net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   20
  44
  45 static const u16 mgmt_commands[] = {
  46         MGMT_OP_READ_INDEX_LIST,
  47         MGMT_OP_READ_INFO,
  48         MGMT_OP_SET_POWERED,
  49         MGMT_OP_SET_DISCOVERABLE,
  50         MGMT_OP_SET_CONNECTABLE,
  51         MGMT_OP_SET_FAST_CONNECTABLE,
  52         MGMT_OP_SET_BONDABLE,
  53         MGMT_OP_SET_LINK_SECURITY,
  54         MGMT_OP_SET_SSP,
  55         MGMT_OP_SET_HS,
  56         MGMT_OP_SET_LE,
  57         MGMT_OP_SET_DEV_CLASS,
  58         MGMT_OP_SET_LOCAL_NAME,
  59         MGMT_OP_ADD_UUID,
  60         MGMT_OP_REMOVE_UUID,
  61         MGMT_OP_LOAD_LINK_KEYS,
  62         MGMT_OP_LOAD_LONG_TERM_KEYS,
  63         MGMT_OP_DISCONNECT,
  64         MGMT_OP_GET_CONNECTIONS,
  65         MGMT_OP_PIN_CODE_REPLY,
  66         MGMT_OP_PIN_CODE_NEG_REPLY,
  67         MGMT_OP_SET_IO_CAPABILITY,
  68         MGMT_OP_PAIR_DEVICE,
  69         MGMT_OP_CANCEL_PAIR_DEVICE,
  70         MGMT_OP_UNPAIR_DEVICE,
  71         MGMT_OP_USER_CONFIRM_REPLY,
  72         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  73         MGMT_OP_USER_PASSKEY_REPLY,
  74         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  75         MGMT_OP_READ_LOCAL_OOB_DATA,
  76         MGMT_OP_ADD_REMOTE_OOB_DATA,
  77         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  78         MGMT_OP_START_DISCOVERY,
  79         MGMT_OP_STOP_DISCOVERY,
  80         MGMT_OP_CONFIRM_NAME,
  81         MGMT_OP_BLOCK_DEVICE,
  82         MGMT_OP_UNBLOCK_DEVICE,
  83         MGMT_OP_SET_DEVICE_ID,
  84         MGMT_OP_SET_ADVERTISING,
  85         MGMT_OP_SET_BREDR,
  86         MGMT_OP_SET_STATIC_ADDRESS,
  87         MGMT_OP_SET_SCAN_PARAMS,
  88         MGMT_OP_SET_SECURE_CONN,
  89         MGMT_OP_SET_DEBUG_KEYS,
  90         MGMT_OP_SET_PRIVACY,
  91         MGMT_OP_LOAD_IRKS,
  92         MGMT_OP_GET_CONN_INFO,
  93         MGMT_OP_GET_CLOCK_INFO,
  94         MGMT_OP_ADD_DEVICE,
  95         MGMT_OP_REMOVE_DEVICE,
  96         MGMT_OP_LOAD_CONN_PARAM,
  97         MGMT_OP_READ_UNCONF_INDEX_LIST,
  98         MGMT_OP_READ_CONFIG_INFO,
  99         MGMT_OP_SET_EXTERNAL_CONFIG,
 100         MGMT_OP_SET_PUBLIC_ADDRESS,
 101         MGMT_OP_START_SERVICE_DISCOVERY,
 102         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 103         MGMT_OP_READ_EXT_INDEX_LIST,
 104         MGMT_OP_READ_ADV_FEATURES,
 105         MGMT_OP_ADD_ADVERTISING,
 106         MGMT_OP_REMOVE_ADVERTISING,
 107         MGMT_OP_GET_ADV_SIZE_INFO,
 108         MGMT_OP_START_LIMITED_DISCOVERY,
 109         MGMT_OP_READ_EXT_INFO,
 110         MGMT_OP_SET_APPEARANCE,
 111         MGMT_OP_GET_PHY_CONFIGURATION,
 112         MGMT_OP_SET_PHY_CONFIGURATION,
 113         MGMT_OP_SET_BLOCKED_KEYS,
 114         MGMT_OP_SET_WIDEBAND_SPEECH,
 115         MGMT_OP_READ_CONTROLLER_CAP,
 116         MGMT_OP_READ_EXP_FEATURES_INFO,
 117         MGMT_OP_SET_EXP_FEATURE,
 118         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 119         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 121         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_GET_DEVICE_FLAGS,
 123         MGMT_OP_SET_DEVICE_FLAGS,
 124         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 125         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 126         MGMT_OP_REMOVE_ADV_MONITOR,
 127         MGMT_OP_ADD_EXT_ADV_PARAMS,
 128         MGMT_OP_ADD_EXT_ADV_DATA,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 130 };
 131
 132 static const u16 mgmt_events[] = {
 133         MGMT_EV_CONTROLLER_ERROR,
 134         MGMT_EV_INDEX_ADDED,
 135         MGMT_EV_INDEX_REMOVED,
 136         MGMT_EV_NEW_SETTINGS,
 137         MGMT_EV_CLASS_OF_DEV_CHANGED,
 138         MGMT_EV_LOCAL_NAME_CHANGED,
 139         MGMT_EV_NEW_LINK_KEY,
 140         MGMT_EV_NEW_LONG_TERM_KEY,
 141         MGMT_EV_DEVICE_CONNECTED,
 142         MGMT_EV_DEVICE_DISCONNECTED,
 143         MGMT_EV_CONNECT_FAILED,
 144         MGMT_EV_PIN_CODE_REQUEST,
 145         MGMT_EV_USER_CONFIRM_REQUEST,
 146         MGMT_EV_USER_PASSKEY_REQUEST,
 147         MGMT_EV_AUTH_FAILED,
 148         MGMT_EV_DEVICE_FOUND,
 149         MGMT_EV_DISCOVERING,
 150         MGMT_EV_DEVICE_BLOCKED,
 151         MGMT_EV_DEVICE_UNBLOCKED,
 152         MGMT_EV_DEVICE_UNPAIRED,
 153         MGMT_EV_PASSKEY_NOTIFY,
 154         MGMT_EV_NEW_IRK,
 155         MGMT_EV_NEW_CSRK,
 156         MGMT_EV_DEVICE_ADDED,
 157         MGMT_EV_DEVICE_REMOVED,
 158         MGMT_EV_NEW_CONN_PARAM,
 159         MGMT_EV_UNCONF_INDEX_ADDED,
 160         MGMT_EV_UNCONF_INDEX_REMOVED,
 161         MGMT_EV_NEW_CONFIG_OPTIONS,
 162         MGMT_EV_EXT_INDEX_ADDED,
 163         MGMT_EV_EXT_INDEX_REMOVED,
 164         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 165         MGMT_EV_ADVERTISING_ADDED,
 166         MGMT_EV_ADVERTISING_REMOVED,
 167         MGMT_EV_EXT_INFO_CHANGED,
 168         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 169         MGMT_EV_EXP_FEATURE_CHANGED,
 170         MGMT_EV_DEVICE_FLAGS_CHANGED,
 171         MGMT_EV_ADV_MONITOR_ADDED,
 172         MGMT_EV_ADV_MONITOR_REMOVED,
 173         MGMT_EV_CONTROLLER_SUSPEND,
 174         MGMT_EV_CONTROLLER_RESUME,
 175 };
 176
 177 static const u16 mgmt_untrusted_commands[] = {
 178         MGMT_OP_READ_INDEX_LIST,
 179         MGMT_OP_READ_INFO,
 180         MGMT_OP_READ_UNCONF_INDEX_LIST,
 181         MGMT_OP_READ_CONFIG_INFO,
 182         MGMT_OP_READ_EXT_INDEX_LIST,
 183         MGMT_OP_READ_EXT_INFO,
 184         MGMT_OP_READ_CONTROLLER_CAP,
 185         MGMT_OP_READ_EXP_FEATURES_INFO,
 186         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 187         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 188 };
 189
 190 static const u16 mgmt_untrusted_events[] = {
 191         MGMT_EV_INDEX_ADDED,
 192         MGMT_EV_INDEX_REMOVED,
 193         MGMT_EV_NEW_SETTINGS,
 194         MGMT_EV_CLASS_OF_DEV_CHANGED,
 195         MGMT_EV_LOCAL_NAME_CHANGED,
 196         MGMT_EV_UNCONF_INDEX_ADDED,
 197         MGMT_EV_UNCONF_INDEX_REMOVED,
 198         MGMT_EV_NEW_CONFIG_OPTIONS,
 199         MGMT_EV_EXT_INDEX_ADDED,
 200         MGMT_EV_EXT_INDEX_REMOVED,
 201         MGMT_EV_EXT_INFO_CHANGED,
 202         MGMT_EV_EXP_FEATURE_CHANGED,
 203 };
 204
 205 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 206
 207 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 208                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 209
 210 /* HCI to MGMT error code conversion table */
 211 static const u8 mgmt_status_table[] = {
 212         MGMT_STATUS_SUCCESS,
 213         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 214         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 215         MGMT_STATUS_FAILED,             /* Hardware Failure */
 216         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 217         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 218         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 219         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 220         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 221         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 222         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 223         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 224         MGMT_STATUS_BUSY,               /* Command Disallowed */
 225         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 226         MGMT_STATUS_REJECTED,           /* Rejected Security */
 227         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 228         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 229         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 230         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 231         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 232         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 233         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 234         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 235         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 236         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 237         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 238         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 239         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 240         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 241         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 243         MGMT_STATUS_FAILED,             /* Unspecified Error */
 244         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 245         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 246         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 247         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 248         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 249         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 250         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 252         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 253         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 254         MGMT_STATUS_FAILED,             /* Transaction Collision */
 255         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 256         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 258         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 260         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 261         MGMT_STATUS_FAILED,             /* Slot Violation */
 262         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 263         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 265         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 266         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 267         MGMT_STATUS_BUSY,               /* Controller Busy */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 269         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 270         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 271         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 272         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 273 };
 274
 275 static u8 mgmt_status(u8 hci_status)
 276 {
 277         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 278                 return mgmt_status_table[hci_status];
 279
 280         return MGMT_STATUS_FAILED;
 281 }
 282
 283 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 284                             u16 len, int flag)
 285 {
 286         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 287                                flag, NULL);
 288 }
 289
 290 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 291                               u16 len, int flag, struct sock *skip_sk)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, skip_sk);
 295 }
 296
 297 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 298                       struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                HCI_SOCK_TRUSTED, skip_sk);
 302 }
 303
 304 static u8 le_addr_type(u8 mgmt_addr_type)
 305 {
 306         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 307                 return ADDR_LE_DEV_PUBLIC;
 308         else
 309                 return ADDR_LE_DEV_RANDOM;
 310 }
 311
 312 void mgmt_fill_version_info(void *ver)
 313 {
 314         struct mgmt_rp_read_version *rp = ver;
 315
 316         rp->version = MGMT_VERSION;
 317         rp->revision = cpu_to_le16(MGMT_REVISION);
 318 }
 319
 320 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 321                         u16 data_len)
 322 {
 323         struct mgmt_rp_read_version rp;
 324
 325         bt_dev_dbg(hdev, "sock %p", sk);
 326
 327         mgmt_fill_version_info(&rp);
 328
 329         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 330                                  &rp, sizeof(rp));
 331 }
 332
 333 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 334                          u16 data_len)
 335 {
 336         struct mgmt_rp_read_commands *rp;
 337         u16 num_commands, num_events;
 338         size_t rp_size;
 339         int i, err;
 340
 341         bt_dev_dbg(hdev, "sock %p", sk);
 342
 343         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 344                 num_commands = ARRAY_SIZE(mgmt_commands);
 345                 num_events = ARRAY_SIZE(mgmt_events);
 346         } else {
 347                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 348                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 349         }
 350
 351         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 352
 353         rp = kmalloc(rp_size, GFP_KERNEL);
 354         if (!rp)
 355                 return -ENOMEM;
 356
 357         rp->num_commands = cpu_to_le16(num_commands);
 358         rp->num_events = cpu_to_le16(num_events);
 359
 360         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 361                 __le16 *opcode = rp->opcodes;
 362
 363                 for (i = 0; i < num_commands; i++, opcode++)
 364                         put_unaligned_le16(mgmt_commands[i], opcode);
 365
 366                 for (i = 0; i < num_events; i++, opcode++)
 367                         put_unaligned_le16(mgmt_events[i], opcode);
 368         } else {
 369                 __le16 *opcode = rp->opcodes;
 370
 371                 for (i = 0; i < num_commands; i++, opcode++)
 372                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 373
 374                 for (i = 0; i < num_events; i++, opcode++)
 375                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 376         }
 377
 378         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 379                                 rp, rp_size);
 380         kfree(rp);
 381
 382         return err;
 383 }
 384
 385 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 386                            u16 data_len)
 387 {
 388         struct mgmt_rp_read_index_list *rp;
 389         struct hci_dev *d;
 390         size_t rp_len;
 391         u16 count;
 392         int err;
 393
 394         bt_dev_dbg(hdev, "sock %p", sk);
 395
 396         read_lock(&hci_dev_list_lock);
 397
 398         count = 0;
 399         list_for_each_entry(d, &hci_dev_list, list) {
 400                 if (d->dev_type == HCI_PRIMARY &&
 401                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 402                         count++;
 403         }
 404
 405         rp_len = sizeof(*rp) + (2 * count);
 406         rp = kmalloc(rp_len, GFP_ATOMIC);
 407         if (!rp) {
 408                 read_unlock(&hci_dev_list_lock);
 409                 return -ENOMEM;
 410         }
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 415                     hci_dev_test_flag(d, HCI_CONFIG) ||
 416                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 417                         continue;
 418
 419                 /* Devices marked as raw-only are neither configured
 420                  * nor unconfigured controllers.
