net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   20
  44
  45 static const u16 mgmt_commands[] = {
  46         MGMT_OP_READ_INDEX_LIST,
  47         MGMT_OP_READ_INFO,
  48         MGMT_OP_SET_POWERED,
  49         MGMT_OP_SET_DISCOVERABLE,
  50         MGMT_OP_SET_CONNECTABLE,
  51         MGMT_OP_SET_FAST_CONNECTABLE,
  52         MGMT_OP_SET_BONDABLE,
  53         MGMT_OP_SET_LINK_SECURITY,
  54         MGMT_OP_SET_SSP,
  55         MGMT_OP_SET_HS,
  56         MGMT_OP_SET_LE,
  57         MGMT_OP_SET_DEV_CLASS,
  58         MGMT_OP_SET_LOCAL_NAME,
  59         MGMT_OP_ADD_UUID,
  60         MGMT_OP_REMOVE_UUID,
  61         MGMT_OP_LOAD_LINK_KEYS,
  62         MGMT_OP_LOAD_LONG_TERM_KEYS,
  63         MGMT_OP_DISCONNECT,
  64         MGMT_OP_GET_CONNECTIONS,
  65         MGMT_OP_PIN_CODE_REPLY,
  66         MGMT_OP_PIN_CODE_NEG_REPLY,
  67         MGMT_OP_SET_IO_CAPABILITY,
  68         MGMT_OP_PAIR_DEVICE,
  69         MGMT_OP_CANCEL_PAIR_DEVICE,
  70         MGMT_OP_UNPAIR_DEVICE,
  71         MGMT_OP_USER_CONFIRM_REPLY,
  72         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  73         MGMT_OP_USER_PASSKEY_REPLY,
  74         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  75         MGMT_OP_READ_LOCAL_OOB_DATA,
  76         MGMT_OP_ADD_REMOTE_OOB_DATA,
  77         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  78         MGMT_OP_START_DISCOVERY,
  79         MGMT_OP_STOP_DISCOVERY,
  80         MGMT_OP_CONFIRM_NAME,
  81         MGMT_OP_BLOCK_DEVICE,
  82         MGMT_OP_UNBLOCK_DEVICE,
  83         MGMT_OP_SET_DEVICE_ID,
  84         MGMT_OP_SET_ADVERTISING,
  85         MGMT_OP_SET_BREDR,
  86         MGMT_OP_SET_STATIC_ADDRESS,
  87         MGMT_OP_SET_SCAN_PARAMS,
  88         MGMT_OP_SET_SECURE_CONN,
  89         MGMT_OP_SET_DEBUG_KEYS,
  90         MGMT_OP_SET_PRIVACY,
  91         MGMT_OP_LOAD_IRKS,
  92         MGMT_OP_GET_CONN_INFO,
  93         MGMT_OP_GET_CLOCK_INFO,
  94         MGMT_OP_ADD_DEVICE,
  95         MGMT_OP_REMOVE_DEVICE,
  96         MGMT_OP_LOAD_CONN_PARAM,
  97         MGMT_OP_READ_UNCONF_INDEX_LIST,
  98         MGMT_OP_READ_CONFIG_INFO,
  99         MGMT_OP_SET_EXTERNAL_CONFIG,
 100         MGMT_OP_SET_PUBLIC_ADDRESS,
 101         MGMT_OP_START_SERVICE_DISCOVERY,
 102         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 103         MGMT_OP_READ_EXT_INDEX_LIST,
 104         MGMT_OP_READ_ADV_FEATURES,
 105         MGMT_OP_ADD_ADVERTISING,
 106         MGMT_OP_REMOVE_ADVERTISING,
 107         MGMT_OP_GET_ADV_SIZE_INFO,
 108         MGMT_OP_START_LIMITED_DISCOVERY,
 109         MGMT_OP_READ_EXT_INFO,
 110         MGMT_OP_SET_APPEARANCE,
 111         MGMT_OP_GET_PHY_CONFIGURATION,
 112         MGMT_OP_SET_PHY_CONFIGURATION,
 113         MGMT_OP_SET_BLOCKED_KEYS,
 114         MGMT_OP_SET_WIDEBAND_SPEECH,
 115         MGMT_OP_READ_CONTROLLER_CAP,
 116         MGMT_OP_READ_EXP_FEATURES_INFO,
 117         MGMT_OP_SET_EXP_FEATURE,
 118         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 119         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 121         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_GET_DEVICE_FLAGS,
 123         MGMT_OP_SET_DEVICE_FLAGS,
 124         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 125         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 126         MGMT_OP_REMOVE_ADV_MONITOR,
 127         MGMT_OP_ADD_EXT_ADV_PARAMS,
 128         MGMT_OP_ADD_EXT_ADV_DATA,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 130 };
 131
 132 static const u16 mgmt_events[] = {
 133         MGMT_EV_CONTROLLER_ERROR,
 134         MGMT_EV_INDEX_ADDED,
 135         MGMT_EV_INDEX_REMOVED,
 136         MGMT_EV_NEW_SETTINGS,
 137         MGMT_EV_CLASS_OF_DEV_CHANGED,
 138         MGMT_EV_LOCAL_NAME_CHANGED,
 139         MGMT_EV_NEW_LINK_KEY,
 140         MGMT_EV_NEW_LONG_TERM_KEY,
 141         MGMT_EV_DEVICE_CONNECTED,
 142         MGMT_EV_DEVICE_DISCONNECTED,
 143         MGMT_EV_CONNECT_FAILED,
 144         MGMT_EV_PIN_CODE_REQUEST,
 145         MGMT_EV_USER_CONFIRM_REQUEST,
 146         MGMT_EV_USER_PASSKEY_REQUEST,
 147         MGMT_EV_AUTH_FAILED,
 148         MGMT_EV_DEVICE_FOUND,
 149         MGMT_EV_DISCOVERING,
 150         MGMT_EV_DEVICE_BLOCKED,
 151         MGMT_EV_DEVICE_UNBLOCKED,
 152         MGMT_EV_DEVICE_UNPAIRED,
 153         MGMT_EV_PASSKEY_NOTIFY,
 154         MGMT_EV_NEW_IRK,
 155         MGMT_EV_NEW_CSRK,
 156         MGMT_EV_DEVICE_ADDED,
 157         MGMT_EV_DEVICE_REMOVED,
 158         MGMT_EV_NEW_CONN_PARAM,
 159         MGMT_EV_UNCONF_INDEX_ADDED,
 160         MGMT_EV_UNCONF_INDEX_REMOVED,
 161         MGMT_EV_NEW_CONFIG_OPTIONS,
 162         MGMT_EV_EXT_INDEX_ADDED,
 163         MGMT_EV_EXT_INDEX_REMOVED,
 164         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 165         MGMT_EV_ADVERTISING_ADDED,
 166         MGMT_EV_ADVERTISING_REMOVED,
 167         MGMT_EV_EXT_INFO_CHANGED,
 168         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 169         MGMT_EV_EXP_FEATURE_CHANGED,
 170         MGMT_EV_DEVICE_FLAGS_CHANGED,
 171         MGMT_EV_ADV_MONITOR_ADDED,
 172         MGMT_EV_ADV_MONITOR_REMOVED,
 173         MGMT_EV_CONTROLLER_SUSPEND,
 174         MGMT_EV_CONTROLLER_RESUME,
 175 };
 176
 177 static const u16 mgmt_untrusted_commands[] = {
 178         MGMT_OP_READ_INDEX_LIST,
 179         MGMT_OP_READ_INFO,
 180         MGMT_OP_READ_UNCONF_INDEX_LIST,
 181         MGMT_OP_READ_CONFIG_INFO,
 182         MGMT_OP_READ_EXT_INDEX_LIST,
 183         MGMT_OP_READ_EXT_INFO,
 184         MGMT_OP_READ_CONTROLLER_CAP,
 185         MGMT_OP_READ_EXP_FEATURES_INFO,
 186         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 187         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 188 };
 189
 190 static const u16 mgmt_untrusted_events[] = {
 191         MGMT_EV_INDEX_ADDED,
 192         MGMT_EV_INDEX_REMOVED,
 193         MGMT_EV_NEW_SETTINGS,
 194         MGMT_EV_CLASS_OF_DEV_CHANGED,
 195         MGMT_EV_LOCAL_NAME_CHANGED,
 196         MGMT_EV_UNCONF_INDEX_ADDED,
 197         MGMT_EV_UNCONF_INDEX_REMOVED,
 198         MGMT_EV_NEW_CONFIG_OPTIONS,
 199         MGMT_EV_EXT_INDEX_ADDED,
 200         MGMT_EV_EXT_INDEX_REMOVED,
 201         MGMT_EV_EXT_INFO_CHANGED,
 202         MGMT_EV_EXP_FEATURE_CHANGED,
 203 };
 204
 205 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 206
 207 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 208                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 209
 210 /* HCI to MGMT error code conversion table */
 211 static const u8 mgmt_status_table[] = {
 212         MGMT_STATUS_SUCCESS,
 213         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 214         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 215         MGMT_STATUS_FAILED,             /* Hardware Failure */
 216         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 217         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 218         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 219         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 220         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 221         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 222         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 223         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 224         MGMT_STATUS_BUSY,               /* Command Disallowed */
 225         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 226         MGMT_STATUS_REJECTED,           /* Rejected Security */
 227         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 228         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 229         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 230         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 231         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 232         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 233         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 234         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 235         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 236         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 237         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 238         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 239         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 240         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 241         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 243         MGMT_STATUS_FAILED,             /* Unspecified Error */
 244         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 245         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 246         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 247         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 248         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 249         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 250         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 252         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 253         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 254         MGMT_STATUS_FAILED,             /* Transaction Collision */
 255         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 256         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 258         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 260         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 261         MGMT_STATUS_FAILED,             /* Slot Violation */
 262         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 263         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 265         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 266         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 267         MGMT_STATUS_BUSY,               /* Controller Busy */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 269         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 270         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 271         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 272         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 273 };
 274
 275 static u8 mgmt_status(u8 hci_status)
 276 {
 277         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 278                 return mgmt_status_table[hci_status];
 279
 280         return MGMT_STATUS_FAILED;
 281 }
 282
 283 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 284                             u16 len, int flag)
 285 {
 286         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 287                                flag, NULL);
 288 }
 289
 290 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 291                               u16 len, int flag, struct sock *skip_sk)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, skip_sk);
 295 }
 296
 297 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 298                       struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                HCI_SOCK_TRUSTED, skip_sk);
 302 }
 303
 304 static u8 le_addr_type(u8 mgmt_addr_type)
 305 {
 306         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 307                 return ADDR_LE_DEV_PUBLIC;
 308         else
 309                 return ADDR_LE_DEV_RANDOM;
 310 }
 311
 312 void mgmt_fill_version_info(void *ver)
 313 {
 314         struct mgmt_rp_read_version *rp = ver;
 315
 316         rp->version = MGMT_VERSION;
 317         rp->revision = cpu_to_le16(MGMT_REVISION);
 318 }
 319
 320 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 321                         u16 data_len)
 322 {
 323         struct mgmt_rp_read_version rp;
 324
 325         bt_dev_dbg(hdev, "sock %p", sk);
 326
 327         mgmt_fill_version_info(&rp);
 328
 329         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 330                                  &rp, sizeof(rp));
 331 }
 332
 333 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 334                          u16 data_len)
 335 {
 336         struct mgmt_rp_read_commands *rp;
 337         u16 num_commands, num_events;
 338         size_t rp_size;
 339         int i, err;
 340
 341         bt_dev_dbg(hdev, "sock %p", sk);
 342
 343         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 344                 num_commands = ARRAY_SIZE(mgmt_commands);
 345                 num_events = ARRAY_SIZE(mgmt_events);
 346         } else {
 347                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 348                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 349         }
 350
 351         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 352
 353         rp = kmalloc(rp_size, GFP_KERNEL);
 354         if (!rp)
 355                 return -ENOMEM;
 356
 357         rp->num_commands = cpu_to_le16(num_commands);
 358         rp->num_events = cpu_to_le16(num_events);
 359
 360         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 361                 __le16 *opcode = rp->opcodes;
 362
 363                 for (i = 0; i < num_commands; i++, opcode++)
 364                         put_unaligned_le16(mgmt_commands[i], opcode);
 365
 366                 for (i = 0; i < num_events; i++, opcode++)
 367                         put_unaligned_le16(mgmt_events[i], opcode);
 368         } else {
 369                 __le16 *opcode = rp->opcodes;
 370
 371                 for (i = 0; i < num_commands; i++, opcode++)
 372                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 373
 374                 for (i = 0; i < num_events; i++, opcode++)
 375                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 376         }
 377
 378         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 379                                 rp, rp_size);
 380         kfree(rp);
 381
 382         return err;
 383 }
 384
 385 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 386                            u16 data_len)
 387 {
 388         struct mgmt_rp_read_index_list *rp;
 389         struct hci_dev *d;
 390         size_t rp_len;
 391         u16 count;
 392         int err;
 393
 394         bt_dev_dbg(hdev, "sock %p", sk);
 395
 396         read_lock(&hci_dev_list_lock);
 397
 398         count = 0;
 399         list_for_each_entry(d, &hci_dev_list, list) {
 400                 if (d->dev_type == HCI_PRIMARY &&
 401                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 402                         count++;
 403         }
 404
 405         rp_len = sizeof(*rp) + (2 * count);
 406         rp = kmalloc(rp_len, GFP_ATOMIC);
 407         if (!rp) {
 408                 read_unlock(&hci_dev_list_lock);
 409                 return -ENOMEM;
 410         }
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 415                     hci_dev_test_flag(d, HCI_CONFIG) ||
 416                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 417                         continue;
 418
 419                 /* Devices marked as raw-only are neither configured
 420                  * nor unconfigured controllers.
 421                  */
 422                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 423                         continue;
 424
 425                 if (d->dev_type == HCI_PRIMARY &&
 426                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 427                         rp->index[count++] = cpu_to_le16(d->id);
 428                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 429                 }
 430         }
 431
 432         rp->num_controllers = cpu_to_le16(count);
 433         rp_len = sizeof(*rp) + (2 * count);
 434
 435         read_unlock(&hci_dev_list_lock);
 436
 437         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 438                                 0, rp, rp_len);
 439
 440         kfree(rp);
 441
 442         return err;
 443 }
 444
 445 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 446                                   void *data, u16 data_len)
 447 {
 448         struct mgmt_rp_read_unconf_index_list *rp;
 449         struct hci_dev *d;
 450         size_t rp_len;
 451         u16 count;
 452         int err;
 453
 454         bt_dev_dbg(hdev, "sock %p", sk);
 455
 456         read_lock(&hci_dev_list_lock);
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (d->dev_type == HCI_PRIMARY &&
 461                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 462                         count++;
 463         }
 464
 465         rp_len = sizeof(*rp) + (2 * count);
 466         rp = kmalloc(rp_len, GFP_ATOMIC);
 467         if (!rp) {
 468                 read_unlock(&hci_dev_list_lock);
 469                 return -ENOMEM;
 470         }
 471
 472         count = 0;
 473         list_for_each_entry(d, &hci_dev_list, list) {
 474                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 475                     hci_dev_test_flag(d, HCI_CONFIG) ||
 476                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 477                         continue;
 478
 479                 /* Devices marked as raw-only are neither configured
 480                  * nor unconfigured controllers.
 481                  */
 482                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 483                         continue;
 484
 485                 if (d->dev_type == HCI_PRIMARY &&
 486                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 487                         rp->index[count++] = cpu_to_le16(d->id);
 488                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 489                 }
 490         }
 491
 492         rp->num_controllers = cpu_to_le16(count);
 493         rp_len = sizeof(*rp) + (2 * count);
 494
 495         read_unlock(&hci_dev_list_lock);
 496
 497         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 498                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 499
 500         kfree(rp);
 501
 502         return err;
 503 }
 504
 505 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 506                                void *data, u16 data_len)
 507 {
 508         struct mgmt_rp_read_ext_index_list *rp;
 509         struct hci_dev *d;
 510         u16 count;
 511         int err;
 512
 513         bt_dev_dbg(hdev, "sock %p", sk);
 514
 515         read_lock(&hci_dev_list_lock);
 516
 517         count = 0;
 518         list_for_each_entry(d, &hci_dev_list, list) {
 519                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 520                         count++;
 521         }
 522
 523         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 524         if (!rp) {
 525                 read_unlock(&hci_dev_list_lock);
 526                 return -ENOMEM;
 527         }
 528
 529         count = 0;
 530         list_for_each_entry(d, &hci_dev_list, list) {
 531                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 532                     hci_dev_test_flag(d, HCI_CONFIG) ||
 533                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 534                         continue;
 535
 536                 /* Devices marked as raw-only are neither configured
 537                  * nor unconfigured controllers.
 538                  */
 539                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 540                         continue;
 541
 542                 if (d->dev_type == HCI_PRIMARY) {
 543                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 544                                 rp->entry[count].type = 0x01;
 545                         else
 546                                 rp->entry[count].type = 0x00;
 547                 } else if (d->dev_type == HCI_AMP) {
 548                         rp->entry[count].type = 0x02;
 549                 } else {
 550                         continue;
 551                 }
 552
 553                 rp->entry[count].bus = d->bus;
 554                 rp->entry[count++].index = cpu_to_le16(d->id);
 555                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 556         }
 557
 558         rp->num_controllers = cpu_to_le16(count);
 559
 560         read_unlock(&hci_dev_list_lock);
 561
 562         /* If this command is called at least once, then all the
 563          * default index and unconfigured index events are disabled
 564          * and from now on only extended index events are used.
 565          */
 566         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 567         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 568         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 569
 570         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 571                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 572                                 struct_size(rp, entry, count));
 573
 574         kfree(rp);
 575
 576         return err;
 577 }
 578
 579 static bool is_configured(struct hci_dev *hdev)
 580 {
 581         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 582             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 583                 return false;
 584
 585         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 586              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 587             !bacmp(&hdev->public_addr, BDADDR_ANY))
 588                 return false;
 589
 590         return true;
 591 }
 592
 593 static __le32 get_missing_options(struct hci_dev *hdev)
 594 {
 595         u32 options = 0;
 596
 597         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 598             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 599                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 600
 601         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 602              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 603             !bacmp(&hdev->public_addr, BDADDR_ANY))
 604                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 605
 606         return cpu_to_le32(options);
 607 }
 608
 609 static int new_options(struct hci_dev *hdev, struct sock *skip)
 610 {
 611         __le32 options = get_missing_options(hdev);
 612
 613         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 614                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 615 }
 616
 617 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 618 {
 619         __le32 options = get_missing_options(hdev);
 620
 621         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 622                                  sizeof(options));
 623 }
 624
 625 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 626                             void *data, u16 data_len)
 627 {
 628         struct mgmt_rp_read_config_info rp;
 629         u32 options = 0;
 630
 631         bt_dev_dbg(hdev, "sock %p", sk);
 632
 633         hci_dev_lock(hdev);
 634
 635         memset(&rp, 0, sizeof(rp));
 636         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 639                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 640
 641         if (hdev->set_bdaddr)
 642                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 643
 644         rp.supported_options = cpu_to_le32(options);
 645         rp.missing_options = get_missing_options(hdev);
 646
 647         hci_dev_unlock(hdev);
 648
 649         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 650                                  &rp, sizeof(rp));
 651 }
 652
 653 static u32 get_supported_phys(struct hci_dev *hdev)
 654 {
 655         u32 supported_phys = 0;
 656
 657         if (lmp_bredr_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 659
 660                 if (hdev->features[0][0] & LMP_3SLOT)
 661                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 662
 663                 if (hdev->features[0][0] & LMP_5SLOT)
 664                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 665
 666                 if (lmp_edr_2m_capable(hdev)) {
 667                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 668
 669                         if (lmp_edr_3slot_capable(hdev))
 670                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 671
 672                         if (lmp_edr_5slot_capable(hdev))
 673                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 674
 675                         if (lmp_edr_3m_capable(hdev)) {
 676                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 677
 678                                 if (lmp_edr_3slot_capable(hdev))
 679                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 680
 681                                 if (lmp_edr_5slot_capable(hdev))
 682                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 683                         }
 684                 }
 685         }
 686
 687         if (lmp_le_capable(hdev)) {
 688                 supported_phys |= MGMT_PHY_LE_1M_TX;
 689                 supported_phys |= MGMT_PHY_LE_1M_RX;
 690
 691                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 692                         supported_phys |= MGMT_PHY_LE_2M_TX;
 693                         supported_phys |= MGMT_PHY_LE_2M_RX;
 694                 }
 695
 696                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 697                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 698                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 699                 }
 700         }
 701
 702         return supported_phys;
 703 }
 704
 705 static u32 get_selected_phys(struct hci_dev *hdev)
 706 {
 707         u32 selected_phys = 0;
 708
 709         if (lmp_bredr_capable(hdev)) {
 710                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 711
 712                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 713                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 714
 715                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 716                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 717
 718                 if (lmp_edr_2m_capable(hdev)) {
 719                         if (!(hdev->pkt_type & HCI_2DH1))
 720                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 721
 722                         if (lmp_edr_3slot_capable(hdev) &&
 723                             !(hdev->pkt_type & HCI_2DH3))
 724                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 725
 726                         if (lmp_edr_5slot_capable(hdev) &&
 727                             !(hdev->pkt_type & HCI_2DH5))
 728                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 729
 730                         if (lmp_edr_3m_capable(hdev)) {
 731                                 if (!(hdev->pkt_type & HCI_3DH1))
 732                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 733
 734                                 if (lmp_edr_3slot_capable(hdev) &&
 735                                     !(hdev->pkt_type & HCI_3DH3))
 736                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 737
 738                                 if (lmp_edr_5slot_capable(hdev) &&
 739                                     !(hdev->pkt_type & HCI_3DH5))
 740                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 741                         }
 742                 }
 743         }
 744
 745         if (lmp_le_capable(hdev)) {
 746                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 747                         selected_phys |= MGMT_PHY_LE_1M_TX;
 748
 749                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 750                         selected_phys |= MGMT_PHY_LE_1M_RX;
 751
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 753                         selected_phys |= MGMT_PHY_LE_2M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 756                         selected_phys |= MGMT_PHY_LE_2M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 759                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 762                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 763         }
 764
 765         return selected_phys;
 766 }
 767
 768 static u32 get_configurable_phys(struct hci_dev *hdev)
 769 {
 770         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 771                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 772 }
 773
 774 static u32 get_supported_settings(struct hci_dev *hdev)
 775 {
 776         u32 settings = 0;
 777
 778         settings |= MGMT_SETTING_POWERED;
 779         settings |= MGMT_SETTING_BONDABLE;
 780         settings |= MGMT_SETTING_DEBUG_KEYS;
 781         settings |= MGMT_SETTING_CONNECTABLE;
 782         settings |= MGMT_SETTING_DISCOVERABLE;
 783
 784         if (lmp_bredr_capable(hdev)) {
 785                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 786                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 787                 settings |= MGMT_SETTING_BREDR;
 788                 settings |= MGMT_SETTING_LINK_SECURITY;
 789
 790                 if (lmp_ssp_capable(hdev)) {
 791                         settings |= MGMT_SETTING_SSP;
 792                         if (IS_ENABLED(CONFIG_BT_HS))
 793                                 settings |= MGMT_SETTING_HS;
 794                 }
 795
 796                 if (lmp_sc_capable(hdev))
 797                         settings |= MGMT_SETTING_SECURE_CONN;
 798
 799                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 800                              &hdev->quirks))
 801                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 802         }
 803
 804         if (lmp_le_capable(hdev)) {
 805                 settings |= MGMT_SETTING_LE;
 806                 settings |= MGMT_SETTING_SECURE_CONN;
 807                 settings |= MGMT_SETTING_PRIVACY;
 808                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 809
 810                 /* When the experimental feature for LL Privacy support is
 811                  * enabled, then advertising is no longer supported.
 812                  */
 813                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 814                         settings |= MGMT_SETTING_ADVERTISING;
 815         }
 816
 817         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 818             hdev->set_bdaddr)
 819                 settings |= MGMT_SETTING_CONFIGURATION;
 820
 821         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 822
 823         return settings;
 824 }
 825
 826 static u32 get_current_settings(struct hci_dev *hdev)
 827 {
 828         u32 settings = 0;
 829
 830         if (hdev_is_powered(hdev))
 831                 settings |= MGMT_SETTING_POWERED;
 832
 833         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 834                 settings |= MGMT_SETTING_CONNECTABLE;
 835
 836         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 837                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 838
 839         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 840                 settings |= MGMT_SETTING_DISCOVERABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 843                 settings |= MGMT_SETTING_BONDABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 846                 settings |= MGMT_SETTING_BREDR;
 847
 848         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 849                 settings |= MGMT_SETTING_LE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 852                 settings |= MGMT_SETTING_LINK_SECURITY;
 853
 854         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 855                 settings |= MGMT_SETTING_SSP;
 856
 857         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 858                 settings |= MGMT_SETTING_HS;
 859
 860         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 861                 settings |= MGMT_SETTING_ADVERTISING;
 862
 863         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 864                 settings |= MGMT_SETTING_SECURE_CONN;
 865
 866         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 867                 settings |= MGMT_SETTING_DEBUG_KEYS;
 868
 869         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 870                 settings |= MGMT_SETTING_PRIVACY;
 871
 872         /* The current setting for static address has two purposes. The
 873          * first is to indicate if the static address will be used and
 874          * the second is to indicate if it is actually set.
 875          *
 876          * This means if the static address is not configured, this flag
 877          * will never be set. If the address is configured, then if the
 878          * address is actually used decides if the flag is set or not.
 879          *
 880          * For single mode LE only controllers and dual-mode controllers
 881          * with BR/EDR disabled, the existence of the static address will
 882          * be evaluated.
 883          */
 884         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 885             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 886             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 887                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 888                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 889         }
 890
 891         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 892                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 893
 894         return settings;
 895 }
 896
 897 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 898 {
 899         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 900 }
 901
 902 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 903                                                   struct hci_dev *hdev,
 904                                                   const void *data)
 905 {
 906         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 907 }
 908
 909 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 910 {
 911         struct mgmt_pending_cmd *cmd;
 912
 913         /* If there's a pending mgmt command the flags will not yet have
 914          * their final values, so check for this first.
 915          */
 916         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 917         if (cmd) {
 918                 struct mgmt_mode *cp = cmd->param;
 919                 if (cp->val == 0x01)
 920                         return LE_AD_GENERAL;
 921                 else if (cp->val == 0x02)
 922                         return LE_AD_LIMITED;
 923         } else {
 924                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 925                         return LE_AD_LIMITED;
 926                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 927                         return LE_AD_GENERAL;
 928         }
 929
 930         return 0;
 931 }
 932
 933 bool mgmt_get_connectable(struct hci_dev *hdev)
 934 {
 935         struct mgmt_pending_cmd *cmd;
 936
 937         /* If there's a pending mgmt command the flag will not yet have
 938          * it's final value, so check for this first.
 939          */
 940         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 941         if (cmd) {
 942                 struct mgmt_mode *cp = cmd->param;
 943
 944                 return cp->val;
 945         }
 946
 947         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 948 }
 949
 950 static void service_cache_off(struct work_struct *work)
 951 {
 952         struct hci_dev *hdev = container_of(work, struct hci_dev,
 953                                             service_cache.work);
 954         struct hci_request req;
 955
 956         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 957                 return;
 958
 959         hci_req_init(&req, hdev);
 960
 961         hci_dev_lock(hdev);
 962
 963         __hci_req_update_eir(&req);
 964         __hci_req_update_class(&req);
 965
 966         hci_dev_unlock(hdev);
 967
 968         hci_req_run(&req, NULL);
 969 }
 970
 971 static void rpa_expired(struct work_struct *work)
 972 {
 973         struct hci_dev *hdev = container_of(work, struct hci_dev,
 974                                             rpa_expired.work);
 975         struct hci_request req;
 976
 977         bt_dev_dbg(hdev, "");
 978
 979         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 980
 981         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 982                 return;
 983
 984         /* The generation of a new RPA and programming it into the
 985          * controller happens in the hci_req_enable_advertising()
 986          * function.
 987          */
 988         hci_req_init(&req, hdev);
 989         if (ext_adv_capable(hdev))
 990                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 991         else
 992                 __hci_req_enable_advertising(&req);
 993         hci_req_run(&req, NULL);
 994 }
 995
 996 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 997 {
 998         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 999                 return;
1000
1001         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1002         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1003
1004         /* Non-mgmt controlled devices get this bit set
1005          * implicitly so that pairing works for them, however
1006          * for mgmt we require user-space to explicitly enable
1007          * it
1008          */
1009         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1010 }
1011
1012 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1013                                 void *data, u16 data_len)
1014 {
1015         struct mgmt_rp_read_info rp;
1016
1017         bt_dev_dbg(hdev, "sock %p", sk);
1018
1019         hci_dev_lock(hdev);
1020
1021         memset(&rp, 0, sizeof(rp));
1022
1023         bacpy(&rp.bdaddr, &hdev->bdaddr);
1024
1025         rp.version = hdev->hci_ver;
1026         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1027
1028         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1029         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1030
1031         memcpy(rp.dev_class, hdev->dev_class, 3);
1032
1033         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1034         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1035
1036         hci_dev_unlock(hdev);
1037
1038         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1039                                  sizeof(rp));
1040 }
1041
1042 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1043 {
1044         u16 eir_len = 0;
1045         size_t name_len;
1046
1047         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1048                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1049                                           hdev->dev_class, 3);
1050
1051         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1052                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1053                                           hdev->appearance);
1054
1055         name_len = strlen(hdev->dev_name);
1056         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1057                                   hdev->dev_name, name_len);
1058
1059         name_len = strlen(hdev->short_name);
1060         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1061                                   hdev->short_name, name_len);
1062
1063         return eir_len;
1064 }
1065
1066 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1067                                     void *data, u16 data_len)
1068 {
1069         char buf[512];
1070         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1071         u16 eir_len;
1072
1073         bt_dev_dbg(hdev, "sock %p", sk);
1074
1075         memset(&buf, 0, sizeof(buf));
1076
1077         hci_dev_lock(hdev);
1078
1079         bacpy(&rp->bdaddr, &hdev->bdaddr);
1080
1081         rp->version = hdev->hci_ver;
1082         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1083
1084         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1085         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1086
1087
1088         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1089         rp->eir_len = cpu_to_le16(eir_len);
1090
1091         hci_dev_unlock(hdev);
1092
1093         /* If this command is called at least once, then the events
1094          * for class of device and local name changes are disabled
1095          * and only the new extended controller information event
1096          * is used.
