856                                  0, rp, sizeof(*rp) + (20 * idx));
3857 }
3858
3859 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3860                                           struct sock *skip)
3861 {
3862         struct mgmt_ev_exp_feature_changed ev;
3863
3864         memset(&ev, 0, sizeof(ev));
3865         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3866         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3867
3868         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3869                                   &ev, sizeof(ev),
3870                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3871
3872 }
3873
3874 #ifdef CONFIG_BT_FEATURE_DEBUG
3875 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3876 {
3877         struct mgmt_ev_exp_feature_changed ev;
3878
3879         memset(&ev, 0, sizeof(ev));
3880         memcpy(ev.uuid, debug_uuid, 16);
3881         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3882
3883         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3884                                   &ev, sizeof(ev),
3885                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3886 }
3887 #endif
3888
3889 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3890                            void *data, u16 data_len)
3891 {
3892         struct mgmt_cp_set_exp_feature *cp = data;
3893         struct mgmt_rp_set_exp_feature rp;
3894
3895         bt_dev_dbg(hdev, "sock %p", sk);
3896
3897         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3898                 memset(rp.uuid, 0, 16);
3899                 rp.flags = cpu_to_le32(0);
3900
3901 #ifdef CONFIG_BT_FEATURE_DEBUG
3902                 if (!hdev) {
3903                         bool changed = bt_dbg_get();
3904
3905                         bt_dbg_set(false);
3906
3907                         if (changed)
3908                                 exp_debug_feature_changed(false, sk);
3909                 }
3910 #endif
3911
3912                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3913                         bool changed = hci_dev_test_flag(hdev,
3914                                                          HCI_ENABLE_LL_PRIVACY);
3915
3916                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3917
3918                         if (changed)
3919                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3920                 }
3921
3922                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3923
3924                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3925                                          MGMT_OP_SET_EXP_FEATURE, 0,
3926                                          &rp, sizeof(rp));
3927         }
3928
3929 #ifdef CONFIG_BT_FEATURE_DEBUG
3930         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3931                 bool val, changed;
3932                 int err;
3933
3934                 /* Command requires to use the non-controller index */
3935                 if (hdev)
3936                         return mgmt_cmd_status(sk, hdev->id,
3937                                                MGMT_OP_SET_EXP_FEATURE,
3938                                                MGMT_STATUS_INVALID_INDEX);
3939
3940                 /* Parameters are limited to a single octet */
3941                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3942                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3943                                                MGMT_OP_SET_EXP_FEATURE,
3944                                                MGMT_STATUS_INVALID_PARAMS);
3945
3946                 /* Only boolean on/off is supported */
3947                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3948                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3949                                                MGMT_OP_SET_EXP_FEATURE,
3950                                                MGMT_STATUS_INVALID_PARAMS);
3951
3952                 val = !!cp->param[0];
3953                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3954                 bt_dbg_set(val);
3955
3956                 memcpy(rp.uuid, debug_uuid, 16);
3957                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3958
3959                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3960
3961                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3962                                         MGMT_OP_SET_EXP_FEATURE, 0,
3963                                         &rp, sizeof(rp));
3964
3965                 if (changed)
3966                         exp_debug_feature_changed(val, sk);
3967
3968                 return err;
3969         }
3970 #endif
3971
3972         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3973                 bool val, changed;
3974                 int err;
3975                 u32 flags;
3976
3977                 /* Command requires to use the controller index */
3978                 if (!hdev)
3979                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3980                                                MGMT_OP_SET_EXP_FEATURE,
3981                                                MGMT_STATUS_INVALID_INDEX);
3982
3983                 /* Changes can only be made when controller is powered down */
3984                 if (hdev_is_powered(hdev))
3985                         return mgmt_cmd_status(sk, hdev->id,
3986                                                MGMT_OP_SET_EXP_FEATURE,
3987                                                MGMT_STATUS_REJECTED);
3988
3989                 /* Parameters are limited to a single octet */
3990                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3991                         return mgmt_cmd_status(sk, hdev->id,
3992                                                MGMT_OP_SET_EXP_FEATURE,
3993                                                MGMT_STATUS_INVALID_PARAMS);
3994
3995                 /* Only boolean on/off is supported */
3996                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3997                         return mgmt_cmd_status(sk, hdev->id,
3998                                                MGMT_OP_SET_EXP_FEATURE,
3999                                                MGMT_STATUS_INVALID_PARAMS);
4000
4001                 val = !!cp->param[0];
4002
4003                 if (val) {
4004                         changed = !hci_dev_test_flag(hdev,
4005                                                      HCI_ENABLE_LL_PRIVACY);
4006                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4007                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4008
4009                         /* Enable LL privacy + supported settings changed */
4010                         flags = BIT(0) | BIT(1);
4011                 } else {
4012                         changed = hci_dev_test_flag(hdev,
4013                                                     HCI_ENABLE_LL_PRIVACY);
4014                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4015
4016                         /* Disable LL privacy + supported settings changed */
4017                         flags = BIT(1);
4018                 }
4019
4020                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4021                 rp.flags = cpu_to_le32(flags);
4022
4023                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4024
4025                 err = mgmt_cmd_complete(sk, hdev->id,
4026                                         MGMT_OP_SET_EXP_FEATURE, 0,
4027                                         &rp, sizeof(rp));
4028
4029                 if (changed)
4030                         exp_ll_privacy_feature_changed(val, hdev, sk);
4031
4032                 return err;
4033         }
4034
4035         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4036                                MGMT_OP_SET_EXP_FEATURE,
4037                                MGMT_STATUS_NOT_SUPPORTED);
4038 }
4039
4040 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4041
4042 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4043                             u16 data_len)
4044 {
4045         struct mgmt_cp_get_device_flags *cp = data;
4046         struct mgmt_rp_get_device_flags rp;
4047         struct bdaddr_list_with_flags *br_params;
4048         struct hci_conn_params *params;
4049         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4050         u32 current_flags = 0;
4051         u8 status = MGMT_STATUS_INVALID_PARAMS;
4052
4053         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4054                    &cp->addr.bdaddr, cp->addr.type);
4055
4056         hci_dev_lock(hdev);
4057
4058         if (cp->addr.type == BDADDR_BREDR) {
4059                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4060                                                               &cp->addr.bdaddr,
4061                                                               cp->addr.type);
4062                 if (!br_params)
4063                         goto done;
4064
4065                 current_flags = br_params->current_flags;
4066         } else {
4067                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4068                                                 le_addr_type(cp->addr.type));
4069
4070                 if (!params)
4071                         goto done;
4072
4073                 current_flags = params->current_flags;
4074         }
4075
4076         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4077         rp.addr.type = cp->addr.type;
4078         rp.supported_flags = cpu_to_le32(supported_flags);
4079         rp.current_flags = cpu_to_le32(current_flags);
4080
4081         status = MGMT_STATUS_SUCCESS;
4082
4083 done:
4084         hci_dev_unlock(hdev);
4085
4086         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4087                                 &rp, sizeof(rp));
4088 }
4089
4090 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4091                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4092                                  u32 supported_flags, u32 current_flags)
4093 {
4094         struct mgmt_ev_device_flags_changed ev;
4095
4096         bacpy(&ev.addr.bdaddr, bdaddr);
4097         ev.addr.type = bdaddr_type;
4098         ev.supported_flags = cpu_to_le32(supported_flags);
4099         ev.current_flags = cpu_to_le32(current_flags);
4100
4101         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4102 }
4103
4104 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4105                             u16 len)
4106 {
4107         struct mgmt_cp_set_device_flags *cp = data;
4108         struct bdaddr_list_with_flags *br_params;
4109         struct hci_conn_params *params;
4110         u8 status = MGMT_STATUS_INVALID_PARAMS;
4111         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4112         u32 current_flags = __le32_to_cpu(cp->current_flags);
4113
4114         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4115                    &cp->addr.bdaddr, cp->addr.type,
4116                    __le32_to_cpu(current_flags));
4117
4118         if ((supported_flags | current_flags) != supported_flags) {
4119                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4120                             current_flags, supported_flags);
4121                 goto done;
4122         }
4123
4124         hci_dev_lock(hdev);
4125
4126         if (cp->addr.type == BDADDR_BREDR) {
4127                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4128                                                               &cp->addr.bdaddr,
4129                                                               cp->addr.type);
4130
4131                 if (br_params) {
4132                         br_params->current_flags = current_flags;
4133                         status = MGMT_STATUS_SUCCESS;
4134                 } else {
4135                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4136                                     &cp->addr.bdaddr, cp->addr.type);
4137                 }
4138         } else {
4139                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4140                                                 le_addr_type(cp->addr.type));
4141                 if (params) {
4142                         params->current_flags = current_flags;
4143                         status = MGMT_STATUS_SUCCESS;
4144                 } else {
4145                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4146                                     &cp->addr.bdaddr,
4147                                     le_addr_type(cp->addr.type));
4148                 }
4149         }
4150
4151 done:
4152         hci_dev_unlock(hdev);
4153
4154         if (status == MGMT_STATUS_SUCCESS)
4155                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4156                                      supported_flags, current_flags);
4157
4158         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4159                                  &cp->addr, sizeof(cp->addr));
4160 }
4161
4162 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4163                                    u16 handle)
4164 {
4165         struct mgmt_ev_adv_monitor_added ev;
4166
4167         ev.monitor_handle = cpu_to_le16(handle);
4168
4169         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4170 }
4171
4172 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4173 {
4174         struct mgmt_ev_adv_monitor_removed ev;
4175         struct mgmt_pending_cmd *cmd;
4176         struct sock *sk_skip = NULL;
4177         struct mgmt_cp_remove_adv_monitor *cp;
4178
4179         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4180         if (cmd) {
4181                 cp = cmd->param;
4182
4183                 if (cp->monitor_handle)
4184                         sk_skip = cmd->sk;
4185         }
4186
4187         ev.monitor_handle = cpu_to_le16(handle);
4188
4189         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4190 }
4191
4192 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4193                                  void *data, u16 len)
4194 {
4195         struct adv_monitor *monitor = NULL;
4196         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4197         int handle, err;
4198         size_t rp_size = 0;
4199         __u32 supported = 0;
4200         __u32 enabled = 0;
4201         __u16 num_handles = 0;
4202         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4203
4204         BT_DBG("request for %s", hdev->name);
4205
4206         hci_dev_lock(hdev);
4207
4208         if (msft_monitor_supported(hdev))
4209                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4210
4211         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4212                 handles[num_handles++] = monitor->handle;
4213
4214         hci_dev_unlock(hdev);
4215
4216         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4217         rp = kmalloc(rp_size, GFP_KERNEL);
4218         if (!rp)
4219                 return -ENOMEM;
4220
4221         /* All supported features are currently enabled */
4222         enabled = supported;
4223
4224         rp->supported_features = cpu_to_le32(supported);
4225         rp->enabled_features = cpu_to_le32(enabled);
4226         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4227         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4228         rp->num_handles = cpu_to_le16(num_handles);
4229         if (num_handles)
4230                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4231
4232         err = mgmt_cmd_complete(sk, hdev->id,
4233                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4234                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4235
4236         kfree(rp);
4237
4238         return err;
4239 }
4240
4241 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4242 {
4243         struct mgmt_rp_add_adv_patterns_monitor rp;
4244         struct mgmt_pending_cmd *cmd;
4245         struct adv_monitor *monitor;
4246         int err = 0;
4247
4248         hci_dev_lock(hdev);
4249
4250         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4251         if (!cmd) {
4252                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4253                 if (!cmd)
4254                         goto done;
4255         }
4256
4257         monitor = cmd->user_data;
4258         rp.monitor_handle = cpu_to_le16(monitor->handle);
4259
4260         if (!status) {
4261                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4262                 hdev->adv_monitors_cnt++;
4263                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4264                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4265                 hci_update_background_scan(hdev);
4266         }
4267
4268         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4269                                 mgmt_status(status), &rp, sizeof(rp));
4270         mgmt_pending_remove(cmd);
4271
4272 done:
4273         hci_dev_unlock(hdev);
4274         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
4275                    rp.monitor_handle, status);
4276
4277         return err;
4278 }
4279
4280 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4281                                       struct adv_monitor *m, u8 status,
4282                                       void *data, u16 len, u16 op)
4283 {
4284         struct mgmt_rp_add_adv_patterns_monitor rp;
4285         struct mgmt_pending_cmd *cmd;
4286         int err;
4287         bool pending;
4288
4289         hci_dev_lock(hdev);
4290
4291         if (status)
4292                 goto unlock;
4293
4294         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4295             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4296             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4297             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4298                 status = MGMT_STATUS_BUSY;
4299                 goto unlock;
4300         }
4301
4302         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4303         if (!cmd) {
4304                 status = MGMT_STATUS_NO_RESOURCES;
4305                 goto unlock;
4306         }
4307
4308         cmd->user_data = m;
4309         pending = hci_add_adv_monitor(hdev, m, &err);
4310         if (err) {
4311                 if (err == -ENOSPC || err == -ENOMEM)
4312                         status = MGMT_STATUS_NO_RESOURCES;
4313                 else if (err == -EINVAL)
4314                         status = MGMT_STATUS_INVALID_PARAMS;
4315                 else
4316                         status = MGMT_STATUS_FAILED;
4317
4318                 mgmt_pending_remove(cmd);
4319                 goto unlock;
4320         }
4321
4322         if (!pending) {
4323                 mgmt_pending_remove(cmd);
4324                 rp.monitor_handle = cpu_to_le16(m->handle);
4325                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4326                 m->state = ADV_MONITOR_STATE_REGISTERED;
4327                 hdev->adv_monitors_cnt++;
4328
4329                 hci_dev_unlock(hdev);
4330                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4331                                          &rp, sizeof(rp));
4332         }
4333
4334         hci_dev_unlock(hdev);
4335
4336         return 0;
4337
4338 unlock:
4339         hci_free_adv_monitor(hdev, m);
4340         hci_dev_unlock(hdev);
4341         return mgmt_cmd_status(sk, hdev->id, op, status);
4342 }
4343
4344 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4345                                    struct mgmt_adv_rssi_thresholds *rssi)
4346 {
4347         if (rssi) {
4348                 m->rssi.low_threshold = rssi->low_threshold;
4349                 m->rssi.low_threshold_timeout =
4350                     __le16_to_cpu(rssi->low_threshold_timeout);
4351                 m->rssi.high_threshold = rssi->high_threshold;
4352                 m->rssi.high_threshold_timeout =
4353                     __le16_to_cpu(rssi->high_threshold_timeout);
4354                 m->rssi.sampling_period = rssi->sampling_period;
4355         } else {
4356                 /* Default values. These numbers are the least constricting
4357                  * parameters for MSFT API to work, so it behaves as if there
4358                  * are no rssi parameter to consider. May need to be changed
4359                  * if other API are to be supported.