 421                  */
 422                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 423                         continue;
 424
 425                 if (d->dev_type == HCI_PRIMARY &&
 426                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 427                         rp->index[count++] = cpu_to_le16(d->id);
 428                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 429                 }
 430         }
 431
 432         rp->num_controllers = cpu_to_le16(count);
 433         rp_len = sizeof(*rp) + (2 * count);
 434
 435         read_unlock(&hci_dev_list_lock);
 436
 437         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 438                                 0, rp, rp_len);
 439
 440         kfree(rp);
 441
 442         return err;
 443 }
 444
 445 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 446                                   void *data, u16 data_len)
 447 {
 448         struct mgmt_rp_read_unconf_index_list *rp;
 449         struct hci_dev *d;
 450         size_t rp_len;
 451         u16 count;
 452         int err;
 453
 454         bt_dev_dbg(hdev, "sock %p", sk);
 455
 456         read_lock(&hci_dev_list_lock);
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (d->dev_type == HCI_PRIMARY &&
 461                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 462                         count++;
 463         }
 464
 465         rp_len = sizeof(*rp) + (2 * count);
 466         rp = kmalloc(rp_len, GFP_ATOMIC);
 467         if (!rp) {
 468                 read_unlock(&hci_dev_list_lock);
 469                 return -ENOMEM;
 470         }
 471
 472         count = 0;
 473         list_for_each_entry(d, &hci_dev_list, list) {
 474                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 475                     hci_dev_test_flag(d, HCI_CONFIG) ||
 476                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 477                         continue;
 478
 479                 /* Devices marked as raw-only are neither configured
 480                  * nor unconfigured controllers.
 481                  */
 482                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 483                         continue;
 484
 485                 if (d->dev_type == HCI_PRIMARY &&
 486                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 487                         rp->index[count++] = cpu_to_le16(d->id);
 488                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 489                 }
 490         }
 491
 492         rp->num_controllers = cpu_to_le16(count);
 493         rp_len = sizeof(*rp) + (2 * count);
 494
 495         read_unlock(&hci_dev_list_lock);
 496
 497         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 498                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 499
 500         kfree(rp);
 501
 502         return err;
 503 }
 504
 505 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 506                                void *data, u16 data_len)
 507 {
 508         struct mgmt_rp_read_ext_index_list *rp;
 509         struct hci_dev *d;
 510         u16 count;
 511         int err;
 512
 513         bt_dev_dbg(hdev, "sock %p", sk);
 514
 515         read_lock(&hci_dev_list_lock);
 516
 517         count = 0;
 518         list_for_each_entry(d, &hci_dev_list, list) {
 519                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 520                         count++;
 521         }
 522
 523         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 524         if (!rp) {
 525                 read_unlock(&hci_dev_list_lock);
 526                 return -ENOMEM;
 527         }
 528
 529         count = 0;
 530         list_for_each_entry(d, &hci_dev_list, list) {
 531                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 532                     hci_dev_test_flag(d, HCI_CONFIG) ||
 533                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 534                         continue;
 535
 536                 /* Devices marked as raw-only are neither configured
 537                  * nor unconfigured controllers.
 538                  */
 539                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 540                         continue;
 541
 542                 if (d->dev_type == HCI_PRIMARY) {
 543                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 544                                 rp->entry[count].type = 0x01;
 545                         else
 546                                 rp->entry[count].type = 0x00;
 547                 } else if (d->dev_type == HCI_AMP) {
 548                         rp->entry[count].type = 0x02;
 549                 } else {
 550                         continue;
 551                 }
 552
 553                 rp->entry[count].bus = d->bus;
 554                 rp->entry[count++].index = cpu_to_le16(d->id);
 555                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 556         }
 557
 558         rp->num_controllers = cpu_to_le16(count);
 559
 560         read_unlock(&hci_dev_list_lock);
 561
 562         /* If this command is called at least once, then all the
 563          * default index and unconfigured index events are disabled
 564          * and from now on only extended index events are used.
 565          */
 566         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 567         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 568         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 569
 570         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 571                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 572                                 struct_size(rp, entry, count));
 573
 574         kfree(rp);
 575
 576         return err;
 577 }
 578
 579 static bool is_configured(struct hci_dev *hdev)
 580 {
 581         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 582             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 583                 return false;
 584
 585         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 586              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 587             !bacmp(&hdev->public_addr, BDADDR_ANY))
 588                 return false;
 589
 590         return true;
 591 }
 592
 593 static __le32 get_missing_options(struct hci_dev *hdev)
 594 {
 595         u32 options = 0;
 596
 597         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 598             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 599                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 600
 601         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 602              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 603             !bacmp(&hdev->public_addr, BDADDR_ANY))
 604                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 605
 606         return cpu_to_le32(options);
 607 }
 608
 609 static int new_options(struct hci_dev *hdev, struct sock *skip)
 610 {
 611         __le32 options = get_missing_options(hdev);
 612
 613         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 614                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 615 }
 616
 617 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 618 {
 619         __le32 options = get_missing_options(hdev);
 620
 621         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 622                                  sizeof(options));
 623 }
 624
 625 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 626                             void *data, u16 data_len)
 627 {
 628         struct mgmt_rp_read_config_info rp;
 629         u32 options = 0;
 630
 631         bt_dev_dbg(hdev, "sock %p", sk);
 632
 633         hci_dev_lock(hdev);
 634
 635         memset(&rp, 0, sizeof(rp));
 636         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 637
 638         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 639                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 640
 641         if (hdev->set_bdaddr)
 642                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 643
 644         rp.supported_options = cpu_to_le32(options);
 645         rp.missing_options = get_missing_options(hdev);
 646
 647         hci_dev_unlock(hdev);
 648
 649         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 650                                  &rp, sizeof(rp));
 651 }
 652
 653 static u32 get_supported_phys(struct hci_dev *hdev)
 654 {
 655         u32 supported_phys = 0;
 656
 657         if (lmp_bredr_capable(hdev)) {
 658                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 659
 660                 if (hdev->features[0][0] & LMP_3SLOT)
 661                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 662
 663                 if (hdev->features[0][0] & LMP_5SLOT)
 664                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 665
 666                 if (lmp_edr_2m_capable(hdev)) {
 667                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 668
 669                         if (lmp_edr_3slot_capable(hdev))
 670                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 671
 672                         if (lmp_edr_5slot_capable(hdev))
 673                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 674
 675                         if (lmp_edr_3m_capable(hdev)) {
 676                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 677
 678                                 if (lmp_edr_3slot_capable(hdev))
 679                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 680
 681                                 if (lmp_edr_5slot_capable(hdev))
 682                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 683                         }
 684                 }
 685         }
 686
 687         if (lmp_le_capable(hdev)) {
 688                 supported_phys |= MGMT_PHY_LE_1M_TX;
 689                 supported_phys |= MGMT_PHY_LE_1M_RX;
 690
 691                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 692                         supported_phys |= MGMT_PHY_LE_2M_TX;
 693                         supported_phys |= MGMT_PHY_LE_2M_RX;
 694                 }
 695
 696                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 697                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 698                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 699                 }
 700         }
 701
 702         return supported_phys;
 703 }
 704
 705 static u32 get_selected_phys(struct hci_dev *hdev)
 706 {
 707         u32 selected_phys = 0;
 708
 709         if (lmp_bredr_capable(hdev)) {
 710                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 711
 712                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 713                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 714
 715                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 716                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 717
 718                 if (lmp_edr_2m_capable(hdev)) {
 719                         if (!(hdev->pkt_type & HCI_2DH1))
 720                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 721
 722                         if (lmp_edr_3slot_capable(hdev) &&
 723                             !(hdev->pkt_type & HCI_2DH3))
 724                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 725
 726                         if (lmp_edr_5slot_capable(hdev) &&
 727                             !(hdev->pkt_type & HCI_2DH5))
 728                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 729
 730                         if (lmp_edr_3m_capable(hdev)) {
 731                                 if (!(hdev->pkt_type & HCI_3DH1))
 732                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 733
 734                                 if (lmp_edr_3slot_capable(hdev) &&
 735                                     !(hdev->pkt_type & HCI_3DH3))
 736                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 737
 738                                 if (lmp_edr_5slot_capable(hdev) &&
 739                                     !(hdev->pkt_type & HCI_3DH5))
 740                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 741                         }
 742                 }
 743         }
 744
 745         if (lmp_le_capable(hdev)) {
 746                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 747                         selected_phys |= MGMT_PHY_LE_1M_TX;
 748
 749                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 750                         selected_phys |= MGMT_PHY_LE_1M_RX;
 751
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 753                         selected_phys |= MGMT_PHY_LE_2M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 756                         selected_phys |= MGMT_PHY_LE_2M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 759                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 762                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 763         }
 764
 765         return selected_phys;
 766 }
 767
 768 static u32 get_configurable_phys(struct hci_dev *hdev)
 769 {
 770         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 771                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 772 }
 773
 774 static u32 get_supported_settings(struct hci_dev *hdev)
 775 {
 776         u32 settings = 0;
 777
 778         settings |= MGMT_SETTING_POWERED;
 779         settings |= MGMT_SETTING_BONDABLE;
 780         settings |= MGMT_SETTING_DEBUG_KEYS;
 781         settings |= MGMT_SETTING_CONNECTABLE;
 782         settings |= MGMT_SETTING_DISCOVERABLE;
 783
 784         if (lmp_bredr_capable(hdev)) {
 785                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 786                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 787                 settings |= MGMT_SETTING_BREDR;
 788                 settings |= MGMT_SETTING_LINK_SECURITY;
 789
 790                 if (lmp_ssp_capable(hdev)) {
 791                         settings |= MGMT_SETTING_SSP;
 792                         if (IS_ENABLED(CONFIG_BT_HS))
 793                                 settings |= MGMT_SETTING_HS;
 794                 }
 795
 796                 if (lmp_sc_capable(hdev))
 797                         settings |= MGMT_SETTING_SECURE_CONN;
 798
 799                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 800                              &hdev->quirks))
 801                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 802         }
 803
 804         if (lmp_le_capable(hdev)) {
 805                 settings |= MGMT_SETTING_LE;
 806                 settings |= MGMT_SETTING_SECURE_CONN;
 807                 settings |= MGMT_SETTING_PRIVACY;
 808                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 809
 810                 /* When the experimental feature for LL Privacy support is
 811                  * enabled, then advertising is no longer supported.
 812                  */
 813                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 814                         settings |= MGMT_SETTING_ADVERTISING;
 815         }
 816
 817         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 818             hdev->set_bdaddr)
 819                 settings |= MGMT_SETTING_CONFIGURATION;
 820
 821         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 822
 823         return settings;
 824 }
 825
 826 static u32 get_current_settings(struct hci_dev *hdev)
 827 {
 828         u32 settings = 0;
 829
 830         if (hdev_is_powered(hdev))
 831                 settings |= MGMT_SETTING_POWERED;
 832
 833         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 834                 settings |= MGMT_SETTING_CONNECTABLE;
 835
 836         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 837                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 838
 839         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 840                 settings |= MGMT_SETTING_DISCOVERABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 843                 settings |= MGMT_SETTING_BONDABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 846                 settings |= MGMT_SETTING_BREDR;
 847
 848         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 849                 settings |= MGMT_SETTING_LE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 852                 settings |= MGMT_SETTING_LINK_SECURITY;
 853
 854         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 855                 settings |= MGMT_SETTING_SSP;
 856
 857         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 858                 settings |= MGMT_SETTING_HS;
 859
 860         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 861                 settings |= MGMT_SETTING_ADVERTISING;
 862
 863         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 864                 settings |= MGMT_SETTING_SECURE_CONN;
 865
 866         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 867                 settings |= MGMT_SETTING_DEBUG_KEYS;
 868
 869         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 870                 settings |= MGMT_SETTING_PRIVACY;
 871
 872         /* The current setting for static address has two purposes. The
 873          * first is to indicate if the static address will be used and
 874          * the second is to indicate if it is actually set.