1097          */
1098         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1099         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1100         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1101
1102         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1103                                  sizeof(*rp) + eir_len);
1104 }
1105
1106 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1107 {
1108         char buf[512];
1109         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1110         u16 eir_len;
1111
1112         memset(buf, 0, sizeof(buf));
1113
1114         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1115         ev->eir_len = cpu_to_le16(eir_len);
1116
1117         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1118                                   sizeof(*ev) + eir_len,
1119                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1120 }
1121
1122 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1123 {
1124         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1125
1126         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1127                                  sizeof(settings));
1128 }
1129
1130 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1131 {
1132         bt_dev_dbg(hdev, "status 0x%02x", status);
1133
1134         if (hci_conn_count(hdev) == 0) {
1135                 cancel_delayed_work(&hdev->power_off);
1136                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1137         }
1138 }
1139
1140 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1141 {
1142         struct mgmt_ev_advertising_added ev;
1143
1144         ev.instance = instance;
1145
1146         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1147 }
1148
1149 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1150                               u8 instance)
1151 {
1152         struct mgmt_ev_advertising_removed ev;
1153
1154         ev.instance = instance;
1155
1156         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1157 }
1158
1159 static void cancel_adv_timeout(struct hci_dev *hdev)
1160 {
1161         if (hdev->adv_instance_timeout) {
1162                 hdev->adv_instance_timeout = 0;
1163                 cancel_delayed_work(&hdev->adv_instance_expire);
1164         }
1165 }
1166
1167 static int clean_up_hci_state(struct hci_dev *hdev)
1168 {
1169         struct hci_request req;
1170         struct hci_conn *conn;
1171         bool discov_stopped;
1172         int err;
1173
1174         hci_req_init(&req, hdev);
1175
1176         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1177             test_bit(HCI_PSCAN, &hdev->flags)) {
1178                 u8 scan = 0x00;
1179                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1180         }
1181
1182         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1183
1184         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1185                 __hci_req_disable_advertising(&req);
1186
1187         discov_stopped = hci_req_stop_discovery(&req);
1188
1189         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1190                 /* 0x15 == Terminated due to Power Off */
1191                 __hci_abort_conn(&req, conn, 0x15);
1192         }
1193
1194         err = hci_req_run(&req, clean_up_hci_complete);
1195         if (!err && discov_stopped)
1196                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1197
1198         return err;
1199 }
1200
1201 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1202                        u16 len)
1203 {
1204         struct mgmt_mode *cp = data;
1205         struct mgmt_pending_cmd *cmd;
1206         int err;
1207
1208         bt_dev_dbg(hdev, "sock %p", sk);
1209
1210         if (cp->val != 0x00 && cp->val != 0x01)
1211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1212                                        MGMT_STATUS_INVALID_PARAMS);
1213
1214         hci_dev_lock(hdev);
1215
1216         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1217                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                       MGMT_STATUS_BUSY);
1219                 goto failed;
1220         }
1221
1222         if (!!cp->val == hdev_is_powered(hdev)) {
1223                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1224                 goto failed;
1225         }
1226
1227         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1228         if (!cmd) {
1229                 err = -ENOMEM;
1230                 goto failed;
1231         }
1232
1233         if (cp->val) {
1234                 queue_work(hdev->req_workqueue, &hdev->power_on);
1235                 err = 0;
1236         } else {
1237                 /* Disconnect connections, stop scans, etc */
1238                 err = clean_up_hci_state(hdev);
1239                 if (!err)
1240                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1241                                            HCI_POWER_OFF_TIMEOUT);
1242
1243                 /* ENODATA means there were no HCI commands queued */
1244                 if (err == -ENODATA) {
1245                         cancel_delayed_work(&hdev->power_off);
1246                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1247                         err = 0;
1248                 }
1249         }
1250
1251 failed:
1252         hci_dev_unlock(hdev);
1253         return err;
1254 }
1255
1256 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1257 {
1258         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1259
1260         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1261                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1262 }
1263
1264 int mgmt_new_settings(struct hci_dev *hdev)
1265 {
1266         return new_settings(hdev, NULL);
1267 }
1268
1269 struct cmd_lookup {
1270         struct sock *sk;
1271         struct hci_dev *hdev;
1272         u8 mgmt_status;
1273 };
1274
1275 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1276 {
1277         struct cmd_lookup *match = data;
1278
1279         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1280
1281         list_del(&cmd->list);
1282
1283         if (match->sk == NULL) {
1284                 match->sk = cmd->sk;
1285                 sock_hold(match->sk);
1286         }
1287
1288         mgmt_pending_free(cmd);
1289 }
1290
1291 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1292 {
1293         u8 *status = data;
1294
1295         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1296         mgmt_pending_remove(cmd);
1297 }
1298
1299 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1300 {
1301         if (cmd->cmd_complete) {
1302                 u8 *status = data;
1303
1304                 cmd->cmd_complete(cmd, *status);
1305                 mgmt_pending_remove(cmd);
1306
1307                 return;
1308         }
1309
1310         cmd_status_rsp(cmd, data);
1311 }
1312
1313 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1314 {
1315         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1316                                  cmd->param, cmd->param_len);
1317 }
1318
1319 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, sizeof(struct mgmt_addr_info));
1323 }
1324
1325 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1326 {
1327         if (!lmp_bredr_capable(hdev))
1328                 return MGMT_STATUS_NOT_SUPPORTED;
1329         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1330                 return MGMT_STATUS_REJECTED;
1331         else
1332                 return MGMT_STATUS_SUCCESS;
1333 }
1334
1335 static u8 mgmt_le_support(struct hci_dev *hdev)
1336 {
1337         if (!lmp_le_capable(hdev))
1338                 return MGMT_STATUS_NOT_SUPPORTED;
1339         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1340                 return MGMT_STATUS_REJECTED;
1341         else
1342                 return MGMT_STATUS_SUCCESS;
1343 }
1344
1345 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1346 {
1347         struct mgmt_pending_cmd *cmd;
1348
1349         bt_dev_dbg(hdev, "status 0x%02x", status);
1350
1351         hci_dev_lock(hdev);
1352
1353         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1354         if (!cmd)
1355                 goto unlock;
1356
1357         if (status) {
1358                 u8 mgmt_err = mgmt_status(status);
1359                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1360                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1361                 goto remove_cmd;
1362         }
1363
1364         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1365             hdev->discov_timeout > 0) {
1366                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1367                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1368         }
1369
1370         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1371         new_settings(hdev, cmd->sk);
1372
1373 remove_cmd:
1374         mgmt_pending_remove(cmd);
1375
1376 unlock:
1377         hci_dev_unlock(hdev);
1378 }
1379
1380 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1381                             u16 len)
1382 {
1383         struct mgmt_cp_set_discoverable *cp = data;
1384         struct mgmt_pending_cmd *cmd;
1385         u16 timeout;
1386         int err;
1387
1388         bt_dev_dbg(hdev, "sock %p", sk);
1389
1390         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1391             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1393                                        MGMT_STATUS_REJECTED);
1394
1395         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1396                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1397                                        MGMT_STATUS_INVALID_PARAMS);
1398
1399         timeout = __le16_to_cpu(cp->timeout);
1400
1401         /* Disabling discoverable requires that no timeout is set,
1402          * and enabling limited discoverable requires a timeout.
1403          */
1404         if ((cp->val == 0x00 && timeout > 0) ||
1405             (cp->val == 0x02 && timeout == 0))
1406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1407                                        MGMT_STATUS_INVALID_PARAMS);
1408
1409         hci_dev_lock(hdev);
1410
1411         if (!hdev_is_powered(hdev) && timeout > 0) {
1412                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                       MGMT_STATUS_NOT_POWERED);
1414                 goto failed;
1415         }
1416
1417         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1418             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_BUSY);
1421                 goto failed;
1422         }
1423
1424         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_REJECTED);
1427                 goto failed;
1428         }
1429
1430         if (hdev->advertising_paused) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_BUSY);
1433                 goto failed;
1434         }
1435
1436         if (!hdev_is_powered(hdev)) {
1437                 bool changed = false;
1438
1439                 /* Setting limited discoverable when powered off is
1440                  * not a valid operation since it requires a timeout
1441                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1442                  */
1443                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1444                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1445                         changed = true;
1446                 }
1447
1448                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1449                 if (err < 0)
1450                         goto failed;
1451
1452                 if (changed)
1453                         err = new_settings(hdev, sk);
1454
1455                 goto failed;
1456         }
1457
1458         /* If the current mode is the same, then just update the timeout
1459          * value with the new value. And if only the timeout gets updated,
1460          * then no need for any HCI transactions.
1461          */
1462         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1463             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1464                                                    HCI_LIMITED_DISCOVERABLE)) {
1465                 cancel_delayed_work(&hdev->discov_off);
1466                 hdev->discov_timeout = timeout;
1467
1468                 if (cp->val && hdev->discov_timeout > 0) {
1469                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1470                         queue_delayed_work(hdev->req_workqueue,
1471                                            &hdev->discov_off, to);
1472                 }
1473
1474                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1475                 goto failed;
1476         }
1477
1478         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1479         if (!cmd) {
1480                 err = -ENOMEM;
1481                 goto failed;
1482         }
1483
1484         /* Cancel any potential discoverable timeout that might be
1485          * still active and store new timeout value. The arming of
1486          * the timeout happens in the complete handler.
1487          */
1488         cancel_delayed_work(&hdev->discov_off);
1489         hdev->discov_timeout = timeout;
1490
1491         if (cp->val)
1492                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1493         else
1494                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1495
1496         /* Limited discoverable mode */
1497         if (cp->val == 0x02)
1498                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1501
1502         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1503         err = 0;
1504
1505 failed:
1506         hci_dev_unlock(hdev);
1507         return err;
1508 }
1509
1510 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1511 {
1512         struct mgmt_pending_cmd *cmd;
1513
1514         bt_dev_dbg(hdev, "status 0x%02x", status);
1515
1516         hci_dev_lock(hdev);
1517
1518         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1519         if (!cmd)
1520                 goto unlock;
1521
1522         if (status) {
1523                 u8 mgmt_err = mgmt_status(status);
1524                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1525                 goto remove_cmd;
1526         }
1527
1528         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1529         new_settings(hdev, cmd->sk);
1530
1531 remove_cmd:
1532         mgmt_pending_remove(cmd);
1533
1534 unlock:
1535         hci_dev_unlock(hdev);
1536 }
1537
1538 static int set_connectable_update_settings(struct hci_dev *hdev,
1539                                            struct sock *sk, u8 val)
1540 {
1541         bool changed = false;
1542         int err;
1543
1544         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1545                 changed = true;
1546
1547         if (val) {
1548                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1549         } else {
1550                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1551                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1552         }
1553
1554         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1555         if (err < 0)
1556                 return err;
1557
1558         if (changed) {
1559                 hci_req_update_scan(hdev);
1560                 hci_update_background_scan(hdev);
1561                 return new_settings(hdev, sk);
1562         }
1563
1564         return 0;
1565 }
1566
1567 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1568                            u16 len)
1569 {
1570         struct mgmt_mode *cp = data;
1571         struct mgmt_pending_cmd *cmd;
1572         int err;
1573
1574         bt_dev_dbg(hdev, "sock %p", sk);
1575
1576         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1577             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1579                                        MGMT_STATUS_REJECTED);
1580
1581         if (cp->val != 0x00 && cp->val != 0x01)
1582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1583                                        MGMT_STATUS_INVALID_PARAMS);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (!hdev_is_powered(hdev)) {
1588                 err = set_connectable_update_settings(hdev, sk, cp->val);
1589                 goto failed;
1590         }
1591
1592         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1593             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1594                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1595                                       MGMT_STATUS_BUSY);
1596                 goto failed;
1597         }
1598
1599         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1600         if (!cmd) {
1601                 err = -ENOMEM;
1602                 goto failed;
1603         }
1604
1605         if (cp->val) {
1606                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1607         } else {
1608                 if (hdev->discov_timeout > 0)
1609                         cancel_delayed_work(&hdev->discov_off);
1610
1611                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1612                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1613                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1614         }
1615
1616         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1617         err = 0;
1618
1619 failed:
1620         hci_dev_unlock(hdev);
1621         return err;
1622 }
1623
1624 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1625                         u16 len)
1626 {
1627         struct mgmt_mode *cp = data;
1628         bool changed;
1629         int err;
1630
1631         bt_dev_dbg(hdev, "sock %p", sk);
1632
1633         if (cp->val != 0x00 && cp->val != 0x01)
1634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1635                                        MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (cp->val)
1640                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1641         else
1642                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1643
1644         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1645         if (err < 0)
1646                 goto unlock;
1647
1648         if (changed) {
1649                 /* In limited privacy mode the change of bondable mode
1650                  * may affect the local advertising address.
1651                  */
1652                 if (hdev_is_powered(hdev) &&
1653                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1654                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1655                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1656                         queue_work(hdev->req_workqueue,
1657                                    &hdev->discoverable_update);
1658
1659                 err = new_settings(hdev, sk);
1660         }
1661
1662 unlock:
1663         hci_dev_unlock(hdev);
1664         return err;
1665 }
1666
1667 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1668                              u16 len)
1669 {
1670         struct mgmt_mode *cp = data;
1671         struct mgmt_pending_cmd *cmd;
1672         u8 val, status;
1673         int err;
1674
1675         bt_dev_dbg(hdev, "sock %p", sk);
1676
1677         status = mgmt_bredr_support(hdev);
1678         if (status)
1679                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1680                                        status);
1681
1682         if (cp->val != 0x00 && cp->val != 0x01)
1683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1684                                        MGMT_STATUS_INVALID_PARAMS);
1685
1686         hci_dev_lock(hdev);
1687
1688         if (!hdev_is_powered(hdev)) {
1689                 bool changed = false;
1690
1691                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1692                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1693                         changed = true;
1694                 }
1695
1696                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1697                 if (err < 0)
1698                         goto failed;
1699
1700                 if (changed)
1701                         err = new_settings(hdev, sk);
1702
1703                 goto failed;
1704         }
1705
1706         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1708                                       MGMT_STATUS_BUSY);
1709                 goto failed;
1710         }
1711
1712         val = !!cp->val;
1713
1714         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1715                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1716                 goto failed;
1717         }
1718
1719         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1720         if (!cmd) {
1721                 err = -ENOMEM;
1722                 goto failed;
1723         }
1724
1725         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1726         if (err < 0) {
1727                 mgmt_pending_remove(cmd);
1728                 goto failed;
1729         }
1730
1731 failed:
1732         hci_dev_unlock(hdev);
1733         return err;
1734 }
1735
1736 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738         struct mgmt_mode *cp = data;
1739         struct mgmt_pending_cmd *cmd;
1740         u8 status;
1741         int err;
1742
1743         bt_dev_dbg(hdev, "sock %p", sk);
1744
1745         status = mgmt_bredr_support(hdev);
1746         if (status)
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1748
1749         if (!lmp_ssp_capable(hdev))
1750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1751                                        MGMT_STATUS_NOT_SUPPORTED);
1752
1753         if (cp->val != 0x00 && cp->val != 0x01)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1755                                        MGMT_STATUS_INVALID_PARAMS);
1756
1757         hci_dev_lock(hdev);
1758
1759         if (!hdev_is_powered(hdev)) {
1760                 bool changed;
1761
1762                 if (cp->val) {
1763                         changed = !hci_dev_test_and_set_flag(hdev,
1764                                                              HCI_SSP_ENABLED);
1765                 } else {
1766                         changed = hci_dev_test_and_clear_flag(hdev,
1767                                                               HCI_SSP_ENABLED);
1768                         if (!changed)
1769                                 changed = hci_dev_test_and_clear_flag(hdev,
1770                                                                       HCI_HS_ENABLED);
1771                         else
1772                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1773                 }
1774
1775                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1776                 if (err < 0)
1777                         goto failed;
1778
1779                 if (changed)
1780                         err = new_settings(hdev, sk);
1781
1782                 goto failed;
1783         }
1784
1785         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1787                                       MGMT_STATUS_BUSY);
1788                 goto failed;
1789         }
1790
1791         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1792                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1793                 goto failed;
1794         }
1795
1796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1797         if (!cmd) {
1798                 err = -ENOMEM;
1799                 goto failed;
1800         }
1801
1802         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1803                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1804                              sizeof(cp->val), &cp->val);
1805
1806         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1807         if (err < 0) {
1808                 mgmt_pending_remove(cmd);
1809                 goto failed;
1810         }
1811
1812 failed:
1813         hci_dev_unlock(hdev);
1814         return err;
1815 }
1816
1817 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1818 {
1819         struct mgmt_mode *cp = data;
1820         bool changed;
1821         u8 status;
1822         int err;
1823
1824         bt_dev_dbg(hdev, "sock %p", sk);
1825
1826         if (!IS_ENABLED(CONFIG_BT_HS))
1827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1828                                        MGMT_STATUS_NOT_SUPPORTED);
1829
1830         status = mgmt_bredr_support(hdev);
1831         if (status)
1832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1833
1834         if (!lmp_ssp_capable(hdev))
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1836                                        MGMT_STATUS_NOT_SUPPORTED);
1837
1838         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1840                                        MGMT_STATUS_REJECTED);
1841
1842         if (cp->val != 0x00 && cp->val != 0x01)
1843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1844                                        MGMT_STATUS_INVALID_PARAMS);
1845
1846         hci_dev_lock(hdev);
1847
1848         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1849                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                       MGMT_STATUS_BUSY);
1851                 goto unlock;
1852         }
1853
1854         if (cp->val) {
1855                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1856         } else {
1857                 if (hdev_is_powered(hdev)) {
1858                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1859                                               MGMT_STATUS_REJECTED);
1860                         goto unlock;
1861                 }
1862
1863                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1864         }
1865
1866         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1867         if (err < 0)
1868                 goto unlock;
1869
1870         if (changed)
1871                 err = new_settings(hdev, sk);
1872
1873 unlock:
1874         hci_dev_unlock(hdev);
1875         return err;
1876 }
1877
1878 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1879 {
1880         struct cmd_lookup match = { NULL, hdev };
1881
1882         hci_dev_lock(hdev);
1883
1884         if (status) {
1885                 u8 mgmt_err = mgmt_status(status);
1886
1887                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1888                                      &mgmt_err);
1889                 goto unlock;
1890         }
1891
1892         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1893
1894         new_settings(hdev, match.sk);
1895
1896         if (match.sk)
1897                 sock_put(match.sk);
1898
1899         /* Make sure the controller has a good default for
1900          * advertising data. Restrict the update to when LE
1901          * has actually been enabled. During power on, the
1902          * update in powered_update_hci will take care of it.
1903          */
1904         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1905                 struct hci_request req;
1906                 hci_req_init(&req, hdev);
1907                 if (ext_adv_capable(hdev)) {
1908                         int err;
1909
1910                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1911                         if (!err)
1912                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1913                 } else {
1914                         __hci_req_update_adv_data(&req, 0x00);
1915                         __hci_req_update_scan_rsp_data(&req, 0x00);
1916                 }
1917                 hci_req_run(&req, NULL);
1918                 hci_update_background_scan(hdev);
1919         }
1920
1921 unlock:
1922         hci_dev_unlock(hdev);
1923 }
1924
1925 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1926 {
1927         struct mgmt_mode *cp = data;
1928         struct hci_cp_write_le_host_supported hci_cp;
1929         struct mgmt_pending_cmd *cmd;
1930         struct hci_request req;
1931         int err;
1932         u8 val, enabled;
1933
1934         bt_dev_dbg(hdev, "sock %p", sk);
1935
1936         if (!lmp_le_capable(hdev))
1937                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1938                                        MGMT_STATUS_NOT_SUPPORTED);
1939
1940         if (cp->val != 0x00 && cp->val != 0x01)
1941                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1942                                        MGMT_STATUS_INVALID_PARAMS);
1943
1944         /* Bluetooth single mode LE only controllers or dual-mode
1945          * controllers configured as LE only devices, do not allow
1946          * switching LE off. These have either LE enabled explicitly
1947          * or BR/EDR has been previously switched off.
1948          *
1949          * When trying to enable an already enabled LE, then gracefully
1950          * send a positive response. Trying to disable it however will
1951          * result into rejection.
1952          */
1953         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1954                 if (cp->val == 0x01)
1955                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1956
1957                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1958                                        MGMT_STATUS_REJECTED);
1959         }
1960
1961         hci_dev_lock(hdev);
1962
1963         val = !!cp->val;
1964         enabled = lmp_host_le_capable(hdev);
1965
1966         if (!val)
1967                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1968
1969         if (!hdev_is_powered(hdev) || val == enabled) {
1970                 bool changed = false;
1971
1972                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1973                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1974                         changed = true;
1975                 }
1976
1977                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1978                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1979                         changed = true;
1980                 }
1981
1982                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1983                 if (err < 0)
1984                         goto unlock;
1985
1986                 if (changed)
1987                         err = new_settings(hdev, sk);
1988
1989                 goto unlock;
1990         }
1991
1992         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1993             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1995                                       MGMT_STATUS_BUSY);
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2000         if (!cmd) {
2001                 err = -ENOMEM;
2002                 goto unlock;
2003         }
2004
2005         hci_req_init(&req, hdev);
2006
2007         memset(&hci_cp, 0, sizeof(hci_cp));
2008
2009         if (val) {
2010                 hci_cp.le = val;
2011                 hci_cp.simul = 0x00;
2012         } else {
2013                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2014                         __hci_req_disable_advertising(&req);
2015
2016                 if (ext_adv_capable(hdev))
2017                         __hci_req_clear_ext_adv_sets(&req);
2018         }
2019
2020         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2021                     &hci_cp);
2022
2023         err = hci_req_run(&req, le_enable_complete);
2024         if (err < 0)
2025                 mgmt_pending_remove(cmd);
2026
2027 unlock:
2028         hci_dev_unlock(hdev);
2029         return err;
2030 }
2031
2032 /* This is a helper function to test for pending mgmt commands that can
2033  * cause CoD or EIR HCI commands. We can only allow one such pending
2034  * mgmt command at a time since otherwise we cannot easily track what
2035  * the current values are, will be, and based on that calculate if a new
2036  * HCI command needs to be sent and if yes with what value.
2037  */
2038 static bool pending_eir_or_class(struct hci_dev *hdev)
2039 {
2040         struct mgmt_pending_cmd *cmd;
2041
2042         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2043                 switch (cmd->opcode) {
2044                 case MGMT_OP_ADD_UUID:
2045                 case MGMT_OP_REMOVE_UUID:
2046                 case MGMT_OP_SET_DEV_CLASS:
2047                 case MGMT_OP_SET_POWERED:
2048                         return true;
2049                 }
2050         }
2051
2052         return false;
2053 }
2054
2055 static const u8 bluetooth_base_uuid[] = {
2056                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2057                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2058 };
2059
2060 static u8 get_uuid_size(const u8 *uuid)
2061 {
2062         u32 val;
2063
2064         if (memcmp(uuid, bluetooth_base_uuid, 12))
2065                 return 128;
2066
2067         val = get_unaligned_le32(&uuid[12]);
2068         if (val > 0xffff)
2069                 return 32;
2070
2071         return 16;
2072 }
2073
2074 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2075 {
2076         struct mgmt_pending_cmd *cmd;
2077
2078         hci_dev_lock(hdev);
2079
2080         cmd = pending_find(mgmt_op, hdev);
2081         if (!cmd)
2082                 goto unlock;
2083
2084         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2085                           mgmt_status(status), hdev->dev_class, 3);
2086
2087         mgmt_pending_remove(cmd);
2088
2089 unlock:
2090         hci_dev_unlock(hdev);
2091 }
2092
2093 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2094 {
2095         bt_dev_dbg(hdev, "status 0x%02x", status);
2096
2097         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2098 }
2099
2100 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2101 {
2102         struct mgmt_cp_add_uuid *cp = data;
2103         struct mgmt_pending_cmd *cmd;
2104         struct hci_request req;
2105         struct bt_uuid *uuid;
2106         int err;
2107
2108         bt_dev_dbg(hdev, "sock %p", sk);
2109
2110         hci_dev_lock(hdev);
2111
2112         if (pending_eir_or_class(hdev)) {
2113                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2114                                       MGMT_STATUS_BUSY);
2115                 goto failed;
2116         }
2117
2118         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2119         if (!uuid) {
2120                 err = -ENOMEM;
2121                 goto failed;
2122         }
2123
2124         memcpy(uuid->uuid, cp->uuid, 16);
2125         uuid->svc_hint = cp->svc_hint;
2126         uuid->size = get_uuid_size(cp->uuid);
2127
2128         list_add_tail(&uuid->list, &hdev->uuids);
2129
2130         hci_req_init(&req, hdev);
2131
2132         __hci_req_update_class(&req);
2133         __hci_req_update_eir(&req);
2134
2135         err = hci_req_run(&req, add_uuid_complete);
2136         if (err < 0) {
2137                 if (err != -ENODATA)
2138                         goto failed;
2139
2140                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2141                                         hdev->dev_class, 3);
2142                 goto failed;
2143         }
2144
2145         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2146         if (!cmd) {
2147                 err = -ENOMEM;
2148                 goto failed;
2149         }
2150
2151         err = 0;
2152
2153 failed:
2154         hci_dev_unlock(hdev);
2155         return err;
2156 }
2157
2158 static bool enable_service_cache(struct hci_dev *hdev)
2159 {
2160         if (!hdev_is_powered(hdev))
2161                 return false;
2162
2163         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2164                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2165                                    CACHE_TIMEOUT);
2166                 return true;
2167         }
2168
2169         return false;
2170 }
2171
2172 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2173 {
2174         bt_dev_dbg(hdev, "status 0x%02x", status);
2175
2176         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2177 }
2178
2179 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2180                        u16 len)
2181 {
2182         struct mgmt_cp_remove_uuid *cp = data;
2183         struct mgmt_pending_cmd *cmd;
2184         struct bt_uuid *match, *tmp;
2185         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2186         struct hci_request req;
2187         int err, found;
2188
2189         bt_dev_dbg(hdev, "sock %p", sk);
2190
2191         hci_dev_lock(hdev);
2192
2193         if (pending_eir_or_class(hdev)) {
2194                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2195                                       MGMT_STATUS_BUSY);
2196                 goto unlock;
2197         }
2198
2199         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2200                 hci_uuids_clear(hdev);
2201
2202                 if (enable_service_cache(hdev)) {
2203                         err = mgmt_cmd_complete(sk, hdev->id,
2204                                                 MGMT_OP_REMOVE_UUID,
2205                                                 0, hdev->dev_class, 3);
2206                         goto unlock;
2207                 }
2208
2209                 goto update_class;
2210         }
2211
2212         found = 0;
2213
2214         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2215                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2216                         continue;
2217
2218                 list_del(&match->list);
2219                 kfree(match);
2220                 found++;
2221         }
2222
2223         if (found == 0) {
2224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2225                                       MGMT_STATUS_INVALID_PARAMS);
2226                 goto unlock;
2227         }
2228
2229 update_class:
2230         hci_req_init(&req, hdev);
2231
2232         __hci_req_update_class(&req);
2233         __hci_req_update_eir(&req);
2234
2235         err = hci_req_run(&req, remove_uuid_complete);
2236         if (err < 0) {
2237                 if (err != -ENODATA)
2238                         goto unlock;
2239
2240                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2241                                         hdev->dev_class, 3);
2242                 goto unlock;
2243         }
2244
2245         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2246         if (!cmd) {
2247                 err = -ENOMEM;
2248                 goto unlock;
2249         }
2250
2251         err = 0;
2252
2253 unlock:
2254         hci_dev_unlock(hdev);
2255         return err;
2256 }
2257
2258 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2259 {
2260         bt_dev_dbg(hdev, "status 0x%02x", status);
2261
2262         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2263 }
2264
2265 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2266                          u16 len)
2267 {
2268         struct mgmt_cp_set_dev_class *cp = data;
2269         struct mgmt_pending_cmd *cmd;
2270         struct hci_request req;
2271         int err;
2272
2273         bt_dev_dbg(hdev, "sock %p", sk);
2274
2275         if (!lmp_bredr_capable(hdev))
2276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2277                                        MGMT_STATUS_NOT_SUPPORTED);
2278
2279         hci_dev_lock(hdev);
2280
2281         if (pending_eir_or_class(hdev)) {
2282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                       MGMT_STATUS_BUSY);
2284                 goto unlock;
2285         }
2286
2287         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_INVALID_PARAMS);
2290                 goto unlock;
2291         }
2292
2293         hdev->major_class = cp->major;
2294         hdev->minor_class = cp->minor;
2295
2296         if (!hdev_is_powered(hdev)) {
2297                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2298                                         hdev->dev_class, 3);
2299                 goto unlock;
2300         }
2301
2302         hci_req_init(&req, hdev);
2303
2304         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2305                 hci_dev_unlock(hdev);
2306                 cancel_delayed_work_sync(&hdev->service_cache);
2307                 hci_dev_lock(hdev);
2308                 __hci_req_update_eir(&req);
2309         }
2310
2311         __hci_req_update_class(&req);
2312
2313         err = hci_req_run(&req, set_class_complete);
2314         if (err < 0) {
2315                 if (err != -ENODATA)
2316                         goto unlock;
2317
2318                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2319                                         hdev->dev_class, 3);
2320                 goto unlock;
2321         }
2322
2323         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2324         if (!cmd) {
2325                 err = -ENOMEM;
2326                 goto unlock;
2327         }
2328
2329         err = 0;
2330
2331 unlock:
2332         hci_dev_unlock(hdev);
2333         return err;
2334 }
2335
2336 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2337                           u16 len)
2338 {
2339         struct mgmt_cp_load_link_keys *cp = data;
2340         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2341                                    sizeof(struct mgmt_link_key_info));
2342         u16 key_count, expected_len;
2343         bool changed;
2344         int i;
2345
2346         bt_dev_dbg(hdev, "sock %p", sk);
2347
2348         if (!lmp_bredr_capable(hdev))
2349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2350                                        MGMT_STATUS_NOT_SUPPORTED);
2351
2352         key_count = __le16_to_cpu(cp->key_count);
2353         if (key_count > max_key_count) {
2354                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2355                            key_count);
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_INVALID_PARAMS);
2358         }
2359
2360         expected_len = struct_size(cp, keys, key_count);
2361         if (expected_len != len) {
2362                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2363                            expected_len, len);
2364                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2365                                        MGMT_STATUS_INVALID_PARAMS);
2366         }
2367
2368         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2369                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2370                                        MGMT_STATUS_INVALID_PARAMS);
2371
2372         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2373                    key_count);
2374
2375         for (i = 0; i < key_count; i++) {
2376                 struct mgmt_link_key_info *key = &cp->keys[i];
2377
2378                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2379                         return mgmt_cmd_status(sk, hdev->id,
2380                                                MGMT_OP_LOAD_LINK_KEYS,
2381                                                MGMT_STATUS_INVALID_PARAMS);
2382         }
2383
2384         hci_dev_lock(hdev);
2385
2386         hci_link_keys_clear(hdev);
2387
2388         if (cp->debug_keys)
2389                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2390         else
2391                 changed = hci_dev_test_and_clear_flag(hdev,
2392                                                       HCI_KEEP_DEBUG_KEYS);
2393
2394         if (changed)
2395                 new_settings(hdev, NULL);
2396
2397         for (i = 0; i < key_count; i++) {
2398                 struct mgmt_link_key_info *key = &cp->keys[i];
2399
2400                 if (hci_is_blocked_key(hdev,
2401                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2402                                        key->val)) {
2403                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2404                                     &key->addr.bdaddr);
2405                         continue;
2406                 }
2407
2408                 /* Always ignore debug keys and require a new pairing if
2409                  * the user wants to use them.
2410                  */
2411                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2412                         continue;
2413
2414                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2415                                  key->type, key->pin_len, NULL);
2416         }
2417
2418         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2419
2420         hci_dev_unlock(hdev);
2421
2422         return 0;
2423 }
2424
2425 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2426                            u8 addr_type, struct sock *skip_sk)
2427 {
2428         struct mgmt_ev_device_unpaired ev;
2429
2430         bacpy(&ev.addr.bdaddr, bdaddr);
2431         ev.addr.type = addr_type;
2432
2433         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2434                           skip_sk);
2435 }
2436
2437 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2438                          u16 len)
2439 {
2440         struct mgmt_cp_unpair_device *cp = data;
2441         struct mgmt_rp_unpair_device rp;
2442         struct hci_conn_params *params;
2443         struct mgmt_pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         u8 addr_type;
2446         int err;
2447
2448         memset(&rp, 0, sizeof(rp));
2449         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2450         rp.addr.type = cp->addr.type;
2451
2452         if (!bdaddr_type_is_valid(cp->addr.type))
2453                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2454                                          MGMT_STATUS_INVALID_PARAMS,
2455                                          &rp, sizeof(rp));
2456
2457         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2458                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2459                                          MGMT_STATUS_INVALID_PARAMS,
2460                                          &rp, sizeof(rp));
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hdev_is_powered(hdev)) {
2465                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                         MGMT_STATUS_NOT_POWERED, &rp,
2467                                         sizeof(rp));
2468                 goto unlock;
2469         }
2470
2471         if (cp->addr.type == BDADDR_BREDR) {
2472                 /* If disconnection is requested, then look up the
2473                  * connection. If the remote device is connected, it
2474                  * will be later used to terminate the link.