4360                  */
4361                 m->rssi.low_threshold = -127;
4362                 m->rssi.low_threshold_timeout = 60;
4363                 m->rssi.high_threshold = -127;
4364                 m->rssi.high_threshold_timeout = 0;
4365                 m->rssi.sampling_period = 0;
4366         }
4367 }
4368
4369 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4370                                     struct mgmt_adv_pattern *patterns)
4371 {
4372         u8 offset = 0, length = 0;
4373         struct adv_pattern *p = NULL;
4374         int i;
4375
4376         for (i = 0; i < pattern_count; i++) {
4377                 offset = patterns[i].offset;
4378                 length = patterns[i].length;
4379                 if (offset >= HCI_MAX_AD_LENGTH ||
4380                     length > HCI_MAX_AD_LENGTH ||
4381                     (offset + length) > HCI_MAX_AD_LENGTH)
4382                         return MGMT_STATUS_INVALID_PARAMS;
4383
4384                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4385                 if (!p)
4386                         return MGMT_STATUS_NO_RESOURCES;
4387
4388                 p->ad_type = patterns[i].ad_type;
4389                 p->offset = patterns[i].offset;
4390                 p->length = patterns[i].length;
4391                 memcpy(p->value, patterns[i].value, p->length);
4392
4393                 INIT_LIST_HEAD(&p->list);
4394                 list_add(&p->list, &m->patterns);
4395         }
4396
4397         return MGMT_STATUS_SUCCESS;
4398 }
4399
4400 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4401                                     void *data, u16 len)
4402 {
4403         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4404         struct adv_monitor *m = NULL;
4405         u8 status = MGMT_STATUS_SUCCESS;
4406         size_t expected_size = sizeof(*cp);
4407
4408         BT_DBG("request for %s", hdev->name);
4409
4410         if (len <= sizeof(*cp)) {
4411                 status = MGMT_STATUS_INVALID_PARAMS;
4412                 goto done;
4413         }
4414
4415         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4416         if (len != expected_size) {
4417                 status = MGMT_STATUS_INVALID_PARAMS;
4418                 goto done;
4419         }
4420
4421         m = kzalloc(sizeof(*m), GFP_KERNEL);
4422         if (!m) {
4423                 status = MGMT_STATUS_NO_RESOURCES;
4424                 goto done;
4425         }
4426
4427         INIT_LIST_HEAD(&m->patterns);
4428
4429         parse_adv_monitor_rssi(m, NULL);
4430         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4431
4432 done:
4433         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4434                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4435 }
4436
4437 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4438                                          void *data, u16 len)
4439 {
4440         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4441         struct adv_monitor *m = NULL;
4442         u8 status = MGMT_STATUS_SUCCESS;
4443         size_t expected_size = sizeof(*cp);
4444
4445         BT_DBG("request for %s", hdev->name);
4446
4447         if (len <= sizeof(*cp)) {
4448                 status = MGMT_STATUS_INVALID_PARAMS;
4449                 goto done;
4450         }
4451
4452         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4453         if (len != expected_size) {
4454                 status = MGMT_STATUS_INVALID_PARAMS;
4455                 goto done;
4456         }
4457
4458         m = kzalloc(sizeof(*m), GFP_KERNEL);
4459         if (!m) {
4460                 status = MGMT_STATUS_NO_RESOURCES;
4461                 goto done;
4462         }
4463
4464         INIT_LIST_HEAD(&m->patterns);
4465
4466         parse_adv_monitor_rssi(m, &cp->rssi);
4467         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4468
4469 done:
4470         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4471                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4472 }
4473
4474 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4475 {
4476         struct mgmt_rp_remove_adv_monitor rp;
4477         struct mgmt_cp_remove_adv_monitor *cp;
4478         struct mgmt_pending_cmd *cmd;
4479         int err = 0;
4480
4481         hci_dev_lock(hdev);
4482
4483         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4484         if (!cmd)
4485                 goto done;
4486
4487         cp = cmd->param;
4488         rp.monitor_handle = cp->monitor_handle;
4489
4490         if (!status)
4491                 hci_update_background_scan(hdev);
4492
4493         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4494                                 mgmt_status(status), &rp, sizeof(rp));
4495         mgmt_pending_remove(cmd);
4496
4497 done:
4498         hci_dev_unlock(hdev);
4499         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
4500                    rp.monitor_handle, status);
4501
4502         return err;
4503 }
4504
4505 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4506                               void *data, u16 len)
4507 {
4508         struct mgmt_cp_remove_adv_monitor *cp = data;
4509         struct mgmt_rp_remove_adv_monitor rp;
4510         struct mgmt_pending_cmd *cmd;
4511         u16 handle = __le16_to_cpu(cp->monitor_handle);
4512         int err, status;
4513         bool pending;
4514
4515         BT_DBG("request for %s", hdev->name);
4516         rp.monitor_handle = cp->monitor_handle;
4517
4518         hci_dev_lock(hdev);
4519
4520         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4521             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4522             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4523             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4524                 status = MGMT_STATUS_BUSY;
4525                 goto unlock;
4526         }
4527
4528         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4529         if (!cmd) {
4530                 status = MGMT_STATUS_NO_RESOURCES;
4531                 goto unlock;
4532         }
4533
4534         if (handle)
4535                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4536         else
4537                 pending = hci_remove_all_adv_monitor(hdev, &err);
4538
4539         if (err) {
4540                 mgmt_pending_remove(cmd);
4541
4542                 if (err == -ENOENT)
4543                         status = MGMT_STATUS_INVALID_INDEX;
4544                 else
4545                         status = MGMT_STATUS_FAILED;
4546
4547                 goto unlock;
4548         }
4549
4550         /* monitor can be removed without forwarding request to controller */
4551         if (!pending) {
4552                 mgmt_pending_remove(cmd);
4553                 hci_dev_unlock(hdev);
4554
4555                 return mgmt_cmd_complete(sk, hdev->id,
4556                                          MGMT_OP_REMOVE_ADV_MONITOR,
4557                                          MGMT_STATUS_SUCCESS,
4558                                          &rp, sizeof(rp));
4559         }
4560
4561         hci_dev_unlock(hdev);
4562         return 0;
4563
4564 unlock:
4565         hci_dev_unlock(hdev);
4566         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4567                                status);
4568 }
4569
4570 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4571                                          u16 opcode, struct sk_buff *skb)
4572 {
4573         struct mgmt_rp_read_local_oob_data mgmt_rp;
4574         size_t rp_size = sizeof(mgmt_rp);
4575         struct mgmt_pending_cmd *cmd;
4576
4577         bt_dev_dbg(hdev, "status %u", status);
4578
4579         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4580         if (!cmd)
4581                 return;
4582
4583         if (status || !skb) {
4584                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4585                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4586                 goto remove;
4587         }
4588
4589         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4590
4591         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4592                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4593
4594                 if (skb->len < sizeof(*rp)) {
4595                         mgmt_cmd_status(cmd->sk, hdev->id,
4596                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4597                                         MGMT_STATUS_FAILED);
4598                         goto remove;
4599                 }
4600
4601                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4602                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4603
4604                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4605         } else {
4606                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4607
4608                 if (skb->len < sizeof(*rp)) {
4609                         mgmt_cmd_status(cmd->sk, hdev->id,
4610                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4611                                         MGMT_STATUS_FAILED);
4612                         goto remove;
4613                 }
4614
4615                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4616                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4617
4618                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4619                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4620         }
4621
4622         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4623                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4624
4625 remove:
4626         mgmt_pending_remove(cmd);
4627 }
4628
4629 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4630                                void *data, u16 data_len)
4631 {
4632         struct mgmt_pending_cmd *cmd;
4633         struct hci_request req;
4634         int err;
4635
4636         bt_dev_dbg(hdev, "sock %p", sk);
4637
4638         hci_dev_lock(hdev);
4639
4640         if (!hdev_is_powered(hdev)) {
4641                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4642                                       MGMT_STATUS_NOT_POWERED);
4643                 goto unlock;
4644         }
4645
4646         if (!lmp_ssp_capable(hdev)) {
4647                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4648                                       MGMT_STATUS_NOT_SUPPORTED);
4649                 goto unlock;
4650         }
4651
4652         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4654                                       MGMT_STATUS_BUSY);
4655                 goto unlock;
4656         }
4657
4658         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4659         if (!cmd) {
4660                 err = -ENOMEM;
4661                 goto unlock;
4662         }
4663
4664         hci_req_init(&req, hdev);
4665
4666         if (bredr_sc_enabled(hdev))
4667                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4668         else
4669                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4670
4671         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4672         if (err < 0)
4673                 mgmt_pending_remove(cmd);
4674
4675 unlock:
4676         hci_dev_unlock(hdev);
4677         return err;
4678 }
4679
4680 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4681                                void *data, u16 len)
4682 {
4683         struct mgmt_addr_info *addr = data;
4684         int err;
4685
4686         bt_dev_dbg(hdev, "sock %p", sk);
4687
4688         if (!bdaddr_type_is_valid(addr->type))
4689                 return mgmt_cmd_complete(sk, hdev->id,
4690                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4691                                          MGMT_STATUS_INVALID_PARAMS,
4692                                          addr, sizeof(*addr));
4693
4694         hci_dev_lock(hdev);
4695
4696         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4697                 struct mgmt_cp_add_remote_oob_data *cp = data;
4698                 u8 status;
4699
4700                 if (cp->addr.type != BDADDR_BREDR) {
4701                         err = mgmt_cmd_complete(sk, hdev->id,
4702                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4703                                                 MGMT_STATUS_INVALID_PARAMS,
4704                                                 &cp->addr, sizeof(cp->addr));
4705                         goto unlock;
4706                 }
4707
4708                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4709                                               cp->addr.type, cp->hash,
4710                                               cp->rand, NULL, NULL);
4711                 if (err < 0)
4712                         status = MGMT_STATUS_FAILED;
4713                 else
4714                         status = MGMT_STATUS_SUCCESS;
4715
4716                 err = mgmt_cmd_complete(sk, hdev->id,
4717                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4718                                         &cp->addr, sizeof(cp->addr));
4719         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4720                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4721                 u8 *rand192, *hash192, *rand256, *hash256;
4722                 u8 status;
4723
4724                 if (bdaddr_type_is_le(cp->addr.type)) {
4725                         /* Enforce zero-valued 192-bit parameters as
4726                          * long as legacy SMP OOB isn't implemented.
4727                          */
4728                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4729                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4730                                 err = mgmt_cmd_complete(sk, hdev->id,
4731                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4732                                                         MGMT_STATUS_INVALID_PARAMS,
4733                                                         addr, sizeof(*addr));
4734                                 goto unlock;
4735                         }
4736
4737                         rand192 = NULL;
4738                         hash192 = NULL;
4739                 } else {
4740                         /* In case one of the P-192 values is set to zero,
4741                          * then just disable OOB data for P-192.
4742                          */
4743                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4744                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4745                                 rand192 = NULL;
4746                                 hash192 = NULL;
4747                         } else {
4748                                 rand192 = cp->rand192;
4749                                 hash192 = cp->hash192;
4750                         }
4751                 }
4752
4753                 /* In case one of the P-256 values is set to zero, then just
4754                  * disable OOB data for P-256.
4755                  */
4756                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4757                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4758                         rand256 = NULL;
4759                         hash256 = NULL;
4760                 } else {
4761                         rand256 = cp->rand256;
4762                         hash256 = cp->hash256;
4763                 }
4764
4765                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4766                                               cp->addr.type, hash192, rand192,
4767                                               hash256, rand256);
4768                 if (err < 0)
4769                         status = MGMT_STATUS_FAILED;
4770                 else
4771                         status = MGMT_STATUS_SUCCESS;
4772
4773                 err = mgmt_cmd_complete(sk, hdev->id,
4774                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4775                                         status, &cp->addr, sizeof(cp->addr));
4776         } else {
4777                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4778                            len);
4779                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4780                                       MGMT_STATUS_INVALID_PARAMS);
4781         }
4782
4783 unlock:
4784         hci_dev_unlock(hdev);
4785         return err;
4786 }
4787
4788 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4789                                   void *data, u16 len)
4790 {
4791         struct mgmt_cp_remove_remote_oob_data *cp = data;
4792         u8 status;
4793         int err;
4794
4795         bt_dev_dbg(hdev, "sock %p", sk);
4796
4797         if (cp->addr.type != BDADDR_BREDR)
4798                 return mgmt_cmd_complete(sk, hdev->id,
4799                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4800                                          MGMT_STATUS_INVALID_PARAMS,
4801                                          &cp->addr, sizeof(cp->addr));
4802
4803         hci_dev_lock(hdev);
4804
4805         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4806                 hci_remote_oob_data_clear(hdev);
4807                 status = MGMT_STATUS_SUCCESS;
4808                 goto done;
4809         }
4810
4811         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4812         if (err < 0)
4813                 status = MGMT_STATUS_INVALID_PARAMS;
4814         else
4815                 status = MGMT_STATUS_SUCCESS;
4816
4817 done:
4818         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4819                                 status, &cp->addr, sizeof(cp->addr));
4820
4821         hci_dev_unlock(hdev);
4822         return err;
4823 }
4824
4825 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4826 {
4827         struct mgmt_pending_cmd *cmd;
4828
4829         bt_dev_dbg(hdev, "status %d", status);
4830
4831         hci_dev_lock(hdev);
4832
4833         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4834         if (!cmd)
4835                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4836
4837         if (!cmd)
4838                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4839
4840         if (cmd) {
4841                 cmd->cmd_complete(cmd, mgmt_status(status));
4842                 mgmt_pending_remove(cmd);
4843         }
4844
4845         hci_dev_unlock(hdev);
4846
4847         /* Handle suspend notifier */
4848         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4849                                hdev->suspend_tasks)) {
4850                 bt_dev_dbg(hdev, "Unpaused discovery");
4851                 wake_up(&hdev->suspend_wait_q);
4852         }
4853 }
4854
4855 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4856                                     uint8_t *mgmt_status)
4857 {
4858         switch (type) {
4859         case DISCOV_TYPE_LE:
4860                 *mgmt_status = mgmt_le_support(hdev);
4861                 if (*mgmt_status)
4862                         return false;
4863                 break;
4864         case DISCOV_TYPE_INTERLEAVED:
4865                 *mgmt_status = mgmt_le_support(hdev);
4866                 if (*mgmt_status)
4867                         return false;
4868                 fallthrough;
4869         case DISCOV_TYPE_BREDR:
4870                 *mgmt_status = mgmt_bredr_support(hdev);
4871                 if (*mgmt_status)
4872                         return false;
4873                 break;
4874         default:
4875                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4876                 return false;
4877         }
4878
4879         return true;
4880 }
4881
4882 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4883                                     u16 op, void *data, u16 len)
4884 {
4885         struct mgmt_cp_start_discovery *cp = data;
4886         struct mgmt_pending_cmd *cmd;
4887         u8 status;
4888         int err;
4889
4890         bt_dev_dbg(hdev, "sock %p", sk);
4891
4892         hci_dev_lock(hdev);
4893
4894         if (!hdev_is_powered(hdev)) {
4895                 err = mgmt_cmd_complete(sk, hdev->id, op,
4896                                         MGMT_STATUS_NOT_POWERED,
4897                                         &cp->type, sizeof(cp->type));
4898                 goto failed;
4899         }
4900
4901         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4902             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4903                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4904                                         &cp->type, sizeof(cp->type));
4905                 goto failed;
4906         }
4907
4908         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4909                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4910                                         &cp->type, sizeof(cp->type));
4911                 goto failed;
4912         }
4913
4914         /* Can't start discovery when it is paused */
4915         if (hdev->discovery_paused) {
4916                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4917                                         &cp->type, sizeof(cp->type));
4918                 goto failed;
4919         }
4920
4921         /* Clear the discovery filter first to free any previously
4922          * allocated memory for the UUID list.
4923          */
4924         hci_discovery_filter_clear(hdev);
4925
4926         hdev->discovery.type = cp->type;
4927         hdev->discovery.report_invalid_rssi = false;
4928         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4929                 hdev->discovery.limited = true;
4930         else
4931                 hdev->discovery.limited = false;
4932
4933         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4934         if (!cmd) {
4935                 err = -ENOMEM;
4936                 goto failed;
4937         }
4938
4939         cmd->cmd_complete = generic_cmd_complete;
4940
4941         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4942         queue_work(hdev->req_workqueue, &hdev->discov_update);
4943         err = 0;
4944
4945 failed:
4946         hci_dev_unlock(hdev);
4947         return err;
4948 }
4949
4950 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4951                            void *data, u16 len)
4952 {
4953         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4954                                         data, len);
4955 }
4956
4957 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4958                                    void *data, u16 len)
4959 {
4960         return start_discovery_internal(sk, hdev,
4961                                         MGMT_OP_START_LIMITED_DISCOVERY,
4962                                         data, len);
4963 }
4964
4965 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4966                                           u8 status)
4967 {
4968         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4969                                  cmd->param, 1);
4970 }
4971
4972 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4973                                    void *data, u16 len)
4974 {
4975         struct mgmt_cp_start_service_discovery *cp = data;
4976         struct mgmt_pending_cmd *cmd;
4977         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4978         u16 uuid_count, expected_len;
4979         u8 status;
4980         int err;
4981
4982         bt_dev_dbg(hdev, "sock %p", sk);
4983
4984         hci_dev_lock(hdev);
4985
4986         if (!hdev_is_powered(hdev)) {
4987                 err = mgmt_cmd_complete(sk, hdev->id,
4988                                         MGMT_OP_START_SERVICE_DISCOVERY,
4989                                         MGMT_STATUS_NOT_POWERED,
4990                                         &cp->type, sizeof(cp->type));
4991                 goto failed;
4992         }
4993
4994         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4995             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4996                 err = mgmt_cmd_complete(sk, hdev->id,
4997                                         MGMT_OP_START_SERVICE_DISCOVERY,
4998                                         MGMT_STATUS_BUSY, &cp->type,
4999                                         sizeof(cp->type));
5000                 goto failed;
5001         }
5002
5003         if (hdev->discovery_paused) {
5004                 err = mgmt_cmd_complete(sk, hdev->id,
5005                                         MGMT_OP_START_SERVICE_DISCOVERY,
5006                                         MGMT_STATUS_BUSY, &cp->type,
5007                                         sizeof(cp->type));
5008                 goto failed;
5009         }
5010
5011         uuid_count = __le16_to_cpu(cp->uuid_count);
5012         if (uuid_count > max_uuid_count) {
5013                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5014                            uuid_count);
5015                 err = mgmt_cmd_complete(sk, hdev->id,
5016                                         MGMT_OP_START_SERVICE_DISCOVERY,
5017                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5018                                         sizeof(cp->type));
5019                 goto failed;
5020         }
5021
5022         expected_len = sizeof(*cp) + uuid_count * 16;
5023         if (expected_len != len) {
5024                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5025                            expected_len, len);
5026                 err = mgmt_cmd_complete(sk, hdev->id,
5027                                         MGMT_OP_START_SERVICE_DISCOVERY,
5028                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5029                                         sizeof(cp->type));
5030                 goto failed;
5031         }
5032
5033         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5034                 err = mgmt_cmd_complete(sk, hdev->id,
5035                                         MGMT_OP_START_SERVICE_DISCOVERY,
5036                                         status, &cp->type, sizeof(cp->type));
5037                 goto failed;
5038         }
5039
5040         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5041                                hdev, data, len);
5042         if (!cmd) {
5043                 err = -ENOMEM;
5044                 goto failed;
5045         }
5046
5047         cmd->cmd_complete = service_discovery_cmd_complete;
5048
5049         /* Clear the discovery filter first to free any previously
5050          * allocated memory for the UUID list.
5051          */
5052         hci_discovery_filter_clear(hdev);
5053
5054         hdev->discovery.result_filtering = true;
5055         hdev->discovery.type = cp->type;
5056         hdev->discovery.rssi = cp->rssi;
5057         hdev->discovery.uuid_count = uuid_count;
5058
5059         if (uuid_count > 0) {
5060                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5061                                                 GFP_KERNEL);
5062                 if (!hdev->discovery.uuids) {
5063                         err = mgmt_cmd_complete(sk, hdev->id,
5064                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5065                                                 MGMT_STATUS_FAILED,
5066                                                 &cp->type, sizeof(cp->type));
5067                         mgmt_pending_remove(cmd);
5068                         goto failed;
5069                 }
5070         }
5071
5072         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5073         queue_work(hdev->req_workqueue, &hdev->discov_update);
5074         err = 0;
5075
5076 failed:
5077         hci_dev_unlock(hdev);
5078         return err;
5079 }
5080
5081 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5082 {
5083         struct mgmt_pending_cmd *cmd;
5084
5085         bt_dev_dbg(hdev, "status %d", status);
5086
5087         hci_dev_lock(hdev);
5088
5089         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5090         if (cmd) {
5091                 cmd->cmd_complete(cmd, mgmt_status(status));
5092                 mgmt_pending_remove(cmd);
5093         }
5094
5095         hci_dev_unlock(hdev);
5096
5097         /* Handle suspend notifier */
5098         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5099                 bt_dev_dbg(hdev, "Paused discovery");
5100                 wake_up(&hdev->suspend_wait_q);
5101         }
5102 }
5103
5104 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5105                           u16 len)
5106 {
5107         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5108         struct mgmt_pending_cmd *cmd;
5109         int err;
5110
5111         bt_dev_dbg(hdev, "sock %p", sk);
5112
5113         hci_dev_lock(hdev);
5114
5115         if (!hci_discovery_active(hdev)) {
5116                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5117                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5118                                         sizeof(mgmt_cp->type));
5119                 goto unlock;
5120         }
5121
5122         if (hdev->discovery.type != mgmt_cp->type) {
5123                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5124                                         MGMT_STATUS_INVALID_PARAMS,
5125                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5126                 goto unlock;
5127         }
5128
5129         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5130         if (!cmd) {
5131                 err = -ENOMEM;
5132                 goto unlock;
5133         }
5134
5135         cmd->cmd_complete = generic_cmd_complete;
5136
5137         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5138         queue_work(hdev->req_workqueue, &hdev->discov_update);
5139         err = 0;
5140
5141 unlock:
5142         hci_dev_unlock(hdev);
5143         return err;
5144 }
5145
5146 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5147                         u16 len)
5148 {
5149         struct mgmt_cp_confirm_name *cp = data;
5150         struct inquiry_entry *e;
5151         int err;
5152
5153         bt_dev_dbg(hdev, "sock %p", sk);
5154
5155         hci_dev_lock(hdev);
5156
5157         if (!hci_discovery_active(hdev)) {
5158                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5159                                         MGMT_STATUS_FAILED, &cp->addr,
5160                                         sizeof(cp->addr));
5161                 goto failed;
5162         }
5163
5164         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5165         if (!e) {
5166                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5167                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5168                                         sizeof(cp->addr));
5169                 goto failed;
5170         }
5171
5172         if (cp->name_known) {
5173                 e->name_state = NAME_KNOWN;
5174                 list_del(&e->list);
5175         } else {
5176                 e->name_state = NAME_NEEDED;
5177                 hci_inquiry_cache_update_resolve(hdev, e);
5178         }
5179
5180         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5181                                 &cp->addr, sizeof(cp->addr));
5182
5183 failed:
5184         hci_dev_unlock(hdev);
5185         return err;
5186 }
5187
5188 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5189                         u16 len)
5190 {
5191         struct mgmt_cp_block_device *cp = data;
5192         u8 status;
5193         int err;
5194
5195         bt_dev_dbg(hdev, "sock %p", sk);
5196
5197         if (!bdaddr_type_is_valid(cp->addr.type))
5198                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5199                                          MGMT_STATUS_INVALID_PARAMS,
5200                                          &cp->addr, sizeof(cp->addr));
5201
5202         hci_dev_lock(hdev);
5203
5204         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
5205                                   cp->addr.type);
5206         if (err < 0) {
5207                 status = MGMT_STATUS_FAILED;
5208                 goto done;
5209         }
5210
5211         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5212                    sk);
5213         status = MGMT_STATUS_SUCCESS;
5214
5215 done:
5216         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5217                                 &cp->addr, sizeof(cp->addr));
5218
5219         hci_dev_unlock(hdev);
5220
5221         return err;
5222 }
5223
5224 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5225                           u16 len)
5226 {
5227         struct mgmt_cp_unblock_device *cp = data;
5228         u8 status;
5229         int err;
5230
5231         bt_dev_dbg(hdev, "sock %p", sk);
5232
5233         if (!bdaddr_type_is_valid(cp->addr.type))
5234                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5235                                          MGMT_STATUS_INVALID_PARAMS,
5236                                          &cp->addr, sizeof(cp->addr));
5237
5238         hci_dev_lock(hdev);
5239
5240         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5241                                   cp->addr.type);
5242         if (err < 0) {
5243                 status = MGMT_STATUS_INVALID_PARAMS;
5244                 goto done;
5245         }
5246
5247         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5248                    sk);
5249         status = MGMT_STATUS_SUCCESS;
5250
5251 done:
5252         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5253                                 &cp->addr, sizeof(cp->addr));
5254
5255         hci_dev_unlock(hdev);
5256
5257         return err;
5258 }
5259
5260 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5261                          u16 len)
5262 {
5263         struct mgmt_cp_set_device_id *cp = data;
5264         struct hci_request req;
5265         int err;
5266         __u16 source;
5267
5268         bt_dev_dbg(hdev, "sock %p", sk);
5269
5270         source = __le16_to_cpu(cp->source);
5271
5272         if (source > 0x0002)
5273                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5274                                        MGMT_STATUS_INVALID_PARAMS);
5275
5276         hci_dev_lock(hdev);
5277
5278         hdev->devid_source = source;
5279         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5280         hdev->devid_product = __le16_to_cpu(cp->product);
5281         hdev->devid_version = __le16_to_cpu(cp->version);
5282
5283         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5284                                 NULL, 0);
5285
5286         hci_req_init(&req, hdev);
5287         __hci_req_update_eir(&req);
5288         hci_req_run(&req, NULL);
5289
5290         hci_dev_unlock(hdev);
5291
5292         return err;
5293 }
5294
5295 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5296                                         u16 opcode)
5297 {
5298         bt_dev_dbg(hdev, "status %d", status);
5299 }
5300
5301 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5302                                      u16 opcode)
5303 {
5304         struct cmd_lookup match = { NULL, hdev };
5305         struct hci_request req;
5306         u8 instance;
5307         struct adv_info *adv_instance;
5308         int err;
5309
5310         hci_dev_lock(hdev);
5311
5312         if (status) {
5313                 u8 mgmt_err = mgmt_status(status);
5314
5315                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5316                                      cmd_status_rsp, &mgmt_err);
5317                 goto unlock;
5318         }
5319
5320         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5321                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5322         else
5323                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5324
5325         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5326                              &match);
5327
5328         new_settings(hdev, match.sk);
5329
5330         if (match.sk)
5331                 sock_put(match.sk);
5332
5333         /* Handle suspend notifier */
5334         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5335                                hdev->suspend_tasks)) {
5336                 bt_dev_dbg(hdev, "Paused advertising");
5337                 wake_up(&hdev->suspend_wait_q);
5338         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5339                                       hdev->suspend_tasks)) {
5340                 bt_dev_dbg(hdev, "Unpaused advertising");
5341                 wake_up(&hdev->suspend_wait_q);
5342         }
5343
5344         /* If "Set Advertising" was just disabled and instance advertising was
5345          * set up earlier, then re-enable multi-instance advertising.