 875          *
 876          * This means if the static address is not configured, this flag
 877          * will never be set. If the address is configured, then if the
 878          * address is actually used decides if the flag is set or not.
 879          *
 880          * For single mode LE only controllers and dual-mode controllers
 881          * with BR/EDR disabled, the existence of the static address will
 882          * be evaluated.
 883          */
 884         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 885             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 886             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 887                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 888                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 889         }
 890
 891         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 892                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 893
 894         return settings;
 895 }
 896
 897 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 898 {
 899         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 900 }
 901
 902 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 903                                                   struct hci_dev *hdev,
 904                                                   const void *data)
 905 {
 906         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 907 }
 908
 909 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 910 {
 911         struct mgmt_pending_cmd *cmd;
 912
 913         /* If there's a pending mgmt command the flags will not yet have
 914          * their final values, so check for this first.
 915          */
 916         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 917         if (cmd) {
 918                 struct mgmt_mode *cp = cmd->param;
 919                 if (cp->val == 0x01)
 920                         return LE_AD_GENERAL;
 921                 else if (cp->val == 0x02)
 922                         return LE_AD_LIMITED;
 923         } else {
 924                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 925                         return LE_AD_LIMITED;
 926                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 927                         return LE_AD_GENERAL;
 928         }
 929
 930         return 0;
 931 }
 932
 933 bool mgmt_get_connectable(struct hci_dev *hdev)
 934 {
 935         struct mgmt_pending_cmd *cmd;
 936
 937         /* If there's a pending mgmt command the flag will not yet have
 938          * it's final value, so check for this first.
 939          */
 940         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 941         if (cmd) {
 942                 struct mgmt_mode *cp = cmd->param;
 943
 944                 return cp->val;
 945         }
 946
 947         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 948 }
 949
 950 static void service_cache_off(struct work_struct *work)
 951 {
 952         struct hci_dev *hdev = container_of(work, struct hci_dev,
 953                                             service_cache.work);
 954         struct hci_request req;
 955
 956         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 957                 return;
 958
 959         hci_req_init(&req, hdev);
 960
 961         hci_dev_lock(hdev);
 962
 963         __hci_req_update_eir(&req);
 964         __hci_req_update_class(&req);
 965
 966         hci_dev_unlock(hdev);
 967
 968         hci_req_run(&req, NULL);
 969 }
 970
 971 static void rpa_expired(struct work_struct *work)
 972 {
 973         struct hci_dev *hdev = container_of(work, struct hci_dev,
 974                                             rpa_expired.work);
 975         struct hci_request req;
 976
 977         bt_dev_dbg(hdev, "");
 978
 979         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 980
 981         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 982                 return;
 983
 984         /* The generation of a new RPA and programming it into the
 985          * controller happens in the hci_req_enable_advertising()
 986          * function.
 987          */
 988         hci_req_init(&req, hdev);
 989         if (ext_adv_capable(hdev))
 990                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 991         else
 992                 __hci_req_enable_advertising(&req);
 993         hci_req_run(&req, NULL);
 994 }
 995
 996 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 997 {
 998         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 999                 return;
1000
1001         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1002         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1003
1004         /* Non-mgmt controlled devices get this bit set
1005          * implicitly so that pairing works for them, however
1006          * for mgmt we require user-space to explicitly enable
1007          * it
1008          */
1009         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1010 }
1011
1012 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1013                                 void *data, u16 data_len)
1014 {
1015         struct mgmt_rp_read_info rp;
1016
1017         bt_dev_dbg(hdev, "sock %p", sk);
1018
1019         hci_dev_lock(hdev);
1020
1021         memset(&rp, 0, sizeof(rp));
1022
1023         bacpy(&rp.bdaddr, &hdev->bdaddr);
1024
1025         rp.version = hdev->hci_ver;
1026         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1027
1028         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1029         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1030
1031         memcpy(rp.dev_class, hdev->dev_class, 3);
1032
1033         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1034         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1035
1036         hci_dev_unlock(hdev);
1037
1038         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1039                                  sizeof(rp));
1040 }
1041
1042 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1043 {
1044         u16 eir_len = 0;
1045         size_t name_len;
1046
1047         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1048                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1049                                           hdev->dev_class, 3);
1050
1051         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1052                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1053                                           hdev->appearance);
1054
1055         name_len = strlen(hdev->dev_name);
1056         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1057                                   hdev->dev_name, name_len);
1058
1059         name_len = strlen(hdev->short_name);
1060         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1061                                   hdev->short_name, name_len);
1062
1063         return eir_len;
1064 }
1065
1066 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1067                                     void *data, u16 data_len)
1068 {
1069         char buf[512];
1070         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1071         u16 eir_len;
1072
1073         bt_dev_dbg(hdev, "sock %p", sk);
1074
1075         memset(&buf, 0, sizeof(buf));
1076
1077         hci_dev_lock(hdev);
1078
1079         bacpy(&rp->bdaddr, &hdev->bdaddr);
1080
1081         rp->version = hdev->hci_ver;
1082         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1083
1084         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1085         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1086
1087
1088         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1089         rp->eir_len = cpu_to_le16(eir_len);
1090
1091         hci_dev_unlock(hdev);
1092
1093         /* If this command is called at least once, then the events
1094          * for class of device and local name changes are disabled
1095          * and only the new extended controller information event
1096          * is used.
1097          */
1098         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1099         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1100         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1101
1102         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1103                                  sizeof(*rp) + eir_len);
1104 }
1105
1106 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1107 {
1108         char buf[512];
1109         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1110         u16 eir_len;
1111
1112         memset(buf, 0, sizeof(buf));
1113
1114         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1115         ev->eir_len = cpu_to_le16(eir_len);
1116
1117         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1118                                   sizeof(*ev) + eir_len,
1119                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1120 }
1121
1122 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1123 {
1124         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1125
1126         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1127                                  sizeof(settings));
1128 }
1129
1130 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1131 {
1132         bt_dev_dbg(hdev, "status 0x%02x", status);
1133
1134         if (hci_conn_count(hdev) == 0) {
1135                 cancel_delayed_work(&hdev->power_off);
1136                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1137         }
1138 }
1139
1140 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1141 {
1142         struct mgmt_ev_advertising_added ev;
1143
1144         ev.instance = instance;
1145
1146         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1147 }
1148
1149 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1150                               u8 instance)
1151 {
1152         struct mgmt_ev_advertising_removed ev;
1153
1154         ev.instance = instance;
1155
1156         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1157 }
1158
1159 static void cancel_adv_timeout(struct hci_dev *hdev)
1160 {
1161         if (hdev->adv_instance_timeout) {
1162                 hdev->adv_instance_timeout = 0;
1163                 cancel_delayed_work(&hdev->adv_instance_expire);
1164         }
1165 }
1166
1167 static int clean_up_hci_state(struct hci_dev *hdev)
1168 {
1169         struct hci_request req;
1170         struct hci_conn *conn;
1171         bool discov_stopped;
1172         int err;
1173
1174         hci_req_init(&req, hdev);
1175
1176         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1177             test_bit(HCI_PSCAN, &hdev->flags)) {
1178                 u8 scan = 0x00;
1179                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1180         }
1181
1182         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1183
1184         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1185                 __hci_req_disable_advertising(&req);
1186
1187         discov_stopped = hci_req_stop_discovery(&req);
1188
1189         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1190                 /* 0x15 == Terminated due to Power Off */
1191                 __hci_abort_conn(&req, conn, 0x15);
1192         }
1193
1194         err = hci_req_run(&req, clean_up_hci_complete);
1195         if (!err && discov_stopped)
1196                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1197
1198         return err;
1199 }
1200
1201 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1202                        u16 len)
1203 {
1204         struct mgmt_mode *cp = data;
1205         struct mgmt_pending_cmd *cmd;
1206         int err;
1207
1208         bt_dev_dbg(hdev, "sock %p", sk);
1209
1210         if (cp->val != 0x00 && cp->val != 0x01)
1211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1212                                        MGMT_STATUS_INVALID_PARAMS);
1213
1214         hci_dev_lock(hdev);
1215
1216         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1217                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                       MGMT_STATUS_BUSY);
1219                 goto failed;
1220         }
1221
1222         if (!!cp->val == hdev_is_powered(hdev)) {
1223                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1224                 goto failed;
1225         }
1226
1227         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1228         if (!cmd) {
1229                 err = -ENOMEM;
1230                 goto failed;
1231         }
1232
1233         if (cp->val) {
1234                 queue_work(hdev->req_workqueue, &hdev->power_on);
1235                 err = 0;
1236         } else {
1237                 /* Disconnect connections, stop scans, etc */
1238                 err = clean_up_hci_state(hdev);
1239                 if (!err)
1240                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1241                                            HCI_POWER_OFF_TIMEOUT);
1242
1243                 /* ENODATA means there were no HCI commands queued */
1244                 if (err == -ENODATA) {
1245                         cancel_delayed_work(&hdev->power_off);
1246                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1247                         err = 0;
1248                 }
1249         }
1250
1251 failed:
1252         hci_dev_unlock(hdev);
1253         return err;
1254 }
1255
1256 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1257 {
1258         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1259
1260         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1261                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1262 }
1263
1264 int mgmt_new_settings(struct hci_dev *hdev)
1265 {
1266         return new_settings(hdev, NULL);
1267 }
1268
1269 struct cmd_lookup {
1270         struct sock *sk;
1271         struct hci_dev *hdev;
1272         u8 mgmt_status;
1273 };
1274
1275 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1276 {
1277         struct cmd_lookup *match = data;
1278
1279         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1280
1281         list_del(&cmd->list);
1282
1283         if (match->sk == NULL) {
1284                 match->sk = cmd->sk;
1285                 sock_hold(match->sk);
1286         }
1287
1288         mgmt_pending_free(cmd);
1289 }
1290
1291 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1292 {
1293         u8 *status = data;
1294
1295         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1296         mgmt_pending_remove(cmd);
1297 }
1298
1299 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1300 {
1301         if (cmd->cmd_complete) {
1302                 u8 *status = data;
1303
1304                 cmd->cmd_complete(cmd, *status);
1305                 mgmt_pending_remove(cmd);
1306
1307                 return;
1308         }
1309
1310         cmd_status_rsp(cmd, data);
1311 }
1312
1313 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1314 {
1315         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1316                                  cmd->param, cmd->param_len);
1317 }
1318
1319 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, sizeof(struct mgmt_addr_info));
1323 }
1324
1325 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1326 {
1327         if (!lmp_bredr_capable(hdev))
1328                 return MGMT_STATUS_NOT_SUPPORTED;
1329         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1330                 return MGMT_STATUS_REJECTED;
1331         else
1332                 return MGMT_STATUS_SUCCESS;
1333 }
1334
1335 static u8 mgmt_le_support(struct hci_dev *hdev)
1336 {
1337         if (!lmp_le_capable(hdev))
1338                 return MGMT_STATUS_NOT_SUPPORTED;
1339         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1340                 return MGMT_STATUS_REJECTED;
1341         else
1342                 return MGMT_STATUS_SUCCESS;
1343 }
1344
1345 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1346 {
1347         struct mgmt_pending_cmd *cmd;
1348
1349         bt_dev_dbg(hdev, "status 0x%02x", status);
1350
1351         hci_dev_lock(hdev);
1352
1353         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1354         if (!cmd)
1355                 goto unlock;
1356
1357         if (status) {
1358                 u8 mgmt_err = mgmt_status(status);
1359                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1360                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1361                 goto remove_cmd;
1362         }
1363
1364         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1365             hdev->discov_timeout > 0) {
1366                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1367                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1368         }
1369
1370         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1371         new_settings(hdev, cmd->sk);
1372
1373 remove_cmd:
1374         mgmt_pending_remove(cmd);
1375
1376 unlock:
1377         hci_dev_unlock(hdev);
1378 }
1379
1380 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1381                             u16 len)
1382 {
1383         struct mgmt_cp_set_discoverable *cp = data;
1384         struct mgmt_pending_cmd *cmd;
1385         u16 timeout;
1386         int err;
1387
1388         bt_dev_dbg(hdev, "sock %p", sk);
1389
1390         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1391             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1393                                        MGMT_STATUS_REJECTED);
1394
1395         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1396                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1397                                        MGMT_STATUS_INVALID_PARAMS);
1398
1399         timeout = __le16_to_cpu(cp->timeout);
1400
1401         /* Disabling discoverable requires that no timeout is set,
1402          * and enabling limited discoverable requires a timeout.