2475                  *
2476                  * Setting it to NULL explicitly will cause no
2477                  * termination of the link.
2478                  */
2479                 if (cp->disconnect)
2480                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2481                                                        &cp->addr.bdaddr);
2482                 else
2483                         conn = NULL;
2484
2485                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2486                 if (err < 0) {
2487                         err = mgmt_cmd_complete(sk, hdev->id,
2488                                                 MGMT_OP_UNPAIR_DEVICE,
2489                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2490                                                 sizeof(rp));
2491                         goto unlock;
2492                 }
2493
2494                 goto done;
2495         }
2496
2497         /* LE address type */
2498         addr_type = le_addr_type(cp->addr.type);
2499
2500         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2501         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2502         if (err < 0) {
2503                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2504                                         MGMT_STATUS_NOT_PAIRED, &rp,
2505                                         sizeof(rp));
2506                 goto unlock;
2507         }
2508
2509         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2510         if (!conn) {
2511                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2512                 goto done;
2513         }
2514
2515
2516         /* Defer clearing up the connection parameters until closing to
2517          * give a chance of keeping them if a repairing happens.
2518          */
2519         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2520
2521         /* Disable auto-connection parameters if present */
2522         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2523         if (params) {
2524                 if (params->explicit_connect)
2525                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2526                 else
2527                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2528         }
2529
2530         /* If disconnection is not requested, then clear the connection
2531          * variable so that the link is not terminated.
2532          */
2533         if (!cp->disconnect)
2534                 conn = NULL;
2535
2536 done:
2537         /* If the connection variable is set, then termination of the
2538          * link is requested.
2539          */
2540         if (!conn) {
2541                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2542                                         &rp, sizeof(rp));
2543                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2544                 goto unlock;
2545         }
2546
2547         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2548                                sizeof(*cp));
2549         if (!cmd) {
2550                 err = -ENOMEM;
2551                 goto unlock;
2552         }
2553
2554         cmd->cmd_complete = addr_cmd_complete;
2555
2556         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2557         if (err < 0)
2558                 mgmt_pending_remove(cmd);
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562         return err;
2563 }
2564
2565 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2566                       u16 len)
2567 {
2568         struct mgmt_cp_disconnect *cp = data;
2569         struct mgmt_rp_disconnect rp;
2570         struct mgmt_pending_cmd *cmd;
2571         struct hci_conn *conn;
2572         int err;
2573
2574         bt_dev_dbg(hdev, "sock %p", sk);
2575
2576         memset(&rp, 0, sizeof(rp));
2577         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2578         rp.addr.type = cp->addr.type;
2579
2580         if (!bdaddr_type_is_valid(cp->addr.type))
2581                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2582                                          MGMT_STATUS_INVALID_PARAMS,
2583                                          &rp, sizeof(rp));
2584
2585         hci_dev_lock(hdev);
2586
2587         if (!test_bit(HCI_UP, &hdev->flags)) {
2588                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                         MGMT_STATUS_NOT_POWERED, &rp,
2590                                         sizeof(rp));
2591                 goto failed;
2592         }
2593
2594         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (cp->addr.type == BDADDR_BREDR)
2601                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2602                                                &cp->addr.bdaddr);
2603         else
2604                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2605                                                le_addr_type(cp->addr.type));
2606
2607         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2608                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2609                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2610                                         sizeof(rp));
2611                 goto failed;
2612         }
2613
2614         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2615         if (!cmd) {
2616                 err = -ENOMEM;
2617                 goto failed;
2618         }
2619
2620         cmd->cmd_complete = generic_cmd_complete;
2621
2622         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2623         if (err < 0)
2624                 mgmt_pending_remove(cmd);
2625
2626 failed:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2632 {
2633         switch (link_type) {
2634         case LE_LINK:
2635                 switch (addr_type) {
2636                 case ADDR_LE_DEV_PUBLIC:
2637                         return BDADDR_LE_PUBLIC;
2638
2639                 default:
2640                         /* Fallback to LE Random address type */
2641                         return BDADDR_LE_RANDOM;
2642                 }
2643
2644         default:
2645                 /* Fallback to BR/EDR type */
2646                 return BDADDR_BREDR;
2647         }
2648 }
2649
2650 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2651                            u16 data_len)
2652 {
2653         struct mgmt_rp_get_connections *rp;
2654         struct hci_conn *c;
2655         int err;
2656         u16 i;
2657
2658         bt_dev_dbg(hdev, "sock %p", sk);
2659
2660         hci_dev_lock(hdev);
2661
2662         if (!hdev_is_powered(hdev)) {
2663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2664                                       MGMT_STATUS_NOT_POWERED);
2665                 goto unlock;
2666         }
2667
2668         i = 0;
2669         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2670                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2671                         i++;
2672         }
2673
2674         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2675         if (!rp) {
2676                 err = -ENOMEM;
2677                 goto unlock;
2678         }
2679
2680         i = 0;
2681         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2682                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2683                         continue;
2684                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2685                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2686                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2687                         continue;
2688                 i++;
2689         }
2690
2691         rp->conn_count = cpu_to_le16(i);
2692
2693         /* Recalculate length in case of filtered SCO connections, etc */
2694         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2695                                 struct_size(rp, addr, i));
2696
2697         kfree(rp);
2698
2699 unlock:
2700         hci_dev_unlock(hdev);
2701         return err;
2702 }
2703
2704 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2705                                    struct mgmt_cp_pin_code_neg_reply *cp)
2706 {
2707         struct mgmt_pending_cmd *cmd;
2708         int err;
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2711                                sizeof(*cp));
2712         if (!cmd)
2713                 return -ENOMEM;
2714
2715         cmd->cmd_complete = addr_cmd_complete;
2716
2717         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2718                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721
2722         return err;
2723 }
2724
2725 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2726                           u16 len)
2727 {
2728         struct hci_conn *conn;
2729         struct mgmt_cp_pin_code_reply *cp = data;
2730         struct hci_cp_pin_code_reply reply;
2731         struct mgmt_pending_cmd *cmd;
2732         int err;
2733
2734         bt_dev_dbg(hdev, "sock %p", sk);
2735
2736         hci_dev_lock(hdev);
2737
2738         if (!hdev_is_powered(hdev)) {
2739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2740                                       MGMT_STATUS_NOT_POWERED);
2741                 goto failed;
2742         }
2743
2744         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2745         if (!conn) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_CONNECTED);
2748                 goto failed;
2749         }
2750
2751         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2752                 struct mgmt_cp_pin_code_neg_reply ncp;
2753
2754                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2755
2756                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2757
2758                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2759                 if (err >= 0)
2760                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2761                                               MGMT_STATUS_INVALID_PARAMS);
2762
2763                 goto failed;
2764         }
2765
2766         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2767         if (!cmd) {
2768                 err = -ENOMEM;
2769                 goto failed;
2770         }
2771
2772         cmd->cmd_complete = addr_cmd_complete;
2773
2774         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2775         reply.pin_len = cp->pin_len;
2776         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2777
2778         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2779         if (err < 0)
2780                 mgmt_pending_remove(cmd);
2781
2782 failed:
2783         hci_dev_unlock(hdev);
2784         return err;
2785 }
2786
2787 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2788                              u16 len)
2789 {
2790         struct mgmt_cp_set_io_capability *cp = data;
2791
2792         bt_dev_dbg(hdev, "sock %p", sk);
2793
2794         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2796                                        MGMT_STATUS_INVALID_PARAMS);
2797
2798         hci_dev_lock(hdev);
2799
2800         hdev->io_capability = cp->io_capability;
2801
2802         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2803
2804         hci_dev_unlock(hdev);
2805
2806         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2807                                  NULL, 0);
2808 }
2809
2810 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2811 {
2812         struct hci_dev *hdev = conn->hdev;
2813         struct mgmt_pending_cmd *cmd;
2814
2815         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2816                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2817                         continue;
2818
2819                 if (cmd->user_data != conn)
2820                         continue;
2821
2822                 return cmd;
2823         }
2824
2825         return NULL;
2826 }
2827
2828 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2829 {
2830         struct mgmt_rp_pair_device rp;
2831         struct hci_conn *conn = cmd->user_data;
2832         int err;
2833
2834         bacpy(&rp.addr.bdaddr, &conn->dst);
2835         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2836
2837         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2838                                 status, &rp, sizeof(rp));
2839
2840         /* So we don't get further callbacks for this connection */
2841         conn->connect_cfm_cb = NULL;
2842         conn->security_cfm_cb = NULL;
2843         conn->disconn_cfm_cb = NULL;
2844
2845         hci_conn_drop(conn);
2846
2847         /* The device is paired so there is no need to remove
2848          * its connection parameters anymore.
2849          */
2850         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2851
2852         hci_conn_put(conn);
2853
2854         return err;
2855 }
2856
2857 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2858 {
2859         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2860         struct mgmt_pending_cmd *cmd;
2861
2862         cmd = find_pairing(conn);
2863         if (cmd) {
2864                 cmd->cmd_complete(cmd, status);
2865                 mgmt_pending_remove(cmd);
2866         }
2867 }
2868
2869 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2870 {
2871         struct mgmt_pending_cmd *cmd;
2872
2873         BT_DBG("status %u", status);
2874
2875         cmd = find_pairing(conn);
2876         if (!cmd) {
2877                 BT_DBG("Unable to find a pending command");
2878                 return;
2879         }
2880
2881         cmd->cmd_complete(cmd, mgmt_status(status));
2882         mgmt_pending_remove(cmd);
2883 }
2884
2885 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2886 {
2887         struct mgmt_pending_cmd *cmd;
2888
2889         BT_DBG("status %u", status);
2890
2891         if (!status)
2892                 return;
2893
2894         cmd = find_pairing(conn);
2895         if (!cmd) {
2896                 BT_DBG("Unable to find a pending command");
2897                 return;
2898         }
2899
2900         cmd->cmd_complete(cmd, mgmt_status(status));
2901         mgmt_pending_remove(cmd);
2902 }
2903
2904 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2905                        u16 len)
2906 {
2907         struct mgmt_cp_pair_device *cp = data;
2908         struct mgmt_rp_pair_device rp;
2909         struct mgmt_pending_cmd *cmd;
2910         u8 sec_level, auth_type;
2911         struct hci_conn *conn;
2912         int err;
2913
2914         bt_dev_dbg(hdev, "sock %p", sk);
2915
2916         memset(&rp, 0, sizeof(rp));
2917         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2918         rp.addr.type = cp->addr.type;
2919
2920         if (!bdaddr_type_is_valid(cp->addr.type))
2921                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2922                                          MGMT_STATUS_INVALID_PARAMS,
2923                                          &rp, sizeof(rp));
2924
2925         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2926                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2927                                          MGMT_STATUS_INVALID_PARAMS,
2928                                          &rp, sizeof(rp));
2929
2930         hci_dev_lock(hdev);
2931
2932         if (!hdev_is_powered(hdev)) {
2933                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                         MGMT_STATUS_NOT_POWERED, &rp,
2935                                         sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         sec_level = BT_SECURITY_MEDIUM;
2947         auth_type = HCI_AT_DEDICATED_BONDING;
2948
2949         if (cp->addr.type == BDADDR_BREDR) {
2950                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2951                                        auth_type, CONN_REASON_PAIR_DEVICE);
2952         } else {
2953                 u8 addr_type = le_addr_type(cp->addr.type);
2954                 struct hci_conn_params *p;
2955
2956                 /* When pairing a new device, it is expected to remember
2957                  * this device for future connections. Adding the connection
2958                  * parameter information ahead of time allows tracking
2959                  * of the slave preferred values and will speed up any
2960                  * further connection establishment.
2961                  *
2962                  * If connection parameters already exist, then they
2963                  * will be kept and this function does nothing.
2964                  */
2965                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2966
2967                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2968                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2969
2970                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2971                                            sec_level, HCI_LE_CONN_TIMEOUT,
2972                                            CONN_REASON_PAIR_DEVICE);
2973         }
2974
2975         if (IS_ERR(conn)) {
2976                 int status;
2977
2978                 if (PTR_ERR(conn) == -EBUSY)
2979                         status = MGMT_STATUS_BUSY;
2980                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2981                         status = MGMT_STATUS_NOT_SUPPORTED;
2982                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2983                         status = MGMT_STATUS_REJECTED;
2984                 else
2985                         status = MGMT_STATUS_CONNECT_FAILED;
2986
2987                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2988                                         status, &rp, sizeof(rp));
2989                 goto unlock;
2990         }
2991
2992         if (conn->connect_cfm_cb) {
2993                 hci_conn_drop(conn);
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 hci_conn_drop(conn);
3003                 goto unlock;
3004         }
3005
3006         cmd->cmd_complete = pairing_complete;
3007
3008         /* For LE, just connecting isn't a proof that the pairing finished */
3009         if (cp->addr.type == BDADDR_BREDR) {
3010                 conn->connect_cfm_cb = pairing_complete_cb;
3011                 conn->security_cfm_cb = pairing_complete_cb;
3012                 conn->disconn_cfm_cb = pairing_complete_cb;
3013         } else {
3014                 conn->connect_cfm_cb = le_pairing_complete_cb;
3015                 conn->security_cfm_cb = le_pairing_complete_cb;
3016                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3017         }
3018
3019         conn->io_capability = cp->io_cap;
3020         cmd->user_data = hci_conn_get(conn);
3021
3022         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3023             hci_conn_security(conn, sec_level, auth_type, true)) {
3024                 cmd->cmd_complete(cmd, 0);
3025                 mgmt_pending_remove(cmd);
3026         }
3027
3028         err = 0;
3029
3030 unlock:
3031         hci_dev_unlock(hdev);
3032         return err;
3033 }
3034
3035 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3036                               u16 len)
3037 {
3038         struct mgmt_addr_info *addr = data;
3039         struct mgmt_pending_cmd *cmd;
3040         struct hci_conn *conn;
3041         int err;
3042
3043         bt_dev_dbg(hdev, "sock %p", sk);
3044
3045         hci_dev_lock(hdev);
3046
3047         if (!hdev_is_powered(hdev)) {
3048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3049                                       MGMT_STATUS_NOT_POWERED);
3050                 goto unlock;
3051         }
3052
3053         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3054         if (!cmd) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_INVALID_PARAMS);
3057                 goto unlock;
3058         }
3059
3060         conn = cmd->user_data;
3061
3062         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3063                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3064                                       MGMT_STATUS_INVALID_PARAMS);
3065                 goto unlock;
3066         }
3067
3068         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3069         mgmt_pending_remove(cmd);
3070
3071         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3072                                 addr, sizeof(*addr));
3073
3074         /* Since user doesn't want to proceed with the connection, abort any
3075          * ongoing pairing and then terminate the link if it was created
3076          * because of the pair device action.
3077          */
3078         if (addr->type == BDADDR_BREDR)
3079                 hci_remove_link_key(hdev, &addr->bdaddr);
3080         else
3081                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3082                                               le_addr_type(addr->type));
3083
3084         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3085                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3086
3087 unlock:
3088         hci_dev_unlock(hdev);
3089         return err;
3090 }
3091
3092 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3093                              struct mgmt_addr_info *addr, u16 mgmt_op,
3094                              u16 hci_op, __le32 passkey)
3095 {
3096         struct mgmt_pending_cmd *cmd;
3097         struct hci_conn *conn;
3098         int err;
3099
3100         hci_dev_lock(hdev);
3101
3102         if (!hdev_is_powered(hdev)) {
3103                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3104                                         MGMT_STATUS_NOT_POWERED, addr,
3105                                         sizeof(*addr));
3106                 goto done;
3107         }
3108
3109         if (addr->type == BDADDR_BREDR)
3110                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3111         else
3112                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3113                                                le_addr_type(addr->type));
3114
3115         if (!conn) {
3116                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3117                                         MGMT_STATUS_NOT_CONNECTED, addr,
3118                                         sizeof(*addr));
3119                 goto done;
3120         }
3121
3122         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3123                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3124                 if (!err)
3125                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3126                                                 MGMT_STATUS_SUCCESS, addr,
3127                                                 sizeof(*addr));
3128                 else
3129                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3130                                                 MGMT_STATUS_FAILED, addr,
3131                                                 sizeof(*addr));
3132
3133                 goto done;
3134         }
3135
3136         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3137         if (!cmd) {
3138                 err = -ENOMEM;
3139                 goto done;
3140         }
3141
3142         cmd->cmd_complete = addr_cmd_complete;
3143
3144         /* Continue with pairing via HCI */
3145         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3146                 struct hci_cp_user_passkey_reply cp;
3147
3148                 bacpy(&cp.bdaddr, &addr->bdaddr);
3149                 cp.passkey = passkey;
3150                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3151         } else
3152                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3153                                    &addr->bdaddr);
3154
3155         if (err < 0)
3156                 mgmt_pending_remove(cmd);
3157
3158 done:
3159         hci_dev_unlock(hdev);
3160         return err;
3161 }
3162
3163 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3164                               void *data, u16 len)
3165 {
3166         struct mgmt_cp_pin_code_neg_reply *cp = data;
3167
3168         bt_dev_dbg(hdev, "sock %p", sk);
3169
3170         return user_pairing_resp(sk, hdev, &cp->addr,
3171                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3172                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3173 }
3174
3175 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3176                               u16 len)
3177 {
3178         struct mgmt_cp_user_confirm_reply *cp = data;
3179
3180         bt_dev_dbg(hdev, "sock %p", sk);
3181
3182         if (len != sizeof(*cp))
3183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3184                                        MGMT_STATUS_INVALID_PARAMS);
3185
3186         return user_pairing_resp(sk, hdev, &cp->addr,
3187                                  MGMT_OP_USER_CONFIRM_REPLY,
3188                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3189 }
3190
3191 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3192                                   void *data, u16 len)
3193 {
3194         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3195
3196         bt_dev_dbg(hdev, "sock %p", sk);
3197
3198         return user_pairing_resp(sk, hdev, &cp->addr,
3199                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3200                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3201 }
3202
3203 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3204                               u16 len)
3205 {
3206         struct mgmt_cp_user_passkey_reply *cp = data;
3207
3208         bt_dev_dbg(hdev, "sock %p", sk);
3209
3210         return user_pairing_resp(sk, hdev, &cp->addr,
3211                                  MGMT_OP_USER_PASSKEY_REPLY,
3212                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3213 }
3214
3215 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3216                                   void *data, u16 len)
3217 {
3218         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3219
3220         bt_dev_dbg(hdev, "sock %p", sk);
3221
3222         return user_pairing_resp(sk, hdev, &cp->addr,
3223                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3224                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3225 }
3226
3227 static void adv_expire(struct hci_dev *hdev, u32 flags)
3228 {
3229         struct adv_info *adv_instance;
3230         struct hci_request req;
3231         int err;
3232
3233         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3234         if (!adv_instance)
3235                 return;
3236
3237         /* stop if current instance doesn't need to be changed */
3238         if (!(adv_instance->flags & flags))
3239                 return;
3240
3241         cancel_adv_timeout(hdev);
3242
3243         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3244         if (!adv_instance)
3245                 return;
3246
3247         hci_req_init(&req, hdev);
3248         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3249                                               true);
3250         if (err)
3251                 return;
3252
3253         hci_req_run(&req, NULL);
3254 }
3255
3256 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3257 {
3258         struct mgmt_cp_set_local_name *cp;
3259         struct mgmt_pending_cmd *cmd;
3260
3261         bt_dev_dbg(hdev, "status 0x%02x", status);
3262
3263         hci_dev_lock(hdev);
3264
3265         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3266         if (!cmd)
3267                 goto unlock;
3268
3269         cp = cmd->param;
3270
3271         if (status) {
3272                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3273                                 mgmt_status(status));
3274         } else {
3275                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3276                                   cp, sizeof(*cp));
3277
3278                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3279                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3280         }
3281
3282         mgmt_pending_remove(cmd);
3283
3284 unlock:
3285         hci_dev_unlock(hdev);
3286 }
3287
3288 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3289                           u16 len)
3290 {
3291         struct mgmt_cp_set_local_name *cp = data;
3292         struct mgmt_pending_cmd *cmd;
3293         struct hci_request req;
3294         int err;
3295
3296         bt_dev_dbg(hdev, "sock %p", sk);
3297
3298         hci_dev_lock(hdev);
3299
3300         /* If the old values are the same as the new ones just return a
3301          * direct command complete event.
3302          */
3303         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3304             !memcmp(hdev->short_name, cp->short_name,
3305                     sizeof(hdev->short_name))) {
3306                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3307                                         data, len);
3308                 goto failed;
3309         }
3310
3311         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3312
3313         if (!hdev_is_powered(hdev)) {
3314                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3315
3316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3317                                         data, len);
3318                 if (err < 0)
3319                         goto failed;
3320
3321                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3322                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3323                 ext_info_changed(hdev, sk);
3324
3325                 goto failed;
3326         }
3327
3328         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3329         if (!cmd) {
3330                 err = -ENOMEM;
3331                 goto failed;
3332         }
3333
3334         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3335
3336         hci_req_init(&req, hdev);
3337
3338         if (lmp_bredr_capable(hdev)) {
3339                 __hci_req_update_name(&req);
3340                 __hci_req_update_eir(&req);
3341         }
3342
3343         /* The name is stored in the scan response data and so
3344          * no need to udpate the advertising data here.
3345          */
3346         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3347                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3348
3349         err = hci_req_run(&req, set_name_complete);
3350         if (err < 0)
3351                 mgmt_pending_remove(cmd);
3352
3353 failed:
3354         hci_dev_unlock(hdev);
3355         return err;
3356 }
3357
3358 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3359                           u16 len)
3360 {
3361         struct mgmt_cp_set_appearance *cp = data;
3362         u16 appearance;
3363         int err;
3364
3365         bt_dev_dbg(hdev, "sock %p", sk);
3366
3367         if (!lmp_le_capable(hdev))
3368                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3369                                        MGMT_STATUS_NOT_SUPPORTED);
3370
3371         appearance = le16_to_cpu(cp->appearance);
3372
3373         hci_dev_lock(hdev);
3374
3375         if (hdev->appearance != appearance) {
3376                 hdev->appearance = appearance;
3377
3378                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3379                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3380
3381                 ext_info_changed(hdev, sk);
3382         }
3383
3384         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3385                                 0);
3386
3387         hci_dev_unlock(hdev);
3388
3389         return err;
3390 }
3391
3392 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3393                                  void *data, u16 len)
3394 {
3395         struct mgmt_rp_get_phy_configuration rp;
3396
3397         bt_dev_dbg(hdev, "sock %p", sk);
3398
3399         hci_dev_lock(hdev);
3400
3401         memset(&rp, 0, sizeof(rp));
3402
3403         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3404         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3405         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3406
3407         hci_dev_unlock(hdev);
3408
3409         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3410                                  &rp, sizeof(rp));
3411 }
3412
3413 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3414 {
3415         struct mgmt_ev_phy_configuration_changed ev;
3416
3417         memset(&ev, 0, sizeof(ev));
3418
3419         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3420
3421         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3422                           sizeof(ev), skip);
3423 }
3424
3425 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3426                                      u16 opcode, struct sk_buff *skb)
3427 {
3428         struct mgmt_pending_cmd *cmd;
3429
3430         bt_dev_dbg(hdev, "status 0x%02x", status);
3431
3432         hci_dev_lock(hdev);
3433
3434         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3435         if (!cmd)
3436                 goto unlock;
3437
3438         if (status) {
3439                 mgmt_cmd_status(cmd->sk, hdev->id,
3440                                 MGMT_OP_SET_PHY_CONFIGURATION,
3441                                 mgmt_status(status));
3442         } else {
3443                 mgmt_cmd_complete(cmd->sk, hdev->id,
3444                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3445                                   NULL, 0);
3446
3447                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3448         }
3449
3450         mgmt_pending_remove(cmd);
3451
3452 unlock:
3453         hci_dev_unlock(hdev);
3454 }
3455
3456 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3457                                  void *data, u16 len)
3458 {
3459         struct mgmt_cp_set_phy_configuration *cp = data;
3460         struct hci_cp_le_set_default_phy cp_phy;
3461         struct mgmt_pending_cmd *cmd;
3462         struct hci_request req;
3463         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3464         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3465         bool changed = false;
3466         int err;
3467
3468         bt_dev_dbg(hdev, "sock %p", sk);
3469
3470         configurable_phys = get_configurable_phys(hdev);
3471         supported_phys = get_supported_phys(hdev);
3472         selected_phys = __le32_to_cpu(cp->selected_phys);
3473
3474         if (selected_phys & ~supported_phys)
3475                 return mgmt_cmd_status(sk, hdev->id,
3476                                        MGMT_OP_SET_PHY_CONFIGURATION,
3477                                        MGMT_STATUS_INVALID_PARAMS);
3478
3479         unconfigure_phys = supported_phys & ~configurable_phys;
3480
3481         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         if (selected_phys == get_selected_phys(hdev))
3487                 return mgmt_cmd_complete(sk, hdev->id,
3488                                          MGMT_OP_SET_PHY_CONFIGURATION,
3489                                          0, NULL, 0);
3490
3491         hci_dev_lock(hdev);
3492
3493         if (!hdev_is_powered(hdev)) {
3494                 err = mgmt_cmd_status(sk, hdev->id,
3495                                       MGMT_OP_SET_PHY_CONFIGURATION,
3496                                       MGMT_STATUS_REJECTED);
3497                 goto unlock;
3498         }
3499
3500         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_BUSY);
3504                 goto unlock;
3505         }
3506
3507         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3508                 pkt_type |= (HCI_DH3 | HCI_DM3);
3509         else
3510                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3511
3512         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3513                 pkt_type |= (HCI_DH5 | HCI_DM5);
3514         else
3515                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3516
3517         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3518                 pkt_type &= ~HCI_2DH1;
3519         else
3520                 pkt_type |= HCI_2DH1;
3521
3522         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3523                 pkt_type &= ~HCI_2DH3;
3524         else
3525                 pkt_type |= HCI_2DH3;
3526
3527         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3528                 pkt_type &= ~HCI_2DH5;
3529         else
3530                 pkt_type |= HCI_2DH5;
3531
3532         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3533                 pkt_type &= ~HCI_3DH1;
3534         else
3535                 pkt_type |= HCI_3DH1;
3536
3537         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3538                 pkt_type &= ~HCI_3DH3;
3539         else
3540                 pkt_type |= HCI_3DH3;
3541
3542         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3543                 pkt_type &= ~HCI_3DH5;
3544         else
3545                 pkt_type |= HCI_3DH5;
3546
3547         if (pkt_type != hdev->pkt_type) {
3548                 hdev->pkt_type = pkt_type;
3549                 changed = true;
3550         }
3551
3552         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3553             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3554                 if (changed)
3555                         mgmt_phy_configuration_changed(hdev, sk);
3556
3557                 err = mgmt_cmd_complete(sk, hdev->id,
3558                                         MGMT_OP_SET_PHY_CONFIGURATION,
3559                                         0, NULL, 0);
3560
3561                 goto unlock;
3562         }
3563
3564         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3565                                len);
3566         if (!cmd) {
3567                 err = -ENOMEM;
3568                 goto unlock;
3569         }
3570
3571         hci_req_init(&req, hdev);
3572
3573         memset(&cp_phy, 0, sizeof(cp_phy));
3574
3575         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3576                 cp_phy.all_phys |= 0x01;
3577
3578         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3579                 cp_phy.all_phys |= 0x02;
3580
3581         if (selected_phys & MGMT_PHY_LE_1M_TX)
3582                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3583
3584         if (selected_phys & MGMT_PHY_LE_2M_TX)
3585                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3586
3587         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3589
3590         if (selected_phys & MGMT_PHY_LE_1M_RX)
3591                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3592
3593         if (selected_phys & MGMT_PHY_LE_2M_RX)
3594                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3595
3596         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3598
3599         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3600
3601         err = hci_req_run_skb(&req, set_default_phy_complete);
3602         if (err < 0)
3603                 mgmt_pending_remove(cmd);
3604
3605 unlock:
3606         hci_dev_unlock(hdev);
3607
3608         return err;
3609 }
3610
3611 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3612                             u16 len)
3613 {
3614         int err = MGMT_STATUS_SUCCESS;
3615         struct mgmt_cp_set_blocked_keys *keys = data;
3616         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3617                                    sizeof(struct mgmt_blocked_key_info));
3618         u16 key_count, expected_len;
3619         int i;
3620
3621         bt_dev_dbg(hdev, "sock %p", sk);
3622
3623         key_count = __le16_to_cpu(keys->key_count);
3624         if (key_count > max_key_count) {
3625                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3627                                        MGMT_STATUS_INVALID_PARAMS);
3628         }
3629
3630         expected_len = struct_size(keys, keys, key_count);
3631         if (expected_len != len) {
3632                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3633                            expected_len, len);
3634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3635                                        MGMT_STATUS_INVALID_PARAMS);
3636         }
3637
3638         hci_dev_lock(hdev);
3639
3640         hci_blocked_keys_clear(hdev);
3641
3642         for (i = 0; i < keys->key_count; ++i) {
3643                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3644
3645                 if (!b) {
3646                         err = MGMT_STATUS_NO_RESOURCES;
3647                         break;
3648                 }
3649
3650                 b->type = keys->keys[i].type;
3651                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3652                 list_add_rcu(&b->list, &hdev->blocked_keys);
3653         }
3654         hci_dev_unlock(hdev);
3655
3656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3657                                 err, NULL, 0);
3658 }
3659
3660 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3661                                void *data, u16 len)
3662 {
3663         struct mgmt_mode *cp = data;
3664         int err;
3665         bool changed = false;
3666
3667         bt_dev_dbg(hdev, "sock %p", sk);
3668
3669         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3670                 return mgmt_cmd_status(sk, hdev->id,
3671                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3672                                        MGMT_STATUS_NOT_SUPPORTED);
3673
3674         if (cp->val != 0x00 && cp->val != 0x01)
3675                 return mgmt_cmd_status(sk, hdev->id,
3676                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3677                                        MGMT_STATUS_INVALID_PARAMS);
3678
3679         hci_dev_lock(hdev);
3680
3681         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3682                 err = mgmt_cmd_status(sk, hdev->id,
3683                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                       MGMT_STATUS_BUSY);
3685                 goto unlock;
3686         }
3687
3688         if (hdev_is_powered(hdev) &&
3689             !!cp->val != hci_dev_test_flag(hdev,
3690                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3691                 err = mgmt_cmd_status(sk, hdev->id,
3692                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3693                                       MGMT_STATUS_REJECTED);
3694                 goto unlock;
3695         }
3696
3697         if (cp->val)
3698                 changed = !hci_dev_test_and_set_flag(hdev,
3699                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3700         else
3701                 changed = hci_dev_test_and_clear_flag(hdev,
3702                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3703
3704         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3705         if (err < 0)
3706                 goto unlock;
3707
3708         if (changed)
3709                 err = new_settings(hdev, sk);
3710
3711 unlock:
3712         hci_dev_unlock(hdev);
3713         return err;
3714 }
3715
3716 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3717                                void *data, u16 data_len)
3718 {
3719         char buf[20];
3720         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3721         u16 cap_len = 0;
3722         u8 flags = 0;
3723         u8 tx_power_range[2];
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         memset(&buf, 0, sizeof(buf));
3728
3729         hci_dev_lock(hdev);
3730
3731         /* When the Read Simple Pairing Options command is supported, then
3732          * the remote public key validation is supported.
3733          */
3734         if (hdev->commands[41] & 0x08)
3735                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3736
3737         flags |= 0x02;          /* Remote public key validation (LE) */
3738
3739         /* When the Read Encryption Key Size command is supported, then the
3740          * encryption key size is enforced.