5346          */
5347         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5348             list_empty(&hdev->adv_instances))
5349                 goto unlock;
5350
5351         instance = hdev->cur_adv_instance;
5352         if (!instance) {
5353                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5354                                                         struct adv_info, list);
5355                 if (!adv_instance)
5356                         goto unlock;
5357
5358                 instance = adv_instance->instance;
5359         }
5360
5361         hci_req_init(&req, hdev);
5362
5363         err = __hci_req_schedule_adv_instance(&req, instance, true);
5364
5365         if (!err)
5366                 err = hci_req_run(&req, enable_advertising_instance);
5367
5368         if (err)
5369                 bt_dev_err(hdev, "failed to re-configure advertising");
5370
5371 unlock:
5372         hci_dev_unlock(hdev);
5373 }
5374
5375 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5376                            u16 len)
5377 {
5378         struct mgmt_mode *cp = data;
5379         struct mgmt_pending_cmd *cmd;
5380         struct hci_request req;
5381         u8 val, status;
5382         int err;
5383
5384         bt_dev_dbg(hdev, "sock %p", sk);
5385
5386         status = mgmt_le_support(hdev);
5387         if (status)
5388                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5389                                        status);
5390
5391         /* Enabling the experimental LL Privay support disables support for
5392          * advertising.
5393          */
5394         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5395                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5396                                        MGMT_STATUS_NOT_SUPPORTED);
5397
5398         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5400                                        MGMT_STATUS_INVALID_PARAMS);
5401
5402         if (hdev->advertising_paused)
5403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5404                                        MGMT_STATUS_BUSY);
5405
5406         hci_dev_lock(hdev);
5407
5408         val = !!cp->val;
5409
5410         /* The following conditions are ones which mean that we should
5411          * not do any HCI communication but directly send a mgmt
5412          * response to user space (after toggling the flag if
5413          * necessary).
5414          */
5415         if (!hdev_is_powered(hdev) ||
5416             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5417              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5418             hci_conn_num(hdev, LE_LINK) > 0 ||
5419             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5420              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5421                 bool changed;
5422
5423                 if (cp->val) {
5424                         hdev->cur_adv_instance = 0x00;
5425                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5426                         if (cp->val == 0x02)
5427                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5428                         else
5429                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5430                 } else {
5431                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5432                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5433                 }
5434
5435                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5436                 if (err < 0)
5437                         goto unlock;
5438
5439                 if (changed)
5440                         err = new_settings(hdev, sk);
5441
5442                 goto unlock;
5443         }
5444
5445         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5446             pending_find(MGMT_OP_SET_LE, hdev)) {
5447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                       MGMT_STATUS_BUSY);
5449                 goto unlock;
5450         }
5451
5452         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5453         if (!cmd) {
5454                 err = -ENOMEM;
5455                 goto unlock;
5456         }
5457
5458         hci_req_init(&req, hdev);
5459
5460         if (cp->val == 0x02)
5461                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5462         else
5463                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5464
5465         cancel_adv_timeout(hdev);
5466
5467         if (val) {
5468                 /* Switch to instance "0" for the Set Advertising setting.
5469                  * We cannot use update_[adv|scan_rsp]_data() here as the
5470                  * HCI_ADVERTISING flag is not yet set.
5471                  */
5472                 hdev->cur_adv_instance = 0x00;
5473
5474                 if (ext_adv_capable(hdev)) {
5475                         __hci_req_start_ext_adv(&req, 0x00);
5476                 } else {
5477                         __hci_req_update_adv_data(&req, 0x00);
5478                         __hci_req_update_scan_rsp_data(&req, 0x00);
5479                         __hci_req_enable_advertising(&req);
5480                 }
5481         } else {
5482                 __hci_req_disable_advertising(&req);
5483         }
5484
5485         err = hci_req_run(&req, set_advertising_complete);
5486         if (err < 0)
5487                 mgmt_pending_remove(cmd);
5488
5489 unlock:
5490         hci_dev_unlock(hdev);
5491         return err;
5492 }
5493
5494 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5495                               void *data, u16 len)
5496 {
5497         struct mgmt_cp_set_static_address *cp = data;
5498         int err;
5499
5500         bt_dev_dbg(hdev, "sock %p", sk);
5501
5502         if (!lmp_le_capable(hdev))
5503                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5504                                        MGMT_STATUS_NOT_SUPPORTED);
5505
5506         if (hdev_is_powered(hdev))
5507                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5508                                        MGMT_STATUS_REJECTED);
5509
5510         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5511                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5512                         return mgmt_cmd_status(sk, hdev->id,
5513                                                MGMT_OP_SET_STATIC_ADDRESS,
5514                                                MGMT_STATUS_INVALID_PARAMS);
5515
5516                 /* Two most significant bits shall be set */
5517                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5518                         return mgmt_cmd_status(sk, hdev->id,
5519                                                MGMT_OP_SET_STATIC_ADDRESS,
5520                                                MGMT_STATUS_INVALID_PARAMS);
5521         }
5522
5523         hci_dev_lock(hdev);
5524
5525         bacpy(&hdev->static_addr, &cp->bdaddr);
5526
5527         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5528         if (err < 0)
5529                 goto unlock;
5530
5531         err = new_settings(hdev, sk);
5532
5533 unlock:
5534         hci_dev_unlock(hdev);
5535         return err;
5536 }
5537
5538 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5539                            void *data, u16 len)
5540 {
5541         struct mgmt_cp_set_scan_params *cp = data;
5542         __u16 interval, window;
5543         int err;
5544
5545         bt_dev_dbg(hdev, "sock %p", sk);
5546
5547         if (!lmp_le_capable(hdev))
5548                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5549                                        MGMT_STATUS_NOT_SUPPORTED);
5550
5551         interval = __le16_to_cpu(cp->interval);
5552
5553         if (interval < 0x0004 || interval > 0x4000)
5554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5555                                        MGMT_STATUS_INVALID_PARAMS);
5556
5557         window = __le16_to_cpu(cp->window);
5558
5559         if (window < 0x0004 || window > 0x4000)
5560                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5561                                        MGMT_STATUS_INVALID_PARAMS);
5562
5563         if (window > interval)
5564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5565                                        MGMT_STATUS_INVALID_PARAMS);
5566
5567         hci_dev_lock(hdev);
5568
5569         hdev->le_scan_interval = interval;
5570         hdev->le_scan_window = window;
5571
5572         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5573                                 NULL, 0);
5574
5575         /* If background scan is running, restart it so new parameters are
5576          * loaded.
5577          */
5578         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5579             hdev->discovery.state == DISCOVERY_STOPPED) {
5580                 struct hci_request req;
5581
5582                 hci_req_init(&req, hdev);
5583
5584                 hci_req_add_le_scan_disable(&req, false);
5585                 hci_req_add_le_passive_scan(&req);
5586
5587                 hci_req_run(&req, NULL);
5588         }
5589
5590         hci_dev_unlock(hdev);
5591
5592         return err;
5593 }
5594
5595 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5596                                       u16 opcode)
5597 {
5598         struct mgmt_pending_cmd *cmd;
5599
5600         bt_dev_dbg(hdev, "status 0x%02x", status);
5601
5602         hci_dev_lock(hdev);
5603
5604         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5605         if (!cmd)
5606                 goto unlock;
5607
5608         if (status) {
5609                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5610                                 mgmt_status(status));
5611         } else {
5612                 struct mgmt_mode *cp = cmd->param;
5613
5614                 if (cp->val)
5615                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5616                 else
5617                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5618
5619                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5620                 new_settings(hdev, cmd->sk);
5621         }
5622
5623         mgmt_pending_remove(cmd);
5624
5625 unlock:
5626         hci_dev_unlock(hdev);
5627 }
5628
5629 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5630                                 void *data, u16 len)
5631 {
5632         struct mgmt_mode *cp = data;
5633         struct mgmt_pending_cmd *cmd;
5634         struct hci_request req;
5635         int err;
5636
5637         bt_dev_dbg(hdev, "sock %p", sk);
5638
5639         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5640             hdev->hci_ver < BLUETOOTH_VER_1_2)
5641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5642                                        MGMT_STATUS_NOT_SUPPORTED);
5643
5644         if (cp->val != 0x00 && cp->val != 0x01)
5645                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5646                                        MGMT_STATUS_INVALID_PARAMS);
5647
5648         hci_dev_lock(hdev);
5649
5650         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5651                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5652                                       MGMT_STATUS_BUSY);
5653                 goto unlock;
5654         }
5655
5656         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5657                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                         hdev);
5659                 goto unlock;
5660         }
5661
5662         if (!hdev_is_powered(hdev)) {
5663                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5664                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5665                                         hdev);
5666                 new_settings(hdev, sk);
5667                 goto unlock;
5668         }
5669
5670         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5671                                data, len);
5672         if (!cmd) {
5673                 err = -ENOMEM;
5674                 goto unlock;
5675         }
5676
5677         hci_req_init(&req, hdev);
5678
5679         __hci_req_write_fast_connectable(&req, cp->val);
5680
5681         err = hci_req_run(&req, fast_connectable_complete);
5682         if (err < 0) {
5683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5684                                       MGMT_STATUS_FAILED);
5685                 mgmt_pending_remove(cmd);
5686         }
5687
5688 unlock:
5689         hci_dev_unlock(hdev);
5690
5691         return err;
5692 }
5693
5694 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5695 {
5696         struct mgmt_pending_cmd *cmd;
5697
5698         bt_dev_dbg(hdev, "status 0x%02x", status);
5699
5700         hci_dev_lock(hdev);
5701
5702         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5703         if (!cmd)
5704                 goto unlock;
5705
5706         if (status) {
5707                 u8 mgmt_err = mgmt_status(status);
5708
5709                 /* We need to restore the flag if related HCI commands
5710                  * failed.
5711                  */
5712                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5713
5714                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5715         } else {
5716                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5717                 new_settings(hdev, cmd->sk);
5718         }
5719
5720         mgmt_pending_remove(cmd);
5721
5722 unlock:
5723         hci_dev_unlock(hdev);
5724 }
5725
5726 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5727 {
5728         struct mgmt_mode *cp = data;
5729         struct mgmt_pending_cmd *cmd;
5730         struct hci_request req;
5731         int err;
5732
5733         bt_dev_dbg(hdev, "sock %p", sk);
5734
5735         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5736                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5737                                        MGMT_STATUS_NOT_SUPPORTED);
5738
5739         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5740                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5741                                        MGMT_STATUS_REJECTED);
5742
5743         if (cp->val != 0x00 && cp->val != 0x01)
5744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5745                                        MGMT_STATUS_INVALID_PARAMS);
5746
5747         hci_dev_lock(hdev);
5748
5749         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5750                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5751                 goto unlock;
5752         }
5753
5754         if (!hdev_is_powered(hdev)) {
5755                 if (!cp->val) {
5756                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5757                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5758                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5759                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5760                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5761                 }
5762
5763                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5764
5765                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5766                 if (err < 0)
5767                         goto unlock;
5768
5769                 err = new_settings(hdev, sk);
5770                 goto unlock;
5771         }
5772
5773         /* Reject disabling when powered on */
5774         if (!cp->val) {
5775                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5776                                       MGMT_STATUS_REJECTED);
5777                 goto unlock;
5778         } else {
5779                 /* When configuring a dual-mode controller to operate
5780                  * with LE only and using a static address, then switching
5781                  * BR/EDR back on is not allowed.
5782                  *
5783                  * Dual-mode controllers shall operate with the public
5784                  * address as its identity address for BR/EDR and LE. So
5785                  * reject the attempt to create an invalid configuration.
5786                  *
5787                  * The same restrictions applies when secure connections
5788                  * has been enabled. For BR/EDR this is a controller feature
5789                  * while for LE it is a host stack feature. This means that
5790                  * switching BR/EDR back on when secure connections has been
5791                  * enabled is not a supported transaction.
5792                  */
5793                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5794                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5795                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5796                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5797                                               MGMT_STATUS_REJECTED);
5798                         goto unlock;
5799                 }
5800         }
5801
5802         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5803                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5804                                       MGMT_STATUS_BUSY);
5805                 goto unlock;
5806         }
5807
5808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5809         if (!cmd) {
5810                 err = -ENOMEM;
5811                 goto unlock;
5812         }
5813
5814         /* We need to flip the bit already here so that
5815          * hci_req_update_adv_data generates the correct flags.
5816          */
5817         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5818
5819         hci_req_init(&req, hdev);
5820
5821         __hci_req_write_fast_connectable(&req, false);
5822         __hci_req_update_scan(&req);
5823
5824         /* Since only the advertising data flags will change, there
5825          * is no need to update the scan response data.