1403          */
1404         if ((cp->val == 0x00 && timeout > 0) ||
1405             (cp->val == 0x02 && timeout == 0))
1406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1407                                        MGMT_STATUS_INVALID_PARAMS);
1408
1409         hci_dev_lock(hdev);
1410
1411         if (!hdev_is_powered(hdev) && timeout > 0) {
1412                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                       MGMT_STATUS_NOT_POWERED);
1414                 goto failed;
1415         }
1416
1417         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1418             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_BUSY);
1421                 goto failed;
1422         }
1423
1424         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_REJECTED);
1427                 goto failed;
1428         }
1429
1430         if (hdev->advertising_paused) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_BUSY);
1433                 goto failed;
1434         }
1435
1436         if (!hdev_is_powered(hdev)) {
1437                 bool changed = false;
1438
1439                 /* Setting limited discoverable when powered off is
1440                  * not a valid operation since it requires a timeout
1441                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1442                  */
1443                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1444                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1445                         changed = true;
1446                 }
1447
1448                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1449                 if (err < 0)
1450                         goto failed;
1451
1452                 if (changed)
1453                         err = new_settings(hdev, sk);
1454
1455                 goto failed;
1456         }
1457
1458         /* If the current mode is the same, then just update the timeout
1459          * value with the new value. And if only the timeout gets updated,
1460          * then no need for any HCI transactions.
1461          */
1462         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1463             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1464                                                    HCI_LIMITED_DISCOVERABLE)) {
1465                 cancel_delayed_work(&hdev->discov_off);
1466                 hdev->discov_timeout = timeout;
1467
1468                 if (cp->val && hdev->discov_timeout > 0) {
1469                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1470                         queue_delayed_work(hdev->req_workqueue,
1471                                            &hdev->discov_off, to);
1472                 }
1473
1474                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1475                 goto failed;
1476         }
1477
1478         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1479         if (!cmd) {
1480                 err = -ENOMEM;
1481                 goto failed;
1482         }
1483
1484         /* Cancel any potential discoverable timeout that might be
1485          * still active and store new timeout value. The arming of
1486          * the timeout happens in the complete handler.
1487          */
1488         cancel_delayed_work(&hdev->discov_off);
1489         hdev->discov_timeout = timeout;
1490
1491         if (cp->val)
1492                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1493         else
1494                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1495
1496         /* Limited discoverable mode */
1497         if (cp->val == 0x02)
1498                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1501
1502         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1503         err = 0;
1504
1505 failed:
1506         hci_dev_unlock(hdev);
1507         return err;
1508 }
1509
1510 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1511 {
1512         struct mgmt_pending_cmd *cmd;
1513
1514         bt_dev_dbg(hdev, "status 0x%02x", status);
1515
1516         hci_dev_lock(hdev);
1517
1518         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1519         if (!cmd)
1520                 goto unlock;
1521
1522         if (status) {
1523                 u8 mgmt_err = mgmt_status(status);
1524                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1525                 goto remove_cmd;
1526         }
1527
1528         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1529         new_settings(hdev, cmd->sk);
1530
1531 remove_cmd:
1532         mgmt_pending_remove(cmd);
1533
1534 unlock:
1535         hci_dev_unlock(hdev);
1536 }
1537
1538 static int set_connectable_update_settings(struct hci_dev *hdev,
1539                                            struct sock *sk, u8 val)
1540 {
1541         bool changed = false;
1542         int err;
1543
1544         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1545                 changed = true;
1546
1547         if (val) {
1548                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1549         } else {
1550                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1551                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1552         }
1553
1554         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1555         if (err < 0)
1556                 return err;
1557
1558         if (changed) {
1559                 hci_req_update_scan(hdev);
1560                 hci_update_background_scan(hdev);
1561                 return new_settings(hdev, sk);
1562         }
1563
1564         return 0;
1565 }
1566
1567 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1568                            u16 len)
1569 {
1570         struct mgmt_mode *cp = data;
1571         struct mgmt_pending_cmd *cmd;
1572         int err;
1573
1574         bt_dev_dbg(hdev, "sock %p", sk);
1575
1576         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1577             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1579                                        MGMT_STATUS_REJECTED);
1580
1581         if (cp->val != 0x00 && cp->val != 0x01)
1582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1583                                        MGMT_STATUS_INVALID_PARAMS);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (!hdev_is_powered(hdev)) {
1588                 err = set_connectable_update_settings(hdev, sk, cp->val);
1589                 goto failed;
1590         }
1591
1592         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1593             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1594                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1595                                       MGMT_STATUS_BUSY);
1596                 goto failed;
1597         }
1598
1599         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1600         if (!cmd) {
1601                 err = -ENOMEM;
1602                 goto failed;
1603         }
1604
1605         if (cp->val) {
1606                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1607         } else {
1608                 if (hdev->discov_timeout > 0)
1609                         cancel_delayed_work(&hdev->discov_off);
1610
1611                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1612                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1613                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1614         }
1615
1616         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1617         err = 0;
1618
1619 failed:
1620         hci_dev_unlock(hdev);
1621         return err;
1622 }
1623
1624 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1625                         u16 len)
1626 {
1627         struct mgmt_mode *cp = data;
1628         bool changed;
1629         int err;
1630
1631         bt_dev_dbg(hdev, "sock %p", sk);
1632
1633         if (cp->val != 0x00 && cp->val != 0x01)
1634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1635                                        MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (cp->val)
1640                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1641         else
1642                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1643
1644         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1645         if (err < 0)
1646                 goto unlock;
1647
1648         if (changed) {
1649                 /* In limited privacy mode the change of bondable mode
1650                  * may affect the local advertising address.
1651                  */
1652                 if (hdev_is_powered(hdev) &&
1653                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1654                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1655                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1656                         queue_work(hdev->req_workqueue,
1657                                    &hdev->discoverable_update);
1658
1659                 err = new_settings(hdev, sk);
1660         }
1661
1662 unlock:
1663         hci_dev_unlock(hdev);
1664         return err;
1665 }
1666
1667 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1668                              u16 len)
1669 {
1670         struct mgmt_mode *cp = data;
1671         struct mgmt_pending_cmd *cmd;
1672         u8 val, status;
1673         int err;
1674
1675         bt_dev_dbg(hdev, "sock %p", sk);
1676
1677         status = mgmt_bredr_support(hdev);
1678         if (status)
1679                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1680                                        status);
1681
1682         if (cp->val != 0x00 && cp->val != 0x01)
1683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1684                                        MGMT_STATUS_INVALID_PARAMS);
1685
1686         hci_dev_lock(hdev);
1687
1688         if (!hdev_is_powered(hdev)) {
1689                 bool changed = false;
1690
1691                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1692                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1693                         changed = true;
1694                 }
1695
1696                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1697                 if (err < 0)
1698                         goto failed;
1699
1700                 if (changed)
1701                         err = new_settings(hdev, sk);
1702
1703                 goto failed;
1704         }
1705
1706         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1707                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1708                                       MGMT_STATUS_BUSY);
1709                 goto failed;
1710         }
1711
1712         val = !!cp->val;
1713
1714         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1715                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1716                 goto failed;
1717         }
1718
1719         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1720         if (!cmd) {
1721                 err = -ENOMEM;
1722                 goto failed;
1723         }
1724
1725         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1726         if (err < 0) {
1727                 mgmt_pending_remove(cmd);
1728                 goto failed;
1729         }
1730
1731 failed:
1732         hci_dev_unlock(hdev);
1733         return err;
1734 }
1735
1736 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738         struct mgmt_mode *cp = data;
1739         struct mgmt_pending_cmd *cmd;
1740         u8 status;
1741         int err;
1742
1743         bt_dev_dbg(hdev, "sock %p", sk);
1744
1745         status = mgmt_bredr_support(hdev);
1746         if (status)
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1748
1749         if (!lmp_ssp_capable(hdev))
1750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1751                                        MGMT_STATUS_NOT_SUPPORTED);
1752
1753         if (cp->val != 0x00 && cp->val != 0x01)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1755                                        MGMT_STATUS_INVALID_PARAMS);
1756
1757         hci_dev_lock(hdev);
1758
1759         if (!hdev_is_powered(hdev)) {
1760                 bool changed;
1761
1762                 if (cp->val) {
1763                         changed = !hci_dev_test_and_set_flag(hdev,
1764                                                              HCI_SSP_ENABLED);
1765                 } else {
1766                         changed = hci_dev_test_and_clear_flag(hdev,
1767                                                               HCI_SSP_ENABLED);
1768                         if (!changed)
1769                                 changed = hci_dev_test_and_clear_flag(hdev,
1770                                                                       HCI_HS_ENABLED);
1771                         else
1772                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1773                 }
1774
1775                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1776                 if (err < 0)
1777                         goto failed;
1778
1779                 if (changed)
1780                         err = new_settings(hdev, sk);
1781
1782                 goto failed;
1783         }
1784
1785         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1787                                       MGMT_STATUS_BUSY);
1788                 goto failed;
1789         }
1790
1791         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1792                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1793                 goto failed;
1794         }
1795
1796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1797         if (!cmd) {
1798                 err = -ENOMEM;
1799                 goto failed;
1800         }
1801
1802         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1803                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1804                              sizeof(cp->val), &cp->val);
1805
1806         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1807         if (err < 0) {
1808                 mgmt_pending_remove(cmd);
1809                 goto failed;
1810         }
1811
1812 failed:
1813         hci_dev_unlock(hdev);
1814         return err;
1815 }
1816
1817 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1818 {
1819         struct mgmt_mode *cp = data;
1820         bool changed;
1821         u8 status;
1822         int err;
1823
1824         bt_dev_dbg(hdev, "sock %p", sk);
1825
1826         if (!IS_ENABLED(CONFIG_BT_HS))
1827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1828                                        MGMT_STATUS_NOT_SUPPORTED);
1829
1830         status = mgmt_bredr_support(hdev);
1831         if (status)
1832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1833
1834         if (!lmp_ssp_capable(hdev))
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1836                                        MGMT_STATUS_NOT_SUPPORTED);
1837
1838         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1840                                        MGMT_STATUS_REJECTED);
1841
1842         if (cp->val != 0x00 && cp->val != 0x01)
1843                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1844                                        MGMT_STATUS_INVALID_PARAMS);
1845
1846         hci_dev_lock(hdev);
1847
1848         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1849                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                       MGMT_STATUS_BUSY);
1851                 goto unlock;
1852         }
1853
1854         if (cp->val) {
1855                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1856         } else {
1857                 if (hdev_is_powered(hdev)) {
1858                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1859                                               MGMT_STATUS_REJECTED);
1860                         goto unlock;
1861                 }
1862
1863                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1864         }
1865
1866         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1867         if (err < 0)
1868                 goto unlock;
1869
1870         if (changed)
1871                 err = new_settings(hdev, sk);
1872
1873 unlock:
1874         hci_dev_unlock(hdev);
1875         return err;
1876 }
1877
1878 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1879 {
1880         struct cmd_lookup match = { NULL, hdev };
1881
1882         hci_dev_lock(hdev);
1883
1884         if (status) {
1885                 u8 mgmt_err = mgmt_status(status);
1886
1887                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1888                                      &mgmt_err);
1889                 goto unlock;
1890         }
1891
1892         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1893
1894         new_settings(hdev, match.sk);
1895
1896         if (match.sk)
1897                 sock_put(match.sk);
1898
1899         /* Make sure the controller has a good default for
1900          * advertising data. Restrict the update to when LE
1901          * has actually been enabled. During power on, the
1902          * update in powered_update_hci will take care of it.