3741          */
3742         if (hdev->commands[20] & 0x10)
3743                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3744
3745         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3746
3747         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3748                                   &flags, 1);
3749
3750         /* When the Read Simple Pairing Options command is supported, then
3751          * also max encryption key size information is provided.
3752          */
3753         if (hdev->commands[41] & 0x08)
3754                 cap_len = eir_append_le16(rp->cap, cap_len,
3755                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3756                                           hdev->max_enc_key_size);
3757
3758         cap_len = eir_append_le16(rp->cap, cap_len,
3759                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3760                                   SMP_MAX_ENC_KEY_SIZE);
3761
3762         /* Append the min/max LE tx power parameters if we were able to fetch
3763          * it from the controller
3764          */
3765         if (hdev->commands[38] & 0x80) {
3766                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3767                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3768                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3769                                           tx_power_range, 2);
3770         }
3771
3772         rp->cap_len = cpu_to_le16(cap_len);
3773
3774         hci_dev_unlock(hdev);
3775
3776         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3777                                  rp, sizeof(*rp) + cap_len);
3778 }
3779
3780 #ifdef CONFIG_BT_FEATURE_DEBUG
3781 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3782 static const u8 debug_uuid[16] = {
3783         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3784         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3785 };
3786 #endif
3787
3788 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3789 static const u8 simult_central_periph_uuid[16] = {
3790         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3791         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3792 };
3793
3794 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3795 static const u8 rpa_resolution_uuid[16] = {
3796         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3797         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3798 };
3799
3800 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3801                                   void *data, u16 data_len)
3802 {
3803         char buf[62];   /* Enough space for 3 features */
3804         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3805         u16 idx = 0;
3806         u32 flags;
3807
3808         bt_dev_dbg(hdev, "sock %p", sk);
3809
3810         memset(&buf, 0, sizeof(buf));
3811
3812 #ifdef CONFIG_BT_FEATURE_DEBUG
3813         if (!hdev) {
3814                 flags = bt_dbg_get() ? BIT(0) : 0;
3815
3816                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3817                 rp->features[idx].flags = cpu_to_le32(flags);
3818                 idx++;
3819         }
3820 #endif
3821
3822         if (hdev) {
3823                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3824                     (hdev->le_states[4] & 0x08) &&      /* Central */
3825                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3826                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3827                         flags = BIT(0);
3828                 else
3829                         flags = 0;
3830
3831                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3832                 rp->features[idx].flags = cpu_to_le32(flags);
3833                 idx++;
3834         }
3835
3836         if (hdev && use_ll_privacy(hdev)) {
3837                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3838                         flags = BIT(0) | BIT(1);
3839                 else
3840                         flags = BIT(1);
3841
3842                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3843                 rp->features[idx].flags = cpu_to_le32(flags);
3844                 idx++;
3845         }
3846
3847         rp->feature_count = cpu_to_le16(idx);
3848
3849         /* After reading the experimental features information, enable
3850          * the events to update client on any future change.
3851          */
3852         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3853
3854         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3855                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3856                                  0, rp, sizeof(*rp) + (20 * idx));
3857 }
3858
3859 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3860                                           struct sock *skip)
3861 {
3862         struct mgmt_ev_exp_feature_changed ev;
3863
3864         memset(&ev, 0, sizeof(ev));
3865         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3866         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3867
3868         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3869                                   &ev, sizeof(ev),
3870                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3871
3872 }
3873
3874 #ifdef CONFIG_BT_FEATURE_DEBUG
3875 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3876 {
3877         struct mgmt_ev_exp_feature_changed ev;
3878
3879         memset(&ev, 0, sizeof(ev));
3880         memcpy(ev.uuid, debug_uuid, 16);
3881         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3882
3883         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3884                                   &ev, sizeof(ev),
3885                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3886 }
3887 #endif
3888
3889 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3890                            void *data, u16 data_len)
3891 {
3892         struct mgmt_cp_set_exp_feature *cp = data;
3893         struct mgmt_rp_set_exp_feature rp;
3894
3895         bt_dev_dbg(hdev, "sock %p", sk);
3896
3897         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3898                 memset(rp.uuid, 0, 16);
3899                 rp.flags = cpu_to_le32(0);
3900
3901 #ifdef CONFIG_BT_FEATURE_DEBUG
3902                 if (!hdev) {
3903                         bool changed = bt_dbg_get();
3904
3905                         bt_dbg_set(false);
3906
3907                         if (changed)
3908                                 exp_debug_feature_changed(false, sk);
3909                 }
3910 #endif
3911
3912                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3913                         bool changed = hci_dev_test_flag(hdev,
3914                                                          HCI_ENABLE_LL_PRIVACY);
3915
3916                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3917
3918                         if (changed)
3919                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3920                 }
3921
3922                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3923
3924                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3925                                          MGMT_OP_SET_EXP_FEATURE, 0,
3926                                          &rp, sizeof(rp));
3927         }
3928
3929 #ifdef CONFIG_BT_FEATURE_DEBUG
3930         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3931                 bool val, changed;
3932                 int err;
3933
3934                 /* Command requires to use the non-controller index */
3935                 if (hdev)
3936                         return mgmt_cmd_status(sk, hdev->id,
3937                                                MGMT_OP_SET_EXP_FEATURE,
3938                                                MGMT_STATUS_INVALID_INDEX);
3939
3940                 /* Parameters are limited to a single octet */
3941                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3942                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3943                                                MGMT_OP_SET_EXP_FEATURE,
3944                                                MGMT_STATUS_INVALID_PARAMS);
3945
3946                 /* Only boolean on/off is supported */
3947                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3948                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3949                                                MGMT_OP_SET_EXP_FEATURE,
3950                                                MGMT_STATUS_INVALID_PARAMS);
3951
3952                 val = !!cp->param[0];
3953                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3954                 bt_dbg_set(val);
3955
3956                 memcpy(rp.uuid, debug_uuid, 16);
3957                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3958
3959                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3960
3961                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3962                                         MGMT_OP_SET_EXP_FEATURE, 0,
3963                                         &rp, sizeof(rp));
3964
3965                 if (changed)
3966                         exp_debug_feature_changed(val, sk);
3967
3968                 return err;
3969         }
3970 #endif
3971
3972         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3973                 bool val, changed;
3974                 int err;
3975                 u32 flags;
3976
3977                 /* Command requires to use the controller index */
3978                 if (!hdev)
3979                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3980                                                MGMT_OP_SET_EXP_FEATURE,
3981                                                MGMT_STATUS_INVALID_INDEX);
3982
3983                 /* Changes can only be made when controller is powered down */
3984                 if (hdev_is_powered(hdev))
3985                         return mgmt_cmd_status(sk, hdev->id,
3986                                                MGMT_OP_SET_EXP_FEATURE,
3987                                                MGMT_STATUS_REJECTED);
3988
3989                 /* Parameters are limited to a single octet */
3990                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3991                         return mgmt_cmd_status(sk, hdev->id,
3992                                                MGMT_OP_SET_EXP_FEATURE,
3993                                                MGMT_STATUS_INVALID_PARAMS);
3994
3995                 /* Only boolean on/off is supported */
3996                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3997                         return mgmt_cmd_status(sk, hdev->id,
3998                                                MGMT_OP_SET_EXP_FEATURE,
3999                                                MGMT_STATUS_INVALID_PARAMS);
4000
4001                 val = !!cp->param[0];
4002
4003                 if (val) {
4004                         changed = !hci_dev_test_flag(hdev,
4005                                                      HCI_ENABLE_LL_PRIVACY);
4006                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4007                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4008
4009                         /* Enable LL privacy + supported settings changed */
4010                         flags = BIT(0) | BIT(1);
4011                 } else {
4012                         changed = hci_dev_test_flag(hdev,
4013                                                     HCI_ENABLE_LL_PRIVACY);
4014                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4015
4016                         /* Disable LL privacy + supported settings changed */
4017                         flags = BIT(1);
4018                 }
4019
4020                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4021                 rp.flags = cpu_to_le32(flags);
4022
4023                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4024
4025                 err = mgmt_cmd_complete(sk, hdev->id,
4026                                         MGMT_OP_SET_EXP_FEATURE, 0,
4027                                         &rp, sizeof(rp));
4028
4029                 if (changed)
4030                         exp_ll_privacy_feature_changed(val, hdev, sk);
4031
4032                 return err;
4033         }
4034
4035         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4036                                MGMT_OP_SET_EXP_FEATURE,
4037                                MGMT_STATUS_NOT_SUPPORTED);
4038 }
4039
4040 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4041
4042 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4043                             u16 data_len)
4044 {
4045         struct mgmt_cp_get_device_flags *cp = data;
4046         struct mgmt_rp_get_device_flags rp;
4047         struct bdaddr_list_with_flags *br_params;
4048         struct hci_conn_params *params;
4049         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4050         u32 current_flags = 0;
4051         u8 status = MGMT_STATUS_INVALID_PARAMS;
4052
4053         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4054                    &cp->addr.bdaddr, cp->addr.type);
4055
4056         hci_dev_lock(hdev);
4057
4058         if (cp->addr.type == BDADDR_BREDR) {
4059                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4060                                                               &cp->addr.bdaddr,
4061                                                               cp->addr.type);
4062                 if (!br_params)
4063                         goto done;
4064
4065                 current_flags = br_params->current_flags;
4066         } else {
4067                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4068                                                 le_addr_type(cp->addr.type));
4069
4070                 if (!params)
4071                         goto done;
4072
4073                 current_flags = params->current_flags;
4074         }
4075
4076         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4077         rp.addr.type = cp->addr.type;
4078         rp.supported_flags = cpu_to_le32(supported_flags);
4079         rp.current_flags = cpu_to_le32(current_flags);
4080
4081         status = MGMT_STATUS_SUCCESS;
4082
4083 done:
4084         hci_dev_unlock(hdev);
4085
4086         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4087                                 &rp, sizeof(rp));
4088 }
4089
4090 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4091                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4092                                  u32 supported_flags, u32 current_flags)
4093 {
4094         struct mgmt_ev_device_flags_changed ev;
4095
4096         bacpy(&ev.addr.bdaddr, bdaddr);
4097         ev.addr.type = bdaddr_type;
4098         ev.supported_flags = cpu_to_le32(supported_flags);
4099         ev.current_flags = cpu_to_le32(current_flags);
4100
4101         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4102 }
4103
4104 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4105                             u16 len)
4106 {
4107         struct mgmt_cp_set_device_flags *cp = data;
4108         struct bdaddr_list_with_flags *br_params;
4109         struct hci_conn_params *params;
4110         u8 status = MGMT_STATUS_INVALID_PARAMS;
4111         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4112         u32 current_flags = __le32_to_cpu(cp->current_flags);
4113
4114         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4115                    &cp->addr.bdaddr, cp->addr.type,
4116                    __le32_to_cpu(current_flags));
4117
4118         if ((supported_flags | current_flags) != supported_flags) {
4119                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4120                             current_flags, supported_flags);
4121                 goto done;
4122         }
4123
4124         hci_dev_lock(hdev);
4125
4126         if (cp->addr.type == BDADDR_BREDR) {
4127                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4128                                                               &cp->addr.bdaddr,
4129                                                               cp->addr.type);
4130
4131                 if (br_params) {
4132                         br_params->current_flags = current_flags;
4133                         status = MGMT_STATUS_SUCCESS;
4134                 } else {
4135                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4136                                     &cp->addr.bdaddr, cp->addr.type);
4137                 }
4138         } else {
4139                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4140                                                 le_addr_type(cp->addr.type));
4141                 if (params) {
4142                         params->current_flags = current_flags;
4143                         status = MGMT_STATUS_SUCCESS;
4144                 } else {
4145                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4146                                     &cp->addr.bdaddr,
4147                                     le_addr_type(cp->addr.type));
4148                 }
4149         }
4150
4151 done:
4152         hci_dev_unlock(hdev);
4153
4154         if (status == MGMT_STATUS_SUCCESS)
4155                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4156                                      supported_flags, current_flags);
4157
4158         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4159                                  &cp->addr, sizeof(cp->addr));
4160 }
4161
4162 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4163                                    u16 handle)
4164 {
4165         struct mgmt_ev_adv_monitor_added ev;
4166
4167         ev.monitor_handle = cpu_to_le16(handle);
4168
4169         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4170 }
4171
4172 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4173 {
4174         struct mgmt_ev_adv_monitor_removed ev;
4175         struct mgmt_pending_cmd *cmd;
4176         struct sock *sk_skip = NULL;
4177         struct mgmt_cp_remove_adv_monitor *cp;
4178
4179         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4180         if (cmd) {
4181                 cp = cmd->param;
4182
4183                 if (cp->monitor_handle)
4184                         sk_skip = cmd->sk;
4185         }
4186
4187         ev.monitor_handle = cpu_to_le16(handle);
4188
4189         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4190 }
4191
4192 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4193                                  void *data, u16 len)
4194 {
4195         struct adv_monitor *monitor = NULL;
4196         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4197         int handle, err;
4198         size_t rp_size = 0;
4199         __u32 supported = 0;
4200         __u32 enabled = 0;
4201         __u16 num_handles = 0;
4202         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4203
4204         BT_DBG("request for %s", hdev->name);
4205
4206         hci_dev_lock(hdev);
4207
4208         if (msft_monitor_supported(hdev))
4209                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4210
4211         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4212                 handles[num_handles++] = monitor->handle;
4213
4214         hci_dev_unlock(hdev);
4215
4216         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4217         rp = kmalloc(rp_size, GFP_KERNEL);
4218         if (!rp)
4219                 return -ENOMEM;
4220
4221         /* All supported features are currently enabled */
4222         enabled = supported;
4223
4224         rp->supported_features = cpu_to_le32(supported);
4225         rp->enabled_features = cpu_to_le32(enabled);
4226         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4227         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4228         rp->num_handles = cpu_to_le16(num_handles);
4229         if (num_handles)
4230                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4231
4232         err = mgmt_cmd_complete(sk, hdev->id,
4233                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4234                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4235
4236         kfree(rp);
4237
4238         return err;
4239 }
4240
4241 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4242 {
4243         struct mgmt_rp_add_adv_patterns_monitor rp;
4244         struct mgmt_pending_cmd *cmd;
4245         struct adv_monitor *monitor;
4246         int err = 0;
4247
4248         hci_dev_lock(hdev);
4249
4250         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4251         if (!cmd) {
4252                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4253                 if (!cmd)
4254                         goto done;
4255         }
4256
4257         monitor = cmd->user_data;
4258         rp.monitor_handle = cpu_to_le16(monitor->handle);
4259
4260         if (!status) {
4261                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4262                 hdev->adv_monitors_cnt++;
4263                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4264                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4265                 hci_update_background_scan(hdev);
4266         }
4267
4268         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4269                                 mgmt_status(status), &rp, sizeof(rp));
4270         mgmt_pending_remove(cmd);
4271
4272 done:
4273         hci_dev_unlock(hdev);
4274         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
4275                    rp.monitor_handle, status);
4276
4277         return err;
4278 }
4279
4280 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4281                                       struct adv_monitor *m, u8 status,
4282                                       void *data, u16 len, u16 op)
4283 {
4284         struct mgmt_rp_add_adv_patterns_monitor rp;
4285         struct mgmt_pending_cmd *cmd;
4286         int err;
4287         bool pending;
4288
4289         hci_dev_lock(hdev);
4290
4291         if (status)
4292                 goto unlock;
4293
4294         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4295             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4296             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4297             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4298                 status = MGMT_STATUS_BUSY;
4299                 goto unlock;
4300         }
4301
4302         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4303         if (!cmd) {
4304                 status = MGMT_STATUS_NO_RESOURCES;
4305                 goto unlock;
4306         }
4307
4308         cmd->user_data = m;
4309         pending = hci_add_adv_monitor(hdev, m, &err);
4310         if (err) {
4311                 if (err == -ENOSPC || err == -ENOMEM)
4312                         status = MGMT_STATUS_NO_RESOURCES;
4313                 else if (err == -EINVAL)
4314                         status = MGMT_STATUS_INVALID_PARAMS;
4315                 else
4316                         status = MGMT_STATUS_FAILED;
4317
4318                 mgmt_pending_remove(cmd);
4319                 goto unlock;
4320         }
4321
4322         if (!pending) {
4323                 mgmt_pending_remove(cmd);
4324                 rp.monitor_handle = cpu_to_le16(m->handle);
4325                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4326                 m->state = ADV_MONITOR_STATE_REGISTERED;
4327                 hdev->adv_monitors_cnt++;
4328
4329                 hci_dev_unlock(hdev);
4330                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4331                                          &rp, sizeof(rp));
4332         }
4333
4334         hci_dev_unlock(hdev);
4335
4336         return 0;
4337
4338 unlock:
4339         hci_free_adv_monitor(hdev, m);
4340         hci_dev_unlock(hdev);
4341         return mgmt_cmd_status(sk, hdev->id, op, status);
4342 }
4343
4344 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4345                                    struct mgmt_adv_rssi_thresholds *rssi)
4346 {
4347         if (rssi) {
4348                 m->rssi.low_threshold = rssi->low_threshold;
4349                 m->rssi.low_threshold_timeout =
4350                     __le16_to_cpu(rssi->low_threshold_timeout);
4351                 m->rssi.high_threshold = rssi->high_threshold;
4352                 m->rssi.high_threshold_timeout =
4353                     __le16_to_cpu(rssi->high_threshold_timeout);
4354                 m->rssi.sampling_period = rssi->sampling_period;
4355         } else {
4356                 /* Default values. These numbers are the least constricting
4357                  * parameters for MSFT API to work, so it behaves as if there
4358                  * are no rssi parameter to consider. May need to be changed
4359                  * if other API are to be supported.
4360                  */
4361                 m->rssi.low_threshold = -127;
4362                 m->rssi.low_threshold_timeout = 60;
4363                 m->rssi.high_threshold = -127;
4364                 m->rssi.high_threshold_timeout = 0;
4365                 m->rssi.sampling_period = 0;
4366         }
4367 }
4368
4369 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4370                                     struct mgmt_adv_pattern *patterns)
4371 {
4372         u8 offset = 0, length = 0;
4373         struct adv_pattern *p = NULL;
4374         int i;
4375
4376         for (i = 0; i < pattern_count; i++) {
4377                 offset = patterns[i].offset;
4378                 length = patterns[i].length;
4379                 if (offset >= HCI_MAX_AD_LENGTH ||
4380                     length > HCI_MAX_AD_LENGTH ||
4381                     (offset + length) > HCI_MAX_AD_LENGTH)
4382                         return MGMT_STATUS_INVALID_PARAMS;
4383
4384                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4385                 if (!p)
4386                         return MGMT_STATUS_NO_RESOURCES;
4387
4388                 p->ad_type = patterns[i].ad_type;
4389                 p->offset = patterns[i].offset;
4390                 p->length = patterns[i].length;
4391                 memcpy(p->value, patterns[i].value, p->length);
4392
4393                 INIT_LIST_HEAD(&p->list);
4394                 list_add(&p->list, &m->patterns);
4395         }
4396
4397         return MGMT_STATUS_SUCCESS;
4398 }
4399
4400 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4401                                     void *data, u16 len)
4402 {
4403         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4404         struct adv_monitor *m = NULL;
4405         u8 status = MGMT_STATUS_SUCCESS;
4406         size_t expected_size = sizeof(*cp);
4407
4408         BT_DBG("request for %s", hdev->name);
4409
4410         if (len <= sizeof(*cp)) {
4411                 status = MGMT_STATUS_INVALID_PARAMS;
4412                 goto done;
4413         }
4414
4415         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4416         if (len != expected_size) {
4417                 status = MGMT_STATUS_INVALID_PARAMS;
4418                 goto done;
4419         }
4420
4421         m = kzalloc(sizeof(*m), GFP_KERNEL);
4422         if (!m) {
4423                 status = MGMT_STATUS_NO_RESOURCES;
4424                 goto done;
4425         }
4426
4427         INIT_LIST_HEAD(&m->patterns);
4428
4429         parse_adv_monitor_rssi(m, NULL);
4430         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4431
4432 done:
4433         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4434                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4435 }
4436
4437 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4438                                          void *data, u16 len)
4439 {
4440         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4441         struct adv_monitor *m = NULL;
4442         u8 status = MGMT_STATUS_SUCCESS;
4443         size_t expected_size = sizeof(*cp);
4444
4445         BT_DBG("request for %s", hdev->name);
4446
4447         if (len <= sizeof(*cp)) {
4448                 status = MGMT_STATUS_INVALID_PARAMS;
4449                 goto done;
4450         }
4451
4452         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4453         if (len != expected_size) {
4454                 status = MGMT_STATUS_INVALID_PARAMS;
4455                 goto done;
4456         }
4457
4458         m = kzalloc(sizeof(*m), GFP_KERNEL);
4459         if (!m) {
4460                 status = MGMT_STATUS_NO_RESOURCES;
4461                 goto done;
4462         }
4463
4464         INIT_LIST_HEAD(&m->patterns);
4465
4466         parse_adv_monitor_rssi(m, &cp->rssi);
4467         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4468
4469 done:
4470         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4471                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4472 }
4473
4474 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4475 {
4476         struct mgmt_rp_remove_adv_monitor rp;
4477         struct mgmt_cp_remove_adv_monitor *cp;
4478         struct mgmt_pending_cmd *cmd;
4479         int err = 0;
4480
4481         hci_dev_lock(hdev);
4482
4483         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4484         if (!cmd)
4485                 goto done;
4486
4487         cp = cmd->param;
4488         rp.monitor_handle = cp->monitor_handle;
4489
4490         if (!status)
4491                 hci_update_background_scan(hdev);
4492
4493         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4494                                 mgmt_status(status), &rp, sizeof(rp));
4495         mgmt_pending_remove(cmd);
4496
4497 done:
4498         hci_dev_unlock(hdev);
4499         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
4500                    rp.monitor_handle, status);
4501
4502         return err;
4503 }
4504
4505 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4506                               void *data, u16 len)
4507 {
4508         struct mgmt_cp_remove_adv_monitor *cp = data;
4509         struct mgmt_rp_remove_adv_monitor rp;
4510         struct mgmt_pending_cmd *cmd;
4511         u16 handle = __le16_to_cpu(cp->monitor_handle);
4512         int err, status;
4513         bool pending;
4514
4515         BT_DBG("request for %s", hdev->name);
4516         rp.monitor_handle = cp->monitor_handle;
4517
4518         hci_dev_lock(hdev);
4519
4520         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4521             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4522             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4523             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4524                 status = MGMT_STATUS_BUSY;
4525                 goto unlock;
4526         }
4527
4528         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4529         if (!cmd) {
4530                 status = MGMT_STATUS_NO_RESOURCES;
4531                 goto unlock;
4532         }
4533
4534         if (handle)
4535                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4536         else
4537                 pending = hci_remove_all_adv_monitor(hdev, &err);
4538
4539         if (err) {
4540                 mgmt_pending_remove(cmd);
4541
4542                 if (err == -ENOENT)
4543                         status = MGMT_STATUS_INVALID_INDEX;
4544                 else
4545                         status = MGMT_STATUS_FAILED;
4546
4547                 goto unlock;
4548         }
4549
4550         /* monitor can be removed without forwarding request to controller */
4551         if (!pending) {
4552                 mgmt_pending_remove(cmd);
4553                 hci_dev_unlock(hdev);
4554
4555                 return mgmt_cmd_complete(sk, hdev->id,
4556                                          MGMT_OP_REMOVE_ADV_MONITOR,
4557                                          MGMT_STATUS_SUCCESS,
4558                                          &rp, sizeof(rp));
4559         }
4560
4561         hci_dev_unlock(hdev);
4562         return 0;
4563
4564 unlock:
4565         hci_dev_unlock(hdev);
4566         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4567                                status);
4568 }
4569
4570 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4571                                          u16 opcode, struct sk_buff *skb)
4572 {
4573         struct mgmt_rp_read_local_oob_data mgmt_rp;
4574         size_t rp_size = sizeof(mgmt_rp);
4575         struct mgmt_pending_cmd *cmd;
4576
4577         bt_dev_dbg(hdev, "status %u", status);
4578
4579         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4580         if (!cmd)
4581                 return;
4582
4583         if (status || !skb) {
4584                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4585                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4586                 goto remove;
4587         }
4588
4589         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4590
4591         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4592                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4593
4594                 if (skb->len < sizeof(*rp)) {
4595                         mgmt_cmd_status(cmd->sk, hdev->id,
4596                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4597                                         MGMT_STATUS_FAILED);
4598                         goto remove;
4599                 }
4600
4601                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4602                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4603
4604                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4605         } else {
4606                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4607
4608                 if (skb->len < sizeof(*rp)) {
4609                         mgmt_cmd_status(cmd->sk, hdev->id,
4610                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4611                                         MGMT_STATUS_FAILED);
4612                         goto remove;
4613                 }
4614
4615                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4616                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4617
4618                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4619                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4620         }
4621
4622         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4623                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4624
4625 remove:
4626         mgmt_pending_remove(cmd);
4627 }
4628
4629 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4630                                void *data, u16 data_len)
4631 {
4632         struct mgmt_pending_cmd *cmd;
4633         struct hci_request req;
4634         int err;
4635
4636         bt_dev_dbg(hdev, "sock %p", sk);
4637
4638         hci_dev_lock(hdev);
4639
4640         if (!hdev_is_powered(hdev)) {
4641                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4642                                       MGMT_STATUS_NOT_POWERED);
4643                 goto unlock;
4644         }
4645
4646         if (!lmp_ssp_capable(hdev)) {
4647                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4648                                       MGMT_STATUS_NOT_SUPPORTED);
4649                 goto unlock;
4650         }
4651
4652         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4654                                       MGMT_STATUS_BUSY);
4655                 goto unlock;
4656         }
4657
4658         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4659         if (!cmd) {
4660                 err = -ENOMEM;
4661                 goto unlock;
4662         }
4663
4664         hci_req_init(&req, hdev);
4665
4666         if (bredr_sc_enabled(hdev))
4667                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4668         else
4669                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4670
4671         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4672         if (err < 0)
4673                 mgmt_pending_remove(cmd);
4674
4675 unlock:
4676         hci_dev_unlock(hdev);
4677         return err;
4678 }
4679
4680 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4681                                void *data, u16 len)
4682 {
4683         struct mgmt_addr_info *addr = data;
4684         int err;
4685
4686         bt_dev_dbg(hdev, "sock %p", sk);
4687
4688         if (!bdaddr_type_is_valid(addr->type))
4689                 return mgmt_cmd_complete(sk, hdev->id,
4690                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4691                                          MGMT_STATUS_INVALID_PARAMS,
4692                                          addr, sizeof(*addr));
4693
4694         hci_dev_lock(hdev);
4695
4696         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4697                 struct mgmt_cp_add_remote_oob_data *cp = data;
4698                 u8 status;
4699
4700                 if (cp->addr.type != BDADDR_BREDR) {
4701                         err = mgmt_cmd_complete(sk, hdev->id,
4702                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4703                                                 MGMT_STATUS_INVALID_PARAMS,
4704                                                 &cp->addr, sizeof(cp->addr));
4705                         goto unlock;
4706                 }
4707
4708                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4709                                               cp->addr.type, cp->hash,
4710                                               cp->rand, NULL, NULL);
4711                 if (err < 0)
4712                         status = MGMT_STATUS_FAILED;
4713                 else
4714                         status = MGMT_STATUS_SUCCESS;
4715
4716                 err = mgmt_cmd_complete(sk, hdev->id,
4717                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4718                                         &cp->addr, sizeof(cp->addr));
4719         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4720                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4721                 u8 *rand192, *hash192, *rand256, *hash256;
4722                 u8 status;
4723
4724                 if (bdaddr_type_is_le(cp->addr.type)) {
4725                         /* Enforce zero-valued 192-bit parameters as
4726                          * long as legacy SMP OOB isn't implemented.
4727                          */
4728                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4729                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4730                                 err = mgmt_cmd_complete(sk, hdev->id,
4731                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4732                                                         MGMT_STATUS_INVALID_PARAMS,
4733                                                         addr, sizeof(*addr));
4734                                 goto unlock;
4735                         }
4736
4737                         rand192 = NULL;
4738                         hash192 = NULL;
4739                 } else {
4740                         /* In case one of the P-192 values is set to zero,
4741                          * then just disable OOB data for P-192.
4742                          */
4743                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4744                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4745                                 rand192 = NULL;
4746                                 hash192 = NULL;
4747                         } else {
4748                                 rand192 = cp->rand192;
4749                                 hash192 = cp->hash192;
4750                         }
4751                 }
4752
4753                 /* In case one of the P-256 values is set to zero, then just
4754                  * disable OOB data for P-256.
4755                  */
4756                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4757                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4758                         rand256 = NULL;
4759                         hash256 = NULL;
4760                 } else {
4761                         rand256 = cp->rand256;
4762                         hash256 = cp->hash256;
4763                 }
4764
4765                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4766                                               cp->addr.type, hash192, rand192,
4767                                               hash256, rand256);
4768                 if (err < 0)
4769                         status = MGMT_STATUS_FAILED;
4770                 else
4771                         status = MGMT_STATUS_SUCCESS;
4772
4773                 err = mgmt_cmd_complete(sk, hdev->id,
4774                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4775                                         status, &cp->addr, sizeof(cp->addr));
4776         } else {
4777                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4778                            len);
4779                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4780                                       MGMT_STATUS_INVALID_PARAMS);
4781         }
4782
4783 unlock:
4784         hci_dev_unlock(hdev);
4785         return err;
4786 }
4787
4788 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4789                                   void *data, u16 len)
4790 {
4791         struct mgmt_cp_remove_remote_oob_data *cp = data;
4792         u8 status;
4793         int err;
4794
4795         bt_dev_dbg(hdev, "sock %p", sk);
4796
4797         if (cp->addr.type != BDADDR_BREDR)
4798                 return mgmt_cmd_complete(sk, hdev->id,
4799                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4800                                          MGMT_STATUS_INVALID_PARAMS,
4801                                          &cp->addr, sizeof(cp->addr));
4802
4803         hci_dev_lock(hdev);
4804
4805         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4806                 hci_remote_oob_data_clear(hdev);
4807                 status = MGMT_STATUS_SUCCESS;
4808                 goto done;
4809         }
4810
4811         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4812         if (err < 0)
4813                 status = MGMT_STATUS_INVALID_PARAMS;
4814         else
4815                 status = MGMT_STATUS_SUCCESS;
4816
4817 done:
4818         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4819                                 status, &cp->addr, sizeof(cp->addr));
4820
4821         hci_dev_unlock(hdev);
4822         return err;
4823 }
4824
4825 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4826 {
4827         struct mgmt_pending_cmd *cmd;
4828
4829         bt_dev_dbg(hdev, "status %d", status);
4830
4831         hci_dev_lock(hdev);
4832
4833         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4834         if (!cmd)
4835                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4836
4837         if (!cmd)
4838                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4839
4840         if (cmd) {
4841                 cmd->cmd_complete(cmd, mgmt_status(status));
4842                 mgmt_pending_remove(cmd);
4843         }
4844
4845         hci_dev_unlock(hdev);
4846
4847         /* Handle suspend notifier */
4848         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4849                                hdev->suspend_tasks)) {
4850                 bt_dev_dbg(hdev, "Unpaused discovery");
4851                 wake_up(&hdev->suspend_wait_q);
4852         }
4853 }
4854
4855 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4856                                     uint8_t *mgmt_status)
4857 {
4858         switch (type) {
4859         case DISCOV_TYPE_LE:
4860                 *mgmt_status = mgmt_le_support(hdev);
4861                 if (*mgmt_status)
4862                         return false;
4863                 break;
4864         case DISCOV_TYPE_INTERLEAVED:
4865                 *mgmt_status = mgmt_le_support(hdev);
4866                 if (*mgmt_status)
4867                         return false;
4868                 fallthrough;
4869         case DISCOV_TYPE_BREDR:
4870                 *mgmt_status = mgmt_bredr_support(hdev);
4871                 if (*mgmt_status)
4872                         return false;
4873                 break;
4874         default:
4875                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4876                 return false;
4877         }
4878
4879         return true;
4880 }
4881
4882 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4883                                     u16 op, void *data, u16 len)
4884 {
4885         struct mgmt_cp_start_discovery *cp = data;
4886         struct mgmt_pending_cmd *cmd;
4887         u8 status;
4888         int err;
4889
4890         bt_dev_dbg(hdev, "sock %p", sk);
4891
4892         hci_dev_lock(hdev);
4893
4894         if (!hdev_is_powered(hdev)) {
4895                 err = mgmt_cmd_complete(sk, hdev->id, op,
4896                                         MGMT_STATUS_NOT_POWERED,
4897                                         &cp->type, sizeof(cp->type));
4898                 goto failed;
4899         }
4900
4901         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4902             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4903                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4904                                         &cp->type, sizeof(cp->type));
4905                 goto failed;
4906         }
4907
4908         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4909                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4910                                         &cp->type, sizeof(cp->type));
4911                 goto failed;
4912         }
4913
4914         /* Can't start discovery when it is paused */
4915         if (hdev->discovery_paused) {
4916                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4917                                         &cp->type, sizeof(cp->type));
4918                 goto failed;
4919         }
4920
4921         /* Clear the discovery filter first to free any previously
4922          * allocated memory for the UUID list.