5826          */
5827         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5828
5829         err = hci_req_run(&req, set_bredr_complete);
5830         if (err < 0)
5831                 mgmt_pending_remove(cmd);
5832
5833 unlock:
5834         hci_dev_unlock(hdev);
5835         return err;
5836 }
5837
5838 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5839 {
5840         struct mgmt_pending_cmd *cmd;
5841         struct mgmt_mode *cp;
5842
5843         bt_dev_dbg(hdev, "status %u", status);
5844
5845         hci_dev_lock(hdev);
5846
5847         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5848         if (!cmd)
5849                 goto unlock;
5850
5851         if (status) {
5852                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5853                                 mgmt_status(status));
5854                 goto remove;
5855         }
5856
5857         cp = cmd->param;
5858
5859         switch (cp->val) {
5860         case 0x00:
5861                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5862                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5863                 break;
5864         case 0x01:
5865                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5866                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5867                 break;
5868         case 0x02:
5869                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5870                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5871                 break;
5872         }
5873
5874         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5875         new_settings(hdev, cmd->sk);
5876
5877 remove:
5878         mgmt_pending_remove(cmd);
5879 unlock:
5880         hci_dev_unlock(hdev);
5881 }
5882
5883 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5884                            void *data, u16 len)
5885 {
5886         struct mgmt_mode *cp = data;
5887         struct mgmt_pending_cmd *cmd;
5888         struct hci_request req;
5889         u8 val;
5890         int err;
5891
5892         bt_dev_dbg(hdev, "sock %p", sk);
5893
5894         if (!lmp_sc_capable(hdev) &&
5895             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5896                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5897                                        MGMT_STATUS_NOT_SUPPORTED);
5898
5899         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5900             lmp_sc_capable(hdev) &&
5901             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5902                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5903                                        MGMT_STATUS_REJECTED);
5904
5905         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5906                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5907                                   MGMT_STATUS_INVALID_PARAMS);
5908
5909         hci_dev_lock(hdev);
5910
5911         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5912             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5913                 bool changed;
5914
5915                 if (cp->val) {
5916                         changed = !hci_dev_test_and_set_flag(hdev,
5917                                                              HCI_SC_ENABLED);
5918                         if (cp->val == 0x02)
5919                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5920                         else
5921                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5922                 } else {
5923                         changed = hci_dev_test_and_clear_flag(hdev,
5924                                                               HCI_SC_ENABLED);
5925                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5926                 }
5927
5928                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5929                 if (err < 0)
5930                         goto failed;
5931
5932                 if (changed)
5933                         err = new_settings(hdev, sk);
5934
5935                 goto failed;
5936         }
5937
5938         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5939                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5940                                       MGMT_STATUS_BUSY);
5941                 goto failed;
5942         }
5943
5944         val = !!cp->val;
5945
5946         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5947             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5948                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5949                 goto failed;
5950         }
5951
5952         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5953         if (!cmd) {
5954                 err = -ENOMEM;
5955                 goto failed;
5956         }
5957
5958         hci_req_init(&req, hdev);
5959         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5960         err = hci_req_run(&req, sc_enable_complete);
5961         if (err < 0) {
5962                 mgmt_pending_remove(cmd);
5963                 goto failed;
5964         }
5965
5966 failed:
5967         hci_dev_unlock(hdev);
5968         return err;
5969 }
5970
5971 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5972                           void *data, u16 len)
5973 {
5974         struct mgmt_mode *cp = data;
5975         bool changed, use_changed;
5976         int err;
5977
5978         bt_dev_dbg(hdev, "sock %p", sk);
5979
5980         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5982                                        MGMT_STATUS_INVALID_PARAMS);
5983
5984         hci_dev_lock(hdev);
5985
5986         if (cp->val)
5987                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5988         else
5989                 changed = hci_dev_test_and_clear_flag(hdev,
5990                                                       HCI_KEEP_DEBUG_KEYS);
5991
5992         if (cp->val == 0x02)
5993                 use_changed = !hci_dev_test_and_set_flag(hdev,
5994                                                          HCI_USE_DEBUG_KEYS);
5995         else
5996                 use_changed = hci_dev_test_and_clear_flag(hdev,
5997                                                           HCI_USE_DEBUG_KEYS);
5998
5999         if (hdev_is_powered(hdev) && use_changed &&
6000             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6001                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6002                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6003                              sizeof(mode), &mode);
6004         }
6005
6006         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6007         if (err < 0)
6008                 goto unlock;
6009
6010         if (changed)
6011                 err = new_settings(hdev, sk);
6012
6013 unlock:
6014         hci_dev_unlock(hdev);
6015         return err;
6016 }
6017
6018 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6019                        u16 len)
6020 {
6021         struct mgmt_cp_set_privacy *cp = cp_data;
6022         bool changed;
6023         int err;
6024
6025         bt_dev_dbg(hdev, "sock %p", sk);
6026
6027         if (!lmp_le_capable(hdev))
6028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6029                                        MGMT_STATUS_NOT_SUPPORTED);
6030
6031         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6033                                        MGMT_STATUS_INVALID_PARAMS);
6034
6035         if (hdev_is_powered(hdev))
6036                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6037                                        MGMT_STATUS_REJECTED);
6038
6039         hci_dev_lock(hdev);
6040
6041         /* If user space supports this command it is also expected to
6042          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6043          */
6044         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6045
6046         if (cp->privacy) {
6047                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6048                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6049                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6050                 hci_adv_instances_set_rpa_expired(hdev, true);
6051                 if (cp->privacy == 0x02)
6052                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6053                 else
6054                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6055         } else {
6056                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6057                 memset(hdev->irk, 0, sizeof(hdev->irk));
6058                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6059                 hci_adv_instances_set_rpa_expired(hdev, false);
6060                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6061         }
6062
6063         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6064         if (err < 0)
6065                 goto unlock;
6066
6067         if (changed)
6068                 err = new_settings(hdev, sk);
6069
6070 unlock:
6071         hci_dev_unlock(hdev);
6072         return err;
6073 }
6074
6075 static bool irk_is_valid(struct mgmt_irk_info *irk)
6076 {
6077         switch (irk->addr.type) {
6078         case BDADDR_LE_PUBLIC:
6079                 return true;
6080
6081         case BDADDR_LE_RANDOM:
6082                 /* Two most significant bits shall be set */
6083                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6084                         return false;
6085                 return true;
6086         }
6087
6088         return false;
6089 }
6090
6091 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6092                      u16 len)
6093 {
6094         struct mgmt_cp_load_irks *cp = cp_data;
6095         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6096                                    sizeof(struct mgmt_irk_info));
6097         u16 irk_count, expected_len;
6098         int i, err;
6099
6100         bt_dev_dbg(hdev, "sock %p", sk);
6101
6102         if (!lmp_le_capable(hdev))
6103                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6104                                        MGMT_STATUS_NOT_SUPPORTED);
6105
6106         irk_count = __le16_to_cpu(cp->irk_count);
6107         if (irk_count > max_irk_count) {
6108                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6109                            irk_count);
6110                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6111                                        MGMT_STATUS_INVALID_PARAMS);
6112         }
6113
6114         expected_len = struct_size(cp, irks, irk_count);
6115         if (expected_len != len) {
6116                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6117                            expected_len, len);
6118                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6119                                        MGMT_STATUS_INVALID_PARAMS);
6120         }
6121
6122         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6123
6124         for (i = 0; i < irk_count; i++) {
6125                 struct mgmt_irk_info *key = &cp->irks[i];
6126
6127                 if (!irk_is_valid(key))
6128                         return mgmt_cmd_status(sk, hdev->id,
6129                                                MGMT_OP_LOAD_IRKS,
6130                                                MGMT_STATUS_INVALID_PARAMS);
6131         }
6132
6133         hci_dev_lock(hdev);
6134
6135         hci_smp_irks_clear(hdev);
6136
6137         for (i = 0; i < irk_count; i++) {
6138                 struct mgmt_irk_info *irk = &cp->irks[i];
6139
6140                 if (hci_is_blocked_key(hdev,
6141                                        HCI_BLOCKED_KEY_TYPE_IRK,
6142                                        irk->val)) {
6143                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6144                                     &irk->addr.bdaddr);
6145                         continue;
6146                 }
6147
6148                 hci_add_irk(hdev, &irk->addr.bdaddr,
6149                             le_addr_type(irk->addr.type), irk->val,
6150                             BDADDR_ANY);
6151         }
6152
6153         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6154
6155         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6156
6157         hci_dev_unlock(hdev);
6158
6159         return err;
6160 }
6161
6162 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6163 {
6164         if (key->master != 0x00 && key->master != 0x01)
6165                 return false;
6166
6167         switch (key->addr.type) {
6168         case BDADDR_LE_PUBLIC:
6169                 return true;
6170
6171         case BDADDR_LE_RANDOM:
6172                 /* Two most significant bits shall be set */
6173                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6174                         return false;
6175                 return true;
6176         }
6177
6178         return false;
6179 }
6180
6181 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6182                                void *cp_data, u16 len)
6183 {
6184         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6185         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6186                                    sizeof(struct mgmt_ltk_info));
6187         u16 key_count, expected_len;
6188         int i, err;
6189
6190         bt_dev_dbg(hdev, "sock %p", sk);
6191
6192         if (!lmp_le_capable(hdev))
6193                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6194                                        MGMT_STATUS_NOT_SUPPORTED);
6195
6196         key_count = __le16_to_cpu(cp->key_count);
6197         if (key_count > max_key_count) {
6198                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6199                            key_count);
6200                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6201                                        MGMT_STATUS_INVALID_PARAMS);
6202         }
6203
6204         expected_len = struct_size(cp, keys, key_count);
6205         if (expected_len != len) {
6206                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6207                            expected_len, len);
6208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6209                                        MGMT_STATUS_INVALID_PARAMS);
6210         }
6211
6212         bt_dev_dbg(hdev, "key_count %u", key_count);
6213
6214         for (i = 0; i < key_count; i++) {
6215                 struct mgmt_ltk_info *key = &cp->keys[i];
6216
6217                 if (!ltk_is_valid(key))
6218                         return mgmt_cmd_status(sk, hdev->id,
6219                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6220                                                MGMT_STATUS_INVALID_PARAMS);
6221         }
6222
6223         hci_dev_lock(hdev);
6224
6225         hci_smp_ltks_clear(hdev);
6226
6227         for (i = 0; i < key_count; i++) {
6228                 struct mgmt_ltk_info *key = &cp->keys[i];
6229                 u8 type, authenticated;
6230
6231                 if (hci_is_blocked_key(hdev,
6232                                        HCI_BLOCKED_KEY_TYPE_LTK,
6233                                        key->val)) {
6234                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6235                                     &key->addr.bdaddr);
6236                         continue;
6237                 }
6238
6239                 switch (key->type) {
6240                 case MGMT_LTK_UNAUTHENTICATED:
6241                         authenticated = 0x00;
6242                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6243                         break;
6244                 case MGMT_LTK_AUTHENTICATED:
6245                         authenticated = 0x01;
6246                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6247                         break;
6248                 case MGMT_LTK_P256_UNAUTH:
6249                         authenticated = 0x00;
6250                         type = SMP_LTK_P256;
6251                         break;
6252                 case MGMT_LTK_P256_AUTH:
6253                         authenticated = 0x01;
6254                         type = SMP_LTK_P256;
6255                         break;
6256                 case MGMT_LTK_P256_DEBUG:
6257                         authenticated = 0x00;
6258                         type = SMP_LTK_P256_DEBUG;
6259                         fallthrough;
6260                 default:
6261                         continue;
6262                 }
6263
6264                 hci_add_ltk(hdev, &key->addr.bdaddr,
6265                             le_addr_type(key->addr.type), type, authenticated,
6266                             key->val, key->enc_size, key->ediv, key->rand);
6267         }
6268
6269         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6270                            NULL, 0);
6271
6272         hci_dev_unlock(hdev);
6273
6274         return err;
6275 }
6276
6277 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6278 {
6279         struct hci_conn *conn = cmd->user_data;
6280         struct mgmt_rp_get_conn_info rp;
6281         int err;
6282
6283         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6284
6285         if (status == MGMT_STATUS_SUCCESS) {
6286                 rp.rssi = conn->rssi;
6287                 rp.tx_power = conn->tx_power;
6288                 rp.max_tx_power = conn->max_tx_power;
6289         } else {
6290                 rp.rssi = HCI_RSSI_INVALID;
6291                 rp.tx_power = HCI_TX_POWER_INVALID;
6292                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6293         }
6294
6295         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6296                                 status, &rp, sizeof(rp));
6297
6298         hci_conn_drop(conn);
6299         hci_conn_put(conn);
6300
6301         return err;
6302 }
6303
6304 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6305                                        u16 opcode)
6306 {
6307         struct hci_cp_read_rssi *cp;
6308         struct mgmt_pending_cmd *cmd;
6309         struct hci_conn *conn;
6310         u16 handle;
6311         u8 status;
6312
6313         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6314
6315         hci_dev_lock(hdev);
6316
6317         /* Commands sent in request are either Read RSSI or Read Transmit Power
6318          * Level so we check which one was last sent to retrieve connection
6319          * handle.  Both commands have handle as first parameter so it's safe to
6320          * cast data on the same command struct.
6321          *
6322          * First command sent is always Read RSSI and we fail only if it fails.
6323          * In other case we simply override error to indicate success as we
6324          * already remembered if TX power value is actually valid.
6325          */
6326         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6327         if (!cp) {
6328                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6329                 status = MGMT_STATUS_SUCCESS;
6330         } else {
6331                 status = mgmt_status(hci_status);
6332         }
6333
6334         if (!cp) {
6335                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6336                 goto unlock;
6337         }
6338
6339         handle = __le16_to_cpu(cp->handle);
6340         conn = hci_conn_hash_lookup_handle(hdev, handle);
6341         if (!conn) {
6342                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6343                            handle);
6344                 goto unlock;
6345         }
6346
6347         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6348         if (!cmd)
6349                 goto unlock;
6350
6351         cmd->cmd_complete(cmd, status);
6352         mgmt_pending_remove(cmd);
6353
6354 unlock:
6355         hci_dev_unlock(hdev);
6356 }
6357
6358 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6359                          u16 len)
6360 {
6361         struct mgmt_cp_get_conn_info *cp = data;
6362         struct mgmt_rp_get_conn_info rp;
6363         struct hci_conn *conn;
6364         unsigned long conn_info_age;
6365         int err = 0;
6366
6367         bt_dev_dbg(hdev, "sock %p", sk);
6368
6369         memset(&rp, 0, sizeof(rp));
6370         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6371         rp.addr.type = cp->addr.type;
6372
6373         if (!bdaddr_type_is_valid(cp->addr.type))
6374                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6375                                          MGMT_STATUS_INVALID_PARAMS,
6376                                          &rp, sizeof(rp));
6377
6378         hci_dev_lock(hdev);
6379
6380         if (!hdev_is_powered(hdev)) {
6381                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6382                                         MGMT_STATUS_NOT_POWERED, &rp,
6383                                         sizeof(rp));
6384                 goto unlock;
6385         }
6386
6387         if (cp->addr.type == BDADDR_BREDR)
6388                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6389                                                &cp->addr.bdaddr);
6390         else
6391                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6392
6393         if (!conn || conn->state != BT_CONNECTED) {
6394                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6395                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6396                                         sizeof(rp));
6397                 goto unlock;
6398         }
6399
6400         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6401                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6402                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6403                 goto unlock;
6404         }
6405
6406         /* To avoid client trying to guess when to poll again for information we
6407          * calculate conn info age as random value between min/max set in hdev.
6408          */
6409         conn_info_age = hdev->conn_info_min_age +
6410                         prandom_u32_max(hdev->conn_info_max_age -
6411                                         hdev->conn_info_min_age);
6412
6413         /* Query controller to refresh cached values if they are too old or were
6414          * never read.
6415          */
6416         if (time_after(jiffies, conn->conn_info_timestamp +
6417                        msecs_to_jiffies(conn_info_age)) ||
6418             !conn->conn_info_timestamp) {
6419                 struct hci_request req;
6420                 struct hci_cp_read_tx_power req_txp_cp;
6421                 struct hci_cp_read_rssi req_rssi_cp;
6422                 struct mgmt_pending_cmd *cmd;
6423
6424                 hci_req_init(&req, hdev);
6425                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6426                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6427                             &req_rssi_cp);
6428
6429                 /* For LE links TX power does not change thus we don't need to
6430                  * query for it once value is known.
6431                  */
6432                 if (!bdaddr_type_is_le(cp->addr.type) ||
6433                     conn->tx_power == HCI_TX_POWER_INVALID) {
6434                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6435                         req_txp_cp.type = 0x00;
6436                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6437                                     sizeof(req_txp_cp), &req_txp_cp);
6438                 }
6439
6440                 /* Max TX power needs to be read only once per connection */
6441                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6442                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6443                         req_txp_cp.type = 0x01;
6444                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6445                                     sizeof(req_txp_cp), &req_txp_cp);
6446                 }
6447
6448                 err = hci_req_run(&req, conn_info_refresh_complete);
6449                 if (err < 0)
6450                         goto unlock;
6451
6452                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6453                                        data, len);
6454                 if (!cmd) {
6455                         err = -ENOMEM;
6456                         goto unlock;
6457                 }
6458
6459                 hci_conn_hold(conn);
6460                 cmd->user_data = hci_conn_get(conn);
6461                 cmd->cmd_complete = conn_info_cmd_complete;
6462
6463                 conn->conn_info_timestamp = jiffies;
6464         } else {
6465                 /* Cache is valid, just reply with values cached in hci_conn */
6466                 rp.rssi = conn->rssi;
6467                 rp.tx_power = conn->tx_power;
6468                 rp.max_tx_power = conn->max_tx_power;
6469
6470                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6471                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6472         }
6473
6474 unlock:
6475         hci_dev_unlock(hdev);
6476         return err;
6477 }
6478
6479 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6480 {
6481         struct hci_conn *conn = cmd->user_data;
6482         struct mgmt_rp_get_clock_info rp;
6483         struct hci_dev *hdev;
6484         int err;
6485
6486         memset(&rp, 0, sizeof(rp));
6487         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6488
6489         if (status)
6490                 goto complete;
6491
6492         hdev = hci_dev_get(cmd->index);
6493         if (hdev) {
6494                 rp.local_clock = cpu_to_le32(hdev->clock);
6495                 hci_dev_put(hdev);
6496         }
6497
6498         if (conn) {
6499                 rp.piconet_clock = cpu_to_le32(conn->clock);
6500                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6501         }
6502
6503 complete:
6504         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6505                                 sizeof(rp));
6506
6507         if (conn) {
6508                 hci_conn_drop(conn);
6509                 hci_conn_put(conn);
6510         }
6511
6512         return err;
6513 }
6514
6515 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6516 {
6517         struct hci_cp_read_clock *hci_cp;
6518         struct mgmt_pending_cmd *cmd;
6519         struct hci_conn *conn;
6520
6521         bt_dev_dbg(hdev, "status %u", status);
6522
6523         hci_dev_lock(hdev);
6524
6525         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6526         if (!hci_cp)
6527                 goto unlock;
6528
6529         if (hci_cp->which) {
6530                 u16 handle = __le16_to_cpu(hci_cp->handle);
6531                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6532         } else {
6533                 conn = NULL;
6534         }
6535
6536         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6537         if (!cmd)
6538                 goto unlock;
6539
6540         cmd->cmd_complete(cmd, mgmt_status(status));
6541         mgmt_pending_remove(cmd);
6542
6543 unlock:
6544         hci_dev_unlock(hdev);
6545 }
6546
6547 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6548                          u16 len)
6549 {
6550         struct mgmt_cp_get_clock_info *cp = data;
6551         struct mgmt_rp_get_clock_info rp;
6552         struct hci_cp_read_clock hci_cp;
6553         struct mgmt_pending_cmd *cmd;
6554         struct hci_request req;
6555         struct hci_conn *conn;
6556         int err;
6557
6558         bt_dev_dbg(hdev, "sock %p", sk);
6559
6560         memset(&rp, 0, sizeof(rp));
6561         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6562         rp.addr.type = cp->addr.type;
6563
6564         if (cp->addr.type != BDADDR_BREDR)
6565                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6566                                          MGMT_STATUS_INVALID_PARAMS,
6567                                          &rp, sizeof(rp));
6568
6569         hci_dev_lock(hdev);
6570
6571         if (!hdev_is_powered(hdev)) {
6572                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6573                                         MGMT_STATUS_NOT_POWERED, &rp,
6574                                         sizeof(rp));
6575                 goto unlock;
6576         }
6577
6578         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6579                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6580                                                &cp->addr.bdaddr);
6581                 if (!conn || conn->state != BT_CONNECTED) {
6582                         err = mgmt_cmd_complete(sk, hdev->id,
6583                                                 MGMT_OP_GET_CLOCK_INFO,
6584                                                 MGMT_STATUS_NOT_CONNECTED,
6585                                                 &rp, sizeof(rp));
6586                         goto unlock;
6587                 }
6588         } else {
6589                 conn = NULL;
6590         }
6591
6592         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6593         if (!cmd) {
6594                 err = -ENOMEM;
6595                 goto unlock;
6596         }
6597
6598         cmd->cmd_complete = clock_info_cmd_complete;
6599
6600         hci_req_init(&req, hdev);
6601
6602         memset(&hci_cp, 0, sizeof(hci_cp));
6603         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6604
6605         if (conn) {
6606                 hci_conn_hold(conn);
6607                 cmd->user_data = hci_conn_get(conn);
6608
6609                 hci_cp.handle = cpu_to_le16(conn->handle);
6610                 hci_cp.which = 0x01; /* Piconet clock */
6611                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6612         }
6613
6614         err = hci_req_run(&req, get_clock_info_complete);
6615         if (err < 0)
6616                 mgmt_pending_remove(cmd);
6617
6618 unlock:
6619         hci_dev_unlock(hdev);
6620         return err;
6621 }
6622
6623 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6624 {
6625         struct hci_conn *conn;
6626
6627         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6628         if (!conn)
6629                 return false;
6630
6631         if (conn->dst_type != type)
6632                 return false;
6633
6634         if (conn->state != BT_CONNECTED)
6635                 return false;
6636
6637         return true;
6638 }
6639
6640 /* This function requires the caller holds hdev->lock */
6641 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6642                                u8 addr_type, u8 auto_connect)
6643 {
6644         struct hci_conn_params *params;
6645
6646         params = hci_conn_params_add(hdev, addr, addr_type);
6647         if (!params)
6648                 return -EIO;
6649
6650         if (params->auto_connect == auto_connect)
6651                 return 0;
6652
6653         list_del_init(&params->action);
6654
6655         switch (auto_connect) {
6656         case HCI_AUTO_CONN_DISABLED:
6657         case HCI_AUTO_CONN_LINK_LOSS:
6658                 /* If auto connect is being disabled when we're trying to
6659                  * connect to device, keep connecting.