1903          */
1904         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1905                 struct hci_request req;
1906                 hci_req_init(&req, hdev);
1907                 if (ext_adv_capable(hdev)) {
1908                         int err;
1909
1910                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1911                         if (!err)
1912                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1913                 } else {
1914                         __hci_req_update_adv_data(&req, 0x00);
1915                         __hci_req_update_scan_rsp_data(&req, 0x00);
1916                 }
1917                 hci_req_run(&req, NULL);
1918                 hci_update_background_scan(hdev);
1919         }
1920
1921 unlock:
1922         hci_dev_unlock(hdev);
1923 }
1924
1925 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1926 {
1927         struct mgmt_mode *cp = data;
1928         struct hci_cp_write_le_host_supported hci_cp;
1929         struct mgmt_pending_cmd *cmd;
1930         struct hci_request req;
1931         int err;
1932         u8 val, enabled;
1933
1934         bt_dev_dbg(hdev, "sock %p", sk);
1935
1936         if (!lmp_le_capable(hdev))
1937                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1938                                        MGMT_STATUS_NOT_SUPPORTED);
1939
1940         if (cp->val != 0x00 && cp->val != 0x01)
1941                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1942                                        MGMT_STATUS_INVALID_PARAMS);
1943
1944         /* Bluetooth single mode LE only controllers or dual-mode
1945          * controllers configured as LE only devices, do not allow
1946          * switching LE off. These have either LE enabled explicitly
1947          * or BR/EDR has been previously switched off.
1948          *
1949          * When trying to enable an already enabled LE, then gracefully
1950          * send a positive response. Trying to disable it however will
1951          * result into rejection.
1952          */
1953         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1954                 if (cp->val == 0x01)
1955                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1956
1957                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1958                                        MGMT_STATUS_REJECTED);
1959         }
1960
1961         hci_dev_lock(hdev);
1962
1963         val = !!cp->val;
1964         enabled = lmp_host_le_capable(hdev);
1965
1966         if (!val)
1967                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1968
1969         if (!hdev_is_powered(hdev) || val == enabled) {
1970                 bool changed = false;
1971
1972                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1973                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1974                         changed = true;
1975                 }
1976
1977                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1978                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1979                         changed = true;
1980                 }
1981
1982                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1983                 if (err < 0)
1984                         goto unlock;
1985
1986                 if (changed)
1987                         err = new_settings(hdev, sk);
1988
1989                 goto unlock;
1990         }
1991
1992         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1993             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1995                                       MGMT_STATUS_BUSY);
1996                 goto unlock;
1997         }
1998
1999         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2000         if (!cmd) {
2001                 err = -ENOMEM;
2002                 goto unlock;
2003         }
2004
2005         hci_req_init(&req, hdev);
2006
2007         memset(&hci_cp, 0, sizeof(hci_cp));
2008
2009         if (val) {
2010                 hci_cp.le = val;
2011                 hci_cp.simul = 0x00;
2012         } else {
2013                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2014                         __hci_req_disable_advertising(&req);
2015
2016                 if (ext_adv_capable(hdev))
2017                         __hci_req_clear_ext_adv_sets(&req);
2018         }
2019
2020         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2021                     &hci_cp);
2022
2023         err = hci_req_run(&req, le_enable_complete);
2024         if (err < 0)
2025                 mgmt_pending_remove(cmd);
2026
2027 unlock:
2028         hci_dev_unlock(hdev);
2029         return err;
2030 }
2031
2032 /* This is a helper function to test for pending mgmt commands that can
2033  * cause CoD or EIR HCI commands. We can only allow one such pending
2034  * mgmt command at a time since otherwise we cannot easily track what
2035  * the current values are, will be, and based on that calculate if a new
2036  * HCI command needs to be sent and if yes with what value.
2037  */
2038 static bool pending_eir_or_class(struct hci_dev *hdev)
2039 {
2040         struct mgmt_pending_cmd *cmd;
2041
2042         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2043                 switch (cmd->opcode) {
2044                 case MGMT_OP_ADD_UUID:
2045                 case MGMT_OP_REMOVE_UUID:
2046                 case MGMT_OP_SET_DEV_CLASS:
2047                 case MGMT_OP_SET_POWERED:
2048                         return true;
2049                 }
2050         }
2051
2052         return false;
2053 }
2054
2055 static const u8 bluetooth_base_uuid[] = {
2056                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2057                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2058 };
2059
2060 static u8 get_uuid_size(const u8 *uuid)
2061 {
2062         u32 val;
2063
2064         if (memcmp(uuid, bluetooth_base_uuid, 12))
2065                 return 128;
2066
2067         val = get_unaligned_le32(&uuid[12]);
2068         if (val > 0xffff)
2069                 return 32;
2070
2071         return 16;
2072 }
2073
2074 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2075 {
2076         struct mgmt_pending_cmd *cmd;
2077
2078         hci_dev_lock(hdev);
2079
2080         cmd = pending_find(mgmt_op, hdev);
2081         if (!cmd)
2082                 goto unlock;
2083
2084         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2085                           mgmt_status(status), hdev->dev_class, 3);
2086
2087         mgmt_pending_remove(cmd);
2088
2089 unlock:
2090         hci_dev_unlock(hdev);
2091 }
2092
2093 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2094 {
2095         bt_dev_dbg(hdev, "status 0x%02x", status);
2096
2097         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2098 }
2099
2100 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2101 {
2102         struct mgmt_cp_add_uuid *cp = data;
2103         struct mgmt_pending_cmd *cmd;
2104         struct hci_request req;
2105         struct bt_uuid *uuid;
2106         int err;
2107
2108         bt_dev_dbg(hdev, "sock %p", sk);
2109
2110         hci_dev_lock(hdev);
2111
2112         if (pending_eir_or_class(hdev)) {
2113                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2114                                       MGMT_STATUS_BUSY);
2115                 goto failed;
2116         }
2117
2118         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2119         if (!uuid) {
2120                 err = -ENOMEM;
2121                 goto failed;
2122         }
2123
2124         memcpy(uuid->uuid, cp->uuid, 16);
2125         uuid->svc_hint = cp->svc_hint;
2126         uuid->size = get_uuid_size(cp->uuid);
2127
2128         list_add_tail(&uuid->list, &hdev->uuids);
2129
2130         hci_req_init(&req, hdev);
2131
2132         __hci_req_update_class(&req);
2133         __hci_req_update_eir(&req);
2134
2135         err = hci_req_run(&req, add_uuid_complete);
2136         if (err < 0) {
2137                 if (err != -ENODATA)
2138                         goto failed;
2139
2140                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2141                                         hdev->dev_class, 3);
2142                 goto failed;
2143         }
2144
2145         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2146         if (!cmd) {
2147                 err = -ENOMEM;
2148                 goto failed;
2149         }
2150
2151         err = 0;
2152
2153 failed:
2154         hci_dev_unlock(hdev);
2155         return err;
2156 }
2157
2158 static bool enable_service_cache(struct hci_dev *hdev)
2159 {
2160         if (!hdev_is_powered(hdev))
2161                 return false;
2162
2163         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2164                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2165                                    CACHE_TIMEOUT);
2166                 return true;
2167         }
2168
2169         return false;
2170 }
2171
2172 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2173 {
2174         bt_dev_dbg(hdev, "status 0x%02x", status);
2175
2176         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2177 }
2178
2179 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2180                        u16 len)
2181 {
2182         struct mgmt_cp_remove_uuid *cp = data;
2183         struct mgmt_pending_cmd *cmd;
2184         struct bt_uuid *match, *tmp;
2185         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2186         struct hci_request req;
2187         int err, found;
2188
2189         bt_dev_dbg(hdev, "sock %p", sk);
2190
2191         hci_dev_lock(hdev);
2192
2193         if (pending_eir_or_class(hdev)) {
2194                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2195                                       MGMT_STATUS_BUSY);
2196                 goto unlock;
2197         }
2198
2199         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2200                 hci_uuids_clear(hdev);
2201
2202                 if (enable_service_cache(hdev)) {
2203                         err = mgmt_cmd_complete(sk, hdev->id,
2204                                                 MGMT_OP_REMOVE_UUID,
2205                                                 0, hdev->dev_class, 3);
2206                         goto unlock;
2207                 }
2208
2209                 goto update_class;
2210         }
2211
2212         found = 0;
2213
2214         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2215                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2216                         continue;
2217
2218                 list_del(&match->list);
2219                 kfree(match);
2220                 found++;
2221         }
2222
2223         if (found == 0) {
2224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2225                                       MGMT_STATUS_INVALID_PARAMS);
2226                 goto unlock;
2227         }
2228
2229 update_class:
2230         hci_req_init(&req, hdev);
2231
2232         __hci_req_update_class(&req);
2233         __hci_req_update_eir(&req);
2234
2235         err = hci_req_run(&req, remove_uuid_complete);
2236         if (err < 0) {
2237                 if (err != -ENODATA)
2238                         goto unlock;
2239
2240                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2241                                         hdev->dev_class, 3);
2242                 goto unlock;
2243         }
2244
2245         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2246         if (!cmd) {
2247                 err = -ENOMEM;
2248                 goto unlock;
2249         }
2250
2251         err = 0;
2252
2253 unlock:
2254         hci_dev_unlock(hdev);
2255         return err;
2256 }
2257
2258 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2259 {
2260         bt_dev_dbg(hdev, "status 0x%02x", status);
2261
2262         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2263 }
2264
2265 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2266                          u16 len)
2267 {
2268         struct mgmt_cp_set_dev_class *cp = data;
2269         struct mgmt_pending_cmd *cmd;
2270         struct hci_request req;
2271         int err;
2272
2273         bt_dev_dbg(hdev, "sock %p", sk);
2274
2275         if (!lmp_bredr_capable(hdev))
2276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2277                                        MGMT_STATUS_NOT_SUPPORTED);
2278
2279         hci_dev_lock(hdev);
2280
2281         if (pending_eir_or_class(hdev)) {
2282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                       MGMT_STATUS_BUSY);
2284                 goto unlock;
2285         }
2286
2287         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_INVALID_PARAMS);
2290                 goto unlock;
2291         }
2292
2293         hdev->major_class = cp->major;
2294         hdev->minor_class = cp->minor;
2295
2296         if (!hdev_is_powered(hdev)) {
2297                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2298                                         hdev->dev_class, 3);
2299                 goto unlock;
2300         }
2301
2302         hci_req_init(&req, hdev);
2303
2304         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2305                 hci_dev_unlock(hdev);
2306                 cancel_delayed_work_sync(&hdev->service_cache);
2307                 hci_dev_lock(hdev);
2308                 __hci_req_update_eir(&req);
2309         }
2310
2311         __hci_req_update_class(&req);
2312
2313         err = hci_req_run(&req, set_class_complete);
2314         if (err < 0) {
2315                 if (err != -ENODATA)
2316                         goto unlock;
2317
2318                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2319                                         hdev->dev_class, 3);
2320                 goto unlock;
2321         }
2322
2323         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2324         if (!cmd) {
2325                 err = -ENOMEM;
2326                 goto unlock;
2327         }
2328
2329         err = 0;
2330
2331 unlock:
2332         hci_dev_unlock(hdev);
2333         return err;
2334 }
2335
2336 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2337                           u16 len)
2338 {
2339         struct mgmt_cp_load_link_keys *cp = data;
2340         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2341                                    sizeof(struct mgmt_link_key_info));
2342         u16 key_count, expected_len;
2343         bool changed;
2344         int i;
2345
2346         bt_dev_dbg(hdev, "sock %p", sk);
2347
2348         if (!lmp_bredr_capable(hdev))
2349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2350                                        MGMT_STATUS_NOT_SUPPORTED);
2351
2352         key_count = __le16_to_cpu(cp->key_count);
2353         if (key_count > max_key_count) {
2354                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2355                            key_count);
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_INVALID_PARAMS);
2358         }
2359
2360         expected_len = struct_size(cp, keys, key_count);
2361         if (expected_len != len) {
2362                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2363                            expected_len, len);
2364                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2365                                        MGMT_STATUS_INVALID_PARAMS);
2366         }
2367
2368         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2369                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2370                                        MGMT_STATUS_INVALID_PARAMS);
2371
2372         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2373                    key_count);
2374
2375         for (i = 0; i < key_count; i++) {
2376                 struct mgmt_link_key_info *key = &cp->keys[i];
2377
2378                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2379                         return mgmt_cmd_status(sk, hdev->id,
2380                                                MGMT_OP_LOAD_LINK_KEYS,
2381                                                MGMT_STATUS_INVALID_PARAMS);
2382         }
2383
2384         hci_dev_lock(hdev);
2385
2386         hci_link_keys_clear(hdev);
2387
2388         if (cp->debug_keys)
2389                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2390         else
2391                 changed = hci_dev_test_and_clear_flag(hdev,
2392                                                       HCI_KEEP_DEBUG_KEYS);
2393
2394         if (changed)
2395                 new_settings(hdev, NULL);
2396
2397         for (i = 0; i < key_count; i++) {
2398                 struct mgmt_link_key_info *key = &cp->keys[i];
2399
2400                 if (hci_is_blocked_key(hdev,
2401                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2402                                        key->val)) {
2403                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2404                                     &key->addr.bdaddr);
2405                         continue;
2406                 }
2407
2408                 /* Always ignore debug keys and require a new pairing if
2409                  * the user wants to use them.