4923          */
4924         hci_discovery_filter_clear(hdev);
4925
4926         hdev->discovery.type = cp->type;
4927         hdev->discovery.report_invalid_rssi = false;
4928         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4929                 hdev->discovery.limited = true;
4930         else
4931                 hdev->discovery.limited = false;
4932
4933         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4934         if (!cmd) {
4935                 err = -ENOMEM;
4936                 goto failed;
4937         }
4938
4939         cmd->cmd_complete = generic_cmd_complete;
4940
4941         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4942         queue_work(hdev->req_workqueue, &hdev->discov_update);
4943         err = 0;
4944
4945 failed:
4946         hci_dev_unlock(hdev);
4947         return err;
4948 }
4949
4950 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4951                            void *data, u16 len)
4952 {
4953         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4954                                         data, len);
4955 }
4956
4957 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4958                                    void *data, u16 len)
4959 {
4960         return start_discovery_internal(sk, hdev,
4961                                         MGMT_OP_START_LIMITED_DISCOVERY,
4962                                         data, len);
4963 }
4964
4965 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4966                                           u8 status)
4967 {
4968         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4969                                  cmd->param, 1);
4970 }
4971
4972 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4973                                    void *data, u16 len)
4974 {
4975         struct mgmt_cp_start_service_discovery *cp = data;
4976         struct mgmt_pending_cmd *cmd;
4977         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4978         u16 uuid_count, expected_len;
4979         u8 status;
4980         int err;
4981
4982         bt_dev_dbg(hdev, "sock %p", sk);
4983
4984         hci_dev_lock(hdev);
4985
4986         if (!hdev_is_powered(hdev)) {
4987                 err = mgmt_cmd_complete(sk, hdev->id,
4988                                         MGMT_OP_START_SERVICE_DISCOVERY,
4989                                         MGMT_STATUS_NOT_POWERED,
4990                                         &cp->type, sizeof(cp->type));
4991                 goto failed;
4992         }
4993
4994         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4995             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4996                 err = mgmt_cmd_complete(sk, hdev->id,
4997                                         MGMT_OP_START_SERVICE_DISCOVERY,
4998                                         MGMT_STATUS_BUSY, &cp->type,
4999                                         sizeof(cp->type));
5000                 goto failed;
5001         }
5002
5003         if (hdev->discovery_paused) {
5004                 err = mgmt_cmd_complete(sk, hdev->id,
5005                                         MGMT_OP_START_SERVICE_DISCOVERY,
5006                                         MGMT_STATUS_BUSY, &cp->type,
5007                                         sizeof(cp->type));
5008                 goto failed;
5009         }
5010
5011         uuid_count = __le16_to_cpu(cp->uuid_count);
5012         if (uuid_count > max_uuid_count) {
5013                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5014                            uuid_count);
5015                 err = mgmt_cmd_complete(sk, hdev->id,
5016                                         MGMT_OP_START_SERVICE_DISCOVERY,
5017                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5018                                         sizeof(cp->type));
5019                 goto failed;
5020         }
5021
5022         expected_len = sizeof(*cp) + uuid_count * 16;
5023         if (expected_len != len) {
5024                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5025                            expected_len, len);
5026                 err = mgmt_cmd_complete(sk, hdev->id,
5027                                         MGMT_OP_START_SERVICE_DISCOVERY,
5028                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5029                                         sizeof(cp->type));
5030                 goto failed;
5031         }
5032
5033         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5034                 err = mgmt_cmd_complete(sk, hdev->id,
5035                                         MGMT_OP_START_SERVICE_DISCOVERY,
5036                                         status, &cp->type, sizeof(cp->type));
5037                 goto failed;
5038         }
5039
5040         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5041                                hdev, data, len);
5042         if (!cmd) {
5043                 err = -ENOMEM;
5044                 goto failed;
5045         }
5046
5047         cmd->cmd_complete = service_discovery_cmd_complete;
5048
5049         /* Clear the discovery filter first to free any previously
5050          * allocated memory for the UUID list.
5051          */
5052         hci_discovery_filter_clear(hdev);
5053
5054         hdev->discovery.result_filtering = true;
5055         hdev->discovery.type = cp->type;
5056         hdev->discovery.rssi = cp->rssi;
5057         hdev->discovery.uuid_count = uuid_count;
5058
5059         if (uuid_count > 0) {
5060                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5061                                                 GFP_KERNEL);
5062                 if (!hdev->discovery.uuids) {
5063                         err = mgmt_cmd_complete(sk, hdev->id,
5064                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5065                                                 MGMT_STATUS_FAILED,
5066                                                 &cp->type, sizeof(cp->type));
5067                         mgmt_pending_remove(cmd);
5068                         goto failed;
5069                 }
5070         }
5071
5072         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5073         queue_work(hdev->req_workqueue, &hdev->discov_update);
5074         err = 0;
5075
5076 failed:
5077         hci_dev_unlock(hdev);
5078         return err;
5079 }
5080
5081 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5082 {
5083         struct mgmt_pending_cmd *cmd;
5084
5085         bt_dev_dbg(hdev, "status %d", status);
5086
5087         hci_dev_lock(hdev);
5088
5089         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5090         if (cmd) {
5091                 cmd->cmd_complete(cmd, mgmt_status(status));
5092                 mgmt_pending_remove(cmd);
5093         }
5094
5095         hci_dev_unlock(hdev);
5096
5097         /* Handle suspend notifier */
5098         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5099                 bt_dev_dbg(hdev, "Paused discovery");
5100                 wake_up(&hdev->suspend_wait_q);
5101         }
5102 }
5103
5104 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5105                           u16 len)
5106 {
5107         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5108         struct mgmt_pending_cmd *cmd;
5109         int err;
5110
5111         bt_dev_dbg(hdev, "sock %p", sk);
5112
5113         hci_dev_lock(hdev);
5114
5115         if (!hci_discovery_active(hdev)) {
5116                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5117                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5118                                         sizeof(mgmt_cp->type));
5119                 goto unlock;
5120         }
5121
5122         if (hdev->discovery.type != mgmt_cp->type) {
5123                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5124                                         MGMT_STATUS_INVALID_PARAMS,
5125                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5126                 goto unlock;
5127         }
5128
5129         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5130         if (!cmd) {
5131                 err = -ENOMEM;
5132                 goto unlock;
5133         }
5134
5135         cmd->cmd_complete = generic_cmd_complete;
5136
5137         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5138         queue_work(hdev->req_workqueue, &hdev->discov_update);
5139         err = 0;
5140
5141 unlock:
5142         hci_dev_unlock(hdev);
5143         return err;
5144 }
5145
5146 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5147                         u16 len)
5148 {
5149         struct mgmt_cp_confirm_name *cp = data;
5150         struct inquiry_entry *e;
5151         int err;
5152
5153         bt_dev_dbg(hdev, "sock %p", sk);
5154
5155         hci_dev_lock(hdev);
5156
5157         if (!hci_discovery_active(hdev)) {
5158                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5159                                         MGMT_STATUS_FAILED, &cp->addr,
5160                                         sizeof(cp->addr));
5161                 goto failed;
5162         }
5163
5164         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5165         if (!e) {
5166                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5167                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5168                                         sizeof(cp->addr));
5169                 goto failed;
5170         }
5171
5172         if (cp->name_known) {
5173                 e->name_state = NAME_KNOWN;
5174                 list_del(&e->list);
5175         } else {
5176                 e->name_state = NAME_NEEDED;
5177                 hci_inquiry_cache_update_resolve(hdev, e);
5178         }
5179
5180         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5181                                 &cp->addr, sizeof(cp->addr));
5182
5183 failed:
5184         hci_dev_unlock(hdev);
5185         return err;
5186 }
5187
5188 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5189                         u16 len)
5190 {
5191         struct mgmt_cp_block_device *cp = data;
5192         u8 status;
5193         int err;
5194
5195         bt_dev_dbg(hdev, "sock %p", sk);
5196
5197         if (!bdaddr_type_is_valid(cp->addr.type))
5198                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5199                                          MGMT_STATUS_INVALID_PARAMS,
5200                                          &cp->addr, sizeof(cp->addr));
5201
5202         hci_dev_lock(hdev);
5203
5204         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
5205                                   cp->addr.type);
5206         if (err < 0) {
5207                 status = MGMT_STATUS_FAILED;
5208                 goto done;
5209         }
5210
5211         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5212                    sk);
5213         status = MGMT_STATUS_SUCCESS;
5214
5215 done:
5216         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5217                                 &cp->addr, sizeof(cp->addr));
5218
5219         hci_dev_unlock(hdev);
5220
5221         return err;
5222 }
5223
5224 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5225                           u16 len)
5226 {
5227         struct mgmt_cp_unblock_device *cp = data;
5228         u8 status;
5229         int err;
5230
5231         bt_dev_dbg(hdev, "sock %p", sk);
5232
5233         if (!bdaddr_type_is_valid(cp->addr.type))
5234                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5235                                          MGMT_STATUS_INVALID_PARAMS,
5236                                          &cp->addr, sizeof(cp->addr));
5237
5238         hci_dev_lock(hdev);
5239
5240         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5241                                   cp->addr.type);
5242         if (err < 0) {
5243                 status = MGMT_STATUS_INVALID_PARAMS;
5244                 goto done;
5245         }
5246
5247         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5248                    sk);
5249         status = MGMT_STATUS_SUCCESS;
5250
5251 done:
5252         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5253                                 &cp->addr, sizeof(cp->addr));
5254
5255         hci_dev_unlock(hdev);
5256
5257         return err;
5258 }
5259
5260 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5261                          u16 len)
5262 {
5263         struct mgmt_cp_set_device_id *cp = data;
5264         struct hci_request req;
5265         int err;
5266         __u16 source;
5267
5268         bt_dev_dbg(hdev, "sock %p", sk);
5269
5270         source = __le16_to_cpu(cp->source);
5271
5272         if (source > 0x0002)
5273                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5274                                        MGMT_STATUS_INVALID_PARAMS);
5275
5276         hci_dev_lock(hdev);
5277
5278         hdev->devid_source = source;
5279         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5280         hdev->devid_product = __le16_to_cpu(cp->product);
5281         hdev->devid_version = __le16_to_cpu(cp->version);
5282
5283         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5284                                 NULL, 0);
5285
5286         hci_req_init(&req, hdev);
5287         __hci_req_update_eir(&req);
5288         hci_req_run(&req, NULL);
5289
5290         hci_dev_unlock(hdev);
5291
5292         return err;
5293 }
5294
5295 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5296                                         u16 opcode)
5297 {
5298         bt_dev_dbg(hdev, "status %d", status);
5299 }
5300
5301 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5302                                      u16 opcode)
5303 {
5304         struct cmd_lookup match = { NULL, hdev };
5305         struct hci_request req;
5306         u8 instance;
5307         struct adv_info *adv_instance;
5308         int err;
5309
5310         hci_dev_lock(hdev);
5311
5312         if (status) {
5313                 u8 mgmt_err = mgmt_status(status);
5314
5315                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5316                                      cmd_status_rsp, &mgmt_err);
5317                 goto unlock;
5318         }
5319
5320         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5321                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5322         else
5323                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5324
5325         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5326                              &match);
5327
5328         new_settings(hdev, match.sk);
5329
5330         if (match.sk)
5331                 sock_put(match.sk);
5332
5333         /* Handle suspend notifier */
5334         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5335                                hdev->suspend_tasks)) {
5336                 bt_dev_dbg(hdev, "Paused advertising");
5337                 wake_up(&hdev->suspend_wait_q);
5338         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5339                                       hdev->suspend_tasks)) {
5340                 bt_dev_dbg(hdev, "Unpaused advertising");
5341                 wake_up(&hdev->suspend_wait_q);
5342         }
5343
5344         /* If "Set Advertising" was just disabled and instance advertising was
5345          * set up earlier, then re-enable multi-instance advertising.
5346          */
5347         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5348             list_empty(&hdev->adv_instances))
5349                 goto unlock;
5350
5351         instance = hdev->cur_adv_instance;
5352         if (!instance) {
5353                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5354                                                         struct adv_info, list);
5355                 if (!adv_instance)
5356                         goto unlock;
5357
5358                 instance = adv_instance->instance;
5359         }
5360
5361         hci_req_init(&req, hdev);
5362
5363         err = __hci_req_schedule_adv_instance(&req, instance, true);
5364
5365         if (!err)
5366                 err = hci_req_run(&req, enable_advertising_instance);
5367
5368         if (err)
5369                 bt_dev_err(hdev, "failed to re-configure advertising");
5370
5371 unlock:
5372         hci_dev_unlock(hdev);
5373 }
5374
5375 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5376                            u16 len)
5377 {
5378         struct mgmt_mode *cp = data;
5379         struct mgmt_pending_cmd *cmd;
5380         struct hci_request req;
5381         u8 val, status;
5382         int err;
5383
5384         bt_dev_dbg(hdev, "sock %p", sk);
5385
5386         status = mgmt_le_support(hdev);
5387         if (status)
5388                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5389                                        status);
5390
5391         /* Enabling the experimental LL Privay support disables support for
5392          * advertising.
5393          */
5394         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5395                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5396                                        MGMT_STATUS_NOT_SUPPORTED);
5397
5398         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5400                                        MGMT_STATUS_INVALID_PARAMS);
5401
5402         if (hdev->advertising_paused)
5403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5404                                        MGMT_STATUS_BUSY);
5405
5406         hci_dev_lock(hdev);
5407
5408         val = !!cp->val;
5409
5410         /* The following conditions are ones which mean that we should
5411          * not do any HCI communication but directly send a mgmt
5412          * response to user space (after toggling the flag if
5413          * necessary).
5414          */
5415         if (!hdev_is_powered(hdev) ||
5416             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5417              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5418             hci_conn_num(hdev, LE_LINK) > 0 ||
5419             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5420              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5421                 bool changed;
5422
5423                 if (cp->val) {
5424                         hdev->cur_adv_instance = 0x00;
5425                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5426                         if (cp->val == 0x02)
5427                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5428                         else
5429                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5430                 } else {
5431                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5432                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5433                 }
5434
5435                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5436                 if (err < 0)
5437                         goto unlock;
5438
5439                 if (changed)
5440                         err = new_settings(hdev, sk);
5441
5442                 goto unlock;
5443         }
5444
5445         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5446             pending_find(MGMT_OP_SET_LE, hdev)) {
5447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                       MGMT_STATUS_BUSY);
5449                 goto unlock;
5450         }
5451
5452         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5453         if (!cmd) {
5454                 err = -ENOMEM;
5455                 goto unlock;
5456         }
5457
5458         hci_req_init(&req, hdev);
5459
5460         if (cp->val == 0x02)
5461                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5462         else
5463                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5464
5465         cancel_adv_timeout(hdev);
5466
5467         if (val) {
5468                 /* Switch to instance "0" for the Set Advertising setting.
5469                  * We cannot use update_[adv|scan_rsp]_data() here as the
5470                  * HCI_ADVERTISING flag is not yet set.
5471                  */
5472                 hdev->cur_adv_instance = 0x00;
5473
5474                 if (ext_adv_capable(hdev)) {
5475                         __hci_req_start_ext_adv(&req, 0x00);
5476                 } else {
5477                         __hci_req_update_adv_data(&req, 0x00);
5478                         __hci_req_update_scan_rsp_data(&req, 0x00);
5479                         __hci_req_enable_advertising(&req);
5480                 }
5481         } else {
5482                 __hci_req_disable_advertising(&req);
5483         }
5484
5485         err = hci_req_run(&req, set_advertising_complete);
5486         if (err < 0)
5487                 mgmt_pending_remove(cmd);
5488
5489 unlock:
5490         hci_dev_unlock(hdev);
5491         return err;
5492 }
5493
5494 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5495                               void *data, u16 len)
5496 {
5497         struct mgmt_cp_set_static_address *cp = data;
5498         int err;
5499
5500         bt_dev_dbg(hdev, "sock %p", sk);
5501
5502         if (!lmp_le_capable(hdev))
5503                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5504                                        MGMT_STATUS_NOT_SUPPORTED);
5505
5506         if (hdev_is_powered(hdev))
5507                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5508                                        MGMT_STATUS_REJECTED);
5509
5510         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5511                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5512                         return mgmt_cmd_status(sk, hdev->id,
5513                                                MGMT_OP_SET_STATIC_ADDRESS,
5514                                                MGMT_STATUS_INVALID_PARAMS);
5515
5516                 /* Two most significant bits shall be set */
5517                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5518                         return mgmt_cmd_status(sk, hdev->id,
5519                                                MGMT_OP_SET_STATIC_ADDRESS,
5520                                                MGMT_STATUS_INVALID_PARAMS);
5521         }
5522
5523         hci_dev_lock(hdev);
5524
5525         bacpy(&hdev->static_addr, &cp->bdaddr);
5526
5527         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5528         if (err < 0)
5529                 goto unlock;
5530
5531         err = new_settings(hdev, sk);
5532
5533 unlock:
5534         hci_dev_unlock(hdev);
5535         return err;
5536 }
5537
5538 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5539                            void *data, u16 len)
5540 {
5541         struct mgmt_cp_set_scan_params *cp = data;
5542         __u16 interval, window;
5543         int err;
5544
5545         bt_dev_dbg(hdev, "sock %p", sk);
5546
5547         if (!lmp_le_capable(hdev))
5548                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5549                                        MGMT_STATUS_NOT_SUPPORTED);
5550
5551         interval = __le16_to_cpu(cp->interval);
5552
5553         if (interval < 0x0004 || interval > 0x4000)
5554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5555                                        MGMT_STATUS_INVALID_PARAMS);
5556
5557         window = __le16_to_cpu(cp->window);
5558
5559         if (window < 0x0004 || window > 0x4000)
5560                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5561                                        MGMT_STATUS_INVALID_PARAMS);
5562
5563         if (window > interval)
5564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5565                                        MGMT_STATUS_INVALID_PARAMS);
5566
5567         hci_dev_lock(hdev);
5568
5569         hdev->le_scan_interval = interval;
5570         hdev->le_scan_window = window;
5571
5572         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5573                                 NULL, 0);
5574
5575         /* If background scan is running, restart it so new parameters are
5576          * loaded.
5577          */
5578         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5579             hdev->discovery.state == DISCOVERY_STOPPED) {
5580                 struct hci_request req;
5581
5582                 hci_req_init(&req, hdev);
5583
5584                 hci_req_add_le_scan_disable(&req, false);
5585                 hci_req_add_le_passive_scan(&req);
5586
5587                 hci_req_run(&req, NULL);
5588         }
5589
5590         hci_dev_unlock(hdev);
5591
5592         return err;
5593 }
5594
5595 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5596                                       u16 opcode)
5597 {
5598         struct mgmt_pending_cmd *cmd;
5599
5600         bt_dev_dbg(hdev, "status 0x%02x", status);
5601
5602         hci_dev_lock(hdev);
5603
5604         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5605         if (!cmd)
5606                 goto unlock;
5607
5608         if (status) {
5609                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5610                                 mgmt_status(status));
5611         } else {
5612                 struct mgmt_mode *cp = cmd->param;
5613
5614                 if (cp->val)
5615                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5616                 else
5617                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5618
5619                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5620                 new_settings(hdev, cmd->sk);
5621         }
5622
5623         mgmt_pending_remove(cmd);
5624
5625 unlock:
5626         hci_dev_unlock(hdev);
5627 }
5628
5629 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5630                                 void *data, u16 len)
5631 {
5632         struct mgmt_mode *cp = data;
5633         struct mgmt_pending_cmd *cmd;
5634         struct hci_request req;
5635         int err;
5636
5637         bt_dev_dbg(hdev, "sock %p", sk);
5638
5639         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5640             hdev->hci_ver < BLUETOOTH_VER_1_2)
5641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5642                                        MGMT_STATUS_NOT_SUPPORTED);
5643
5644         if (cp->val != 0x00 && cp->val != 0x01)
5645                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5646                                        MGMT_STATUS_INVALID_PARAMS);
5647
5648         hci_dev_lock(hdev);
5649
5650         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5651                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5652                                       MGMT_STATUS_BUSY);
5653                 goto unlock;
5654         }
5655
5656         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5657                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                         hdev);
5659                 goto unlock;
5660         }
5661
5662         if (!hdev_is_powered(hdev)) {
5663                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5664                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5665                                         hdev);
5666                 new_settings(hdev, sk);
5667                 goto unlock;
5668         }
5669
5670         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5671                                data, len);
5672         if (!cmd) {
5673                 err = -ENOMEM;
5674                 goto unlock;
5675         }
5676
5677         hci_req_init(&req, hdev);
5678
5679         __hci_req_write_fast_connectable(&req, cp->val);
5680
5681         err = hci_req_run(&req, fast_connectable_complete);
5682         if (err < 0) {
5683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5684                                       MGMT_STATUS_FAILED);
5685                 mgmt_pending_remove(cmd);
5686         }
5687
5688 unlock:
5689         hci_dev_unlock(hdev);
5690
5691         return err;
5692 }
5693
5694 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5695 {
5696         struct mgmt_pending_cmd *cmd;
5697
5698         bt_dev_dbg(hdev, "status 0x%02x", status);
5699
5700         hci_dev_lock(hdev);
5701
5702         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5703         if (!cmd)
5704                 goto unlock;
5705
5706         if (status) {
5707                 u8 mgmt_err = mgmt_status(status);
5708
5709                 /* We need to restore the flag if related HCI commands
5710                  * failed.
5711                  */
5712                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5713
5714                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5715         } else {
5716                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5717                 new_settings(hdev, cmd->sk);
5718         }
5719
5720         mgmt_pending_remove(cmd);
5721
5722 unlock:
5723         hci_dev_unlock(hdev);
5724 }
5725
5726 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5727 {
5728         struct mgmt_mode *cp = data;
5729         struct mgmt_pending_cmd *cmd;
5730         struct hci_request req;
5731         int err;
5732
5733         bt_dev_dbg(hdev, "sock %p", sk);
5734
5735         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5736                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5737                                        MGMT_STATUS_NOT_SUPPORTED);
5738
5739         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5740                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5741                                        MGMT_STATUS_REJECTED);
5742
5743         if (cp->val != 0x00 && cp->val != 0x01)
5744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5745                                        MGMT_STATUS_INVALID_PARAMS);
5746
5747         hci_dev_lock(hdev);
5748
5749         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5750                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5751                 goto unlock;
5752         }
5753
5754         if (!hdev_is_powered(hdev)) {
5755                 if (!cp->val) {
5756                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5757                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5758                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5759                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5760                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5761                 }
5762
5763                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5764
5765                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5766                 if (err < 0)
5767                         goto unlock;
5768
5769                 err = new_settings(hdev, sk);
5770                 goto unlock;
5771         }
5772
5773         /* Reject disabling when powered on */
5774         if (!cp->val) {
5775                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5776                                       MGMT_STATUS_REJECTED);
5777                 goto unlock;
5778         } else {
5779                 /* When configuring a dual-mode controller to operate
5780                  * with LE only and using a static address, then switching
5781                  * BR/EDR back on is not allowed.
5782                  *
5783                  * Dual-mode controllers shall operate with the public
5784                  * address as its identity address for BR/EDR and LE. So
5785                  * reject the attempt to create an invalid configuration.
5786                  *
5787                  * The same restrictions applies when secure connections
5788                  * has been enabled. For BR/EDR this is a controller feature
5789                  * while for LE it is a host stack feature. This means that
5790                  * switching BR/EDR back on when secure connections has been
5791                  * enabled is not a supported transaction.
5792                  */
5793                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5794                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5795                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5796                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5797                                               MGMT_STATUS_REJECTED);
5798                         goto unlock;
5799                 }
5800         }
5801
5802         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5803                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5804                                       MGMT_STATUS_BUSY);
5805                 goto unlock;
5806         }
5807
5808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5809         if (!cmd) {
5810                 err = -ENOMEM;
5811                 goto unlock;
5812         }
5813
5814         /* We need to flip the bit already here so that
5815          * hci_req_update_adv_data generates the correct flags.
5816          */
5817         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5818
5819         hci_req_init(&req, hdev);
5820
5821         __hci_req_write_fast_connectable(&req, false);
5822         __hci_req_update_scan(&req);
5823
5824         /* Since only the advertising data flags will change, there
5825          * is no need to update the scan response data.