6660                  */
6661                 if (params->explicit_connect)
6662                         list_add(&params->action, &hdev->pend_le_conns);
6663                 break;
6664         case HCI_AUTO_CONN_REPORT:
6665                 if (params->explicit_connect)
6666                         list_add(&params->action, &hdev->pend_le_conns);
6667                 else
6668                         list_add(&params->action, &hdev->pend_le_reports);
6669                 break;
6670         case HCI_AUTO_CONN_DIRECT:
6671         case HCI_AUTO_CONN_ALWAYS:
6672                 if (!is_connected(hdev, addr, addr_type))
6673                         list_add(&params->action, &hdev->pend_le_conns);
6674                 break;
6675         }
6676
6677         params->auto_connect = auto_connect;
6678
6679         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6680                    addr, addr_type, auto_connect);
6681
6682         return 0;
6683 }
6684
6685 static void device_added(struct sock *sk, struct hci_dev *hdev,
6686                          bdaddr_t *bdaddr, u8 type, u8 action)
6687 {
6688         struct mgmt_ev_device_added ev;
6689
6690         bacpy(&ev.addr.bdaddr, bdaddr);
6691         ev.addr.type = type;
6692         ev.action = action;
6693
6694         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6695 }
6696
6697 static int add_device(struct sock *sk, struct hci_dev *hdev,
6698                       void *data, u16 len)
6699 {
6700         struct mgmt_cp_add_device *cp = data;
6701         u8 auto_conn, addr_type;
6702         struct hci_conn_params *params;
6703         int err;
6704         u32 current_flags = 0;
6705
6706         bt_dev_dbg(hdev, "sock %p", sk);
6707
6708         if (!bdaddr_type_is_valid(cp->addr.type) ||
6709             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6710                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6711                                          MGMT_STATUS_INVALID_PARAMS,
6712                                          &cp->addr, sizeof(cp->addr));
6713
6714         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6715                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6716                                          MGMT_STATUS_INVALID_PARAMS,
6717                                          &cp->addr, sizeof(cp->addr));
6718
6719         hci_dev_lock(hdev);
6720
6721         if (cp->addr.type == BDADDR_BREDR) {
6722                 /* Only incoming connections action is supported for now */
6723                 if (cp->action != 0x01) {
6724                         err = mgmt_cmd_complete(sk, hdev->id,
6725                                                 MGMT_OP_ADD_DEVICE,
6726                                                 MGMT_STATUS_INVALID_PARAMS,
6727                                                 &cp->addr, sizeof(cp->addr));
6728                         goto unlock;
6729                 }
6730
6731                 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
6732                                                      &cp->addr.bdaddr,
6733                                                      cp->addr.type, 0);
6734                 if (err)
6735                         goto unlock;
6736
6737                 hci_req_update_scan(hdev);
6738
6739                 goto added;
6740         }
6741
6742         addr_type = le_addr_type(cp->addr.type);
6743
6744         if (cp->action == 0x02)
6745                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6746         else if (cp->action == 0x01)
6747                 auto_conn = HCI_AUTO_CONN_DIRECT;
6748         else
6749                 auto_conn = HCI_AUTO_CONN_REPORT;
6750
6751         /* Kernel internally uses conn_params with resolvable private
6752          * address, but Add Device allows only identity addresses.
6753          * Make sure it is enforced before calling
6754          * hci_conn_params_lookup.
6755          */
6756         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6757                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6758                                         MGMT_STATUS_INVALID_PARAMS,
6759                                         &cp->addr, sizeof(cp->addr));
6760                 goto unlock;
6761         }
6762
6763         /* If the connection parameters don't exist for this device,
6764          * they will be created and configured with defaults.
6765          */
6766         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6767                                 auto_conn) < 0) {
6768                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6769                                         MGMT_STATUS_FAILED, &cp->addr,
6770                                         sizeof(cp->addr));
6771                 goto unlock;
6772         } else {
6773                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6774                                                 addr_type);
6775                 if (params)
6776                         current_flags = params->current_flags;
6777         }
6778
6779         hci_update_background_scan(hdev);
6780
6781 added:
6782         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6783         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6784                              SUPPORTED_DEVICE_FLAGS(), current_flags);
6785
6786         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6787                                 MGMT_STATUS_SUCCESS, &cp->addr,
6788                                 sizeof(cp->addr));
6789
6790 unlock:
6791         hci_dev_unlock(hdev);
6792         return err;
6793 }
6794
6795 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6796                            bdaddr_t *bdaddr, u8 type)
6797 {
6798         struct mgmt_ev_device_removed ev;
6799
6800         bacpy(&ev.addr.bdaddr, bdaddr);
6801         ev.addr.type = type;
6802
6803         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6804 }
6805
6806 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6807                          void *data, u16 len)
6808 {
6809         struct mgmt_cp_remove_device *cp = data;
6810         int err;
6811
6812         bt_dev_dbg(hdev, "sock %p", sk);
6813
6814         hci_dev_lock(hdev);
6815
6816         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6817                 struct hci_conn_params *params;
6818                 u8 addr_type;
6819
6820                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6821                         err = mgmt_cmd_complete(sk, hdev->id,
6822                                                 MGMT_OP_REMOVE_DEVICE,
6823                                                 MGMT_STATUS_INVALID_PARAMS,
6824                                                 &cp->addr, sizeof(cp->addr));
6825                         goto unlock;
6826                 }
6827
6828                 if (cp->addr.type == BDADDR_BREDR) {
6829                         err = hci_bdaddr_list_del(&hdev->whitelist,
6830                                                   &cp->addr.bdaddr,
6831                                                   cp->addr.type);
6832                         if (err) {
6833                                 err = mgmt_cmd_complete(sk, hdev->id,
6834                                                         MGMT_OP_REMOVE_DEVICE,
6835                                                         MGMT_STATUS_INVALID_PARAMS,
6836                                                         &cp->addr,
6837                                                         sizeof(cp->addr));
6838                                 goto unlock;
6839                         }
6840
6841                         hci_req_update_scan(hdev);
6842
6843                         device_removed(sk, hdev, &cp->addr.bdaddr,
6844                                        cp->addr.type);
6845                         goto complete;
6846                 }
6847
6848                 addr_type = le_addr_type(cp->addr.type);
6849
6850                 /* Kernel internally uses conn_params with resolvable private
6851                  * address, but Remove Device allows only identity addresses.
6852                  * Make sure it is enforced before calling
6853                  * hci_conn_params_lookup.
6854                  */
6855                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6856                         err = mgmt_cmd_complete(sk, hdev->id,
6857                                                 MGMT_OP_REMOVE_DEVICE,
6858                                                 MGMT_STATUS_INVALID_PARAMS,
6859                                                 &cp->addr, sizeof(cp->addr));
6860                         goto unlock;
6861                 }
6862
6863                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6864                                                 addr_type);
6865                 if (!params) {
6866                         err = mgmt_cmd_complete(sk, hdev->id,
6867                                                 MGMT_OP_REMOVE_DEVICE,
6868                                                 MGMT_STATUS_INVALID_PARAMS,
6869                                                 &cp->addr, sizeof(cp->addr));
6870                         goto unlock;
6871                 }
6872
6873                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6874                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6875                         err = mgmt_cmd_complete(sk, hdev->id,
6876                                                 MGMT_OP_REMOVE_DEVICE,
6877                                                 MGMT_STATUS_INVALID_PARAMS,
6878                                                 &cp->addr, sizeof(cp->addr));
6879                         goto unlock;
6880                 }
6881
6882                 list_del(&params->action);
6883                 list_del(&params->list);
6884                 kfree(params);
6885                 hci_update_background_scan(hdev);
6886
6887                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6888         } else {
6889                 struct hci_conn_params *p, *tmp;
6890                 struct bdaddr_list *b, *btmp;
6891
6892                 if (cp->addr.type) {
6893                         err = mgmt_cmd_complete(sk, hdev->id,
6894                                                 MGMT_OP_REMOVE_DEVICE,
6895                                                 MGMT_STATUS_INVALID_PARAMS,
6896                                                 &cp->addr, sizeof(cp->addr));
6897                         goto unlock;
6898                 }
6899
6900                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6901                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6902                         list_del(&b->list);
6903                         kfree(b);
6904                 }
6905
6906                 hci_req_update_scan(hdev);
6907
6908                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6909                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6910                                 continue;
6911                         device_removed(sk, hdev, &p->addr, p->addr_type);
6912                         if (p->explicit_connect) {
6913                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6914                                 continue;
6915                         }
6916                         list_del(&p->action);
6917                         list_del(&p->list);
6918                         kfree(p);
6919                 }
6920
6921                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6922
6923                 hci_update_background_scan(hdev);
6924         }
6925
6926 complete:
6927         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6928                                 MGMT_STATUS_SUCCESS, &cp->addr,
6929                                 sizeof(cp->addr));
6930 unlock:
6931         hci_dev_unlock(hdev);
6932         return err;
6933 }
6934
6935 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6936                            u16 len)
6937 {
6938         struct mgmt_cp_load_conn_param *cp = data;
6939         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6940                                      sizeof(struct mgmt_conn_param));
6941         u16 param_count, expected_len;
6942         int i;
6943
6944         if (!lmp_le_capable(hdev))
6945                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6946                                        MGMT_STATUS_NOT_SUPPORTED);
6947
6948         param_count = __le16_to_cpu(cp->param_count);
6949         if (param_count > max_param_count) {
6950                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6951                            param_count);
6952                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6953                                        MGMT_STATUS_INVALID_PARAMS);
6954         }
6955
6956         expected_len = struct_size(cp, params, param_count);
6957         if (expected_len != len) {
6958                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6959                            expected_len, len);
6960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6961                                        MGMT_STATUS_INVALID_PARAMS);
6962         }
6963
6964         bt_dev_dbg(hdev, "param_count %u", param_count);
6965
6966         hci_dev_lock(hdev);
6967
6968         hci_conn_params_clear_disabled(hdev);
6969
6970         for (i = 0; i < param_count; i++) {
6971                 struct mgmt_conn_param *param = &cp->params[i];
6972                 struct hci_conn_params *hci_param;
6973                 u16 min, max, latency, timeout;
6974                 u8 addr_type;
6975
6976                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
6977                            param->addr.type);
6978
6979                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6980                         addr_type = ADDR_LE_DEV_PUBLIC;
6981                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6982                         addr_type = ADDR_LE_DEV_RANDOM;
6983                 } else {
6984                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6985                         continue;
6986                 }
6987
6988                 min = le16_to_cpu(param->min_interval);
6989                 max = le16_to_cpu(param->max_interval);
6990                 latency = le16_to_cpu(param->latency);
6991                 timeout = le16_to_cpu(param->timeout);
6992
6993                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6994                            min, max, latency, timeout);
6995
6996                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6997                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6998                         continue;
6999                 }
7000
7001                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7002                                                 addr_type);
7003                 if (!hci_param) {
7004                         bt_dev_err(hdev, "failed to add connection parameters");
7005                         continue;
7006                 }
7007
7008                 hci_param->conn_min_interval = min;
7009                 hci_param->conn_max_interval = max;
7010                 hci_param->conn_latency = latency;
7011                 hci_param->supervision_timeout = timeout;
7012         }
7013
7014         hci_dev_unlock(hdev);
7015
7016         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7017                                  NULL, 0);
7018 }
7019
7020 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7021                                void *data, u16 len)
7022 {
7023         struct mgmt_cp_set_external_config *cp = data;
7024         bool changed;
7025         int err;
7026
7027         bt_dev_dbg(hdev, "sock %p", sk);
7028
7029         if (hdev_is_powered(hdev))
7030                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7031                                        MGMT_STATUS_REJECTED);
7032
7033         if (cp->config != 0x00 && cp->config != 0x01)
7034                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7035                                          MGMT_STATUS_INVALID_PARAMS);
7036
7037         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7038                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7039                                        MGMT_STATUS_NOT_SUPPORTED);
7040
7041         hci_dev_lock(hdev);
7042
7043         if (cp->config)
7044                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7045         else
7046                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7047
7048         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7049         if (err < 0)
7050                 goto unlock;
7051
7052         if (!changed)
7053                 goto unlock;
7054
7055         err = new_options(hdev, sk);
7056
7057         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7058                 mgmt_index_removed(hdev);
7059
7060                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7061                         hci_dev_set_flag(hdev, HCI_CONFIG);
7062                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7063
7064                         queue_work(hdev->req_workqueue, &hdev->power_on);
7065                 } else {
7066                         set_bit(HCI_RAW, &hdev->flags);
7067                         mgmt_index_added(hdev);
7068                 }
7069         }
7070
7071 unlock:
7072         hci_dev_unlock(hdev);
7073         return err;
7074 }
7075
7076 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7077                               void *data, u16 len)
7078 {
7079         struct mgmt_cp_set_public_address *cp = data;
7080         bool changed;
7081         int err;
7082
7083         bt_dev_dbg(hdev, "sock %p", sk);
7084
7085         if (hdev_is_powered(hdev))
7086                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7087                                        MGMT_STATUS_REJECTED);
7088
7089         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7090                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7091                                        MGMT_STATUS_INVALID_PARAMS);
7092
7093         if (!hdev->set_bdaddr)
7094                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7095                                        MGMT_STATUS_NOT_SUPPORTED);
7096
7097         hci_dev_lock(hdev);
7098
7099         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7100         bacpy(&hdev->public_addr, &cp->bdaddr);
7101
7102         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7103         if (err < 0)
7104                 goto unlock;
7105
7106         if (!changed)
7107                 goto unlock;
7108
7109         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7110                 err = new_options(hdev, sk);
7111
7112         if (is_configured(hdev)) {
7113                 mgmt_index_removed(hdev);
7114
7115                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7116
7117                 hci_dev_set_flag(hdev, HCI_CONFIG);
7118                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7119
7120                 queue_work(hdev->req_workqueue, &hdev->power_on);
7121         }
7122
7123 unlock:
7124         hci_dev_unlock(hdev);
7125         return err;
7126 }
7127
7128 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
7129                                              u16 opcode, struct sk_buff *skb)
7130 {
7131         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7132         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7133         u8 *h192, *r192, *h256, *r256;
7134         struct mgmt_pending_cmd *cmd;
7135         u16 eir_len;
7136         int err;
7137
7138         bt_dev_dbg(hdev, "status %u", status);
7139
7140         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
7141         if (!cmd)
7142                 return;
7143
7144         mgmt_cp = cmd->param;
7145
7146         if (status) {
7147                 status = mgmt_status(status);
7148                 eir_len = 0;
7149
7150                 h192 = NULL;
7151                 r192 = NULL;
7152                 h256 = NULL;
7153                 r256 = NULL;
7154         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
7155                 struct hci_rp_read_local_oob_data *rp;
7156
7157                 if (skb->len != sizeof(*rp)) {
7158                         status = MGMT_STATUS_FAILED;
7159                         eir_len = 0;
7160                 } else {
7161                         status = MGMT_STATUS_SUCCESS;
7162                         rp = (void *)skb->data;
7163
7164                         eir_len = 5 + 18 + 18;
7165                         h192 = rp->hash;
7166                         r192 = rp->rand;
7167                         h256 = NULL;
7168                         r256 = NULL;
7169                 }
7170         } else {
7171                 struct hci_rp_read_local_oob_ext_data *rp;
7172
7173                 if (skb->len != sizeof(*rp)) {
7174                         status = MGMT_STATUS_FAILED;
7175                         eir_len = 0;
7176                 } else {
7177                         status = MGMT_STATUS_SUCCESS;
7178                         rp = (void *)skb->data;
7179
7180                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7181                                 eir_len = 5 + 18 + 18;
7182                                 h192 = NULL;
7183                                 r192 = NULL;
7184                         } else {
7185                                 eir_len = 5 + 18 + 18 + 18 + 18;
7186                                 h192 = rp->hash192;
7187                                 r192 = rp->rand192;
7188                         }
7189
7190                         h256 = rp->hash256;
7191                         r256 = rp->rand256;
7192                 }
7193         }
7194
7195         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7196         if (!mgmt_rp)
7197                 goto done;
7198
7199         if (status)
7200                 goto send_rsp;
7201
7202         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7203                                   hdev->dev_class, 3);
7204
7205         if (h192 && r192) {
7206                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7207                                           EIR_SSP_HASH_C192, h192, 16);
7208                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7209                                           EIR_SSP_RAND_R192, r192, 16);
7210         }
7211
7212         if (h256 && r256) {
7213                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7214                                           EIR_SSP_HASH_C256, h256, 16);
7215                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7216                                           EIR_SSP_RAND_R256, r256, 16);
7217         }
7218
7219 send_rsp:
7220         mgmt_rp->type = mgmt_cp->type;
7221         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7222
7223         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7224                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7225                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7226         if (err < 0 || status)
7227                 goto done;
7228
7229         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7230
7231         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7232                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7233                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7234 done:
7235         kfree(mgmt_rp);
7236         mgmt_pending_remove(cmd);
7237 }
7238
7239 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7240                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7241 {
7242         struct mgmt_pending_cmd *cmd;
7243         struct hci_request req;
7244         int err;
7245
7246         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7247                                cp, sizeof(*cp));
7248         if (!cmd)
7249                 return -ENOMEM;
7250
7251         hci_req_init(&req, hdev);
7252
7253         if (bredr_sc_enabled(hdev))
7254                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7255         else
7256                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7257
7258         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7259         if (err < 0) {
7260                 mgmt_pending_remove(cmd);
7261                 return err;
7262         }
7263
7264         return 0;
7265 }
7266
7267 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7268                                    void *data, u16 data_len)
7269 {
7270         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7271         struct mgmt_rp_read_local_oob_ext_data *rp;
7272         size_t rp_len;
7273         u16 eir_len;
7274         u8 status, flags, role, addr[7], hash[16], rand[16];
7275         int err;
7276
7277         bt_dev_dbg(hdev, "sock %p", sk);
7278
7279         if (hdev_is_powered(hdev)) {
7280                 switch (cp->type) {
7281                 case BIT(BDADDR_BREDR):
7282                         status = mgmt_bredr_support(hdev);
7283                         if (status)
7284                                 eir_len = 0;
7285                         else
7286                                 eir_len = 5;
7287                         break;
7288                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7289                         status = mgmt_le_support(hdev);
7290                         if (status)
7291                                 eir_len = 0;
7292                         else
7293                                 eir_len = 9 + 3 + 18 + 18 + 3;
7294                         break;
7295                 default:
7296                         status = MGMT_STATUS_INVALID_PARAMS;
7297                         eir_len = 0;
7298                         break;
7299                 }
7300         } else {
7301                 status = MGMT_STATUS_NOT_POWERED;
7302                 eir_len = 0;
7303         }
7304
7305         rp_len = sizeof(*rp) + eir_len;
7306         rp = kmalloc(rp_len, GFP_ATOMIC);
7307         if (!rp)
7308                 return -ENOMEM;
7309
7310         if (status)
7311                 goto complete;
7312
7313         hci_dev_lock(hdev);
7314
7315         eir_len = 0;
7316         switch (cp->type) {
7317         case BIT(BDADDR_BREDR):
7318                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7319                         err = read_local_ssp_oob_req(hdev, sk, cp);
7320                         hci_dev_unlock(hdev);
7321                         if (!err)
7322                                 goto done;
7323
7324                         status = MGMT_STATUS_FAILED;
7325                         goto complete;
7326                 } else {
7327                         eir_len = eir_append_data(rp->eir, eir_len,
7328                                                   EIR_CLASS_OF_DEV,
7329                                                   hdev->dev_class, 3);
7330                 }
7331                 break;
7332         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7333                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7334                     smp_generate_oob(hdev, hash, rand) < 0) {
7335                         hci_dev_unlock(hdev);
7336                         status = MGMT_STATUS_FAILED;
7337                         goto complete;
7338                 }
7339
7340                 /* This should return the active RPA, but since the RPA
7341                  * is only programmed on demand, it is really hard to fill
7342                  * this in at the moment. For now disallow retrieving
7343                  * local out-of-band data when privacy is in use.
7344                  *
7345                  * Returning the identity address will not help here since
7346                  * pairing happens before the identity resolving key is
7347                  * known and thus the connection establishment happens
7348                  * based on the RPA and not the identity address.