2410                  */
2411                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2412                         continue;
2413
2414                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2415                                  key->type, key->pin_len, NULL);
2416         }
2417
2418         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2419
2420         hci_dev_unlock(hdev);
2421
2422         return 0;
2423 }
2424
2425 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2426                            u8 addr_type, struct sock *skip_sk)
2427 {
2428         struct mgmt_ev_device_unpaired ev;
2429
2430         bacpy(&ev.addr.bdaddr, bdaddr);
2431         ev.addr.type = addr_type;
2432
2433         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2434                           skip_sk);
2435 }
2436
2437 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2438                          u16 len)
2439 {
2440         struct mgmt_cp_unpair_device *cp = data;
2441         struct mgmt_rp_unpair_device rp;
2442         struct hci_conn_params *params;
2443         struct mgmt_pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         u8 addr_type;
2446         int err;
2447
2448         memset(&rp, 0, sizeof(rp));
2449         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2450         rp.addr.type = cp->addr.type;
2451
2452         if (!bdaddr_type_is_valid(cp->addr.type))
2453                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2454                                          MGMT_STATUS_INVALID_PARAMS,
2455                                          &rp, sizeof(rp));
2456
2457         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2458                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2459                                          MGMT_STATUS_INVALID_PARAMS,
2460                                          &rp, sizeof(rp));
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hdev_is_powered(hdev)) {
2465                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                         MGMT_STATUS_NOT_POWERED, &rp,
2467                                         sizeof(rp));
2468                 goto unlock;
2469         }
2470
2471         if (cp->addr.type == BDADDR_BREDR) {
2472                 /* If disconnection is requested, then look up the
2473                  * connection. If the remote device is connected, it
2474                  * will be later used to terminate the link.
2475                  *
2476                  * Setting it to NULL explicitly will cause no
2477                  * termination of the link.
2478                  */
2479                 if (cp->disconnect)
2480                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2481                                                        &cp->addr.bdaddr);
2482                 else
2483                         conn = NULL;
2484
2485                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2486                 if (err < 0) {
2487                         err = mgmt_cmd_complete(sk, hdev->id,
2488                                                 MGMT_OP_UNPAIR_DEVICE,
2489                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2490                                                 sizeof(rp));
2491                         goto unlock;
2492                 }
2493
2494                 goto done;
2495         }
2496
2497         /* LE address type */
2498         addr_type = le_addr_type(cp->addr.type);
2499
2500         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2501         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2502         if (err < 0) {
2503                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2504                                         MGMT_STATUS_NOT_PAIRED, &rp,
2505                                         sizeof(rp));
2506                 goto unlock;
2507         }
2508
2509         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2510         if (!conn) {
2511                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2512                 goto done;
2513         }
2514
2515
2516         /* Defer clearing up the connection parameters until closing to
2517          * give a chance of keeping them if a repairing happens.
2518          */
2519         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2520
2521         /* Disable auto-connection parameters if present */
2522         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2523         if (params) {
2524                 if (params->explicit_connect)
2525                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2526                 else
2527                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2528         }
2529
2530         /* If disconnection is not requested, then clear the connection
2531          * variable so that the link is not terminated.
2532          */
2533         if (!cp->disconnect)
2534                 conn = NULL;
2535
2536 done:
2537         /* If the connection variable is set, then termination of the
2538          * link is requested.
2539          */
2540         if (!conn) {
2541                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2542                                         &rp, sizeof(rp));
2543                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2544                 goto unlock;
2545         }
2546
2547         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2548                                sizeof(*cp));
2549         if (!cmd) {
2550                 err = -ENOMEM;
2551                 goto unlock;
2552         }
2553
2554         cmd->cmd_complete = addr_cmd_complete;
2555
2556         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2557         if (err < 0)
2558                 mgmt_pending_remove(cmd);
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562         return err;
2563 }
2564
2565 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2566                       u16 len)
2567 {
2568         struct mgmt_cp_disconnect *cp = data;
2569         struct mgmt_rp_disconnect rp;
2570         struct mgmt_pending_cmd *cmd;
2571         struct hci_conn *conn;
2572         int err;
2573
2574         bt_dev_dbg(hdev, "sock %p", sk);
2575
2576         memset(&rp, 0, sizeof(rp));
2577         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2578         rp.addr.type = cp->addr.type;
2579
2580         if (!bdaddr_type_is_valid(cp->addr.type))
2581                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2582                                          MGMT_STATUS_INVALID_PARAMS,
2583                                          &rp, sizeof(rp));
2584
2585         hci_dev_lock(hdev);
2586
2587         if (!test_bit(HCI_UP, &hdev->flags)) {
2588                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                         MGMT_STATUS_NOT_POWERED, &rp,
2590                                         sizeof(rp));
2591                 goto failed;
2592         }
2593
2594         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (cp->addr.type == BDADDR_BREDR)
2601                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2602                                                &cp->addr.bdaddr);
2603         else
2604                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2605                                                le_addr_type(cp->addr.type));
2606
2607         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2608                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2609                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2610                                         sizeof(rp));
2611                 goto failed;
2612         }
2613
2614         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2615         if (!cmd) {
2616                 err = -ENOMEM;
2617                 goto failed;
2618         }
2619
2620         cmd->cmd_complete = generic_cmd_complete;
2621
2622         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2623         if (err < 0)
2624                 mgmt_pending_remove(cmd);
2625
2626 failed:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2632 {
2633         switch (link_type) {
2634         case LE_LINK:
2635                 switch (addr_type) {
2636                 case ADDR_LE_DEV_PUBLIC:
2637                         return BDADDR_LE_PUBLIC;
2638
2639                 default:
2640                         /* Fallback to LE Random address type */
2641                         return BDADDR_LE_RANDOM;
2642                 }
2643
2644         default:
2645                 /* Fallback to BR/EDR type */
2646                 return BDADDR_BREDR;
2647         }
2648 }
2649
2650 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2651                            u16 data_len)
2652 {
2653         struct mgmt_rp_get_connections *rp;
2654         struct hci_conn *c;
2655         int err;
2656         u16 i;
2657
2658         bt_dev_dbg(hdev, "sock %p", sk);
2659
2660         hci_dev_lock(hdev);
2661
2662         if (!hdev_is_powered(hdev)) {
2663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2664                                       MGMT_STATUS_NOT_POWERED);
2665                 goto unlock;
2666         }
2667
2668         i = 0;
2669         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2670                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2671                         i++;
2672         }
2673
2674         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2675         if (!rp) {
2676                 err = -ENOMEM;
2677                 goto unlock;
2678         }
2679
2680         i = 0;
2681         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2682                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2683                         continue;
2684                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2685                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2686                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2687                         continue;
2688                 i++;
2689         }
2690
2691         rp->conn_count = cpu_to_le16(i);
2692
2693         /* Recalculate length in case of filtered SCO connections, etc */
2694         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2695                                 struct_size(rp, addr, i));
2696
2697         kfree(rp);
2698
2699 unlock:
2700         hci_dev_unlock(hdev);
2701         return err;
2702 }
2703
2704 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2705                                    struct mgmt_cp_pin_code_neg_reply *cp)
2706 {
2707         struct mgmt_pending_cmd *cmd;
2708         int err;
2709
2710         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2711                                sizeof(*cp));
2712         if (!cmd)
2713                 return -ENOMEM;
2714
2715         cmd->cmd_complete = addr_cmd_complete;
2716
2717         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2718                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721
2722         return err;
2723 }
2724
2725 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2726                           u16 len)
2727 {
2728         struct hci_conn *conn;
2729         struct mgmt_cp_pin_code_reply *cp = data;
2730         struct hci_cp_pin_code_reply reply;
2731         struct mgmt_pending_cmd *cmd;
2732         int err;
2733
2734         bt_dev_dbg(hdev, "sock %p", sk);
2735
2736         hci_dev_lock(hdev);
2737
2738         if (!hdev_is_powered(hdev)) {
2739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2740                                       MGMT_STATUS_NOT_POWERED);
2741                 goto failed;
2742         }
2743
2744         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2745         if (!conn) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_CONNECTED);
2748                 goto failed;
2749         }
2750
2751         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2752                 struct mgmt_cp_pin_code_neg_reply ncp;
2753
2754                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2755
2756                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2757
2758                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2759                 if (err >= 0)
2760                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2761                                               MGMT_STATUS_INVALID_PARAMS);
2762
2763                 goto failed;
2764         }
2765
2766         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2767         if (!cmd) {
2768                 err = -ENOMEM;
2769                 goto failed;
2770         }
2771
2772         cmd->cmd_complete = addr_cmd_complete;
2773
2774         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2775         reply.pin_len = cp->pin_len;
2776         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2777
2778         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2779         if (err < 0)
2780                 mgmt_pending_remove(cmd);
2781
2782 failed:
2783         hci_dev_unlock(hdev);
2784         return err;
2785 }
2786
2787 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2788                              u16 len)
2789 {
2790         struct mgmt_cp_set_io_capability *cp = data;
2791
2792         bt_dev_dbg(hdev, "sock %p", sk);
2793
2794         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2795                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2796                                        MGMT_STATUS_INVALID_PARAMS);
2797
2798         hci_dev_lock(hdev);
2799
2800         hdev->io_capability = cp->io_capability;
2801
2802         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2803
2804         hci_dev_unlock(hdev);
2805
2806         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2807                                  NULL, 0);
2808 }
2809
2810 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2811 {
2812         struct hci_dev *hdev = conn->hdev;
2813         struct mgmt_pending_cmd *cmd;
2814
2815         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2816                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2817                         continue;
2818
2819                 if (cmd->user_data != conn)
2820                         continue;
2821
2822                 return cmd;
2823         }
2824
2825         return NULL;
2826 }
2827
2828 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2829 {
2830         struct mgmt_rp_pair_device rp;
2831         struct hci_conn *conn = cmd->user_data;
2832         int err;
2833
2834         bacpy(&rp.addr.bdaddr, &conn->dst);
2835         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2836
2837         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2838                                 status, &rp, sizeof(rp));
2839
2840         /* So we don't get further callbacks for this connection */
2841         conn->connect_cfm_cb = NULL;
2842         conn->security_cfm_cb = NULL;
2843         conn->disconn_cfm_cb = NULL;
2844
2845         hci_conn_drop(conn);
2846
2847         /* The device is paired so there is no need to remove
2848          * its connection parameters anymore.
2849          */
2850         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2851
2852         hci_conn_put(conn);
2853
2854         return err;
2855 }
2856
2857 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2858 {
2859         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2860         struct mgmt_pending_cmd *cmd;
2861
2862         cmd = find_pairing(conn);
2863         if (cmd) {
2864                 cmd->cmd_complete(cmd, status);
2865                 mgmt_pending_remove(cmd);
2866         }
2867 }
2868
2869 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2870 {
2871         struct mgmt_pending_cmd *cmd;
2872
2873         BT_DBG("status %u", status);
2874
2875         cmd = find_pairing(conn);
2876         if (!cmd) {
2877                 BT_DBG("Unable to find a pending command");
2878                 return;
2879         }
2880
2881         cmd->cmd_complete(cmd, mgmt_status(status));
2882         mgmt_pending_remove(cmd);
2883 }
2884
2885 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2886 {
2887         struct mgmt_pending_cmd *cmd;
2888
2889         BT_DBG("status %u", status);
2890
2891         if (!status)
2892                 return;
2893
2894         cmd = find_pairing(conn);
2895         if (!cmd) {
2896                 BT_DBG("Unable to find a pending command");
2897                 return;
2898         }
2899
2900         cmd->cmd_complete(cmd, mgmt_status(status));
2901         mgmt_pending_remove(cmd);
2902 }
2903
2904 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2905                        u16 len)
2906 {
2907         struct mgmt_cp_pair_device *cp = data;
2908         struct mgmt_rp_pair_device rp;
2909         struct mgmt_pending_cmd *cmd;
2910         u8 sec_level, auth_type;
2911         struct hci_conn *conn;
2912         int err;
2913
2914         bt_dev_dbg(hdev, "sock %p", sk);
2915
2916         memset(&rp, 0, sizeof(rp));
2917         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2918         rp.addr.type = cp->addr.type;
2919
2920         if (!bdaddr_type_is_valid(cp->addr.type))
2921                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2922                                          MGMT_STATUS_INVALID_PARAMS,
2923                                          &rp, sizeof(rp));
2924
2925         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2926                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2927                                          MGMT_STATUS_INVALID_PARAMS,
2928                                          &rp, sizeof(rp));
2929
2930         hci_dev_lock(hdev);
2931
2932         if (!hdev_is_powered(hdev)) {
2933                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                         MGMT_STATUS_NOT_POWERED, &rp,
2935                                         sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         sec_level = BT_SECURITY_MEDIUM;
2947         auth_type = HCI_AT_DEDICATED_BONDING;
2948
2949         if (cp->addr.type == BDADDR_BREDR) {
2950                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2951                                        auth_type, CONN_REASON_PAIR_DEVICE);
2952         } else {
2953                 u8 addr_type = le_addr_type(cp->addr.type);
2954                 struct hci_conn_params *p;
2955
2956                 /* When pairing a new device, it is expected to remember
2957                  * this device for future connections. Adding the connection
2958                  * parameter information ahead of time allows tracking
2959                  * of the slave preferred values and will speed up any
2960                  * further connection establishment.