5826          */
5827         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5828
5829         err = hci_req_run(&req, set_bredr_complete);
5830         if (err < 0)
5831                 mgmt_pending_remove(cmd);
5832
5833 unlock:
5834         hci_dev_unlock(hdev);
5835         return err;
5836 }
5837
5838 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5839 {
5840         struct mgmt_pending_cmd *cmd;
5841         struct mgmt_mode *cp;
5842
5843         bt_dev_dbg(hdev, "status %u", status);
5844
5845         hci_dev_lock(hdev);
5846
5847         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5848         if (!cmd)
5849                 goto unlock;
5850
5851         if (status) {
5852                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5853                                 mgmt_status(status));
5854                 goto remove;
5855         }
5856
5857         cp = cmd->param;
5858
5859         switch (cp->val) {
5860         case 0x00:
5861                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5862                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5863                 break;
5864         case 0x01:
5865                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5866                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5867                 break;
5868         case 0x02:
5869                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5870                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5871                 break;
5872         }
5873
5874         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5875         new_settings(hdev, cmd->sk);
5876
5877 remove:
5878         mgmt_pending_remove(cmd);
5879 unlock:
5880         hci_dev_unlock(hdev);
5881 }
5882
5883 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5884                            void *data, u16 len)
5885 {
5886         struct mgmt_mode *cp = data;
5887         struct mgmt_pending_cmd *cmd;
5888         struct hci_request req;
5889         u8 val;
5890         int err;
5891
5892         bt_dev_dbg(hdev, "sock %p", sk);
5893
5894         if (!lmp_sc_capable(hdev) &&
5895             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5896                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5897                                        MGMT_STATUS_NOT_SUPPORTED);
5898
5899         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5900             lmp_sc_capable(hdev) &&
5901             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5902                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5903                                        MGMT_STATUS_REJECTED);
5904
5905         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5906                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5907                                   MGMT_STATUS_INVALID_PARAMS);
5908
5909         hci_dev_lock(hdev);
5910
5911         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5912             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5913                 bool changed;
5914
5915                 if (cp->val) {
5916                         changed = !hci_dev_test_and_set_flag(hdev,
5917                                                              HCI_SC_ENABLED);
5918                         if (cp->val == 0x02)
5919                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5920                         else
5921                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5922                 } else {
5923                         changed = hci_dev_test_and_clear_flag(hdev,
5924                                                               HCI_SC_ENABLED);
5925                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5926                 }
5927
5928                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5929                 if (err < 0)
5930                         goto failed;
5931
5932                 if (changed)
5933                         err = new_settings(hdev, sk);
5934
5935                 goto failed;
5936         }
5937
5938         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5939                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5940                                       MGMT_STATUS_BUSY);
5941                 goto failed;
5942         }
5943
5944         val = !!cp->val;
5945
5946         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5947             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5948                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5949                 goto failed;
5950         }
5951
5952         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5953         if (!cmd) {
5954                 err = -ENOMEM;
5955                 goto failed;
5956         }
5957
5958         hci_req_init(&req, hdev);
5959         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5960         err = hci_req_run(&req, sc_enable_complete);
5961         if (err < 0) {
5962                 mgmt_pending_remove(cmd);
5963                 goto failed;
5964         }
5965
5966 failed:
5967         hci_dev_unlock(hdev);
5968         return err;
5969 }
5970
5971 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5972                           void *data, u16 len)
5973 {
5974         struct mgmt_mode *cp = data;
5975         bool changed, use_changed;
5976         int err;
5977
5978         bt_dev_dbg(hdev, "sock %p", sk);
5979
5980         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5982                                        MGMT_STATUS_INVALID_PARAMS);
5983
5984         hci_dev_lock(hdev);
5985
5986         if (cp->val)
5987                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5988         else
5989                 changed = hci_dev_test_and_clear_flag(hdev,
5990                                                       HCI_KEEP_DEBUG_KEYS);
5991
5992         if (cp->val == 0x02)
5993                 use_changed = !hci_dev_test_and_set_flag(hdev,
5994                                                          HCI_USE_DEBUG_KEYS);
5995         else
5996                 use_changed = hci_dev_test_and_clear_flag(hdev,
5997                                                           HCI_USE_DEBUG_KEYS);
5998
5999         if (hdev_is_powered(hdev) && use_changed &&
6000             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6001                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6002                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6003                              sizeof(mode), &mode);
6004         }
6005
6006         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6007         if (err < 0)
6008                 goto unlock;
6009
6010         if (changed)
6011                 err = new_settings(hdev, sk);
6012
6013 unlock:
6014         hci_dev_unlock(hdev);
6015         return err;
6016 }
6017
6018 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6019                        u16 len)
6020 {
6021         struct mgmt_cp_set_privacy *cp = cp_data;
6022         bool changed;
6023         int err;
6024
6025         bt_dev_dbg(hdev, "sock %p", sk);
6026
6027         if (!lmp_le_capable(hdev))
6028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6029                                        MGMT_STATUS_NOT_SUPPORTED);
6030
6031         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6033                                        MGMT_STATUS_INVALID_PARAMS);
6034
6035         if (hdev_is_powered(hdev))
6036                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6037                                        MGMT_STATUS_REJECTED);
6038
6039         hci_dev_lock(hdev);
6040
6041         /* If user space supports this command it is also expected to
6042          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6043          */
6044         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6045
6046         if (cp->privacy) {
6047                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6048                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6049                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6050                 hci_adv_instances_set_rpa_expired(hdev, true);
6051                 if (cp->privacy == 0x02)
6052                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6053                 else
6054                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6055         } else {
6056                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6057                 memset(hdev->irk, 0, sizeof(hdev->irk));
6058                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6059                 hci_adv_instances_set_rpa_expired(hdev, false);
6060                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6061         }
6062
6063         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6064         if (err < 0)
6065                 goto unlock;
6066
6067         if (changed)
6068                 err = new_settings(hdev, sk);
6069
6070 unlock:
6071         hci_dev_unlock(hdev);
6072         return err;
6073 }
6074
6075 static bool irk_is_valid(struct mgmt_irk_info *irk)
6076 {
6077         switch (irk->addr.type) {
6078         case BDADDR_LE_PUBLIC:
6079                 return true;
6080
6081         case BDADDR_LE_RANDOM:
6082                 /* Two most significant bits shall be set */
6083                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6084                         return false;
6085                 return true;
6086         }
6087
6088         return false;
6089 }
6090
6091 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6092                      u16 len)
6093 {
6094         struct mgmt_cp_load_irks *cp = cp_data;
6095         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6096                                    sizeof(struct mgmt_irk_info));
6097         u16 irk_count, expected_len;
6098         int i, err;
6099
6100         bt_dev_dbg(hdev, "sock %p", sk);
6101
6102         if (!lmp_le_capable(hdev))
6103                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6104                                        MGMT_STATUS_NOT_SUPPORTED);
6105
6106         irk_count = __le16_to_cpu(cp->irk_count);
6107         if (irk_count > max_irk_count) {
6108                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6109                            irk_count);
6110                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6111                                        MGMT_STATUS_INVALID_PARAMS);
6112         }
6113
6114         expected_len = struct_size(cp, irks, irk_count);
6115         if (expected_len != len) {
6116                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6117                            expected_len, len);
6118                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6119                                        MGMT_STATUS_INVALID_PARAMS);
6120         }
6121
6122         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6123
6124         for (i = 0; i < irk_count; i++) {
6125                 struct mgmt_irk_info *key = &cp->irks[i];
6126
6127                 if (!irk_is_valid(key))
6128                         return mgmt_cmd_status(sk, hdev->id,
6129                                                MGMT_OP_LOAD_IRKS,
6130                                                MGMT_STATUS_INVALID_PARAMS);
6131         }
6132
6133         hci_dev_lock(hdev);
6134
6135         hci_smp_irks_clear(hdev);
6136
6137         for (i = 0; i < irk_count; i++) {
6138                 struct mgmt_irk_info *irk = &cp->irks[i];
6139
6140                 if (hci_is_blocked_key(hdev,
6141                                        HCI_BLOCKED_KEY_TYPE_IRK,
6142                                        irk->val)) {
6143                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6144                                     &irk->addr.bdaddr);
6145                         continue;
6146                 }
6147
6148                 hci_add_irk(hdev, &irk->addr.bdaddr,
6149                             le_addr_type(irk->addr.type), irk->val,
6150                             BDADDR_ANY);
6151         }
6152
6153         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6154
6155         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6156
6157         hci_dev_unlock(hdev);
6158
6159         return err;
6160 }
6161
6162 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6163 {
6164         if (key->master != 0x00 && key->master != 0x01)
6165                 return false;
6166
6167         switch (key->addr.type) {
6168         case BDADDR_LE_PUBLIC:
6169                 return true;
6170
6171         case BDADDR_LE_RANDOM:
6172                 /* Two most significant bits shall be set */
6173                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6174                         return false;
6175                 return true;
6176         }
6177
6178         return false;
6179 }
6180
6181 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6182                                void *cp_data, u16 len)
6183 {
6184         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6185         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6186                                    sizeof(struct mgmt_ltk_info));
6187         u16 key_count, expected_len;
6188         int i, err;
6189
6190         bt_dev_dbg(hdev, "sock %p", sk);
6191
6192         if (!lmp_le_capable(hdev))
6193                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6194                                        MGMT_STATUS_NOT_SUPPORTED);
6195
6196         key_count = __le16_to_cpu(cp->key_count);
6197         if (key_count > max_key_count) {
6198                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6199                            key_count);
6200                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6201                                        MGMT_STATUS_INVALID_PARAMS);
6202         }
6203
6204         expected_len = struct_size(cp, keys, key_count);
6205         if (expected_len != len) {
6206                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6207                            expected_len, len);
6208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6209                                        MGMT_STATUS_INVALID_PARAMS);
6210         }
6211
6212         bt_dev_dbg(hdev, "key_count %u", key_count);
6213
6214         for (i = 0; i < key_count; i++) {
6215                 struct mgmt_ltk_info *key = &cp->keys[i];
6216
6217                 if (!ltk_is_valid(key))
6218                         return mgmt_cmd_status(sk, hdev->id,
6219                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6220                                                MGMT_STATUS_INVALID_PARAMS);
6221         }
6222
6223         hci_dev_lock(hdev);
6224
6225         hci_smp_ltks_clear(hdev);
6226
6227         for (i = 0; i < key_count; i++) {
6228                 struct mgmt_ltk_info *key = &cp->keys[i];
6229                 u8 type, authenticated;
6230
6231                 if (hci_is_blocked_key(hdev,
6232                                        HCI_BLOCKED_KEY_TYPE_LTK,
6233                                        key->val)) {
6234                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6235                                     &key->addr.bdaddr);
6236                         continue;
6237                 }
6238
6239                 switch (key->type) {
6240                 case MGMT_LTK_UNAUTHENTICATED:
6241                         authenticated = 0x00;
6242                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6243                         break;
6244                 case MGMT_LTK_AUTHENTICATED:
6245                         authenticated = 0x01;
6246                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6247                         break;
6248                 case MGMT_LTK_P256_UNAUTH:
6249                         authenticated = 0x00;
6250                         type = SMP_LTK_P256;
6251                         break;
6252                 case MGMT_LTK_P256_AUTH:
6253                         authenticated = 0x01;
6254                         type = SMP_LTK_P256;
6255                         break;
6256                 case MGMT_LTK_P256_DEBUG:
6257                         authenticated = 0x00;
6258                         type = SMP_LTK_P256_DEBUG;
6259                         fallthrough;
6260                 default:
6261                         continue;
6262                 }
6263
6264                 hci_add_ltk(hdev, &key->addr.bdaddr,
6265                             le_addr_type(key->addr.type), type, authenticated,
6266                             key->val, key->enc_size, key->ediv, key->rand);
6267         }
6268
6269         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6270                            NULL, 0);
6271
6272         hci_dev_unlock(hdev);
6273
6274         return err;
6275 }
6276
6277 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6278 {
6279         struct hci_conn *conn = cmd->user_data;
6280         struct mgmt_rp_get_conn_info rp;
6281         int err;
6282
6283         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6284
6285         if (status == MGMT_STATUS_SUCCESS) {
6286                 rp.rssi = conn->rssi;
6287                 rp.tx_power = conn->tx_power;
6288                 rp.max_tx_power = conn->max_tx_power;
6289         } else {
6290                 rp.rssi = HCI_RSSI_INVALID;
6291                 rp.tx_power = HCI_TX_POWER_INVALID;
6292                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6293         }
6294
6295         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6296                                 status, &rp, sizeof(rp));
6297
6298         hci_conn_drop(conn);
6299         hci_conn_put(conn);
6300
6301         return err;
6302 }
6303
6304 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6305                                        u16 opcode)
6306 {
6307         struct hci_cp_read_rssi *cp;
6308         struct mgmt_pending_cmd *cmd;
6309         struct hci_conn *conn;
6310         u16 handle;
6311         u8 status;
6312
6313         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6314
6315         hci_dev_lock(hdev);
6316
6317         /* Commands sent in request are either Read RSSI or Read Transmit Power
6318          * Level so we check which one was last sent to retrieve connection
6319          * handle.  Both commands have handle as first parameter so it's safe to
6320          * cast data on the same command struct.
6321          *
6322          * First command sent is always Read RSSI and we fail only if it fails.
6323          * In other case we simply override error to indicate success as we
6324          * already remembered if TX power value is actually valid.
6325          */
6326         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6327         if (!cp) {
6328                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6329                 status = MGMT_STATUS_SUCCESS;
6330         } else {
6331                 status = mgmt_status(hci_status);
6332         }
6333
6334         if (!cp) {
6335                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6336                 goto unlock;
6337         }
6338
6339         handle = __le16_to_cpu(cp->handle);
6340         conn = hci_conn_hash_lookup_handle(hdev, handle);
6341         if (!conn) {
6342                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6343                            handle);
6344                 goto unlock;
6345         }
6346
6347         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6348         if (!cmd)
6349                 goto unlock;
6350
6351         cmd->cmd_complete(cmd, status);
6352         mgmt_pending_remove(cmd);
6353
6354 unlock:
6355         hci_dev_unlock(hdev);
6356 }
6357
6358 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6359                          u16 len)
6360 {
6361         struct mgmt_cp_get_conn_info *cp = data;
6362         struct mgmt_rp_get_conn_info rp;
6363         struct hci_conn *conn;
6364         unsigned long conn_info_age;
6365         int err = 0;
6366
6367         bt_dev_dbg(hdev, "sock %p", sk);
6368
6369         memset(&rp, 0, sizeof(rp));
6370         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6371         rp.addr.type = cp->addr.type;
6372
6373         if (!bdaddr_type_is_valid(cp->addr.type))
6374                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6375                                          MGMT_STATUS_INVALID_PARAMS,
6376                                          &rp, sizeof(rp));
6377
6378         hci_dev_lock(hdev);
6379
6380         if (!hdev_is_powered(hdev)) {
6381                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6382                                         MGMT_STATUS_NOT_POWERED, &rp,
6383                                         sizeof(rp));
6384                 goto unlock;
6385         }
6386
6387         if (cp->addr.type == BDADDR_BREDR)
6388                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6389                                                &cp->addr.bdaddr);
6390         else
6391                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6392
6393         if (!conn || conn->state != BT_CONNECTED) {
6394                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6395                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6396                                         sizeof(rp));
6397                 goto unlock;
6398         }
6399
6400         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6401                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6402                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6403                 goto unlock;
6404         }
6405
6406         /* To avoid client trying to guess when to poll again for information we
6407          * calculate conn info age as random value between min/max set in hdev.
6408          */
6409         conn_info_age = hdev->conn_info_min_age +
6410                         prandom_u32_max(hdev->conn_info_max_age -
6411                                         hdev->conn_info_min_age);
6412
6413         /* Query controller to refresh cached values if they are too old or were
6414          * never read.
6415          */
6416         if (time_after(jiffies, conn->conn_info_timestamp +
6417                        msecs_to_jiffies(conn_info_age)) ||
6418             !conn->conn_info_timestamp) {
6419                 struct hci_request req;
6420                 struct hci_cp_read_tx_power req_txp_cp;
6421                 struct hci_cp_read_rssi req_rssi_cp;
6422                 struct mgmt_pending_cmd *cmd;
6423
6424                 hci_req_init(&req, hdev);
6425                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6426                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6427                             &req_rssi_cp);
6428
6429                 /* For LE links TX power does not change thus we don't need to
6430                  * query for it once value is known.
6431                  */
6432                 if (!bdaddr_type_is_le(cp->addr.type) ||
6433                     conn->tx_power == HCI_TX_POWER_INVALID) {
6434                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6435                         req_txp_cp.type = 0x00;
6436                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6437                                     sizeof(req_txp_cp), &req_txp_cp);
6438                 }
6439
6440                 /* Max TX power needs to be read only once per connection */
6441                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6442                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6443                         req_txp_cp.type = 0x01;
6444                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6445                                     sizeof(req_txp_cp), &req_txp_cp);
6446                 }
6447
6448                 err = hci_req_run(&req, conn_info_refresh_complete);
6449                 if (err < 0)
6450                         goto unlock;
6451
6452                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6453                                        data, len);
6454                 if (!cmd) {
6455                         err = -ENOMEM;
6456                         goto unlock;
6457                 }
6458
6459                 hci_conn_hold(conn);
6460                 cmd->user_data = hci_conn_get(conn);
6461                 cmd->cmd_complete = conn_info_cmd_complete;
6462
6463                 conn->conn_info_timestamp = jiffies;
6464         } else {
6465                 /* Cache is valid, just reply with values cached in hci_conn */
6466                 rp.rssi = conn->rssi;
6467                 rp.tx_power = conn->tx_power;
6468                 rp.max_tx_power = conn->max_tx_power;
6469
6470                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6471                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6472         }
6473
6474 unlock:
6475         hci_dev_unlock(hdev);
6476         return err;
6477 }
6478
6479 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6480 {
6481         struct hci_conn *conn = cmd->user_data;
6482         struct mgmt_rp_get_clock_info rp;
6483         struct hci_dev *hdev;
6484         int err;
6485
6486         memset(&rp, 0, sizeof(rp));
6487         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6488
6489         if (status)
6490                 goto complete;
6491
6492         hdev = hci_dev_get(cmd->index);
6493         if (hdev) {
6494                 rp.local_clock = cpu_to_le32(hdev->clock);
6495                 hci_dev_put(hdev);
6496         }
6497
6498         if (conn) {
6499                 rp.piconet_clock = cpu_to_le32(conn->clock);
6500                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6501         }
6502
6503 complete:
6504         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6505                                 sizeof(rp));
6506
6507         if (conn) {
6508                 hci_conn_drop(conn);
6509                 hci_conn_put(conn);
6510         }
6511
6512         return err;
6513 }
6514
6515 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6516 {
6517         struct hci_cp_read_clock *hci_cp;
6518         struct mgmt_pending_cmd *cmd;
6519         struct hci_conn *conn;
6520
6521         bt_dev_dbg(hdev, "status %u", status);
6522
6523         hci_dev_lock(hdev);
6524
6525         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6526         if (!hci_cp)
6527                 goto unlock;
6528
6529         if (hci_cp->which) {
6530                 u16 handle = __le16_to_cpu(hci_cp->handle);
6531                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6532         } else {
6533                 conn = NULL;
6534         }
6535
6536         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6537         if (!cmd)
6538                 goto unlock;
6539
6540         cmd->cmd_complete(cmd, mgmt_status(status));
6541         mgmt_pending_remove(cmd);
6542
6543 unlock:
6544         hci_dev_unlock(hdev);
6545 }
6546
6547 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6548                          u16 len)
6549 {
6550         struct mgmt_cp_get_clock_info *cp = data;
6551         struct mgmt_rp_get_clock_info rp;
6552         struct hci_cp_read_clock hci_cp;
6553         struct mgmt_pending_cmd *cmd;
6554         struct hci_request req;
6555         struct hci_conn *conn;
6556         int err;
6557
6558         bt_dev_dbg(hdev, "sock %p", sk);
6559
6560         memset(&rp, 0, sizeof(rp));
6561         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6562         rp.addr.type = cp->addr.type;
6563
6564         if (cp->addr.type != BDADDR_BREDR)
6565                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6566                                          MGMT_STATUS_INVALID_PARAMS,
6567                                          &rp, sizeof(rp));
6568
6569         hci_dev_lock(hdev);
6570
6571         if (!hdev_is_powered(hdev)) {
6572                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6573                                         MGMT_STATUS_NOT_POWERED, &rp,
6574                                         sizeof(rp));
6575                 goto unlock;
6576         }
6577
6578         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6579                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6580                                                &cp->addr.bdaddr);
6581                 if (!conn || conn->state != BT_CONNECTED) {
6582                         err = mgmt_cmd_complete(sk, hdev->id,
6583                                                 MGMT_OP_GET_CLOCK_INFO,
6584                                                 MGMT_STATUS_NOT_CONNECTED,
6585                                                 &rp, sizeof(rp));
6586                         goto unlock;
6587                 }
6588         } else {
6589                 conn = NULL;
6590         }
6591
6592         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6593         if (!cmd) {
6594                 err = -ENOMEM;
6595                 goto unlock;
6596         }
6597
6598         cmd->cmd_complete = clock_info_cmd_complete;
6599
6600         hci_req_init(&req, hdev);
6601
6602         memset(&hci_cp, 0, sizeof(hci_cp));
6603         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6604
6605         if (conn) {
6606                 hci_conn_hold(conn);
6607                 cmd->user_data = hci_conn_get(conn);
6608
6609                 hci_cp.handle = cpu_to_le16(conn->handle);
6610                 hci_cp.which = 0x01; /* Piconet clock */
6611                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6612         }
6613
6614         err = hci_req_run(&req, get_clock_info_complete);
6615         if (err < 0)
6616                 mgmt_pending_remove(cmd);
6617
6618 unlock:
6619         hci_dev_unlock(hdev);
6620         return err;
6621 }
6622
6623 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6624 {
6625         struct hci_conn *conn;
6626
6627         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6628         if (!conn)
6629                 return false;
6630
6631         if (conn->dst_type != type)
6632                 return false;
6633
6634         if (conn->state != BT_CONNECTED)
6635                 return false;
6636
6637         return true;
6638 }
6639
6640 /* This function requires the caller holds hdev->lock */
6641 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6642                                u8 addr_type, u8 auto_connect)
6643 {
6644         struct hci_conn_params *params;
6645
6646         params = hci_conn_params_add(hdev, addr, addr_type);
6647         if (!params)
6648                 return -EIO;
6649
6650         if (params->auto_connect == auto_connect)
6651                 return 0;
6652
6653         list_del_init(&params->action);
6654
6655         switch (auto_connect) {
6656         case HCI_AUTO_CONN_DISABLED:
6657         case HCI_AUTO_CONN_LINK_LOSS:
6658                 /* If auto connect is being disabled when we're trying to
6659                  * connect to device, keep connecting.
6660                  */
6661                 if (params->explicit_connect)
6662                         list_add(&params->action, &hdev->pend_le_conns);
6663                 break;
6664         case HCI_AUTO_CONN_REPORT:
6665                 if (params->explicit_connect)
6666                         list_add(&params->action, &hdev->pend_le_conns);
6667                 else
6668                         list_add(&params->action, &hdev->pend_le_reports);
6669                 break;
6670         case HCI_AUTO_CONN_DIRECT:
6671         case HCI_AUTO_CONN_ALWAYS:
6672                 if (!is_connected(hdev, addr, addr_type))
6673                         list_add(&params->action, &hdev->pend_le_conns);
6674                 break;
6675         }
6676
6677         params->auto_connect = auto_connect;
6678
6679         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6680                    addr, addr_type, auto_connect);
6681
6682         return 0;
6683 }
6684
6685 static void device_added(struct sock *sk, struct hci_dev *hdev,
6686                          bdaddr_t *bdaddr, u8 type, u8 action)
6687 {
6688         struct mgmt_ev_device_added ev;
6689
6690         bacpy(&ev.addr.bdaddr, bdaddr);
6691         ev.addr.type = type;
6692         ev.action = action;
6693
6694         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6695 }
6696
6697 static int add_device(struct sock *sk, struct hci_dev *hdev,
6698                       void *data, u16 len)
6699 {
6700         struct mgmt_cp_add_device *cp = data;
6701         u8 auto_conn, addr_type;
6702         struct hci_conn_params *params;
6703         int err;
6704         u32 current_flags = 0;
6705
6706         bt_dev_dbg(hdev, "sock %p", sk);
6707
6708         if (!bdaddr_type_is_valid(cp->addr.type) ||
6709             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6710                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6711                                          MGMT_STATUS_INVALID_PARAMS,
6712                                          &cp->addr, sizeof(cp->addr));
6713
6714         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6715                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6716                                          MGMT_STATUS_INVALID_PARAMS,
6717                                          &cp->addr, sizeof(cp->addr));
6718
6719         hci_dev_lock(hdev);
6720
6721         if (cp->addr.type == BDADDR_BREDR) {
6722                 /* Only incoming connections action is supported for now */
6723                 if (cp->action != 0x01) {
6724                         err = mgmt_cmd_complete(sk, hdev->id,
6725                                                 MGMT_OP_ADD_DEVICE,
6726                                                 MGMT_STATUS_INVALID_PARAMS,
6727                                                 &cp->addr, sizeof(cp->addr));
6728                         goto unlock;
6729                 }
6730
6731                 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
6732                                                      &cp->addr.bdaddr,
6733                                                      cp->addr.type, 0);
6734                 if (err)
6735                         goto unlock;
6736
6737                 hci_req_update_scan(hdev);
6738
6739                 goto added;
6740         }
6741
6742         addr_type = le_addr_type(cp->addr.type);
6743
6744         if (cp->action == 0x02)
6745                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6746         else if (cp->action == 0x01)
6747                 auto_conn = HCI_AUTO_CONN_DIRECT;
6748         else
6749                 auto_conn = HCI_AUTO_CONN_REPORT;
6750
6751         /* Kernel internally uses conn_params with resolvable private
6752          * address, but Add Device allows only identity addresses.
6753          * Make sure it is enforced before calling
6754          * hci_conn_params_lookup.
6755          */
6756         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6757                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6758                                         MGMT_STATUS_INVALID_PARAMS,
6759                                         &cp->addr, sizeof(cp->addr));
6760                 goto unlock;
6761         }
6762
6763         /* If the connection parameters don't exist for this device,
6764          * they will be created and configured with defaults.
6765          */
6766         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6767                                 auto_conn) < 0) {
6768                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6769                                         MGMT_STATUS_FAILED, &cp->addr,
6770                                         sizeof(cp->addr));
6771                 goto unlock;
6772         } else {
6773                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6774                                                 addr_type);
6775                 if (params)
6776                         current_flags = params->current_flags;
6777         }
6778
6779         hci_update_background_scan(hdev);
6780
6781 added:
6782         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6783         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6784                              SUPPORTED_DEVICE_FLAGS(), current_flags);
6785
6786         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6787                                 MGMT_STATUS_SUCCESS, &cp->addr,
6788                                 sizeof(cp->addr));
6789
6790 unlock:
6791         hci_dev_unlock(hdev);
6792         return err;
6793 }
6794
6795 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6796                            bdaddr_t *bdaddr, u8 type)
6797 {
6798         struct mgmt_ev_device_removed ev;
6799
6800         bacpy(&ev.addr.bdaddr, bdaddr);
6801         ev.addr.type = type;
6802
6803         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6804 }
6805
6806 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6807                          void *data, u16 len)
6808 {
6809         struct mgmt_cp_remove_device *cp = data;
6810         int err;
6811
6812         bt_dev_dbg(hdev, "sock %p", sk);
6813
6814         hci_dev_lock(hdev);
6815
6816         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6817                 struct hci_conn_params *params;
6818                 u8 addr_type;
6819
6820                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6821                         err = mgmt_cmd_complete(sk, hdev->id,
6822                                                 MGMT_OP_REMOVE_DEVICE,
6823                                                 MGMT_STATUS_INVALID_PARAMS,
6824                                                 &cp->addr, sizeof(cp->addr));
6825                         goto unlock;
6826                 }
6827
6828                 if (cp->addr.type == BDADDR_BREDR) {
6829                         err = hci_bdaddr_list_del(&hdev->whitelist,
6830                                                   &cp->addr.bdaddr,
6831                                                   cp->addr.type);
6832                         if (err) {
6833                                 err = mgmt_cmd_complete(sk, hdev->id,
6834                                                         MGMT_OP_REMOVE_DEVICE,
6835                                                         MGMT_STATUS_INVALID_PARAMS,
6836                                                         &cp->addr,
6837                                                         sizeof(cp->addr));
6838                                 goto unlock;
6839                         }
6840
6841                         hci_req_update_scan(hdev);
6842
6843                         device_removed(sk, hdev, &cp->addr.bdaddr,
6844                                        cp->addr.type);
6845                         goto complete;
6846                 }
6847
6848                 addr_type = le_addr_type(cp->addr.type);
6849
6850                 /* Kernel internally uses conn_params with resolvable private
6851                  * address, but Remove Device allows only identity addresses.
6852                  * Make sure it is enforced before calling
6853                  * hci_conn_params_lookup.
6854                  */
6855                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6856                         err = mgmt_cmd_complete(sk, hdev->id,
6857                                                 MGMT_OP_REMOVE_DEVICE,
6858                                                 MGMT_STATUS_INVALID_PARAMS,
6859                                                 &cp->addr, sizeof(cp->addr));
6860                         goto unlock;
6861                 }
6862
6863                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6864                                                 addr_type);
6865                 if (!params) {
6866                         err = mgmt_cmd_complete(sk, hdev->id,
6867                                                 MGMT_OP_REMOVE_DEVICE,
6868                                                 MGMT_STATUS_INVALID_PARAMS,
6869                                                 &cp->addr, sizeof(cp->addr));
6870                         goto unlock;
6871                 }
6872
6873                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6874                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6875                         err = mgmt_cmd_complete(sk, hdev->id,
6876                                                 MGMT_OP_REMOVE_DEVICE,
6877                                                 MGMT_STATUS_INVALID_PARAMS,
6878                                                 &cp->addr, sizeof(cp->addr));
6879                         goto unlock;
6880                 }
6881
6882                 list_del(&params->action);
6883                 list_del(&params->list);
6884                 kfree(params);
6885                 hci_update_background_scan(hdev);
6886
6887                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6888         } else {
6889                 struct hci_conn_params *p, *tmp;
6890                 struct bdaddr_list *b, *btmp;
6891
6892                 if (cp->addr.type) {
6893                         err = mgmt_cmd_complete(sk, hdev->id,
6894                                                 MGMT_OP_REMOVE_DEVICE,
6895                                                 MGMT_STATUS_INVALID_PARAMS,
6896                                                 &cp->addr, sizeof(cp->addr));
6897                         goto unlock;
6898                 }
6899
6900                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6901                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6902                         list_del(&b->list);
6903                         kfree(b);
6904                 }
6905
6906                 hci_req_update_scan(hdev);
6907
6908                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6909                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6910                                 continue;
6911                         device_removed(sk, hdev, &p->addr, p->addr_type);
6912                         if (p->explicit_connect) {
6913                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6914                                 continue;
6915                         }
6916                         list_del(&p->action);
6917                         list_del(&p->list);
6918                         kfree(p);
6919                 }
6920
6921                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6922
6923                 hci_update_background_scan(hdev);
6924         }
6925
6926 complete:
6927         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6928                                 MGMT_STATUS_SUCCESS, &cp->addr,
6929                                 sizeof(cp->addr));
6930 unlock:
6931         hci_dev_unlock(hdev);
6932         return err;
6933 }
6934
6935 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6936                            u16 len)
6937 {
6938         struct mgmt_cp_load_conn_param *cp = data;
6939         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6940                                      sizeof(struct mgmt_conn_param));
6941         u16 param_count, expected_len;
6942         int i;
6943
6944         if (!lmp_le_capable(hdev))
6945                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6946                                        MGMT_STATUS_NOT_SUPPORTED);
6947
6948         param_count = __le16_to_cpu(cp->param_count);
6949         if (param_count > max_param_count) {
6950                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6951                            param_count);
6952                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6953                                        MGMT_STATUS_INVALID_PARAMS);
6954         }
6955
6956         expected_len = struct_size(cp, params, param_count);
6957         if (expected_len != len) {
6958                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6959                            expected_len, len);
6960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6961                                        MGMT_STATUS_INVALID_PARAMS);
6962         }
6963
6964         bt_dev_dbg(hdev, "param_count %u", param_count);
6965
6966         hci_dev_lock(hdev);
6967
6968         hci_conn_params_clear_disabled(hdev);
6969
6970         for (i = 0; i < param_count; i++) {
6971                 struct mgmt_conn_param *param = &cp->params[i];
6972                 struct hci_conn_params *hci_param;
6973                 u16 min, max, latency, timeout;
6974                 u8 addr_type;
6975
6976                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
6977                            param->addr.type);
6978
6979                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6980                         addr_type = ADDR_LE_DEV_PUBLIC;
6981                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6982                         addr_type = ADDR_LE_DEV_RANDOM;
6983                 } else {
6984                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6985                         continue;
6986                 }
6987
6988                 min = le16_to_cpu(param->min_interval);
6989                 max = le16_to_cpu(param->max_interval);
6990                 latency = le16_to_cpu(param->latency);
6991                 timeout = le16_to_cpu(param->timeout);
6992
6993                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6994                            min, max, latency, timeout);
6995
6996                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6997                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6998                         continue;
6999                 }
7000
7001                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7002                                                 addr_type);
7003                 if (!hci_param) {
7004                         bt_dev_err(hdev, "failed to add connection parameters");
7005                         continue;
7006                 }
7007
7008                 hci_param->conn_min_interval = min;
7009                 hci_param->conn_max_interval = max;
7010                 hci_param->conn_latency = latency;
7011                 hci_param->supervision_timeout = timeout;
7012         }
7013
7014         hci_dev_unlock(hdev);
7015
7016         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7017                                  NULL, 0);
7018 }
7019
7020 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7021                                void *data, u16 len)
7022 {
7023         struct mgmt_cp_set_external_config *cp = data;
7024         bool changed;
7025         int err;
7026
7027         bt_dev_dbg(hdev, "sock %p", sk);
7028
7029         if (hdev_is_powered(hdev))
7030                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7031                                        MGMT_STATUS_REJECTED);
7032
7033         if (cp->config != 0x00 && cp->config != 0x01)
7034                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7035                                          MGMT_STATUS_INVALID_PARAMS);
7036
7037         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7038                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7039                                        MGMT_STATUS_NOT_SUPPORTED);
7040
7041         hci_dev_lock(hdev);
7042
7043         if (cp->config)
7044                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7045         else
7046                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7047
7048         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7049         if (err < 0)
7050                 goto unlock;
7051
7052         if (!changed)
7053                 goto unlock;
7054
7055         err = new_options(hdev, sk);
7056
7057         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7058                 mgmt_index_removed(hdev);
7059
7060                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7061                         hci_dev_set_flag(hdev, HCI_CONFIG);
7062                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7063
7064                         queue_work(hdev->req_workqueue, &hdev->power_on);
7065                 } else {
7066                         set_bit(HCI_RAW, &hdev->flags);
7067                         mgmt_index_added(hdev);
7068                 }
7069         }
7070
7071 unlock:
7072         hci_dev_unlock(hdev);
7073         return err;
7074 }
7075
7076 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7077                               void *data, u16 len)
7078 {
7079         struct mgmt_cp_set_public_address *cp = data;
7080         bool changed;
7081         int err;
7082
7083         bt_dev_dbg(hdev, "sock %p", sk);
7084
7085         if (hdev_is_powered(hdev))
7086                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7087                                        MGMT_STATUS_REJECTED);
7088
7089         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7090                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7091                                        MGMT_STATUS_INVALID_PARAMS);
7092
7093         if (!hdev->set_bdaddr)
7094                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7095                                        MGMT_STATUS_NOT_SUPPORTED);
7096
7097         hci_dev_lock(hdev);
7098
7099         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7100         bacpy(&hdev->public_addr, &cp->bdaddr);
7101
7102         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7103         if (err < 0)
7104                 goto unlock;
7105
7106         if (!changed)
7107                 goto unlock;
7108
7109         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7110                 err = new_options(hdev, sk);
7111
7112         if (is_configured(hdev)) {
7113                 mgmt_index_removed(hdev);
7114
7115                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7116
7117                 hci_dev_set_flag(hdev, HCI_CONFIG);
7118                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7119
7120                 queue_work(hdev->req_workqueue, &hdev->power_on);
7121         }
7122
7123 unlock:
7124         hci_dev_unlock(hdev);
7125         return err;
7126 }
7127
7128 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
7129                                              u16 opcode, struct sk_buff *skb)
7130 {
7131         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7132         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7133         u8 *h192, *r192, *h256, *r256;
7134         struct mgmt_pending_cmd *cmd;
7135         u16 eir_len;
7136         int err;
7137
7138         bt_dev_dbg(hdev, "status %u", status);
7139
7140         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
7141         if (!cmd)
7142                 return;
7143
7144         mgmt_cp = cmd->param;
7145
7146         if (status) {
7147                 status = mgmt_status(status);
7148                 eir_len = 0;
7149
7150                 h192 = NULL;
7151                 r192 = NULL;
7152                 h256 = NULL;
7153                 r256 = NULL;
7154         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
7155                 struct hci_rp_read_local_oob_data *rp;
7156
7157                 if (skb->len != sizeof(*rp)) {
7158                         status = MGMT_STATUS_FAILED;
7159                         eir_len = 0;
7160                 } else {
7161                         status = MGMT_STATUS_SUCCESS;
7162                         rp = (void *)skb->data;
7163
7164                         eir_len = 5 + 18 + 18;
7165                         h192 = rp->hash;
7166                         r192 = rp->rand;
7167                         h256 = NULL;
7168                         r256 = NULL;
7169                 }
7170         } else {
7171                 struct hci_rp_read_local_oob_ext_data *rp;
7172
7173                 if (skb->len != sizeof(*rp)) {
7174                         status = MGMT_STATUS_FAILED;
7175                         eir_len = 0;
7176                 } else {
7177                         status = MGMT_STATUS_SUCCESS;
7178                         rp = (void *)skb->data;
7179
7180                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7181                                 eir_len = 5 + 18 + 18;
7182                                 h192 = NULL;
7183                                 r192 = NULL;
7184                         } else {
7185                                 eir_len = 5 + 18 + 18 + 18 + 18;
7186                                 h192 = rp->hash192;
7187                                 r192 = rp->rand192;
7188                         }
7189
7190                         h256 = rp->hash256;
7191                         r256 = rp->rand256;
7192                 }
7193         }
7194
7195         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7196         if (!mgmt_rp)
7197                 goto done;
7198
7199         if (status)
7200                 goto send_rsp;
7201
7202         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7203                                   hdev->dev_class, 3);
7204
7205         if (h192 && r192) {
7206                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7207                                           EIR_SSP_HASH_C192, h192, 16);
7208                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7209                                           EIR_SSP_RAND_R192, r192, 16);
7210         }
7211
7212         if (h256 && r256) {
7213                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7214                                           EIR_SSP_HASH_C256, h256, 16);
7215                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7216                                           EIR_SSP_RAND_R256, r256, 16);
7217         }
7218
7219 send_rsp:
7220         mgmt_rp->type = mgmt_cp->type;
7221         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7222
7223         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7224                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7225                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7226         if (err < 0 || status)
7227                 goto done;
7228
7229         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7230
7231         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7232                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7233                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7234 done:
7235         kfree(mgmt_rp);
7236         mgmt_pending_remove(cmd);
7237 }
7238
7239 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7240                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7241 {
7242         struct mgmt_pending_cmd *cmd;
7243         struct hci_request req;
7244         int err;
7245
7246         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7247                                cp, sizeof(*cp));
7248         if (!cmd)
7249                 return -ENOMEM;
7250
7251         hci_req_init(&req, hdev);
7252
7253         if (bredr_sc_enabled(hdev))
7254                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7255         else
7256                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7257
7258         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7259         if (err < 0) {
7260                 mgmt_pending_remove(cmd);
7261                 return err;
7262         }
7263
7264         return 0;
7265 }
7266
7267 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7268                                    void *data, u16 data_len)
7269 {
7270         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7271         struct mgmt_rp_read_local_oob_ext_data *rp;
7272         size_t rp_len;
7273         u16 eir_len;
7274         u8 status, flags, role, addr[7], hash[16], rand[16];
7275         int err;
7276
7277         bt_dev_dbg(hdev, "sock %p", sk);
7278
7279         if (hdev_is_powered(hdev)) {
7280                 switch (cp->type) {
7281                 case BIT(BDADDR_BREDR):
7282                         status = mgmt_bredr_support(hdev);
7283                         if (status)
7284                                 eir_len = 0;
7285                         else
7286                                 eir_len = 5;
7287                         break;
7288                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7289                         status = mgmt_le_support(hdev);
7290                         if (status)
7291                                 eir_len = 0;
7292                         else
7293                                 eir_len = 9 + 3 + 18 + 18 + 3;
7294                         break;
7295                 default:
7296                         status = MGMT_STATUS_INVALID_PARAMS;
7297                         eir_len = 0;
7298                         break;
7299                 }
7300         } else {
7301                 status = MGMT_STATUS_NOT_POWERED;
7302                 eir_len = 0;
7303         }
7304
7305         rp_len = sizeof(*rp) + eir_len;
7306         rp = kmalloc(rp_len, GFP_ATOMIC);
7307         if (!rp)
7308                 return -ENOMEM;
7309
7310         if (status)
7311                 goto complete;
7312
7313         hci_dev_lock(hdev);
7314
7315         eir_len = 0;
7316         switch (cp->type) {
7317         case BIT(BDADDR_BREDR):
7318                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7319                         err = read_local_ssp_oob_req(hdev, sk, cp);
7320                         hci_dev_unlock(hdev);
7321                         if (!err)
7322                                 goto done;
7323
7324                         status = MGMT_STATUS_FAILED;
7325                         goto complete;
7326                 } else {
7327                         eir_len = eir_append_data(rp->eir, eir_len,
7328                                                   EIR_CLASS_OF_DEV,
7329                                                   hdev->dev_class, 3);
7330                 }
7331                 break;
7332         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7333                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7334                     smp_generate_oob(hdev, hash, rand) < 0) {
7335                         hci_dev_unlock(hdev);
7336                         status = MGMT_STATUS_FAILED;
7337                         goto complete;
7338                 }
7339
7340                 /* This should return the active RPA, but since the RPA
7341                  * is only programmed on demand, it is really hard to fill
7342                  * this in at the moment. For now disallow retrieving
7343                  * local out-of-band data when privacy is in use.