7349                  */
7350                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7351                         hci_dev_unlock(hdev);
7352                         status = MGMT_STATUS_REJECTED;
7353                         goto complete;
7354                 }
7355
7356                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7357                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7358                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7359                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7360                         memcpy(addr, &hdev->static_addr, 6);
7361                         addr[6] = 0x01;
7362                 } else {
7363                         memcpy(addr, &hdev->bdaddr, 6);
7364                         addr[6] = 0x00;
7365                 }
7366
7367                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7368                                           addr, sizeof(addr));
7369
7370                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7371                         role = 0x02;
7372                 else
7373                         role = 0x01;
7374
7375                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7376                                           &role, sizeof(role));
7377
7378                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7379                         eir_len = eir_append_data(rp->eir, eir_len,
7380                                                   EIR_LE_SC_CONFIRM,
7381                                                   hash, sizeof(hash));
7382
7383                         eir_len = eir_append_data(rp->eir, eir_len,
7384                                                   EIR_LE_SC_RANDOM,
7385                                                   rand, sizeof(rand));
7386                 }
7387
7388                 flags = mgmt_get_adv_discov_flags(hdev);
7389
7390                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7391                         flags |= LE_AD_NO_BREDR;
7392
7393                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7394                                           &flags, sizeof(flags));
7395                 break;
7396         }
7397
7398         hci_dev_unlock(hdev);
7399
7400         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7401
7402         status = MGMT_STATUS_SUCCESS;
7403
7404 complete:
7405         rp->type = cp->type;
7406         rp->eir_len = cpu_to_le16(eir_len);
7407
7408         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7409                                 status, rp, sizeof(*rp) + eir_len);
7410         if (err < 0 || status)
7411                 goto done;
7412
7413         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7414                                  rp, sizeof(*rp) + eir_len,
7415                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7416
7417 done:
7418         kfree(rp);
7419
7420         return err;
7421 }
7422
7423 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7424 {
7425         u32 flags = 0;
7426
7427         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7428         flags |= MGMT_ADV_FLAG_DISCOV;
7429         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7430         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7431         flags |= MGMT_ADV_FLAG_APPEARANCE;
7432         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7433         flags |= MGMT_ADV_PARAM_DURATION;
7434         flags |= MGMT_ADV_PARAM_TIMEOUT;
7435         flags |= MGMT_ADV_PARAM_INTERVALS;
7436         flags |= MGMT_ADV_PARAM_TX_POWER;
7437         flags |= MGMT_ADV_PARAM_SCAN_RSP;
7438
7439         /* In extended adv TX_POWER returned from Set Adv Param
7440          * will be always valid.
7441          */
7442         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7443             ext_adv_capable(hdev))
7444                 flags |= MGMT_ADV_FLAG_TX_POWER;
7445
7446         if (ext_adv_capable(hdev)) {
7447                 flags |= MGMT_ADV_FLAG_SEC_1M;
7448                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7449                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7450
7451                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7452                         flags |= MGMT_ADV_FLAG_SEC_2M;
7453
7454                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7455                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7456         }
7457
7458         return flags;
7459 }
7460
7461 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7462                              void *data, u16 data_len)
7463 {
7464         struct mgmt_rp_read_adv_features *rp;
7465         size_t rp_len;
7466         int err;
7467         struct adv_info *adv_instance;
7468         u32 supported_flags;
7469         u8 *instance;
7470
7471         bt_dev_dbg(hdev, "sock %p", sk);
7472
7473         if (!lmp_le_capable(hdev))
7474                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7475                                        MGMT_STATUS_REJECTED);
7476
7477         /* Enabling the experimental LL Privay support disables support for
7478          * advertising.
7479          */
7480         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7481                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7482                                        MGMT_STATUS_NOT_SUPPORTED);
7483
7484         hci_dev_lock(hdev);
7485
7486         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7487         rp = kmalloc(rp_len, GFP_ATOMIC);
7488         if (!rp) {
7489                 hci_dev_unlock(hdev);
7490                 return -ENOMEM;
7491         }
7492
7493         supported_flags = get_supported_adv_flags(hdev);
7494
7495         rp->supported_flags = cpu_to_le32(supported_flags);
7496         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7497         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7498         rp->max_instances = hdev->le_num_of_adv_sets;
7499         rp->num_instances = hdev->adv_instance_cnt;
7500
7501         instance = rp->instance;
7502         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7503                 *instance = adv_instance->instance;
7504                 instance++;
7505         }
7506
7507         hci_dev_unlock(hdev);
7508
7509         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7510                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7511
7512         kfree(rp);
7513
7514         return err;
7515 }
7516
7517 static u8 calculate_name_len(struct hci_dev *hdev)
7518 {
7519         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7520
7521         return append_local_name(hdev, buf, 0);
7522 }
7523
7524 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7525                            bool is_adv_data)
7526 {
7527         u8 max_len = HCI_MAX_AD_LENGTH;
7528
7529         if (is_adv_data) {
7530                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7531                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7532                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7533                         max_len -= 3;
7534
7535                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7536                         max_len -= 3;
7537         } else {
7538                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7539                         max_len -= calculate_name_len(hdev);
7540
7541                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7542                         max_len -= 4;
7543         }
7544
7545         return max_len;
7546 }
7547
7548 static bool flags_managed(u32 adv_flags)
7549 {
7550         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7551                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7552                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7553 }
7554
7555 static bool tx_power_managed(u32 adv_flags)
7556 {
7557         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7558 }
7559
7560 static bool name_managed(u32 adv_flags)
7561 {
7562         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7563 }
7564
7565 static bool appearance_managed(u32 adv_flags)
7566 {
7567         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7568 }
7569
7570 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7571                               u8 len, bool is_adv_data)
7572 {
7573         int i, cur_len;
7574         u8 max_len;
7575
7576         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7577
7578         if (len > max_len)
7579                 return false;
7580
7581         /* Make sure that the data is correctly formatted. */
7582         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7583                 cur_len = data[i];
7584
7585                 if (data[i + 1] == EIR_FLAGS &&
7586                     (!is_adv_data || flags_managed(adv_flags)))
7587                         return false;
7588
7589                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7590                         return false;
7591
7592                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7593                         return false;
7594
7595                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7596                         return false;
7597
7598                 if (data[i + 1] == EIR_APPEARANCE &&
7599                     appearance_managed(adv_flags))
7600                         return false;
7601
7602                 /* If the current field length would exceed the total data
7603                  * length, then it's invalid.
7604                  */
7605                 if (i + cur_len >= len)
7606                         return false;
7607         }
7608
7609         return true;
7610 }
7611
7612 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7613 {
7614         u32 supported_flags, phy_flags;
7615
7616         /* The current implementation only supports a subset of the specified
7617          * flags. Also need to check mutual exclusiveness of sec flags.
7618          */
7619         supported_flags = get_supported_adv_flags(hdev);
7620         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7621         if (adv_flags & ~supported_flags ||
7622             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7623                 return false;
7624
7625         return true;
7626 }
7627
7628 static bool adv_busy(struct hci_dev *hdev)
7629 {
7630         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7631                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7632                 pending_find(MGMT_OP_SET_LE, hdev) ||
7633                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7634                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7635 }
7636
7637 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7638                                      u16 opcode)
7639 {
7640         struct mgmt_pending_cmd *cmd;
7641         struct mgmt_cp_add_advertising *cp;
7642         struct mgmt_rp_add_advertising rp;
7643         struct adv_info *adv_instance, *n;
7644         u8 instance;
7645
7646         bt_dev_dbg(hdev, "status %d", status);
7647
7648         hci_dev_lock(hdev);
7649
7650         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7651         if (!cmd)
7652                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
7653
7654         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7655                 if (!adv_instance->pending)
7656                         continue;
7657
7658                 if (!status) {
7659                         adv_instance->pending = false;
7660                         continue;
7661                 }
7662
7663                 instance = adv_instance->instance;
7664
7665                 if (hdev->cur_adv_instance == instance)
7666                         cancel_adv_timeout(hdev);
7667
7668                 hci_remove_adv_instance(hdev, instance);
7669                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7670         }
7671
7672         if (!cmd)
7673                 goto unlock;
7674
7675         cp = cmd->param;
7676         rp.instance = cp->instance;
7677
7678         if (status)
7679                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7680                                 mgmt_status(status));
7681         else
7682                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7683                                   mgmt_status(status), &rp, sizeof(rp));
7684
7685         mgmt_pending_remove(cmd);
7686
7687 unlock:
7688         hci_dev_unlock(hdev);
7689 }
7690
7691 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7692                            void *data, u16 data_len)
7693 {
7694         struct mgmt_cp_add_advertising *cp = data;
7695         struct mgmt_rp_add_advertising rp;
7696         u32 flags;
7697         u8 status;
7698         u16 timeout, duration;
7699         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7700         u8 schedule_instance = 0;
7701         struct adv_info *next_instance;
7702         int err;
7703         struct mgmt_pending_cmd *cmd;
7704         struct hci_request req;
7705
7706         bt_dev_dbg(hdev, "sock %p", sk);
7707
7708         status = mgmt_le_support(hdev);
7709         if (status)
7710                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7711                                        status);
7712
7713         /* Enabling the experimental LL Privay support disables support for
7714          * advertising.
7715          */
7716         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7717                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7718                                        MGMT_STATUS_NOT_SUPPORTED);
7719
7720         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7721                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7722                                        MGMT_STATUS_INVALID_PARAMS);
7723
7724         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7725                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7726                                        MGMT_STATUS_INVALID_PARAMS);
7727
7728         flags = __le32_to_cpu(cp->flags);
7729         timeout = __le16_to_cpu(cp->timeout);
7730         duration = __le16_to_cpu(cp->duration);
7731
7732         if (!requested_adv_flags_are_valid(hdev, flags))
7733                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7734                                        MGMT_STATUS_INVALID_PARAMS);
7735
7736         hci_dev_lock(hdev);
7737
7738         if (timeout && !hdev_is_powered(hdev)) {
7739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7740                                       MGMT_STATUS_REJECTED);
7741                 goto unlock;
7742         }
7743
7744         if (adv_busy(hdev)) {
7745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7746                                       MGMT_STATUS_BUSY);
7747                 goto unlock;
7748         }
7749
7750         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7751             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7752                                cp->scan_rsp_len, false)) {
7753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7754                                       MGMT_STATUS_INVALID_PARAMS);
7755                 goto unlock;
7756         }
7757
7758         err = hci_add_adv_instance(hdev, cp->instance, flags,
7759                                    cp->adv_data_len, cp->data,
7760                                    cp->scan_rsp_len,
7761                                    cp->data + cp->adv_data_len,
7762                                    timeout, duration,
7763                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
7764                                    hdev->le_adv_min_interval,
7765                                    hdev->le_adv_max_interval);
7766         if (err < 0) {
7767                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7768                                       MGMT_STATUS_FAILED);
7769                 goto unlock;
7770         }
7771
7772         /* Only trigger an advertising added event if a new instance was
7773          * actually added.
7774          */
7775         if (hdev->adv_instance_cnt > prev_instance_cnt)
7776                 mgmt_advertising_added(sk, hdev, cp->instance);
7777
7778         if (hdev->cur_adv_instance == cp->instance) {
7779                 /* If the currently advertised instance is being changed then
7780                  * cancel the current advertising and schedule the next
7781                  * instance. If there is only one instance then the overridden
7782                  * advertising data will be visible right away.
7783                  */
7784                 cancel_adv_timeout(hdev);
7785
7786                 next_instance = hci_get_next_instance(hdev, cp->instance);
7787                 if (next_instance)
7788                         schedule_instance = next_instance->instance;
7789         } else if (!hdev->adv_instance_timeout) {
7790                 /* Immediately advertise the new instance if no other
7791                  * instance is currently being advertised.
7792                  */
7793                 schedule_instance = cp->instance;
7794         }
7795
7796         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7797          * there is no instance to be advertised then we have no HCI
7798          * communication to make. Simply return.
7799          */
7800         if (!hdev_is_powered(hdev) ||
7801             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7802             !schedule_instance) {
7803                 rp.instance = cp->instance;
7804                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7805                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7806                 goto unlock;
7807         }
7808
7809         /* We're good to go, update advertising data, parameters, and start
7810          * advertising.
7811          */
7812         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7813                                data_len);
7814         if (!cmd) {
7815                 err = -ENOMEM;
7816                 goto unlock;
7817         }
7818
7819         hci_req_init(&req, hdev);
7820
7821         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7822
7823         if (!err)
7824                 err = hci_req_run(&req, add_advertising_complete);
7825
7826         if (err < 0) {
7827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7828                                       MGMT_STATUS_FAILED);
7829                 mgmt_pending_remove(cmd);
7830         }
7831
7832 unlock:
7833         hci_dev_unlock(hdev);
7834
7835         return err;
7836 }
7837
7838 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
7839                                         u16 opcode)
7840 {
7841         struct mgmt_pending_cmd *cmd;
7842         struct mgmt_cp_add_ext_adv_params *cp;
7843         struct mgmt_rp_add_ext_adv_params rp;
7844         struct adv_info *adv_instance;
7845         u32 flags;
7846
7847         BT_DBG("%s", hdev->name);
7848
7849         hci_dev_lock(hdev);
7850
7851         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
7852         if (!cmd)
7853                 goto unlock;
7854
7855         cp = cmd->param;
7856         adv_instance = hci_find_adv_instance(hdev, cp->instance);
7857         if (!adv_instance)
7858                 goto unlock;
7859
7860         rp.instance = cp->instance;
7861         rp.tx_power = adv_instance->tx_power;
7862
7863         /* While we're at it, inform userspace of the available space for this
7864          * advertisement, given the flags that will be used.
7865          */
7866         flags = __le32_to_cpu(cp->flags);
7867         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7868         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7869
7870         if (status) {
7871                 /* If this advertisement was previously advertising and we
7872                  * failed to update it, we signal that it has been removed and
7873                  * delete its structure
7874                  */
7875                 if (!adv_instance->pending)
7876                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
7877
7878                 hci_remove_adv_instance(hdev, cp->instance);
7879
7880                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7881                                 mgmt_status(status));
7882
7883         } else {
7884                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7885                                   mgmt_status(status), &rp, sizeof(rp));
7886         }
7887
7888 unlock:
7889         if (cmd)
7890                 mgmt_pending_remove(cmd);
7891
7892         hci_dev_unlock(hdev);
7893 }
7894
7895 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
7896                               void *data, u16 data_len)
7897 {
7898         struct mgmt_cp_add_ext_adv_params *cp = data;
7899         struct mgmt_rp_add_ext_adv_params rp;
7900         struct mgmt_pending_cmd *cmd = NULL;
7901         struct adv_info *adv_instance;
7902         struct hci_request req;
7903         u32 flags, min_interval, max_interval;
7904         u16 timeout, duration;
7905         u8 status;
7906         s8 tx_power;
7907         int err;
7908
7909         BT_DBG("%s", hdev->name);
7910
7911         status = mgmt_le_support(hdev);
7912         if (status)
7913                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7914                                        status);
7915
7916         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7917                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7918                                        MGMT_STATUS_INVALID_PARAMS);
7919
7920         /* The purpose of breaking add_advertising into two separate MGMT calls
7921          * for params and data is to allow more parameters to be added to this
7922          * structure in the future. For this reason, we verify that we have the
7923          * bare minimum structure we know of when the interface was defined. Any
7924          * extra parameters we don't know about will be ignored in this request.
7925          */
7926         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
7927                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7928                                        MGMT_STATUS_INVALID_PARAMS);
7929
7930         flags = __le32_to_cpu(cp->flags);
7931
7932         if (!requested_adv_flags_are_valid(hdev, flags))
7933                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7934                                        MGMT_STATUS_INVALID_PARAMS);
7935
7936         hci_dev_lock(hdev);
7937
7938         /* In new interface, we require that we are powered to register */
7939         if (!hdev_is_powered(hdev)) {
7940                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7941                                       MGMT_STATUS_REJECTED);
7942                 goto unlock;
7943         }
7944
7945         if (adv_busy(hdev)) {
7946                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7947                                       MGMT_STATUS_BUSY);
7948                 goto unlock;
7949         }
7950
7951         /* Parse defined parameters from request, use defaults otherwise */
7952         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
7953                   __le16_to_cpu(cp->timeout) : 0;
7954
7955         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
7956                    __le16_to_cpu(cp->duration) :
7957                    hdev->def_multi_adv_rotation_duration;
7958
7959         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7960                        __le32_to_cpu(cp->min_interval) :
7961                        hdev->le_adv_min_interval;
7962
7963         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7964                        __le32_to_cpu(cp->max_interval) :
7965                        hdev->le_adv_max_interval;
7966
7967         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
7968                    cp->tx_power :
7969                    HCI_ADV_TX_POWER_NO_PREFERENCE;
7970
7971         /* Create advertising instance with no advertising or response data */
7972         err = hci_add_adv_instance(hdev, cp->instance, flags,
7973                                    0, NULL, 0, NULL, timeout, duration,
7974                                    tx_power, min_interval, max_interval);
7975
7976         if (err < 0) {
7977                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7978                                       MGMT_STATUS_FAILED);
7979                 goto unlock;
7980         }
7981
7982         hdev->cur_adv_instance = cp->instance;
7983         /* Submit request for advertising params if ext adv available */
7984         if (ext_adv_capable(hdev)) {
7985                 hci_req_init(&req, hdev);
7986                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7987
7988                 /* Updating parameters of an active instance will return a
7989                  * Command Disallowed error, so we must first disable the
7990                  * instance if it is active.
7991                  */
7992                 if (!adv_instance->pending)
7993                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
7994
7995                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
7996
7997                 err = hci_req_run(&req, add_ext_adv_params_complete);
7998
7999                 if (!err)
8000                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
8001                                                hdev, data, data_len);
8002                 if (!cmd) {
8003                         err = -ENOMEM;
8004                         hci_remove_adv_instance(hdev, cp->instance);
8005                         goto unlock;
8006                 }
8007
8008         } else {
8009                 rp.instance = cp->instance;
8010                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8011                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8012                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8013                 err = mgmt_cmd_complete(sk, hdev->id,
8014                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8015                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8016         }
8017
8018 unlock:
8019         hci_dev_unlock(hdev);
8020
8021         return err;
8022 }
8023
8024 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8025                             u16 data_len)
8026 {
8027         struct mgmt_cp_add_ext_adv_data *cp = data;
8028         struct mgmt_rp_add_ext_adv_data rp;
8029         u8 schedule_instance = 0;
8030         struct adv_info *next_instance;
8031         struct adv_info *adv_instance;
8032         int err = 0;
8033         struct mgmt_pending_cmd *cmd;
8034         struct hci_request req;
8035
8036         BT_DBG("%s", hdev->name);
8037
8038         hci_dev_lock(hdev);
8039
8040         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8041
8042         if (!adv_instance) {
8043                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8044                                       MGMT_STATUS_INVALID_PARAMS);
8045                 goto unlock;
8046         }
8047
8048         /* In new interface, we require that we are powered to register */
8049         if (!hdev_is_powered(hdev)) {
8050                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8051                                       MGMT_STATUS_REJECTED);
8052                 goto clear_new_instance;
8053         }
8054
8055         if (adv_busy(hdev)) {
8056                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8057                                       MGMT_STATUS_BUSY);
8058                 goto clear_new_instance;
8059         }
8060
8061         /* Validate new data */
8062         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8063                                cp->adv_data_len, true) ||
8064             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8065                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8066                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8067                                       MGMT_STATUS_INVALID_PARAMS);
8068                 goto clear_new_instance;
8069         }
8070
8071         /* Set the data in the advertising instance */
8072         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8073                                   cp->data, cp->scan_rsp_len,
8074                                   cp->data + cp->adv_data_len);
8075
8076         /* We're good to go, update advertising data, parameters, and start
8077          * advertising.