2961                  *
2962                  * If connection parameters already exist, then they
2963                  * will be kept and this function does nothing.
2964                  */
2965                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2966
2967                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2968                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2969
2970                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2971                                            sec_level, HCI_LE_CONN_TIMEOUT,
2972                                            CONN_REASON_PAIR_DEVICE);
2973         }
2974
2975         if (IS_ERR(conn)) {
2976                 int status;
2977
2978                 if (PTR_ERR(conn) == -EBUSY)
2979                         status = MGMT_STATUS_BUSY;
2980                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2981                         status = MGMT_STATUS_NOT_SUPPORTED;
2982                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2983                         status = MGMT_STATUS_REJECTED;
2984                 else
2985                         status = MGMT_STATUS_CONNECT_FAILED;
2986
2987                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2988                                         status, &rp, sizeof(rp));
2989                 goto unlock;
2990         }
2991
2992         if (conn->connect_cfm_cb) {
2993                 hci_conn_drop(conn);
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 hci_conn_drop(conn);
3003                 goto unlock;
3004         }
3005
3006         cmd->cmd_complete = pairing_complete;
3007
3008         /* For LE, just connecting isn't a proof that the pairing finished */
3009         if (cp->addr.type == BDADDR_BREDR) {
3010                 conn->connect_cfm_cb = pairing_complete_cb;
3011                 conn->security_cfm_cb = pairing_complete_cb;
3012                 conn->disconn_cfm_cb = pairing_complete_cb;
3013         } else {
3014                 conn->connect_cfm_cb = le_pairing_complete_cb;
3015                 conn->security_cfm_cb = le_pairing_complete_cb;
3016                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3017         }
3018
3019         conn->io_capability = cp->io_cap;
3020         cmd->user_data = hci_conn_get(conn);
3021
3022         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3023             hci_conn_security(conn, sec_level, auth_type, true)) {
3024                 cmd->cmd_complete(cmd, 0);
3025                 mgmt_pending_remove(cmd);
3026         }
3027
3028         err = 0;
3029
3030 unlock:
3031         hci_dev_unlock(hdev);
3032         return err;
3033 }
3034
3035 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3036                               u16 len)
3037 {
3038         struct mgmt_addr_info *addr = data;
3039         struct mgmt_pending_cmd *cmd;
3040         struct hci_conn *conn;
3041         int err;
3042
3043         bt_dev_dbg(hdev, "sock %p", sk);
3044
3045         hci_dev_lock(hdev);
3046
3047         if (!hdev_is_powered(hdev)) {
3048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3049                                       MGMT_STATUS_NOT_POWERED);
3050                 goto unlock;
3051         }
3052
3053         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3054         if (!cmd) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_INVALID_PARAMS);
3057                 goto unlock;
3058         }
3059
3060         conn = cmd->user_data;
3061
3062         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3063                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3064                                       MGMT_STATUS_INVALID_PARAMS);
3065                 goto unlock;
3066         }
3067
3068         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3069         mgmt_pending_remove(cmd);
3070
3071         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3072                                 addr, sizeof(*addr));
3073
3074         /* Since user doesn't want to proceed with the connection, abort any
3075          * ongoing pairing and then terminate the link if it was created
3076          * because of the pair device action.
3077          */
3078         if (addr->type == BDADDR_BREDR)
3079                 hci_remove_link_key(hdev, &addr->bdaddr);
3080         else
3081                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3082                                               le_addr_type(addr->type));
3083
3084         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3085                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3086
3087 unlock:
3088         hci_dev_unlock(hdev);
3089         return err;
3090 }
3091
3092 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3093                              struct mgmt_addr_info *addr, u16 mgmt_op,
3094                              u16 hci_op, __le32 passkey)
3095 {
3096         struct mgmt_pending_cmd *cmd;
3097         struct hci_conn *conn;
3098         int err;
3099
3100         hci_dev_lock(hdev);
3101
3102         if (!hdev_is_powered(hdev)) {
3103                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3104                                         MGMT_STATUS_NOT_POWERED, addr,
3105                                         sizeof(*addr));
3106                 goto done;
3107         }
3108
3109         if (addr->type == BDADDR_BREDR)
3110                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3111         else
3112                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3113                                                le_addr_type(addr->type));
3114
3115         if (!conn) {
3116                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3117                                         MGMT_STATUS_NOT_CONNECTED, addr,
3118                                         sizeof(*addr));
3119                 goto done;
3120         }
3121
3122         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3123                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3124                 if (!err)
3125                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3126                                                 MGMT_STATUS_SUCCESS, addr,
3127                                                 sizeof(*addr));
3128                 else
3129                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3130                                                 MGMT_STATUS_FAILED, addr,
3131                                                 sizeof(*addr));
3132
3133                 goto done;
3134         }
3135
3136         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3137         if (!cmd) {
3138                 err = -ENOMEM;
3139                 goto done;
3140         }
3141
3142         cmd->cmd_complete = addr_cmd_complete;
3143
3144         /* Continue with pairing via HCI */
3145         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3146                 struct hci_cp_user_passkey_reply cp;
3147
3148                 bacpy(&cp.bdaddr, &addr->bdaddr);
3149                 cp.passkey = passkey;
3150                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3151         } else
3152                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3153                                    &addr->bdaddr);
3154
3155         if (err < 0)
3156                 mgmt_pending_remove(cmd);
3157
3158 done:
3159         hci_dev_unlock(hdev);
3160         return err;
3161 }
3162
3163 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3164                               void *data, u16 len)
3165 {
3166         struct mgmt_cp_pin_code_neg_reply *cp = data;
3167
3168         bt_dev_dbg(hdev, "sock %p", sk);
3169
3170         return user_pairing_resp(sk, hdev, &cp->addr,
3171                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3172                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3173 }
3174
3175 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3176                               u16 len)
3177 {
3178         struct mgmt_cp_user_confirm_reply *cp = data;
3179
3180         bt_dev_dbg(hdev, "sock %p", sk);
3181
3182         if (len != sizeof(*cp))
3183                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3184                                        MGMT_STATUS_INVALID_PARAMS);
3185
3186         return user_pairing_resp(sk, hdev, &cp->addr,
3187                                  MGMT_OP_USER_CONFIRM_REPLY,
3188                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3189 }
3190
3191 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3192                                   void *data, u16 len)
3193 {
3194         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3195
3196         bt_dev_dbg(hdev, "sock %p", sk);
3197
3198         return user_pairing_resp(sk, hdev, &cp->addr,
3199                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3200                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3201 }
3202
3203 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3204                               u16 len)
3205 {
3206         struct mgmt_cp_user_passkey_reply *cp = data;
3207
3208         bt_dev_dbg(hdev, "sock %p", sk);
3209
3210         return user_pairing_resp(sk, hdev, &cp->addr,
3211                                  MGMT_OP_USER_PASSKEY_REPLY,
3212                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3213 }
3214
3215 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3216                                   void *data, u16 len)
3217 {
3218         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3219
3220         bt_dev_dbg(hdev, "sock %p", sk);
3221
3222         return user_pairing_resp(sk, hdev, &cp->addr,
3223                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3224                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3225 }
3226
3227 static void adv_expire(struct hci_dev *hdev, u32 flags)
3228 {
3229         struct adv_info *adv_instance;
3230         struct hci_request req;
3231         int err;
3232
3233         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3234         if (!adv_instance)
3235                 return;
3236
3237         /* stop if current instance doesn't need to be changed */
3238         if (!(adv_instance->flags & flags))
3239                 return;
3240
3241         cancel_adv_timeout(hdev);
3242
3243         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3244         if (!adv_instance)
3245                 return;
3246
3247         hci_req_init(&req, hdev);
3248         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3249                                               true);
3250         if (err)
3251                 return;
3252
3253         hci_req_run(&req, NULL);
3254 }
3255
3256 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3257 {
3258         struct mgmt_cp_set_local_name *cp;
3259         struct mgmt_pending_cmd *cmd;
3260
3261         bt_dev_dbg(hdev, "status 0x%02x", status);
3262
3263         hci_dev_lock(hdev);
3264
3265         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3266         if (!cmd)
3267                 goto unlock;
3268
3269         cp = cmd->param;
3270
3271         if (status) {
3272                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3273                                 mgmt_status(status));
3274         } else {
3275                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3276                                   cp, sizeof(*cp));
3277
3278                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3279                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3280         }
3281
3282         mgmt_pending_remove(cmd);
3283
3284 unlock:
3285         hci_dev_unlock(hdev);
3286 }
3287
3288 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3289                           u16 len)
3290 {
3291         struct mgmt_cp_set_local_name *cp = data;
3292         struct mgmt_pending_cmd *cmd;
3293         struct hci_request req;
3294         int err;
3295
3296         bt_dev_dbg(hdev, "sock %p", sk);
3297
3298         hci_dev_lock(hdev);
3299
3300         /* If the old values are the same as the new ones just return a
3301          * direct command complete event.
3302          */
3303         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3304             !memcmp(hdev->short_name, cp->short_name,
3305                     sizeof(hdev->short_name))) {
3306                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3307                                         data, len);
3308                 goto failed;
3309         }
3310
3311         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3312
3313         if (!hdev_is_powered(hdev)) {
3314                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3315
3316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3317                                         data, len);
3318                 if (err < 0)
3319                         goto failed;
3320
3321                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3322                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3323                 ext_info_changed(hdev, sk);
3324
3325                 goto failed;
3326         }
3327
3328         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3329         if (!cmd) {
3330                 err = -ENOMEM;
3331                 goto failed;
3332         }
3333
3334         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3335
3336         hci_req_init(&req, hdev);
3337
3338         if (lmp_bredr_capable(hdev)) {
3339                 __hci_req_update_name(&req);
3340                 __hci_req_update_eir(&req);
3341         }
3342
3343         /* The name is stored in the scan response data and so
3344          * no need to udpate the advertising data here.