7344                  *
7345                  * Returning the identity address will not help here since
7346                  * pairing happens before the identity resolving key is
7347                  * known and thus the connection establishment happens
7348                  * based on the RPA and not the identity address.
7349                  */
7350                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7351                         hci_dev_unlock(hdev);
7352                         status = MGMT_STATUS_REJECTED;
7353                         goto complete;
7354                 }
7355
7356                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7357                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7358                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7359                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7360                         memcpy(addr, &hdev->static_addr, 6);
7361                         addr[6] = 0x01;
7362                 } else {
7363                         memcpy(addr, &hdev->bdaddr, 6);
7364                         addr[6] = 0x00;
7365                 }
7366
7367                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7368                                           addr, sizeof(addr));
7369
7370                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7371                         role = 0x02;
7372                 else
7373                         role = 0x01;
7374
7375                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7376                                           &role, sizeof(role));
7377
7378                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7379                         eir_len = eir_append_data(rp->eir, eir_len,
7380                                                   EIR_LE_SC_CONFIRM,
7381                                                   hash, sizeof(hash));
7382
7383                         eir_len = eir_append_data(rp->eir, eir_len,
7384                                                   EIR_LE_SC_RANDOM,
7385                                                   rand, sizeof(rand));
7386                 }
7387
7388                 flags = mgmt_get_adv_discov_flags(hdev);
7389
7390                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7391                         flags |= LE_AD_NO_BREDR;
7392
7393                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7394                                           &flags, sizeof(flags));
7395                 break;
7396         }
7397
7398         hci_dev_unlock(hdev);
7399
7400         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7401
7402         status = MGMT_STATUS_SUCCESS;
7403
7404 complete:
7405         rp->type = cp->type;
7406         rp->eir_len = cpu_to_le16(eir_len);
7407
7408         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7409                                 status, rp, sizeof(*rp) + eir_len);
7410         if (err < 0 || status)
7411                 goto done;
7412
7413         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7414                                  rp, sizeof(*rp) + eir_len,
7415                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7416
7417 done:
7418         kfree(rp);
7419
7420         return err;
7421 }
7422
7423 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7424 {
7425         u32 flags = 0;
7426
7427         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7428         flags |= MGMT_ADV_FLAG_DISCOV;
7429         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7430         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7431         flags |= MGMT_ADV_FLAG_APPEARANCE;
7432         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7433         flags |= MGMT_ADV_PARAM_DURATION;
7434         flags |= MGMT_ADV_PARAM_TIMEOUT;
7435         flags |= MGMT_ADV_PARAM_INTERVALS;
7436         flags |= MGMT_ADV_PARAM_TX_POWER;
7437         flags |= MGMT_ADV_PARAM_SCAN_RSP;
7438
7439         /* In extended adv TX_POWER returned from Set Adv Param
7440          * will be always valid.
7441          */
7442         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7443             ext_adv_capable(hdev))
7444                 flags |= MGMT_ADV_FLAG_TX_POWER;
7445
7446         if (ext_adv_capable(hdev)) {
7447                 flags |= MGMT_ADV_FLAG_SEC_1M;
7448                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7449                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7450
7451                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7452                         flags |= MGMT_ADV_FLAG_SEC_2M;
7453
7454                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7455                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7456         }
7457
7458         return flags;
7459 }
7460
7461 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7462                              void *data, u16 data_len)
7463 {
7464         struct mgmt_rp_read_adv_features *rp;
7465         size_t rp_len;
7466         int err;
7467         struct adv_info *adv_instance;
7468         u32 supported_flags;
7469         u8 *instance;
7470
7471         bt_dev_dbg(hdev, "sock %p", sk);
7472
7473         if (!lmp_le_capable(hdev))
7474                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7475                                        MGMT_STATUS_REJECTED);
7476
7477         /* Enabling the experimental LL Privay support disables support for
7478          * advertising.
7479          */
7480         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7481                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7482                                        MGMT_STATUS_NOT_SUPPORTED);
7483
7484         hci_dev_lock(hdev);
7485
7486         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7487         rp = kmalloc(rp_len, GFP_ATOMIC);
7488         if (!rp) {
7489                 hci_dev_unlock(hdev);
7490                 return -ENOMEM;
7491         }
7492
7493         supported_flags = get_supported_adv_flags(hdev);
7494
7495         rp->supported_flags = cpu_to_le32(supported_flags);
7496         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7497         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7498         rp->max_instances = hdev->le_num_of_adv_sets;
7499         rp->num_instances = hdev->adv_instance_cnt;
7500
7501         instance = rp->instance;
7502         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7503                 *instance = adv_instance->instance;
7504                 instance++;
7505         }
7506
7507         hci_dev_unlock(hdev);
7508
7509         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7510                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7511
7512         kfree(rp);
7513
7514         return err;
7515 }
7516
7517 static u8 calculate_name_len(struct hci_dev *hdev)
7518 {
7519         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7520
7521         return append_local_name(hdev, buf, 0);
7522 }
7523
7524 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7525                            bool is_adv_data)
7526 {
7527         u8 max_len = HCI_MAX_AD_LENGTH;
7528
7529         if (is_adv_data) {
7530                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7531                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7532                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7533                         max_len -= 3;
7534
7535                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7536                         max_len -= 3;
7537         } else {
7538                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7539                         max_len -= calculate_name_len(hdev);
7540
7541                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7542                         max_len -= 4;
7543         }
7544
7545         return max_len;
7546 }
7547
7548 static bool flags_managed(u32 adv_flags)
7549 {
7550         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7551                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7552                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7553 }
7554
7555 static bool tx_power_managed(u32 adv_flags)
7556 {
7557         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7558 }
7559
7560 static bool name_managed(u32 adv_flags)
7561 {
7562         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7563 }
7564
7565 static bool appearance_managed(u32 adv_flags)
7566 {
7567         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7568 }
7569
7570 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7571                               u8 len, bool is_adv_data)
7572 {
7573         int i, cur_len;
7574         u8 max_len;
7575
7576         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7577
7578         if (len > max_len)
7579                 return false;
7580
7581         /* Make sure that the data is correctly formatted. */
7582         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7583                 cur_len = data[i];
7584
7585                 if (data[i + 1] == EIR_FLAGS &&
7586                     (!is_adv_data || flags_managed(adv_flags)))
7587                         return false;
7588
7589                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7590                         return false;
7591
7592                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7593                         return false;
7594
7595                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7596                         return false;
7597
7598                 if (data[i + 1] == EIR_APPEARANCE &&
7599                     appearance_managed(adv_flags))
7600                         return false;
7601
7602                 /* If the current field length would exceed the total data
7603                  * length, then it's invalid.
7604                  */
7605                 if (i + cur_len >= len)
7606                         return false;
7607         }
7608
7609         return true;
7610 }
7611
7612 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7613 {
7614         u32 supported_flags, phy_flags;
7615
7616         /* The current implementation only supports a subset of the specified
7617          * flags. Also need to check mutual exclusiveness of sec flags.
7618          */
7619         supported_flags = get_supported_adv_flags(hdev);
7620         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7621         if (adv_flags & ~supported_flags ||
7622             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7623                 return false;
7624
7625         return true;
7626 }
7627
7628 static bool adv_busy(struct hci_dev *hdev)
7629 {
7630         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7631                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7632                 pending_find(MGMT_OP_SET_LE, hdev) ||
7633                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7634                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7635 }
7636
7637 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7638                                      u16 opcode)
7639 {
7640         struct mgmt_pending_cmd *cmd;
7641         struct mgmt_cp_add_advertising *cp;
7642         struct mgmt_rp_add_advertising rp;
7643         struct adv_info *adv_instance, *n;
7644         u8 instance;
7645
7646         bt_dev_dbg(hdev, "status %d", status);
7647
7648         hci_dev_lock(hdev);
7649
7650         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7651         if (!cmd)
7652                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
7653
7654         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7655                 if (!adv_instance->pending)
7656                         continue;
7657
7658                 if (!status) {
7659                         adv_instance->pending = false;
7660                         continue;
7661                 }
7662
7663                 instance = adv_instance->instance;
7664
7665                 if (hdev->cur_adv_instance == instance)
7666                         cancel_adv_timeout(hdev);
7667
7668                 hci_remove_adv_instance(hdev, instance);
7669                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7670         }
7671
7672         if (!cmd)
7673                 goto unlock;
7674
7675         cp = cmd->param;
7676         rp.instance = cp->instance;
7677
7678         if (status)
7679                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7680                                 mgmt_status(status));
7681         else
7682                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7683                                   mgmt_status(status), &rp, sizeof(rp));
7684
7685         mgmt_pending_remove(cmd);
7686
7687 unlock:
7688         hci_dev_unlock(hdev);
7689 }
7690
7691 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7692                            void *data, u16 data_len)
7693 {
7694         struct mgmt_cp_add_advertising *cp = data;
7695         struct mgmt_rp_add_advertising rp;
7696         u32 flags;
7697         u8 status;
7698         u16 timeout, duration;
7699         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7700         u8 schedule_instance = 0;
7701         struct adv_info *next_instance;
7702         int err;
7703         struct mgmt_pending_cmd *cmd;
7704         struct hci_request req;
7705
7706         bt_dev_dbg(hdev, "sock %p", sk);
7707
7708         status = mgmt_le_support(hdev);
7709         if (status)
7710                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7711                                        status);
7712
7713         /* Enabling the experimental LL Privay support disables support for
7714          * advertising.
7715          */
7716         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7717                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7718                                        MGMT_STATUS_NOT_SUPPORTED);
7719
7720         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7721                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7722                                        MGMT_STATUS_INVALID_PARAMS);
7723
7724         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7725                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7726                                        MGMT_STATUS_INVALID_PARAMS);
7727
7728         flags = __le32_to_cpu(cp->flags);
7729         timeout = __le16_to_cpu(cp->timeout);
7730         duration = __le16_to_cpu(cp->duration);
7731
7732         if (!requested_adv_flags_are_valid(hdev, flags))
7733                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7734                                        MGMT_STATUS_INVALID_PARAMS);
7735
7736         hci_dev_lock(hdev);
7737
7738         if (timeout && !hdev_is_powered(hdev)) {
7739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7740                                       MGMT_STATUS_REJECTED);
7741                 goto unlock;
7742         }
7743
7744         if (adv_busy(hdev)) {
7745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7746                                       MGMT_STATUS_BUSY);
7747                 goto unlock;
7748         }
7749
7750         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7751             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7752                                cp->scan_rsp_len, false)) {
7753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7754                                       MGMT_STATUS_INVALID_PARAMS);
7755                 goto unlock;
7756         }
7757
7758         err = hci_add_adv_instance(hdev, cp->instance, flags,
7759                                    cp->adv_data_len, cp->data,
7760                                    cp->scan_rsp_len,
7761                                    cp->data + cp->adv_data_len,
7762                                    timeout, duration,
7763                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
7764                                    hdev->le_adv_min_interval,
7765                                    hdev->le_adv_max_interval);
7766         if (err < 0) {
7767                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7768                                       MGMT_STATUS_FAILED);
7769                 goto unlock;
7770         }
7771
7772         /* Only trigger an advertising added event if a new instance was
7773          * actually added.
7774          */
7775         if (hdev->adv_instance_cnt > prev_instance_cnt)
7776                 mgmt_advertising_added(sk, hdev, cp->instance);
7777
7778         if (hdev->cur_adv_instance == cp->instance) {
7779                 /* If the currently advertised instance is being changed then
7780                  * cancel the current advertising and schedule the next
7781                  * instance. If there is only one instance then the overridden
7782                  * advertising data will be visible right away.
7783                  */
7784                 cancel_adv_timeout(hdev);
7785
7786                 next_instance = hci_get_next_instance(hdev, cp->instance);
7787                 if (next_instance)
7788                         schedule_instance = next_instance->instance;
7789         } else if (!hdev->adv_instance_timeout) {
7790                 /* Immediately advertise the new instance if no other
7791                  * instance is currently being advertised.
7792                  */
7793                 schedule_instance = cp->instance;
7794         }
7795
7796         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7797          * there is no instance to be advertised then we have no HCI
7798          * communication to make. Simply return.
7799          */
7800         if (!hdev_is_powered(hdev) ||
7801             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7802             !schedule_instance) {
7803                 rp.instance = cp->instance;
7804                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7805                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7806                 goto unlock;
7807         }
7808
7809         /* We're good to go, update advertising data, parameters, and start
7810          * advertising.
7811          */
7812         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7813                                data_len);
7814         if (!cmd) {
7815                 err = -ENOMEM;
7816                 goto unlock;
7817         }
7818
7819         hci_req_init(&req, hdev);
7820
7821         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7822
7823         if (!err)
7824                 err = hci_req_run(&req, add_advertising_complete);
7825
7826         if (err < 0) {
7827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7828                                       MGMT_STATUS_FAILED);
7829                 mgmt_pending_remove(cmd);
7830         }
7831
7832 unlock:
7833         hci_dev_unlock(hdev);
7834
7835         return err;
7836 }
7837
7838 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
7839                                         u16 opcode)
7840 {
7841         struct mgmt_pending_cmd *cmd;
7842         struct mgmt_cp_add_ext_adv_params *cp;
7843         struct mgmt_rp_add_ext_adv_params rp;
7844         struct adv_info *adv_instance;
7845         u32 flags;
7846
7847         BT_DBG("%s", hdev->name);
7848
7849         hci_dev_lock(hdev);
7850
7851         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
7852         if (!cmd)
7853                 goto unlock;
7854
7855         cp = cmd->param;
7856         adv_instance = hci_find_adv_instance(hdev, cp->instance);
7857         if (!adv_instance)
7858                 goto unlock;
7859
7860         rp.instance = cp->instance;
7861         rp.tx_power = adv_instance->tx_power;
7862
7863         /* While we're at it, inform userspace of the available space for this
7864          * advertisement, given the flags that will be used.
7865          */
7866         flags = __le32_to_cpu(cp->flags);
7867         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7868         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7869
7870         if (status) {
7871                 /* If this advertisement was previously advertising and we
7872                  * failed to update it, we signal that it has been removed and
7873                  * delete its structure
7874                  */
7875                 if (!adv_instance->pending)
7876                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
7877
7878                 hci_remove_adv_instance(hdev, cp->instance);
7879
7880                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7881                                 mgmt_status(status));
7882
7883         } else {
7884                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7885                                   mgmt_status(status), &rp, sizeof(rp));
7886         }
7887
7888 unlock:
7889         if (cmd)
7890                 mgmt_pending_remove(cmd);
7891
7892         hci_dev_unlock(hdev);
7893 }
7894
7895 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
7896                               void *data, u16 data_len)
7897 {
7898         struct mgmt_cp_add_ext_adv_params *cp = data;
7899         struct mgmt_rp_add_ext_adv_params rp;
7900         struct mgmt_pending_cmd *cmd = NULL;
7901         struct adv_info *adv_instance;
7902         struct hci_request req;
7903         u32 flags, min_interval, max_interval;
7904         u16 timeout, duration;
7905         u8 status;
7906         s8 tx_power;
7907         int err;
7908
7909         BT_DBG("%s", hdev->name);
7910
7911         status = mgmt_le_support(hdev);
7912         if (status)
7913                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7914                                        status);
7915
7916         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7917                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7918                                        MGMT_STATUS_INVALID_PARAMS);
7919
7920         /* The purpose of breaking add_advertising into two separate MGMT calls
7921          * for params and data is to allow more parameters to be added to this
7922          * structure in the future. For this reason, we verify that we have the
7923          * bare minimum structure we know of when the interface was defined. Any
7924          * extra parameters we don't know about will be ignored in this request.
7925          */
7926         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
7927                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7928                                        MGMT_STATUS_INVALID_PARAMS);
7929
7930         flags = __le32_to_cpu(cp->flags);
7931
7932         if (!requested_adv_flags_are_valid(hdev, flags))
7933                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7934                                        MGMT_STATUS_INVALID_PARAMS);
7935
7936         hci_dev_lock(hdev);
7937
7938         /* In new interface, we require that we are powered to register */
7939         if (!hdev_is_powered(hdev)) {
7940                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7941                                       MGMT_STATUS_REJECTED);
7942                 goto unlock;
7943         }
7944
7945         if (adv_busy(hdev)) {
7946                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7947                                       MGMT_STATUS_BUSY);
7948                 goto unlock;
7949         }
7950
7951         /* Parse defined parameters from request, use defaults otherwise */
7952         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
7953                   __le16_to_cpu(cp->timeout) : 0;
7954
7955         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
7956                    __le16_to_cpu(cp->duration) :
7957                    hdev->def_multi_adv_rotation_duration;
7958
7959         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7960                        __le32_to_cpu(cp->min_interval) :
7961                        hdev->le_adv_min_interval;
7962
7963         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7964                        __le32_to_cpu(cp->max_interval) :
7965                        hdev->le_adv_max_interval;
7966
7967         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
7968                    cp->tx_power :
7969                    HCI_ADV_TX_POWER_NO_PREFERENCE;
7970
7971         /* Create advertising instance with no advertising or response data */
7972         err = hci_add_adv_instance(hdev, cp->instance, flags,
7973                                    0, NULL, 0, NULL, timeout, duration,
7974                                    tx_power, min_interval, max_interval);
7975
7976         if (err < 0) {
7977                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7978                                       MGMT_STATUS_FAILED);
7979                 goto unlock;
7980         }
7981
7982         /* Submit request for advertising params if ext adv available */
7983         if (ext_adv_capable(hdev)) {
7984                 hci_req_init(&req, hdev);
7985                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7986
7987                 /* Updating parameters of an active instance will return a
7988                  * Command Disallowed error, so we must first disable the
7989                  * instance if it is active.
7990                  */
7991                 if (!adv_instance->pending)
7992                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
7993
7994                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
7995
7996                 err = hci_req_run(&req, add_ext_adv_params_complete);
7997
7998                 if (!err)
7999                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
8000                                                hdev, data, data_len);
8001                 if (!cmd) {
8002                         err = -ENOMEM;
8003                         hci_remove_adv_instance(hdev, cp->instance);
8004                         goto unlock;
8005                 }
8006
8007         } else {
8008                 rp.instance = cp->instance;
8009                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8010                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8011                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8012                 err = mgmt_cmd_complete(sk, hdev->id,
8013                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8014                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8015         }
8016
8017 unlock:
8018         hci_dev_unlock(hdev);
8019
8020         return err;
8021 }
8022
8023 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8024                             u16 data_len)
8025 {
8026         struct mgmt_cp_add_ext_adv_data *cp = data;
8027         struct mgmt_rp_add_ext_adv_data rp;
8028         u8 schedule_instance = 0;
8029         struct adv_info *next_instance;
8030         struct adv_info *adv_instance;
8031         int err = 0;
8032         struct mgmt_pending_cmd *cmd;
8033         struct hci_request req;
8034
8035         BT_DBG("%s", hdev->name);
8036
8037         hci_dev_lock(hdev);
8038
8039         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8040
8041         if (!adv_instance) {
8042                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8043                                       MGMT_STATUS_INVALID_PARAMS);
8044                 goto unlock;
8045         }
8046
8047         /* In new interface, we require that we are powered to register */
8048         if (!hdev_is_powered(hdev)) {
8049                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8050                                       MGMT_STATUS_REJECTED);
8051                 goto clear_new_instance;
8052         }
8053
8054         if (adv_busy(hdev)) {
8055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8056                                       MGMT_STATUS_BUSY);
8057                 goto clear_new_instance;
8058         }
8059
8060         /* Validate new data */
8061         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8062                                cp->adv_data_len, true) ||
8063             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8064                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8065                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8066                                       MGMT_STATUS_INVALID_PARAMS);
8067                 goto clear_new_instance;
8068         }
8069
8070         /* Set the data in the advertising instance */
8071         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8072                                   cp->data, cp->scan_rsp_len,
8073                                   cp->data + cp->adv_data_len);
8074
8075         /* We're good to go, update advertising data, parameters, and start
8076          * advertising.
8077          */
8078
8079         hci_req_init(&req, hdev);
8080
8081         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
8082
8083         if (ext_adv_capable(hdev)) {
8084                 __hci_req_update_adv_data(&req, cp->instance);
8085                 __hci_req_update_scan_rsp_data(&req, cp->instance);
8086                 __hci_req_enable_ext_advertising(&req, cp->instance);
8087
8088         } else {
8089                 /* If using software rotation, determine next instance to use */
8090
8091                 if (hdev->cur_adv_instance == cp->instance) {
8092                         /* If the currently advertised instance is being changed
8093                          * then cancel the current advertising and schedule the
8094                          * next instance. If there is only one instance then the
8095                          * overridden advertising data will be visible right
8096                          * away
8097                          */
8098                         cancel_adv_timeout(hdev);
8099
8100                         next_instance = hci_get_next_instance(hdev,
8101                                                               cp->instance);
8102                         if (next_instance)
8103                                 schedule_instance = next_instance->instance;
8104                 } else if (!hdev->adv_instance_timeout) {
8105                         /* Immediately advertise the new instance if no other
8106                          * instance is currently being advertised.
8107                          */
8108                         schedule_instance = cp->instance;
8109                 }
8110
8111                 /* If the HCI_ADVERTISING flag is set or there is no instance to
8112                  * be advertised then we have no HCI communication to make.
8113                  * Simply return.
8114                  */
8115                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8116                     !schedule_instance) {
8117                         if (adv_instance->pending) {
8118                                 mgmt_advertising_added(sk, hdev, cp->instance);
8119                                 adv_instance->pending = false;
8120                         }
8121                         rp.instance = cp->instance;
8122                         err = mgmt_cmd_complete(sk, hdev->id,
8123                                                 MGMT_OP_ADD_EXT_ADV_DATA,
8124                                                 MGMT_STATUS_SUCCESS, &rp,
8125                                                 sizeof(rp));
8126                         goto unlock;
8127                 }
8128
8129                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
8130                                                       true);
8131         }
8132
8133         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8134                                data_len);
8135         if (!cmd) {
8136                 err = -ENOMEM;
8137                 goto clear_new_instance;
8138         }
8139
8140         if (!err)
8141                 err = hci_req_run(&req, add_advertising_complete);
8142
8143         if (err < 0) {
8144                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8145                                       MGMT_STATUS_FAILED);
8146                 mgmt_pending_remove(cmd);
8147                 goto clear_new_instance;
8148         }
8149
8150         /* We were successful in updating data, so trigger advertising_added
8151          * event if this is an instance that wasn't previously advertising. If
8152          * a failure occurs in the requests we initiated, we will remove the
8153          * instance again in add_advertising_complete
8154          */
8155         if (adv_instance->pending)
8156                 mgmt_advertising_added(sk, hdev, cp->instance);
8157
8158         goto unlock;
8159
8160 clear_new_instance:
8161         hci_remove_adv_instance(hdev, cp->instance);
8162
8163 unlock:
8164         hci_dev_unlock(hdev);
8165
8166         return err;
8167 }
8168
8169 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
8170                                         u16 opcode)
8171 {
8172         struct mgmt_pending_cmd *cmd;
8173         struct mgmt_cp_remove_advertising *cp;
8174         struct mgmt_rp_remove_advertising rp;
8175
8176         bt_dev_dbg(hdev, "status %d", status);
8177
8178         hci_dev_lock(hdev);
8179
8180         /* A failure status here only means that we failed to disable
8181          * advertising. Otherwise, the advertising instance has been removed,
8182          * so report success.
8183          */
8184         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
8185         if (!cmd)
8186                 goto unlock;
8187
8188         cp = cmd->param;
8189         rp.instance = cp->instance;
8190
8191         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
8192                           &rp, sizeof(rp));
8193         mgmt_pending_remove(cmd);
8194
8195 unlock:
8196         hci_dev_unlock(hdev);
8197 }
8198
8199 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8200                               void *data, u16 data_len)
8201 {
8202         struct mgmt_cp_remove_advertising *cp = data;
8203         struct mgmt_rp_remove_advertising rp;
8204         struct mgmt_pending_cmd *cmd;
8205         struct hci_request req;
8206         int err;
8207
8208         bt_dev_dbg(hdev, "sock %p", sk);
8209
8210         /* Enabling the experimental LL Privay support disables support for
8211          * advertising.
8212          */
8213         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8214                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8215                                        MGMT_STATUS_NOT_SUPPORTED);
8216
8217         hci_dev_lock(hdev);
8218
8219         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8220                 err = mgmt_cmd_status(sk, hdev->id,
8221                                       MGMT_OP_REMOVE_ADVERTISING,
8222                                       MGMT_STATUS_INVALID_PARAMS);
8223                 goto unlock;
8224         }
8225
8226         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8227             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8228             pending_find(MGMT_OP_SET_LE, hdev)) {
8229                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8230                                       MGMT_STATUS_BUSY);
8231                 goto unlock;
8232         }
8233
8234         if (list_empty(&hdev->adv_instances)) {
8235                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8236                                       MGMT_STATUS_INVALID_PARAMS);
8237                 goto unlock;
8238         }
8239
8240         hci_req_init(&req, hdev);
8241
8242         /* If we use extended advertising, instance is disabled and removed */
8243         if (ext_adv_capable(hdev)) {
8244                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
8245                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
8246         }
8247
8248         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8249
8250         if (list_empty(&hdev->adv_instances))
8251                 __hci_req_disable_advertising(&req);
8252
8253         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8254          * flag is set or the device isn't powered then we have no HCI
8255          * communication to make. Simply return.
8256          */
8257         if (skb_queue_empty(&req.cmd_q) ||
8258             !hdev_is_powered(hdev) ||
8259             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8260                 hci_req_purge(&req);
8261                 rp.instance = cp->instance;
8262                 err = mgmt_cmd_complete(sk, hdev->id,
8263                                         MGMT_OP_REMOVE_ADVERTISING,
8264                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8265                 goto unlock;
8266         }
8267
8268         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8269                                data_len);
8270         if (!cmd) {
8271                 err = -ENOMEM;
8272                 goto unlock;
8273         }
8274
8275         err = hci_req_run(&req, remove_advertising_complete);
8276         if (err < 0)
8277                 mgmt_pending_remove(cmd);
8278
8279 unlock:
8280         hci_dev_unlock(hdev);
8281
8282         return err;
8283 }
8284
8285 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8286                              void *data, u16 data_len)
8287 {
8288         struct mgmt_cp_get_adv_size_info *cp = data;
8289         struct mgmt_rp_get_adv_size_info rp;
8290         u32 flags, supported_flags;
8291         int err;
8292
8293         bt_dev_dbg(hdev, "sock %p", sk);
8294
8295         if (!lmp_le_capable(hdev))
8296                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8297                                        MGMT_STATUS_REJECTED);
8298
8299         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8300                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8301                                        MGMT_STATUS_INVALID_PARAMS);
8302
8303         flags = __le32_to_cpu(cp->flags);
8304
8305         /* The current implementation only supports a subset of the specified
8306          * flags.