8078          */
8079
8080         hci_req_init(&req, hdev);
8081
8082         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
8083
8084         if (ext_adv_capable(hdev)) {
8085                 __hci_req_update_adv_data(&req, cp->instance);
8086                 __hci_req_update_scan_rsp_data(&req, cp->instance);
8087                 __hci_req_enable_ext_advertising(&req, cp->instance);
8088
8089         } else {
8090                 /* If using software rotation, determine next instance to use */
8091
8092                 if (hdev->cur_adv_instance == cp->instance) {
8093                         /* If the currently advertised instance is being changed
8094                          * then cancel the current advertising and schedule the
8095                          * next instance. If there is only one instance then the
8096                          * overridden advertising data will be visible right
8097                          * away
8098                          */
8099                         cancel_adv_timeout(hdev);
8100
8101                         next_instance = hci_get_next_instance(hdev,
8102                                                               cp->instance);
8103                         if (next_instance)
8104                                 schedule_instance = next_instance->instance;
8105                 } else if (!hdev->adv_instance_timeout) {
8106                         /* Immediately advertise the new instance if no other
8107                          * instance is currently being advertised.
8108                          */
8109                         schedule_instance = cp->instance;
8110                 }
8111
8112                 /* If the HCI_ADVERTISING flag is set or there is no instance to
8113                  * be advertised then we have no HCI communication to make.
8114                  * Simply return.
8115                  */
8116                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8117                     !schedule_instance) {
8118                         if (adv_instance->pending) {
8119                                 mgmt_advertising_added(sk, hdev, cp->instance);
8120                                 adv_instance->pending = false;
8121                         }
8122                         rp.instance = cp->instance;
8123                         err = mgmt_cmd_complete(sk, hdev->id,
8124                                                 MGMT_OP_ADD_EXT_ADV_DATA,
8125                                                 MGMT_STATUS_SUCCESS, &rp,
8126                                                 sizeof(rp));
8127                         goto unlock;
8128                 }
8129
8130                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
8131                                                       true);
8132         }
8133
8134         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8135                                data_len);
8136         if (!cmd) {
8137                 err = -ENOMEM;
8138                 goto clear_new_instance;
8139         }
8140
8141         if (!err)
8142                 err = hci_req_run(&req, add_advertising_complete);
8143
8144         if (err < 0) {
8145                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8146                                       MGMT_STATUS_FAILED);
8147                 mgmt_pending_remove(cmd);
8148                 goto clear_new_instance;
8149         }
8150
8151         /* We were successful in updating data, so trigger advertising_added
8152          * event if this is an instance that wasn't previously advertising. If
8153          * a failure occurs in the requests we initiated, we will remove the
8154          * instance again in add_advertising_complete
8155          */
8156         if (adv_instance->pending)
8157                 mgmt_advertising_added(sk, hdev, cp->instance);
8158
8159         goto unlock;
8160
8161 clear_new_instance:
8162         hci_remove_adv_instance(hdev, cp->instance);
8163
8164 unlock:
8165         hci_dev_unlock(hdev);
8166
8167         return err;
8168 }
8169
8170 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
8171                                         u16 opcode)
8172 {
8173         struct mgmt_pending_cmd *cmd;
8174         struct mgmt_cp_remove_advertising *cp;
8175         struct mgmt_rp_remove_advertising rp;
8176
8177         bt_dev_dbg(hdev, "status %d", status);
8178
8179         hci_dev_lock(hdev);
8180
8181         /* A failure status here only means that we failed to disable
8182          * advertising. Otherwise, the advertising instance has been removed,
8183          * so report success.
8184          */
8185         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
8186         if (!cmd)
8187                 goto unlock;
8188
8189         cp = cmd->param;
8190         rp.instance = cp->instance;
8191
8192         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
8193                           &rp, sizeof(rp));
8194         mgmt_pending_remove(cmd);
8195
8196 unlock:
8197         hci_dev_unlock(hdev);
8198 }
8199
8200 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8201                               void *data, u16 data_len)
8202 {
8203         struct mgmt_cp_remove_advertising *cp = data;
8204         struct mgmt_rp_remove_advertising rp;
8205         struct mgmt_pending_cmd *cmd;
8206         struct hci_request req;
8207         int err;
8208
8209         bt_dev_dbg(hdev, "sock %p", sk);
8210
8211         /* Enabling the experimental LL Privay support disables support for
8212          * advertising.
8213          */
8214         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8215                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8216                                        MGMT_STATUS_NOT_SUPPORTED);
8217
8218         hci_dev_lock(hdev);
8219
8220         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8221                 err = mgmt_cmd_status(sk, hdev->id,
8222                                       MGMT_OP_REMOVE_ADVERTISING,
8223                                       MGMT_STATUS_INVALID_PARAMS);
8224                 goto unlock;
8225         }
8226
8227         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8228             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8229             pending_find(MGMT_OP_SET_LE, hdev)) {
8230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8231                                       MGMT_STATUS_BUSY);
8232                 goto unlock;
8233         }
8234
8235         if (list_empty(&hdev->adv_instances)) {
8236                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8237                                       MGMT_STATUS_INVALID_PARAMS);
8238                 goto unlock;
8239         }
8240
8241         hci_req_init(&req, hdev);
8242
8243         /* If we use extended advertising, instance is disabled and removed */
8244         if (ext_adv_capable(hdev)) {
8245                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
8246                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
8247         }
8248
8249         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8250
8251         if (list_empty(&hdev->adv_instances))
8252                 __hci_req_disable_advertising(&req);
8253
8254         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8255          * flag is set or the device isn't powered then we have no HCI
8256          * communication to make. Simply return.
8257          */
8258         if (skb_queue_empty(&req.cmd_q) ||
8259             !hdev_is_powered(hdev) ||
8260             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8261                 hci_req_purge(&req);
8262                 rp.instance = cp->instance;
8263                 err = mgmt_cmd_complete(sk, hdev->id,
8264                                         MGMT_OP_REMOVE_ADVERTISING,
8265                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8266                 goto unlock;
8267         }
8268
8269         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8270                                data_len);
8271         if (!cmd) {
8272                 err = -ENOMEM;
8273                 goto unlock;
8274         }
8275
8276         err = hci_req_run(&req, remove_advertising_complete);
8277         if (err < 0)
8278                 mgmt_pending_remove(cmd);
8279
8280 unlock:
8281         hci_dev_unlock(hdev);
8282
8283         return err;
8284 }
8285
8286 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8287                              void *data, u16 data_len)
8288 {
8289         struct mgmt_cp_get_adv_size_info *cp = data;
8290         struct mgmt_rp_get_adv_size_info rp;
8291         u32 flags, supported_flags;
8292         int err;
8293
8294         bt_dev_dbg(hdev, "sock %p", sk);
8295
8296         if (!lmp_le_capable(hdev))
8297                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8298                                        MGMT_STATUS_REJECTED);
8299
8300         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8302                                        MGMT_STATUS_INVALID_PARAMS);
8303
8304         flags = __le32_to_cpu(cp->flags);
8305
8306         /* The current implementation only supports a subset of the specified
8307          * flags.
8308          */
8309         supported_flags = get_supported_adv_flags(hdev);
8310         if (flags & ~supported_flags)
8311                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8312                                        MGMT_STATUS_INVALID_PARAMS);
8313
8314         rp.instance = cp->instance;
8315         rp.flags = cp->flags;
8316         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8317         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8318
8319         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8320                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8321
8322         return err;
8323 }
8324
8325 static const struct hci_mgmt_handler mgmt_handlers[] = {
8326         { NULL }, /* 0x0000 (no command) */
8327         { read_version,            MGMT_READ_VERSION_SIZE,
8328                                                 HCI_MGMT_NO_HDEV |
8329                                                 HCI_MGMT_UNTRUSTED },
8330         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8331                                                 HCI_MGMT_NO_HDEV |
8332                                                 HCI_MGMT_UNTRUSTED },
8333         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8334                                                 HCI_MGMT_NO_HDEV |
8335                                                 HCI_MGMT_UNTRUSTED },
8336         { read_controller_info,    MGMT_READ_INFO_SIZE,
8337                                                 HCI_MGMT_UNTRUSTED },
8338         { set_powered,             MGMT_SETTING_SIZE },
8339         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8340         { set_connectable,         MGMT_SETTING_SIZE },
8341         { set_fast_connectable,    MGMT_SETTING_SIZE },
8342         { set_bondable,            MGMT_SETTING_SIZE },
8343         { set_link_security,       MGMT_SETTING_SIZE },
8344         { set_ssp,                 MGMT_SETTING_SIZE },
8345         { set_hs,                  MGMT_SETTING_SIZE },
8346         { set_le,                  MGMT_SETTING_SIZE },
8347         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8348         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8349         { add_uuid,                MGMT_ADD_UUID_SIZE },
8350         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8351         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8352                                                 HCI_MGMT_VAR_LEN },
8353         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8354                                                 HCI_MGMT_VAR_LEN },
8355         { disconnect,              MGMT_DISCONNECT_SIZE },
8356         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8357         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8358         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8359         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8360         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8361         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8362         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8363         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8364         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8365         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8366         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8367         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8368         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8369                                                 HCI_MGMT_VAR_LEN },
8370         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8371         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8372         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8373         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8374         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8375         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8376         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8377         { set_advertising,         MGMT_SETTING_SIZE },
8378         { set_bredr,               MGMT_SETTING_SIZE },
8379         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8380         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8381         { set_secure_conn,         MGMT_SETTING_SIZE },
8382         { set_debug_keys,          MGMT_SETTING_SIZE },
8383         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8384         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8385                                                 HCI_MGMT_VAR_LEN },
8386         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8387         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8388         { add_device,              MGMT_ADD_DEVICE_SIZE },
8389         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8390         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8391                                                 HCI_MGMT_VAR_LEN },
8392         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8393                                                 HCI_MGMT_NO_HDEV |
8394                                                 HCI_MGMT_UNTRUSTED },
8395         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8396                                                 HCI_MGMT_UNCONFIGURED |
8397                                                 HCI_MGMT_UNTRUSTED },
8398         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8399                                                 HCI_MGMT_UNCONFIGURED },
8400         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8401                                                 HCI_MGMT_UNCONFIGURED },
8402         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8403                                                 HCI_MGMT_VAR_LEN },
8404         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8405         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8406                                                 HCI_MGMT_NO_HDEV |
8407                                                 HCI_MGMT_UNTRUSTED },
8408         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8409         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8410                                                 HCI_MGMT_VAR_LEN },
8411         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8412         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8413         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8414         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8415                                                 HCI_MGMT_UNTRUSTED },
8416         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8417         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8418         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8419         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8420                                                 HCI_MGMT_VAR_LEN },
8421         { set_wideband_speech,     MGMT_SETTING_SIZE },
8422         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8423                                                 HCI_MGMT_UNTRUSTED },
8424         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8425                                                 HCI_MGMT_UNTRUSTED |
8426                                                 HCI_MGMT_HDEV_OPTIONAL },
8427         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8428                                                 HCI_MGMT_VAR_LEN |
8429                                                 HCI_MGMT_HDEV_OPTIONAL },
8430         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8431                                                 HCI_MGMT_UNTRUSTED },
8432         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8433                                                 HCI_MGMT_VAR_LEN },
8434         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8435                                                 HCI_MGMT_UNTRUSTED },
8436         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8437                                                 HCI_MGMT_VAR_LEN },
8438         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8439         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8440         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8441         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8442                                                 HCI_MGMT_VAR_LEN },
8443         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8444         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8445                                                 HCI_MGMT_VAR_LEN },
8446         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8447                                                 HCI_MGMT_VAR_LEN },
8448         { add_adv_patterns_monitor_rssi,
8449                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8450                                                 HCI_MGMT_VAR_LEN },
8451 };
8452
8453 void mgmt_index_added(struct hci_dev *hdev)
8454 {
8455         struct mgmt_ev_ext_index ev;
8456
8457         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8458                 return;
8459
8460         switch (hdev->dev_type) {
8461         case HCI_PRIMARY:
8462                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8463                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8464                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8465                         ev.type = 0x01;
8466                 } else {
8467                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8468                                          HCI_MGMT_INDEX_EVENTS);
8469                         ev.type = 0x00;
8470                 }
8471                 break;
8472         case HCI_AMP:
8473                 ev.type = 0x02;
8474                 break;
8475         default:
8476                 return;
8477         }
8478
8479         ev.bus = hdev->bus;
8480
8481         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8482                          HCI_MGMT_EXT_INDEX_EVENTS);
8483 }
8484
8485 void mgmt_index_removed(struct hci_dev *hdev)
8486 {
8487         struct mgmt_ev_ext_index ev;
8488         u8 status = MGMT_STATUS_INVALID_INDEX;
8489
8490         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8491                 return;
8492
8493         switch (hdev->dev_type) {
8494         case HCI_PRIMARY:
8495                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8496
8497                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8498                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8499                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8500                         ev.type = 0x01;
8501                 } else {
8502                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8503                                          HCI_MGMT_INDEX_EVENTS);
8504                         ev.type = 0x00;
8505                 }
8506                 break;
8507         case HCI_AMP:
8508                 ev.type = 0x02;
8509                 break;
8510         default:
8511                 return;
8512         }
8513
8514         ev.bus = hdev->bus;
8515
8516         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8517                          HCI_MGMT_EXT_INDEX_EVENTS);
8518 }
8519
8520 /* This function requires the caller holds hdev->lock */
8521 static void restart_le_actions(struct hci_dev *hdev)
8522 {
8523         struct hci_conn_params *p;
8524
8525         list_for_each_entry(p, &hdev->le_conn_params, list) {
8526                 /* Needed for AUTO_OFF case where might not "really"
8527                  * have been powered off.
8528                  */
8529                 list_del_init(&p->action);
8530
8531                 switch (p->auto_connect) {
8532                 case HCI_AUTO_CONN_DIRECT:
8533                 case HCI_AUTO_CONN_ALWAYS:
8534                         list_add(&p->action, &hdev->pend_le_conns);
8535                         break;
8536                 case HCI_AUTO_CONN_REPORT:
8537                         list_add(&p->action, &hdev->pend_le_reports);
8538                         break;
8539                 default:
8540                         break;
8541                 }
8542         }
8543 }
8544
8545 void mgmt_power_on(struct hci_dev *hdev, int err)
8546 {
8547         struct cmd_lookup match = { NULL, hdev };
8548
8549         bt_dev_dbg(hdev, "err %d", err);
8550
8551         hci_dev_lock(hdev);
8552
8553         if (!err) {
8554                 restart_le_actions(hdev);
8555                 hci_update_background_scan(hdev);
8556         }
8557
8558         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8559
8560         new_settings(hdev, match.sk);
8561
8562         if (match.sk)
8563                 sock_put(match.sk);
8564
8565         hci_dev_unlock(hdev);
8566 }
8567
8568 void __mgmt_power_off(struct hci_dev *hdev)
8569 {
8570         struct cmd_lookup match = { NULL, hdev };
8571         u8 status, zero_cod[] = { 0, 0, 0 };
8572
8573         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8574
8575         /* If the power off is because of hdev unregistration let
8576          * use the appropriate INVALID_INDEX status. Otherwise use
8577          * NOT_POWERED. We cover both scenarios here since later in
8578          * mgmt_index_removed() any hci_conn callbacks will have already
8579          * been triggered, potentially causing misleading DISCONNECTED
8580          * status responses.
8581          */
8582         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8583                 status = MGMT_STATUS_INVALID_INDEX;
8584         else
8585                 status = MGMT_STATUS_NOT_POWERED;
8586
8587         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8588
8589         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8590                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8591                                    zero_cod, sizeof(zero_cod),
8592                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8593                 ext_info_changed(hdev, NULL);
8594         }
8595
8596         new_settings(hdev, match.sk);
8597
8598         if (match.sk)
8599                 sock_put(match.sk);
8600 }
8601
8602 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8603 {
8604         struct mgmt_pending_cmd *cmd;
8605         u8 status;
8606
8607         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8608         if (!cmd)
8609                 return;
8610
8611         if (err == -ERFKILL)
8612                 status = MGMT_STATUS_RFKILLED;
8613         else
8614                 status = MGMT_STATUS_FAILED;
8615
8616         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8617
8618         mgmt_pending_remove(cmd);
8619 }
8620
8621 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8622                        bool persistent)
8623 {
8624         struct mgmt_ev_new_link_key ev;
8625
8626         memset(&ev, 0, sizeof(ev));
8627
8628         ev.store_hint = persistent;
8629         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8630         ev.key.addr.type = BDADDR_BREDR;
8631         ev.key.type = key->type;
8632         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8633         ev.key.pin_len = key->pin_len;
8634
8635         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8636 }
8637
8638 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8639 {
8640         switch (ltk->type) {
8641         case SMP_LTK:
8642         case SMP_LTK_SLAVE:
8643                 if (ltk->authenticated)
8644                         return MGMT_LTK_AUTHENTICATED;
8645                 return MGMT_LTK_UNAUTHENTICATED;
8646         case SMP_LTK_P256:
8647                 if (ltk->authenticated)
8648                         return MGMT_LTK_P256_AUTH;
8649                 return MGMT_LTK_P256_UNAUTH;
8650         case SMP_LTK_P256_DEBUG:
8651                 return MGMT_LTK_P256_DEBUG;
8652         }
8653
8654         return MGMT_LTK_UNAUTHENTICATED;
8655 }
8656
8657 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8658 {
8659         struct mgmt_ev_new_long_term_key ev;
8660
8661         memset(&ev, 0, sizeof(ev));
8662
8663         /* Devices using resolvable or non-resolvable random addresses
8664          * without providing an identity resolving key don't require
8665          * to store long term keys. Their addresses will change the
8666          * next time around.
8667          *
8668          * Only when a remote device provides an identity address
8669          * make sure the long term key is stored. If the remote
8670          * identity is known, the long term keys are internally
8671          * mapped to the identity address. So allow static random
8672          * and public addresses here.
8673          */
8674         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8675             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8676                 ev.store_hint = 0x00;
8677         else
8678                 ev.store_hint = persistent;
8679
8680         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8681         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8682         ev.key.type = mgmt_ltk_type(key);
8683         ev.key.enc_size = key->enc_size;
8684         ev.key.ediv = key->ediv;
8685         ev.key.rand = key->rand;
8686
8687         if (key->type == SMP_LTK)
8688                 ev.key.master = 1;
8689
8690         /* Make sure we copy only the significant bytes based on the
8691          * encryption key size, and set the rest of the value to zeroes.
8692          */
8693         memcpy(ev.key.val, key->val, key->enc_size);
8694         memset(ev.key.val + key->enc_size, 0,
8695                sizeof(ev.key.val) - key->enc_size);
8696
8697         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8698 }
8699
8700 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8701 {
8702         struct mgmt_ev_new_irk ev;
8703
8704         memset(&ev, 0, sizeof(ev));
8705
8706         ev.store_hint = persistent;
8707
8708         bacpy(&ev.rpa, &irk->rpa);
8709         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8710         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8711         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8712
8713         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8714 }
8715
8716 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8717                    bool persistent)
8718 {
8719         struct mgmt_ev_new_csrk ev;
8720
8721         memset(&ev, 0, sizeof(ev));
8722
8723         /* Devices using resolvable or non-resolvable random addresses
8724          * without providing an identity resolving key don't require
8725          * to store signature resolving keys. Their addresses will change
8726          * the next time around.
8727          *
8728          * Only when a remote device provides an identity address
8729          * make sure the signature resolving key is stored. So allow
8730          * static random and public addresses here.
8731          */
8732         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8733             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8734                 ev.store_hint = 0x00;
8735         else
8736                 ev.store_hint = persistent;
8737
8738         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8739         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8740         ev.key.type = csrk->type;
8741         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8742
8743         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8744 }
8745
8746 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8747                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8748                          u16 max_interval, u16 latency, u16 timeout)
8749 {
8750         struct mgmt_ev_new_conn_param ev;
8751
8752         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8753                 return;
8754
8755         memset(&ev, 0, sizeof(ev));
8756         bacpy(&ev.addr.bdaddr, bdaddr);
8757         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8758         ev.store_hint = store_hint;
8759         ev.min_interval = cpu_to_le16(min_interval);
8760         ev.max_interval = cpu_to_le16(max_interval);
8761         ev.latency = cpu_to_le16(latency);
8762         ev.timeout = cpu_to_le16(timeout);
8763
8764         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8765 }
8766
8767 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8768                            u32 flags, u8 *name, u8 name_len)
8769 {
8770         char buf[512];
8771         struct mgmt_ev_device_connected *ev = (void *) buf;
8772         u16 eir_len = 0;
8773
8774         bacpy(&ev->addr.bdaddr, &conn->dst);
8775         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8776
8777         ev->flags = __cpu_to_le32(flags);
8778
8779         /* We must ensure that the EIR Data fields are ordered and
8780          * unique. Keep it simple for now and avoid the problem by not
8781          * adding any BR/EDR data to the LE adv.
8782          */
8783         if (conn->le_adv_data_len > 0) {
8784                 memcpy(&ev->eir[eir_len],
8785                        conn->le_adv_data, conn->le_adv_data_len);
8786                 eir_len = conn->le_adv_data_len;
8787         } else {
8788                 if (name_len > 0)
8789                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8790                                                   name, name_len);
8791
8792                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8793                         eir_len = eir_append_data(ev->eir, eir_len,
8794                                                   EIR_CLASS_OF_DEV,
8795                                                   conn->dev_class, 3);
8796         }
8797
8798         ev->eir_len = cpu_to_le16(eir_len);
8799
8800         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8801                     sizeof(*ev) + eir_len, NULL);
8802 }
8803
8804 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8805 {
8806         struct sock **sk = data;
8807
8808         cmd->cmd_complete(cmd, 0);
8809
8810         *sk = cmd->sk;
8811         sock_hold(*sk);
8812
8813         mgmt_pending_remove(cmd);
8814 }
8815
8816 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8817 {
8818         struct hci_dev *hdev = data;
8819         struct mgmt_cp_unpair_device *cp = cmd->param;
8820
8821         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8822
8823         cmd->cmd_complete(cmd, 0);
8824         mgmt_pending_remove(cmd);
8825 }
8826
8827 bool mgmt_powering_down(struct hci_dev *hdev)
8828 {
8829         struct mgmt_pending_cmd *cmd;
8830         struct mgmt_mode *cp;
8831
8832         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8833         if (!cmd)
8834                 return false;
8835
8836         cp = cmd->param;
8837         if (!cp->val)
8838                 return true;
8839
8840         return false;
8841 }
8842
8843 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8844                               u8 link_type, u8 addr_type, u8 reason,
8845                               bool mgmt_connected)
8846 {
8847         struct mgmt_ev_device_disconnected ev;
8848         struct sock *sk = NULL;
8849
8850         /* The connection is still in hci_conn_hash so test for 1
8851          * instead of 0 to know if this is the last one.
8852          */
8853         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8854                 cancel_delayed_work(&hdev->power_off);
8855                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8856         }
8857
8858         if (!mgmt_connected)
8859                 return;
8860
8861         if (link_type != ACL_LINK && link_type != LE_LINK)
8862                 return;
8863
8864         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8865
8866         bacpy(&ev.addr.bdaddr, bdaddr);
8867         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8868         ev.reason = reason;
8869
8870         /* Report disconnects due to suspend */
8871         if (hdev->suspended)
8872                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8873
8874         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8875
8876         if (sk)
8877                 sock_put(sk);
8878
8879         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8880                              hdev);
8881 }
8882
8883 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8884                             u8 link_type, u8 addr_type, u8 status)
8885 {
8886         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8887         struct mgmt_cp_disconnect *cp;
8888         struct mgmt_pending_cmd *cmd;
8889
8890         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8891                              hdev);
8892
8893         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8894         if (!cmd)
8895                 return;
8896
8897         cp = cmd->param;
8898
8899         if (bacmp(bdaddr, &cp->addr.bdaddr))
8900                 return;
8901
8902         if (cp->addr.type != bdaddr_type)
8903                 return;
8904
8905         cmd->cmd_complete(cmd, mgmt_status(status));
8906         mgmt_pending_remove(cmd);
8907 }
8908
8909 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8910                          u8 addr_type, u8 status)
8911 {
8912         struct mgmt_ev_connect_failed ev;
8913
8914         /* The connection is still in hci_conn_hash so test for 1
8915          * instead of 0 to know if this is the last one.
8916          */
8917         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8918                 cancel_delayed_work(&hdev->power_off);
8919                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8920         }
8921
8922         bacpy(&ev.addr.bdaddr, bdaddr);
8923         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8924         ev.status = mgmt_status(status);
8925
8926         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8927 }
8928
8929 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8930 {
8931         struct mgmt_ev_pin_code_request ev;
8932
8933         bacpy(&ev.addr.bdaddr, bdaddr);
8934         ev.addr.type = BDADDR_BREDR;
8935         ev.secure = secure;
8936
8937         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8938 }
8939
8940 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8941                                   u8 status)
8942 {
8943         struct mgmt_pending_cmd *cmd;
8944
8945         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8946         if (!cmd)
8947                 return;
8948
8949         cmd->cmd_complete(cmd, mgmt_status(status));
8950         mgmt_pending_remove(cmd);
8951 }
8952
8953 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8954                                       u8 status)
8955 {
8956         struct mgmt_pending_cmd *cmd;
8957
8958         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8959         if (!cmd)
8960                 return;
8961
8962         cmd->cmd_complete(cmd, mgmt_status(status));
8963         mgmt_pending_remove(cmd);
8964 }
8965
8966 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8967                               u8 link_type, u8 addr_type, u32 value,
8968                               u8 confirm_hint)
8969 {
8970         struct mgmt_ev_user_confirm_request ev;
8971
8972         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8973
8974         bacpy(&ev.addr.bdaddr, bdaddr);
8975         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8976         ev.confirm_hint = confirm_hint;
8977         ev.value = cpu_to_le32(value);
8978
8979         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8980                           NULL);
8981 }
8982
8983 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8984                               u8 link_type, u8 addr_type)
8985 {
8986         struct mgmt_ev_user_passkey_request ev;
8987
8988         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8989
8990         bacpy(&ev.addr.bdaddr, bdaddr);
8991         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8992
8993         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8994                           NULL);
8995 }
8996
8997 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8998                                       u8 link_type, u8 addr_type, u8 status,
8999                                       u8 opcode)
9000 {
9001         struct mgmt_pending_cmd *cmd;
9002
9003         cmd = pending_find(opcode, hdev);
9004         if (!cmd)
9005                 return -ENOENT;
9006
9007         cmd->cmd_complete(cmd, mgmt_status(status));
9008         mgmt_pending_remove(cmd);
9009
9010         return 0;
9011 }
9012
9013 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9014                                      u8 link_type, u8 addr_type, u8 status)
9015 {
9016         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9017                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9018 }
9019
9020 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9021                                          u8 link_type, u8 addr_type, u8 status)
9022 {
9023         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9024                                           status,
9025                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9026 }
9027
9028 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9029                                      u8 link_type, u8 addr_type, u8 status)
9030 {
9031         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9032                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9033 }
9034
9035 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9036                                          u8 link_type, u8 addr_type, u8 status)
9037 {
9038         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9039                                           status,
9040                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9041 }
9042
9043 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9044                              u8 link_type, u8 addr_type, u32 passkey,
9045                              u8 entered)
9046 {
9047         struct mgmt_ev_passkey_notify ev;
9048
9049         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9050
9051         bacpy(&ev.addr.bdaddr, bdaddr);
9052         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9053         ev.passkey = __cpu_to_le32(passkey);
9054         ev.entered = entered;
9055
9056         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9057 }
9058
9059 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9060 {
9061         struct mgmt_ev_auth_failed ev;
9062         struct mgmt_pending_cmd *cmd;
9063         u8 status = mgmt_status(hci_status);
9064
9065         bacpy(&ev.addr.bdaddr, &conn->dst);
9066         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9067         ev.status = status;
9068
9069         cmd = find_pairing(conn);
9070
9071         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9072                     cmd ? cmd->sk : NULL);
9073
9074         if (cmd) {
9075                 cmd->cmd_complete(cmd, status);
9076                 mgmt_pending_remove(cmd);
9077         }
9078 }
9079
9080 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9081 {
9082         struct cmd_lookup match = { NULL, hdev };
9083         bool changed;
9084
9085         if (status) {
9086                 u8 mgmt_err = mgmt_status(status);
9087                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9088                                      cmd_status_rsp, &mgmt_err);
9089                 return;
9090         }
9091
9092         if (test_bit(HCI_AUTH, &hdev->flags))
9093                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9094         else
9095                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9096
9097         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9098                              &match);
9099
9100         if (changed)
9101                 new_settings(hdev, match.sk);
9102
9103         if (match.sk)
9104                 sock_put(match.sk);
9105 }
9106
9107 static void clear_eir(struct hci_request *req)
9108 {
9109         struct hci_dev *hdev = req->hdev;
9110         struct hci_cp_write_eir cp;
9111
9112         if (!lmp_ext_inq_capable(hdev))
9113                 return;
9114
9115         memset(hdev->eir, 0, sizeof(hdev->eir));
9116
9117         memset(&cp, 0, sizeof(cp));
9118
9119         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9120 }
9121
9122 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9123 {
9124         struct cmd_lookup match = { NULL, hdev };
9125         struct hci_request req;
9126         bool changed = false;
9127
9128         if (status) {
9129                 u8 mgmt_err = mgmt_status(status);
9130
9131                 if (enable && hci_dev_test_and_clear_flag(hdev,
9132                                                           HCI_SSP_ENABLED)) {
9133                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9134                         new_settings(hdev, NULL);
9135                 }
9136
9137                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9138                                      &mgmt_err);
9139                 return;
9140         }
9141
9142         if (enable) {
9143                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
9144         } else {
9145                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9146                 if (!changed)
9147                         changed = hci_dev_test_and_clear_flag(hdev,
9148                                                               HCI_HS_ENABLED);
9149                 else
9150                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9151         }
9152
9153         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9154
9155         if (changed)
9156                 new_settings(hdev, match.sk);
9157
9158         if (match.sk)
9159                 sock_put(match.sk);
9160
9161         hci_req_init(&req, hdev);
9162
9163         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9164                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
9165                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9166                                     sizeof(enable), &enable);
9167                 __hci_req_update_eir(&req);
9168         } else {
9169                 clear_eir(&req);
9170         }
9171
9172         hci_req_run(&req, NULL);
9173 }
9174
9175 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9176 {
9177         struct cmd_lookup *match = data;
9178
9179         if (match->sk == NULL) {
9180                 match->sk = cmd->sk;
9181                 sock_hold(match->sk);
9182         }
9183 }
9184
9185 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9186                                     u8 status)
9187 {
9188         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9189
9190         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9191         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9192         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9193
9194         if (!status) {
9195                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9196                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9197                 ext_info_changed(hdev, NULL);
9198         }
9199
9200         if (match.sk)
9201                 sock_put(match.sk);
9202 }
9203
9204 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9205 {
9206         struct mgmt_cp_set_local_name ev;
9207         struct mgmt_pending_cmd *cmd;
9208
9209         if (status)
9210                 return;
9211
9212         memset(&ev, 0, sizeof(ev));
9213         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9214         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9215
9216         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9217         if (!cmd) {
9218                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9219
9220                 /* If this is a HCI command related to powering on the
9221                  * HCI dev don't send any mgmt signals.
9222                  */
9223                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9224                         return;
9225         }
9226
9227         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9228                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9229         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9230 }
9231
9232 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9233 {
9234         int i;
9235
9236         for (i = 0; i < uuid_count; i++) {
9237                 if (!memcmp(uuid, uuids[i], 16))
9238                         return true;
9239         }
9240
9241         return false;
9242 }
9243
9244 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9245 {
9246         u16 parsed = 0;
9247
9248         while (parsed < eir_len) {
9249                 u8 field_len = eir[0];
9250                 u8 uuid[16];
9251                 int i;
9252
9253                 if (field_len == 0)
9254                         break;
9255
9256                 if (eir_len - parsed < field_len + 1)
9257                         break;
9258
9259                 switch (eir[1]) {
9260                 case EIR_UUID16_ALL:
9261                 case EIR_UUID16_SOME:
9262                         for (i = 0; i + 3 <= field_len; i += 2) {
9263                                 memcpy(uuid, bluetooth_base_uuid, 16);
9264                                 uuid[13] = eir[i + 3];
9265                                 uuid[12] = eir[i + 2];
9266                                 if (has_uuid(uuid, uuid_count, uuids))
9267                                         return true;
9268                         }
9269                         break;
9270                 case EIR_UUID32_ALL:
9271                 case EIR_UUID32_SOME:
9272                         for (i = 0; i + 5 <= field_len; i += 4) {
9273                                 memcpy(uuid, bluetooth_base_uuid, 16);
9274                                 uuid[15] = eir[i + 5];
9275                                 uuid[14] = eir[i + 4];
9276                                 uuid[13] = eir[i + 3];
9277                                 uuid[12] = eir[i + 2];
9278                                 if (has_uuid(uuid, uuid_count, uuids))
9279                                         return true;
9280                         }
9281                         break;
9282                 case EIR_UUID128_ALL:
9283                 case EIR_UUID128_SOME:
9284                         for (i = 0; i + 17 <= field_len; i += 16) {
9285                                 memcpy(uuid, eir + i + 2, 16);
9286                                 if (has_uuid(uuid, uuid_count, uuids))
9287                                         return true;
9288                         }
9289                         break;
9290                 }
9291
9292                 parsed += field_len + 1;
9293                 eir += field_len + 1;
9294         }
9295
9296         return false;
9297 }
9298
9299 static void restart_le_scan(struct hci_dev *hdev)
9300 {
9301         /* If controller is not scanning we are done. */
9302         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9303                 return;
9304
9305         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9306                        hdev->discovery.scan_start +
9307                        hdev->discovery.scan_duration))
9308                 return;
9309
9310         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9311                            DISCOV_LE_RESTART_DELAY);
9312 }
9313
9314 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9315                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9316 {
9317         /* If a RSSI threshold has been specified, and
9318          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9319          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9320          * is set, let it through for further processing, as we might need to
9321          * restart the scan.
9322          *
9323          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9324          * the results are also dropped.
9325          */
9326         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9327             (rssi == HCI_RSSI_INVALID ||
9328             (rssi < hdev->discovery.rssi &&
9329              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9330                 return  false;
9331
9332         if (hdev->discovery.uuid_count != 0) {
9333                 /* If a list of UUIDs is provided in filter, results with no
9334                  * matching UUID should be dropped.
9335                  */
9336                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9337                                    hdev->discovery.uuids) &&
9338                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9339                                    hdev->discovery.uuid_count,
9340                                    hdev->discovery.uuids))
9341                         return false;
9342         }
9343
9344         /* If duplicate filtering does not report RSSI changes, then restart
9345          * scanning to ensure updated result with updated RSSI values.
9346          */
9347         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9348                 restart_le_scan(hdev);
9349
9350                 /* Validate RSSI value against the RSSI threshold once more. */
9351                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9352                     rssi < hdev->discovery.rssi)
9353                         return false;
9354         }
9355
9356         return true;
9357 }
9358
9359 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9360                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9361                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9362 {
9363         char buf[512];
9364         struct mgmt_ev_device_found *ev = (void *)buf;
9365         size_t ev_size;
9366
9367         /* Don't send events for a non-kernel initiated discovery. With
9368          * LE one exception is if we have pend_le_reports > 0 in which
9369          * case we're doing passive scanning and want these events.
9370          */
9371         if (!hci_discovery_active(hdev)) {
9372                 if (link_type == ACL_LINK)
9373                         return;
9374                 if (link_type == LE_LINK &&
9375                     list_empty(&hdev->pend_le_reports) &&
9376                     !hci_is_adv_monitoring(hdev)) {
9377                         return;
9378                 }
9379         }
9380
9381         if (hdev->discovery.result_filtering) {
9382                 /* We are using service discovery */
9383                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9384                                      scan_rsp_len))
9385                         return;
9386         }
9387
9388         if (hdev->discovery.limited) {
9389                 /* Check for limited discoverable bit */
9390                 if (dev_class) {
9391                         if (!(dev_class[1] & 0x20))
9392                                 return;
9393                 } else {
9394                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9395                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9396                                 return;
9397                 }
9398         }
9399
9400         /* Make sure that the buffer is big enough. The 5 extra bytes
9401          * are for the potential CoD field.
9402          */
9403         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9404                 return;
9405
9406         memset(buf, 0, sizeof(buf));
9407
9408         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9409          * RSSI value was reported as 0 when not available. This behavior
9410          * is kept when using device discovery. This is required for full
9411          * backwards compatibility with the API.
9412          *
9413          * However when using service discovery, the value 127 will be
9414          * returned when the RSSI is not available.
9415          */
9416         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9417             link_type == ACL_LINK)
9418                 rssi = 0;
9419
9420         bacpy(&ev->addr.bdaddr, bdaddr);
9421         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9422         ev->rssi = rssi;
9423         ev->flags = cpu_to_le32(flags);
9424
9425         if (eir_len > 0)
9426                 /* Copy EIR or advertising data into event */
9427                 memcpy(ev->eir, eir, eir_len);
9428
9429         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9430                                        NULL))
9431                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9432                                           dev_class, 3);
9433
9434         if (scan_rsp_len > 0)
9435                 /* Append scan response data to event */
9436                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9437
9438         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9439         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9440
9441         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9442 }
9443
9444 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9445                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9446 {
9447         struct mgmt_ev_device_found *ev;
9448         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9449         u16 eir_len;
9450
9451         ev = (struct mgmt_ev_device_found *) buf;
9452
9453         memset(buf, 0, sizeof(buf));
9454
9455         bacpy(&ev->addr.bdaddr, bdaddr);
9456         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9457         ev->rssi = rssi;
9458
9459         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9460                                   name_len);
9461
9462         ev->eir_len = cpu_to_le16(eir_len);
9463
9464         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9465 }
9466
9467 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9468 {
9469         struct mgmt_ev_discovering ev;
9470
9471         bt_dev_dbg(hdev, "discovering %u", discovering);
9472
9473         memset(&ev, 0, sizeof(ev));
9474         ev.type = hdev->discovery.type;
9475         ev.discovering = discovering;
9476
9477         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9478 }
9479
9480 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9481 {
9482         struct mgmt_ev_controller_suspend ev;
9483
9484         ev.suspend_state = state;
9485         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9486 }
9487
9488 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9489                    u8 addr_type)
9490 {
9491         struct mgmt_ev_controller_resume ev;
9492
9493         ev.wake_reason = reason;
9494         if (bdaddr) {
9495                 bacpy(&ev.addr.bdaddr, bdaddr);
9496                 ev.addr.type = addr_type;
9497         } else {
9498                 memset(&ev.addr, 0, sizeof(ev.addr));
9499         }
9500
9501         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9502 }
9503
9504 static struct hci_mgmt_chan chan = {
9505         .channel        = HCI_CHANNEL_CONTROL,
9506         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9507         .handlers       = mgmt_handlers,
9508         .hdev_init      = mgmt_init_hdev,
9509 };
9510
9511 int mgmt_init(void)
9512 {
9513         return hci_mgmt_chan_register(&chan);
9514 }
9515
9516 void mgmt_exit(void)
9517 {
9518         hci_mgmt_chan_unregister(&chan);
9519 }