8307          */
8308         supported_flags = get_supported_adv_flags(hdev);
8309         if (flags & ~supported_flags)
8310                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8311                                        MGMT_STATUS_INVALID_PARAMS);
8312
8313         rp.instance = cp->instance;
8314         rp.flags = cp->flags;
8315         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8316         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8317
8318         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8319                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8320
8321         return err;
8322 }
8323
8324 static const struct hci_mgmt_handler mgmt_handlers[] = {
8325         { NULL }, /* 0x0000 (no command) */
8326         { read_version,            MGMT_READ_VERSION_SIZE,
8327                                                 HCI_MGMT_NO_HDEV |
8328                                                 HCI_MGMT_UNTRUSTED },
8329         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8330                                                 HCI_MGMT_NO_HDEV |
8331                                                 HCI_MGMT_UNTRUSTED },
8332         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8333                                                 HCI_MGMT_NO_HDEV |
8334                                                 HCI_MGMT_UNTRUSTED },
8335         { read_controller_info,    MGMT_READ_INFO_SIZE,
8336                                                 HCI_MGMT_UNTRUSTED },
8337         { set_powered,             MGMT_SETTING_SIZE },
8338         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8339         { set_connectable,         MGMT_SETTING_SIZE },
8340         { set_fast_connectable,    MGMT_SETTING_SIZE },
8341         { set_bondable,            MGMT_SETTING_SIZE },
8342         { set_link_security,       MGMT_SETTING_SIZE },
8343         { set_ssp,                 MGMT_SETTING_SIZE },
8344         { set_hs,                  MGMT_SETTING_SIZE },
8345         { set_le,                  MGMT_SETTING_SIZE },
8346         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8347         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8348         { add_uuid,                MGMT_ADD_UUID_SIZE },
8349         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8350         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8351                                                 HCI_MGMT_VAR_LEN },
8352         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8353                                                 HCI_MGMT_VAR_LEN },
8354         { disconnect,              MGMT_DISCONNECT_SIZE },
8355         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8356         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8357         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8358         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8359         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8360         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8361         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8362         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8363         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8364         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8365         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8366         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8367         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8368                                                 HCI_MGMT_VAR_LEN },
8369         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8370         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8371         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8372         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8373         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8374         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8375         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8376         { set_advertising,         MGMT_SETTING_SIZE },
8377         { set_bredr,               MGMT_SETTING_SIZE },
8378         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8379         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8380         { set_secure_conn,         MGMT_SETTING_SIZE },
8381         { set_debug_keys,          MGMT_SETTING_SIZE },
8382         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8383         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8384                                                 HCI_MGMT_VAR_LEN },
8385         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8386         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8387         { add_device,              MGMT_ADD_DEVICE_SIZE },
8388         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8389         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8390                                                 HCI_MGMT_VAR_LEN },
8391         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8392                                                 HCI_MGMT_NO_HDEV |
8393                                                 HCI_MGMT_UNTRUSTED },
8394         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8395                                                 HCI_MGMT_UNCONFIGURED |
8396                                                 HCI_MGMT_UNTRUSTED },
8397         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8398                                                 HCI_MGMT_UNCONFIGURED },
8399         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8400                                                 HCI_MGMT_UNCONFIGURED },
8401         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8402                                                 HCI_MGMT_VAR_LEN },
8403         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8404         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8405                                                 HCI_MGMT_NO_HDEV |
8406                                                 HCI_MGMT_UNTRUSTED },
8407         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8408         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8409                                                 HCI_MGMT_VAR_LEN },
8410         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8411         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8412         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8413         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8414                                                 HCI_MGMT_UNTRUSTED },
8415         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8416         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8417         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8418         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8419                                                 HCI_MGMT_VAR_LEN },
8420         { set_wideband_speech,     MGMT_SETTING_SIZE },
8421         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8422                                                 HCI_MGMT_UNTRUSTED },
8423         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8424                                                 HCI_MGMT_UNTRUSTED |
8425                                                 HCI_MGMT_HDEV_OPTIONAL },
8426         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8427                                                 HCI_MGMT_VAR_LEN |
8428                                                 HCI_MGMT_HDEV_OPTIONAL },
8429         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8430                                                 HCI_MGMT_UNTRUSTED },
8431         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8432                                                 HCI_MGMT_VAR_LEN },
8433         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8434                                                 HCI_MGMT_UNTRUSTED },
8435         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8436                                                 HCI_MGMT_VAR_LEN },
8437         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8438         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8439         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8440         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8441                                                 HCI_MGMT_VAR_LEN },
8442         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8443         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8444                                                 HCI_MGMT_VAR_LEN },
8445         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8446                                                 HCI_MGMT_VAR_LEN },
8447         { add_adv_patterns_monitor_rssi,
8448                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8449                                                 HCI_MGMT_VAR_LEN },
8450 };
8451
8452 void mgmt_index_added(struct hci_dev *hdev)
8453 {
8454         struct mgmt_ev_ext_index ev;
8455
8456         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8457                 return;
8458
8459         switch (hdev->dev_type) {
8460         case HCI_PRIMARY:
8461                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8462                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8463                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8464                         ev.type = 0x01;
8465                 } else {
8466                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8467                                          HCI_MGMT_INDEX_EVENTS);
8468                         ev.type = 0x00;
8469                 }
8470                 break;
8471         case HCI_AMP:
8472                 ev.type = 0x02;
8473                 break;
8474         default:
8475                 return;
8476         }
8477
8478         ev.bus = hdev->bus;
8479
8480         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8481                          HCI_MGMT_EXT_INDEX_EVENTS);
8482 }
8483
8484 void mgmt_index_removed(struct hci_dev *hdev)
8485 {
8486         struct mgmt_ev_ext_index ev;
8487         u8 status = MGMT_STATUS_INVALID_INDEX;
8488
8489         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8490                 return;
8491
8492         switch (hdev->dev_type) {
8493         case HCI_PRIMARY:
8494                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8495
8496                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8497                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8498                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8499                         ev.type = 0x01;
8500                 } else {
8501                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8502                                          HCI_MGMT_INDEX_EVENTS);
8503                         ev.type = 0x00;
8504                 }
8505                 break;
8506         case HCI_AMP:
8507                 ev.type = 0x02;
8508                 break;
8509         default:
8510                 return;
8511         }
8512
8513         ev.bus = hdev->bus;
8514
8515         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8516                          HCI_MGMT_EXT_INDEX_EVENTS);
8517 }
8518
8519 /* This function requires the caller holds hdev->lock */
8520 static void restart_le_actions(struct hci_dev *hdev)
8521 {
8522         struct hci_conn_params *p;
8523
8524         list_for_each_entry(p, &hdev->le_conn_params, list) {
8525                 /* Needed for AUTO_OFF case where might not "really"
8526                  * have been powered off.
8527                  */
8528                 list_del_init(&p->action);
8529
8530                 switch (p->auto_connect) {
8531                 case HCI_AUTO_CONN_DIRECT:
8532                 case HCI_AUTO_CONN_ALWAYS:
8533                         list_add(&p->action, &hdev->pend_le_conns);
8534                         break;
8535                 case HCI_AUTO_CONN_REPORT:
8536                         list_add(&p->action, &hdev->pend_le_reports);
8537                         break;
8538                 default:
8539                         break;
8540                 }
8541         }
8542 }
8543
8544 void mgmt_power_on(struct hci_dev *hdev, int err)
8545 {
8546         struct cmd_lookup match = { NULL, hdev };
8547
8548         bt_dev_dbg(hdev, "err %d", err);
8549
8550         hci_dev_lock(hdev);
8551
8552         if (!err) {
8553                 restart_le_actions(hdev);
8554                 hci_update_background_scan(hdev);
8555         }
8556
8557         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8558
8559         new_settings(hdev, match.sk);
8560
8561         if (match.sk)
8562                 sock_put(match.sk);
8563
8564         hci_dev_unlock(hdev);
8565 }
8566
8567 void __mgmt_power_off(struct hci_dev *hdev)
8568 {
8569         struct cmd_lookup match = { NULL, hdev };
8570         u8 status, zero_cod[] = { 0, 0, 0 };
8571
8572         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8573
8574         /* If the power off is because of hdev unregistration let
8575          * use the appropriate INVALID_INDEX status. Otherwise use
8576          * NOT_POWERED. We cover both scenarios here since later in
8577          * mgmt_index_removed() any hci_conn callbacks will have already
8578          * been triggered, potentially causing misleading DISCONNECTED
8579          * status responses.
8580          */
8581         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8582                 status = MGMT_STATUS_INVALID_INDEX;
8583         else
8584                 status = MGMT_STATUS_NOT_POWERED;
8585
8586         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8587
8588         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8589                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8590                                    zero_cod, sizeof(zero_cod),
8591                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8592                 ext_info_changed(hdev, NULL);
8593         }
8594
8595         new_settings(hdev, match.sk);
8596
8597         if (match.sk)
8598                 sock_put(match.sk);
8599 }
8600
8601 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8602 {
8603         struct mgmt_pending_cmd *cmd;
8604         u8 status;
8605
8606         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8607         if (!cmd)
8608                 return;
8609
8610         if (err == -ERFKILL)
8611                 status = MGMT_STATUS_RFKILLED;
8612         else
8613                 status = MGMT_STATUS_FAILED;
8614
8615         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8616
8617         mgmt_pending_remove(cmd);
8618 }
8619
8620 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8621                        bool persistent)
8622 {
8623         struct mgmt_ev_new_link_key ev;
8624
8625         memset(&ev, 0, sizeof(ev));
8626
8627         ev.store_hint = persistent;
8628         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8629         ev.key.addr.type = BDADDR_BREDR;
8630         ev.key.type = key->type;
8631         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8632         ev.key.pin_len = key->pin_len;
8633
8634         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8635 }
8636
8637 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8638 {
8639         switch (ltk->type) {
8640         case SMP_LTK:
8641         case SMP_LTK_SLAVE:
8642                 if (ltk->authenticated)
8643                         return MGMT_LTK_AUTHENTICATED;
8644                 return MGMT_LTK_UNAUTHENTICATED;
8645         case SMP_LTK_P256:
8646                 if (ltk->authenticated)
8647                         return MGMT_LTK_P256_AUTH;
8648                 return MGMT_LTK_P256_UNAUTH;
8649         case SMP_LTK_P256_DEBUG:
8650                 return MGMT_LTK_P256_DEBUG;
8651         }
8652
8653         return MGMT_LTK_UNAUTHENTICATED;
8654 }
8655
8656 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8657 {
8658         struct mgmt_ev_new_long_term_key ev;
8659
8660         memset(&ev, 0, sizeof(ev));
8661
8662         /* Devices using resolvable or non-resolvable random addresses
8663          * without providing an identity resolving key don't require
8664          * to store long term keys. Their addresses will change the
8665          * next time around.
8666          *
8667          * Only when a remote device provides an identity address
8668          * make sure the long term key is stored. If the remote
8669          * identity is known, the long term keys are internally
8670          * mapped to the identity address. So allow static random
8671          * and public addresses here.
8672          */
8673         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8674             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8675                 ev.store_hint = 0x00;
8676         else
8677                 ev.store_hint = persistent;
8678
8679         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8680         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8681         ev.key.type = mgmt_ltk_type(key);
8682         ev.key.enc_size = key->enc_size;
8683         ev.key.ediv = key->ediv;
8684         ev.key.rand = key->rand;
8685
8686         if (key->type == SMP_LTK)
8687                 ev.key.master = 1;
8688
8689         /* Make sure we copy only the significant bytes based on the
8690          * encryption key size, and set the rest of the value to zeroes.
8691          */
8692         memcpy(ev.key.val, key->val, key->enc_size);
8693         memset(ev.key.val + key->enc_size, 0,
8694                sizeof(ev.key.val) - key->enc_size);
8695
8696         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8697 }
8698
8699 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8700 {
8701         struct mgmt_ev_new_irk ev;
8702
8703         memset(&ev, 0, sizeof(ev));
8704
8705         ev.store_hint = persistent;
8706
8707         bacpy(&ev.rpa, &irk->rpa);
8708         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8709         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8710         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8711
8712         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8713 }
8714
8715 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8716                    bool persistent)
8717 {
8718         struct mgmt_ev_new_csrk ev;
8719
8720         memset(&ev, 0, sizeof(ev));
8721
8722         /* Devices using resolvable or non-resolvable random addresses
8723          * without providing an identity resolving key don't require
8724          * to store signature resolving keys. Their addresses will change
8725          * the next time around.
8726          *
8727          * Only when a remote device provides an identity address
8728          * make sure the signature resolving key is stored. So allow
8729          * static random and public addresses here.
8730          */
8731         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8732             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8733                 ev.store_hint = 0x00;
8734         else
8735                 ev.store_hint = persistent;
8736
8737         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8738         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8739         ev.key.type = csrk->type;
8740         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8741
8742         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8743 }
8744
8745 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8746                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8747                          u16 max_interval, u16 latency, u16 timeout)
8748 {
8749         struct mgmt_ev_new_conn_param ev;
8750
8751         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8752                 return;
8753
8754         memset(&ev, 0, sizeof(ev));
8755         bacpy(&ev.addr.bdaddr, bdaddr);
8756         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8757         ev.store_hint = store_hint;
8758         ev.min_interval = cpu_to_le16(min_interval);
8759         ev.max_interval = cpu_to_le16(max_interval);
8760         ev.latency = cpu_to_le16(latency);
8761         ev.timeout = cpu_to_le16(timeout);
8762
8763         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8764 }
8765
8766 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8767                            u32 flags, u8 *name, u8 name_len)
8768 {
8769         char buf[512];
8770         struct mgmt_ev_device_connected *ev = (void *) buf;
8771         u16 eir_len = 0;
8772
8773         bacpy(&ev->addr.bdaddr, &conn->dst);
8774         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8775
8776         ev->flags = __cpu_to_le32(flags);
8777
8778         /* We must ensure that the EIR Data fields are ordered and
8779          * unique. Keep it simple for now and avoid the problem by not
8780          * adding any BR/EDR data to the LE adv.
8781          */
8782         if (conn->le_adv_data_len > 0) {
8783                 memcpy(&ev->eir[eir_len],
8784                        conn->le_adv_data, conn->le_adv_data_len);
8785                 eir_len = conn->le_adv_data_len;
8786         } else {
8787                 if (name_len > 0)
8788                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8789                                                   name, name_len);
8790
8791                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8792                         eir_len = eir_append_data(ev->eir, eir_len,
8793                                                   EIR_CLASS_OF_DEV,
8794                                                   conn->dev_class, 3);
8795         }
8796
8797         ev->eir_len = cpu_to_le16(eir_len);
8798
8799         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8800                     sizeof(*ev) + eir_len, NULL);
8801 }
8802
8803 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8804 {
8805         struct sock **sk = data;
8806
8807         cmd->cmd_complete(cmd, 0);
8808
8809         *sk = cmd->sk;
8810         sock_hold(*sk);
8811
8812         mgmt_pending_remove(cmd);
8813 }
8814
8815 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8816 {
8817         struct hci_dev *hdev = data;
8818         struct mgmt_cp_unpair_device *cp = cmd->param;
8819
8820         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8821
8822         cmd->cmd_complete(cmd, 0);
8823         mgmt_pending_remove(cmd);
8824 }
8825
8826 bool mgmt_powering_down(struct hci_dev *hdev)
8827 {
8828         struct mgmt_pending_cmd *cmd;
8829         struct mgmt_mode *cp;
8830
8831         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8832         if (!cmd)
8833                 return false;
8834
8835         cp = cmd->param;
8836         if (!cp->val)
8837                 return true;
8838
8839         return false;
8840 }
8841
8842 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8843                               u8 link_type, u8 addr_type, u8 reason,
8844                               bool mgmt_connected)
8845 {
8846         struct mgmt_ev_device_disconnected ev;
8847         struct sock *sk = NULL;
8848
8849         /* The connection is still in hci_conn_hash so test for 1
8850          * instead of 0 to know if this is the last one.
8851          */
8852         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8853                 cancel_delayed_work(&hdev->power_off);
8854                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8855         }
8856
8857         if (!mgmt_connected)
8858                 return;
8859
8860         if (link_type != ACL_LINK && link_type != LE_LINK)
8861                 return;
8862
8863         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8864
8865         bacpy(&ev.addr.bdaddr, bdaddr);
8866         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8867         ev.reason = reason;
8868
8869         /* Report disconnects due to suspend */
8870         if (hdev->suspended)
8871                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8872
8873         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8874
8875         if (sk)
8876                 sock_put(sk);
8877
8878         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8879                              hdev);
8880 }
8881
8882 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8883                             u8 link_type, u8 addr_type, u8 status)
8884 {
8885         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8886         struct mgmt_cp_disconnect *cp;
8887         struct mgmt_pending_cmd *cmd;
8888
8889         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8890                              hdev);
8891
8892         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8893         if (!cmd)
8894                 return;
8895
8896         cp = cmd->param;
8897
8898         if (bacmp(bdaddr, &cp->addr.bdaddr))
8899                 return;
8900
8901         if (cp->addr.type != bdaddr_type)
8902                 return;
8903
8904         cmd->cmd_complete(cmd, mgmt_status(status));
8905         mgmt_pending_remove(cmd);
8906 }
8907
8908 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8909                          u8 addr_type, u8 status)
8910 {
8911         struct mgmt_ev_connect_failed ev;
8912
8913         /* The connection is still in hci_conn_hash so test for 1
8914          * instead of 0 to know if this is the last one.
8915          */
8916         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8917                 cancel_delayed_work(&hdev->power_off);
8918                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8919         }
8920
8921         bacpy(&ev.addr.bdaddr, bdaddr);
8922         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8923         ev.status = mgmt_status(status);
8924
8925         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8926 }
8927
8928 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8929 {
8930         struct mgmt_ev_pin_code_request ev;
8931
8932         bacpy(&ev.addr.bdaddr, bdaddr);
8933         ev.addr.type = BDADDR_BREDR;
8934         ev.secure = secure;
8935
8936         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8937 }
8938
8939 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8940                                   u8 status)
8941 {
8942         struct mgmt_pending_cmd *cmd;
8943
8944         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8945         if (!cmd)
8946                 return;
8947
8948         cmd->cmd_complete(cmd, mgmt_status(status));
8949         mgmt_pending_remove(cmd);
8950 }
8951
8952 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8953                                       u8 status)
8954 {
8955         struct mgmt_pending_cmd *cmd;
8956
8957         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8958         if (!cmd)
8959                 return;
8960
8961         cmd->cmd_complete(cmd, mgmt_status(status));
8962         mgmt_pending_remove(cmd);
8963 }
8964
8965 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8966                               u8 link_type, u8 addr_type, u32 value,
8967                               u8 confirm_hint)
8968 {
8969         struct mgmt_ev_user_confirm_request ev;
8970
8971         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8972
8973         bacpy(&ev.addr.bdaddr, bdaddr);
8974         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8975         ev.confirm_hint = confirm_hint;
8976         ev.value = cpu_to_le32(value);
8977
8978         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8979                           NULL);
8980 }
8981
8982 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8983                               u8 link_type, u8 addr_type)
8984 {
8985         struct mgmt_ev_user_passkey_request ev;
8986
8987         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8988
8989         bacpy(&ev.addr.bdaddr, bdaddr);
8990         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8991
8992         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8993                           NULL);
8994 }
8995
8996 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8997                                       u8 link_type, u8 addr_type, u8 status,
8998                                       u8 opcode)
8999 {
9000         struct mgmt_pending_cmd *cmd;
9001
9002         cmd = pending_find(opcode, hdev);
9003         if (!cmd)
9004                 return -ENOENT;
9005
9006         cmd->cmd_complete(cmd, mgmt_status(status));
9007         mgmt_pending_remove(cmd);
9008
9009         return 0;
9010 }
9011
9012 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9013                                      u8 link_type, u8 addr_type, u8 status)
9014 {
9015         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9016                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9017 }
9018
9019 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9020                                          u8 link_type, u8 addr_type, u8 status)
9021 {
9022         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9023                                           status,
9024                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9025 }
9026
9027 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9028                                      u8 link_type, u8 addr_type, u8 status)
9029 {
9030         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9031                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9032 }
9033
9034 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9035                                          u8 link_type, u8 addr_type, u8 status)
9036 {
9037         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9038                                           status,
9039                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9040 }
9041
9042 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9043                              u8 link_type, u8 addr_type, u32 passkey,
9044                              u8 entered)
9045 {
9046         struct mgmt_ev_passkey_notify ev;
9047
9048         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9049
9050         bacpy(&ev.addr.bdaddr, bdaddr);
9051         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9052         ev.passkey = __cpu_to_le32(passkey);
9053         ev.entered = entered;
9054
9055         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9056 }
9057
9058 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9059 {
9060         struct mgmt_ev_auth_failed ev;
9061         struct mgmt_pending_cmd *cmd;
9062         u8 status = mgmt_status(hci_status);
9063
9064         bacpy(&ev.addr.bdaddr, &conn->dst);
9065         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9066         ev.status = status;
9067
9068         cmd = find_pairing(conn);
9069
9070         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9071                     cmd ? cmd->sk : NULL);
9072
9073         if (cmd) {
9074                 cmd->cmd_complete(cmd, status);
9075                 mgmt_pending_remove(cmd);
9076         }
9077 }
9078
9079 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9080 {
9081         struct cmd_lookup match = { NULL, hdev };
9082         bool changed;
9083
9084         if (status) {
9085                 u8 mgmt_err = mgmt_status(status);
9086                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9087                                      cmd_status_rsp, &mgmt_err);
9088                 return;
9089         }
9090
9091         if (test_bit(HCI_AUTH, &hdev->flags))
9092                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9093         else
9094                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9095
9096         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9097                              &match);
9098
9099         if (changed)
9100                 new_settings(hdev, match.sk);
9101
9102         if (match.sk)
9103                 sock_put(match.sk);
9104 }
9105
9106 static void clear_eir(struct hci_request *req)
9107 {
9108         struct hci_dev *hdev = req->hdev;
9109         struct hci_cp_write_eir cp;
9110
9111         if (!lmp_ext_inq_capable(hdev))
9112                 return;
9113
9114         memset(hdev->eir, 0, sizeof(hdev->eir));
9115
9116         memset(&cp, 0, sizeof(cp));
9117
9118         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9119 }
9120
9121 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9122 {
9123         struct cmd_lookup match = { NULL, hdev };
9124         struct hci_request req;
9125         bool changed = false;
9126
9127         if (status) {
9128                 u8 mgmt_err = mgmt_status(status);
9129
9130                 if (enable && hci_dev_test_and_clear_flag(hdev,
9131                                                           HCI_SSP_ENABLED)) {
9132                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9133                         new_settings(hdev, NULL);
9134                 }
9135
9136                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9137                                      &mgmt_err);
9138                 return;
9139         }
9140
9141         if (enable) {
9142                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
9143         } else {
9144                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9145                 if (!changed)
9146                         changed = hci_dev_test_and_clear_flag(hdev,
9147                                                               HCI_HS_ENABLED);
9148                 else
9149                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9150         }
9151
9152         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9153
9154         if (changed)
9155                 new_settings(hdev, match.sk);
9156
9157         if (match.sk)
9158                 sock_put(match.sk);
9159
9160         hci_req_init(&req, hdev);
9161
9162         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9163                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
9164                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9165                                     sizeof(enable), &enable);
9166                 __hci_req_update_eir(&req);
9167         } else {
9168                 clear_eir(&req);
9169         }
9170
9171         hci_req_run(&req, NULL);
9172 }
9173
9174 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9175 {
9176         struct cmd_lookup *match = data;
9177
9178         if (match->sk == NULL) {
9179                 match->sk = cmd->sk;
9180                 sock_hold(match->sk);
9181         }
9182 }
9183
9184 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9185                                     u8 status)
9186 {
9187         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9188
9189         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9190         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9191         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9192
9193         if (!status) {
9194                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9195                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9196                 ext_info_changed(hdev, NULL);
9197         }
9198
9199         if (match.sk)
9200                 sock_put(match.sk);
9201 }
9202
9203 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9204 {
9205         struct mgmt_cp_set_local_name ev;
9206         struct mgmt_pending_cmd *cmd;
9207
9208         if (status)
9209                 return;
9210
9211         memset(&ev, 0, sizeof(ev));
9212         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9213         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9214
9215         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9216         if (!cmd) {
9217                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9218
9219                 /* If this is a HCI command related to powering on the
9220                  * HCI dev don't send any mgmt signals.
9221                  */
9222                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9223                         return;
9224         }
9225
9226         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9227                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9228         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9229 }
9230
9231 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9232 {
9233         int i;
9234
9235         for (i = 0; i < uuid_count; i++) {
9236                 if (!memcmp(uuid, uuids[i], 16))
9237                         return true;
9238         }
9239
9240         return false;
9241 }
9242
9243 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9244 {
9245         u16 parsed = 0;
9246
9247         while (parsed < eir_len) {
9248                 u8 field_len = eir[0];
9249                 u8 uuid[16];
9250                 int i;
9251
9252                 if (field_len == 0)
9253                         break;
9254
9255                 if (eir_len - parsed < field_len + 1)
9256                         break;
9257
9258                 switch (eir[1]) {
9259                 case EIR_UUID16_ALL:
9260                 case EIR_UUID16_SOME:
9261                         for (i = 0; i + 3 <= field_len; i += 2) {
9262                                 memcpy(uuid, bluetooth_base_uuid, 16);
9263                                 uuid[13] = eir[i + 3];
9264                                 uuid[12] = eir[i + 2];
9265                                 if (has_uuid(uuid, uuid_count, uuids))
9266                                         return true;
9267                         }
9268                         break;
9269                 case EIR_UUID32_ALL:
9270                 case EIR_UUID32_SOME:
9271                         for (i = 0; i + 5 <= field_len; i += 4) {
9272                                 memcpy(uuid, bluetooth_base_uuid, 16);
9273                                 uuid[15] = eir[i + 5];
9274                                 uuid[14] = eir[i + 4];
9275                                 uuid[13] = eir[i + 3];
9276                                 uuid[12] = eir[i + 2];
9277                                 if (has_uuid(uuid, uuid_count, uuids))
9278                                         return true;
9279                         }
9280                         break;
9281                 case EIR_UUID128_ALL:
9282                 case EIR_UUID128_SOME:
9283                         for (i = 0; i + 17 <= field_len; i += 16) {
9284                                 memcpy(uuid, eir + i + 2, 16);
9285                                 if (has_uuid(uuid, uuid_count, uuids))
9286                                         return true;
9287                         }
9288                         break;
9289                 }
9290
9291                 parsed += field_len + 1;
9292                 eir += field_len + 1;
9293         }
9294
9295         return false;
9296 }
9297
9298 static void restart_le_scan(struct hci_dev *hdev)
9299 {
9300         /* If controller is not scanning we are done. */
9301         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9302                 return;
9303
9304         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9305                        hdev->discovery.scan_start +
9306                        hdev->discovery.scan_duration))
9307                 return;
9308
9309         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9310                            DISCOV_LE_RESTART_DELAY);
9311 }
9312
9313 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9314                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9315 {
9316         /* If a RSSI threshold has been specified, and
9317          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9318          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9319          * is set, let it through for further processing, as we might need to
9320          * restart the scan.
9321          *
9322          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9323          * the results are also dropped.
9324          */
9325         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9326             (rssi == HCI_RSSI_INVALID ||
9327             (rssi < hdev->discovery.rssi &&
9328              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9329                 return  false;
9330
9331         if (hdev->discovery.uuid_count != 0) {
9332                 /* If a list of UUIDs is provided in filter, results with no
9333                  * matching UUID should be dropped.
9334                  */
9335                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9336                                    hdev->discovery.uuids) &&
9337                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9338                                    hdev->discovery.uuid_count,
9339                                    hdev->discovery.uuids))
9340                         return false;
9341         }
9342
9343         /* If duplicate filtering does not report RSSI changes, then restart
9344          * scanning to ensure updated result with updated RSSI values.
9345          */
9346         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9347                 restart_le_scan(hdev);
9348
9349                 /* Validate RSSI value against the RSSI threshold once more. */
9350                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9351                     rssi < hdev->discovery.rssi)
9352                         return false;
9353         }
9354
9355         return true;
9356 }
9357
9358 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9359                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9360                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9361 {
9362         char buf[512];
9363         struct mgmt_ev_device_found *ev = (void *)buf;
9364         size_t ev_size;
9365
9366         /* Don't send events for a non-kernel initiated discovery. With
9367          * LE one exception is if we have pend_le_reports > 0 in which
9368          * case we're doing passive scanning and want these events.
9369          */
9370         if (!hci_discovery_active(hdev)) {
9371                 if (link_type == ACL_LINK)
9372                         return;
9373                 if (link_type == LE_LINK &&
9374                     list_empty(&hdev->pend_le_reports) &&
9375                     !hci_is_adv_monitoring(hdev)) {
9376                         return;
9377                 }
9378         }
9379
9380         if (hdev->discovery.result_filtering) {
9381                 /* We are using service discovery */
9382                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9383                                      scan_rsp_len))
9384                         return;
9385         }
9386
9387         if (hdev->discovery.limited) {
9388                 /* Check for limited discoverable bit */
9389                 if (dev_class) {
9390                         if (!(dev_class[1] & 0x20))
9391                                 return;
9392                 } else {
9393                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9394                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9395                                 return;
9396                 }
9397         }
9398
9399         /* Make sure that the buffer is big enough. The 5 extra bytes
9400          * are for the potential CoD field.
9401          */
9402         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9403                 return;
9404
9405         memset(buf, 0, sizeof(buf));
9406
9407         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9408          * RSSI value was reported as 0 when not available. This behavior
9409          * is kept when using device discovery. This is required for full
9410          * backwards compatibility with the API.
9411          *
9412          * However when using service discovery, the value 127 will be
9413          * returned when the RSSI is not available.
9414          */
9415         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9416             link_type == ACL_LINK)
9417                 rssi = 0;
9418
9419         bacpy(&ev->addr.bdaddr, bdaddr);
9420         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9421         ev->rssi = rssi;
9422         ev->flags = cpu_to_le32(flags);
9423
9424         if (eir_len > 0)
9425                 /* Copy EIR or advertising data into event */
9426                 memcpy(ev->eir, eir, eir_len);
9427
9428         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9429                                        NULL))
9430                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9431                                           dev_class, 3);
9432
9433         if (scan_rsp_len > 0)
9434                 /* Append scan response data to event */
9435                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9436
9437         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9438         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9439
9440         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9441 }
9442
9443 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9444                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9445 {
9446         struct mgmt_ev_device_found *ev;
9447         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9448         u16 eir_len;
9449
9450         ev = (struct mgmt_ev_device_found *) buf;
9451
9452         memset(buf, 0, sizeof(buf));
9453
9454         bacpy(&ev->addr.bdaddr, bdaddr);
9455         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9456         ev->rssi = rssi;
9457
9458         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9459                                   name_len);
9460
9461         ev->eir_len = cpu_to_le16(eir_len);
9462
9463         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9464 }
9465
9466 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9467 {
9468         struct mgmt_ev_discovering ev;
9469
9470         bt_dev_dbg(hdev, "discovering %u", discovering);
9471
9472         memset(&ev, 0, sizeof(ev));
9473         ev.type = hdev->discovery.type;
9474         ev.discovering = discovering;
9475
9476         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9477 }
9478
9479 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9480 {
9481         struct mgmt_ev_controller_suspend ev;
9482
9483         ev.suspend_state = state;
9484         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9485 }
9486
9487 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9488                    u8 addr_type)
9489 {
9490         struct mgmt_ev_controller_resume ev;
9491
9492         ev.wake_reason = reason;
9493         if (bdaddr) {
9494                 bacpy(&ev.addr.bdaddr, bdaddr);
9495                 ev.addr.type = addr_type;
9496         } else {
9497                 memset(&ev.addr, 0, sizeof(ev.addr));
9498         }
9499
9500         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9501 }
9502
9503 static struct hci_mgmt_chan chan = {
9504         .channel        = HCI_CHANNEL_CONTROL,
9505         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9506         .handlers       = mgmt_handlers,
9507         .hdev_init      = mgmt_init_hdev,
9508 };
9509
9510 int mgmt_init(void)
9511 {
9512         return hci_mgmt_chan_register(&chan);
9513 }
9514
9515 void mgmt_exit(void)
9516 {
9517         hci_mgmt_chan_unregister(&chan);
9518 }