3345          */
3346         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3347                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3348
3349         err = hci_req_run(&req, set_name_complete);
3350         if (err < 0)
3351                 mgmt_pending_remove(cmd);
3352
3353 failed:
3354         hci_dev_unlock(hdev);
3355         return err;
3356 }
3357
3358 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3359                           u16 len)
3360 {
3361         struct mgmt_cp_set_appearance *cp = data;
3362         u16 appearance;
3363         int err;
3364
3365         bt_dev_dbg(hdev, "sock %p", sk);
3366
3367         if (!lmp_le_capable(hdev))
3368                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3369                                        MGMT_STATUS_NOT_SUPPORTED);
3370
3371         appearance = le16_to_cpu(cp->appearance);
3372
3373         hci_dev_lock(hdev);
3374
3375         if (hdev->appearance != appearance) {
3376                 hdev->appearance = appearance;
3377
3378                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3379                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3380
3381                 ext_info_changed(hdev, sk);
3382         }
3383
3384         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3385                                 0);
3386
3387         hci_dev_unlock(hdev);
3388
3389         return err;
3390 }
3391
3392 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3393                                  void *data, u16 len)
3394 {
3395         struct mgmt_rp_get_phy_configuration rp;
3396
3397         bt_dev_dbg(hdev, "sock %p", sk);
3398
3399         hci_dev_lock(hdev);
3400
3401         memset(&rp, 0, sizeof(rp));
3402
3403         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3404         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3405         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3406
3407         hci_dev_unlock(hdev);
3408
3409         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3410                                  &rp, sizeof(rp));
3411 }
3412
3413 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3414 {
3415         struct mgmt_ev_phy_configuration_changed ev;
3416
3417         memset(&ev, 0, sizeof(ev));
3418
3419         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3420
3421         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3422                           sizeof(ev), skip);
3423 }
3424
3425 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3426                                      u16 opcode, struct sk_buff *skb)
3427 {
3428         struct mgmt_pending_cmd *cmd;
3429
3430         bt_dev_dbg(hdev, "status 0x%02x", status);
3431
3432         hci_dev_lock(hdev);
3433
3434         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3435         if (!cmd)
3436                 goto unlock;
3437
3438         if (status) {
3439                 mgmt_cmd_status(cmd->sk, hdev->id,
3440                                 MGMT_OP_SET_PHY_CONFIGURATION,
3441                                 mgmt_status(status));
3442         } else {
3443                 mgmt_cmd_complete(cmd->sk, hdev->id,
3444                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3445                                   NULL, 0);
3446
3447                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3448         }
3449
3450         mgmt_pending_remove(cmd);
3451
3452 unlock:
3453         hci_dev_unlock(hdev);
3454 }
3455
3456 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3457                                  void *data, u16 len)
3458 {
3459         struct mgmt_cp_set_phy_configuration *cp = data;
3460         struct hci_cp_le_set_default_phy cp_phy;
3461         struct mgmt_pending_cmd *cmd;
3462         struct hci_request req;
3463         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3464         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3465         bool changed = false;
3466         int err;
3467
3468         bt_dev_dbg(hdev, "sock %p", sk);
3469
3470         configurable_phys = get_configurable_phys(hdev);
3471         supported_phys = get_supported_phys(hdev);
3472         selected_phys = __le32_to_cpu(cp->selected_phys);
3473
3474         if (selected_phys & ~supported_phys)
3475                 return mgmt_cmd_status(sk, hdev->id,
3476                                        MGMT_OP_SET_PHY_CONFIGURATION,
3477                                        MGMT_STATUS_INVALID_PARAMS);
3478
3479         unconfigure_phys = supported_phys & ~configurable_phys;
3480
3481         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         if (selected_phys == get_selected_phys(hdev))
3487                 return mgmt_cmd_complete(sk, hdev->id,
3488                                          MGMT_OP_SET_PHY_CONFIGURATION,
3489                                          0, NULL, 0);
3490
3491         hci_dev_lock(hdev);
3492
3493         if (!hdev_is_powered(hdev)) {
3494                 err = mgmt_cmd_status(sk, hdev->id,
3495                                       MGMT_OP_SET_PHY_CONFIGURATION,
3496                                       MGMT_STATUS_REJECTED);
3497                 goto unlock;
3498         }
3499
3500         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_BUSY);
3504                 goto unlock;
3505         }
3506
3507         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3508                 pkt_type |= (HCI_DH3 | HCI_DM3);
3509         else
3510                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3511
3512         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3513                 pkt_type |= (HCI_DH5 | HCI_DM5);
3514         else
3515                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3516
3517         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3518                 pkt_type &= ~HCI_2DH1;
3519         else
3520                 pkt_type |= HCI_2DH1;
3521
3522         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3523                 pkt_type &= ~HCI_2DH3;
3524         else
3525                 pkt_type |= HCI_2DH3;
3526
3527         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3528                 pkt_type &= ~HCI_2DH5;
3529         else
3530                 pkt_type |= HCI_2DH5;
3531
3532         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3533                 pkt_type &= ~HCI_3DH1;
3534         else
3535                 pkt_type |= HCI_3DH1;
3536
3537         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3538                 pkt_type &= ~HCI_3DH3;
3539         else
3540                 pkt_type |= HCI_3DH3;
3541
3542         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3543                 pkt_type &= ~HCI_3DH5;
3544         else
3545                 pkt_type |= HCI_3DH5;
3546
3547         if (pkt_type != hdev->pkt_type) {
3548                 hdev->pkt_type = pkt_type;
3549                 changed = true;
3550         }
3551
3552         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3553             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3554                 if (changed)
3555                         mgmt_phy_configuration_changed(hdev, sk);
3556
3557                 err = mgmt_cmd_complete(sk, hdev->id,
3558                                         MGMT_OP_SET_PHY_CONFIGURATION,
3559                                         0, NULL, 0);
3560
3561                 goto unlock;
3562         }
3563
3564         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3565                                len);
3566         if (!cmd) {
3567                 err = -ENOMEM;
3568                 goto unlock;
3569         }
3570
3571         hci_req_init(&req, hdev);
3572
3573         memset(&cp_phy, 0, sizeof(cp_phy));
3574
3575         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3576                 cp_phy.all_phys |= 0x01;
3577
3578         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3579                 cp_phy.all_phys |= 0x02;
3580
3581         if (selected_phys & MGMT_PHY_LE_1M_TX)
3582                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3583
3584         if (selected_phys & MGMT_PHY_LE_2M_TX)
3585                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3586
3587         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3589
3590         if (selected_phys & MGMT_PHY_LE_1M_RX)
3591                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3592
3593         if (selected_phys & MGMT_PHY_LE_2M_RX)
3594                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3595
3596         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3598
3599         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3600
3601         err = hci_req_run_skb(&req, set_default_phy_complete);
3602         if (err < 0)
3603                 mgmt_pending_remove(cmd);
3604
3605 unlock:
3606         hci_dev_unlock(hdev);
3607
3608         return err;
3609 }
3610
3611 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3612                             u16 len)
3613 {
3614         int err = MGMT_STATUS_SUCCESS;
3615         struct mgmt_cp_set_blocked_keys *keys = data;
3616         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3617                                    sizeof(struct mgmt_blocked_key_info));
3618         u16 key_count, expected_len;
3619         int i;
3620
3621         bt_dev_dbg(hdev, "sock %p", sk);
3622
3623         key_count = __le16_to_cpu(keys->key_count);
3624         if (key_count > max_key_count) {
3625                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3627                                        MGMT_STATUS_INVALID_PARAMS);
3628         }
3629
3630         expected_len = struct_size(keys, keys, key_count);
3631         if (expected_len != len) {
3632                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3633                            expected_len, len);
3634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3635                                        MGMT_STATUS_INVALID_PARAMS);
3636         }
3637
3638         hci_dev_lock(hdev);
3639
3640         hci_blocked_keys_clear(hdev);
3641
3642         for (i = 0; i < keys->key_count; ++i) {
3643                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3644
3645                 if (!b) {
3646                         err = MGMT_STATUS_NO_RESOURCES;
3647                         break;
3648                 }
3649
3650                 b->type = keys->keys[i].type;
3651                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3652                 list_add_rcu(&b->list, &hdev->blocked_keys);
3653         }
3654         hci_dev_unlock(hdev);
3655
3656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3657                                 err, NULL, 0);
3658 }
3659
3660 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3661                                void *data, u16 len)
3662 {
3663         struct mgmt_mode *cp = data;
3664         int err;
3665         bool changed = false;
3666
3667         bt_dev_dbg(hdev, "sock %p", sk);
3668
3669         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3670                 return mgmt_cmd_status(sk, hdev->id,
3671                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3672                                        MGMT_STATUS_NOT_SUPPORTED);
3673
3674         if (cp->val != 0x00 && cp->val != 0x01)
3675                 return mgmt_cmd_status(sk, hdev->id,
3676                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3677                                        MGMT_STATUS_INVALID_PARAMS);
3678
3679         hci_dev_lock(hdev);
3680
3681         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3682                 err = mgmt_cmd_status(sk, hdev->id,
3683                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                       MGMT_STATUS_BUSY);
3685                 goto unlock;
3686         }
3687
3688         if (hdev_is_powered(hdev) &&
3689             !!cp->val != hci_dev_test_flag(hdev,
3690                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3691                 err = mgmt_cmd_status(sk, hdev->id,
3692                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3693                                       MGMT_STATUS_REJECTED);
3694                 goto unlock;
3695         }
3696
3697         if (cp->val)
3698                 changed = !hci_dev_test_and_set_flag(hdev,
3699                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3700         else
3701                 changed = hci_dev_test_and_clear_flag(hdev,
3702                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3703
3704         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3705         if (err < 0)
3706                 goto unlock;
3707
3708         if (changed)
3709                 err = new_settings(hdev, sk);
3710
3711 unlock:
3712         hci_dev_unlock(hdev);
3713         return err;
3714 }
3715
3716 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3717                                void *data, u16 data_len)
3718 {
3719         char buf[20];
3720         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3721         u16 cap_len = 0;
3722         u8 flags = 0;
3723         u8 tx_power_range[2];
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         memset(&buf, 0, sizeof(buf));
3728
3729         hci_dev_lock(hdev);
3730
3731         /* When the Read Simple Pairing Options command is supported, then
3732          * the remote public key validation is supported.
3733          *
3734          * Alternatively, when Microsoft extensions are available, they can
3735          * indicate support for public key validation as well.
3736          */
3737         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3738                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3739
3740         flags |= 0x02;          /* Remote public key validation (LE) */
3741
3742         /* When the Read Encryption Key Size command is supported, then the
3743          * encryption key size is enforced.
3744          */
3745         if (hdev->commands[20] & 0x10)
3746                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3747
3748         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3749
3750         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3751                                   &flags, 1);
3752
3753         /* When the Read Simple Pairing Options command is supported, then
3754          * also max encryption key size information is provided.
3755          */
3756         if (hdev->commands[41] & 0x08)
3757                 cap_len = eir_append_le16(rp->cap, cap_len,
3758                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3759                                           hdev->max_enc_key_size);
3760
3761         cap_len = eir_append_le16(rp->cap, cap_len,
3762                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3763                                   SMP_MAX_ENC_KEY_SIZE);
3764
3765         /* Append the min/max LE tx power parameters if we were able to fetch
3766          * it from the controller
3767          */
3768         if (hdev->commands[38] & 0x80) {
3769                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3770                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3771                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3772                                           tx_power_range, 2);
3773         }
3774
3775         rp->cap_len = cpu_to_le16(cap_len);
3776
3777         hci_dev_unlock(hdev);
3778
3779         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3780                                  rp, sizeof(*rp) + cap_len);
3781 }
3782
3783 #ifdef CONFIG_BT_FEATURE_DEBUG
3784 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3785 static const u8 debug_uuid[16] = {
3786         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3787         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3788 };
3789 #endif
3790
3791 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3792 static const u8 simult_central_periph_uuid[16] = {
3793         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3794         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3795 };
3796
3797 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3798 static const u8 rpa_resolution_uuid[16] = {
3799         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3800         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3801 };
3802
3803 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3804                                   void *data, u16 data_len)
3805 {
3806         char buf[62];   /* Enough space for 3 features */
3807         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3808         u16 idx = 0;
3809         u32 flags;
3810
3811         bt_dev_dbg(hdev, "sock %p", sk);
3812
3813         memset(&buf, 0, sizeof(buf));
3814
3815 #ifdef CONFIG_BT_FEATURE_DEBUG
3816         if (!hdev) {
3817                 flags = bt_dbg_get() ? BIT(0) : 0;
3818
3819                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3820                 rp->features[idx].flags = cpu_to_le32(flags);
3821                 idx++;
3822         }
3823 #endif
3824
3825         if (hdev) {
3826                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3827                     (hdev->le_states[4] & 0x08) &&      /* Central */
3828                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3829                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3830                         flags = BIT(0);
3831                 else
3832                         flags = 0;
3833
3834                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3835                 rp->features[idx].flags = cpu_to_le32(flags);
3836                 idx++;
3837         }
3838
3839         if (hdev && use_ll_privacy(hdev)) {
3840                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3841                         flags = BIT(0) | BIT(1);
3842                 else
3843                         flags = BIT(1);
3844
3845                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3846                 rp->features[idx].flags = cpu_to_le32(flags);
3847                 idx++;
3848         }
3849
3850         rp->feature_count = cpu_to_le16(idx);
3851
3852         /* After reading the experimental features information, enable
3853          * the events to update client on any future change.
3854          */
3855         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3856
3857         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3858                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3859                                  0, rp, sizeof(*rp) + (20 * idx));
3860 }
3861
3862 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3863                                           struct sock *skip)
3864 {
3865         struct mgmt_ev_exp_feature_changed ev;
3866
3867         memset(&ev, 0, sizeof(ev));
3868         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3869         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3870
3871         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3872                                   &ev, sizeof(ev),
3873                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3874
3875 }
3876
3877 #ifdef CONFIG_BT_FEATURE_DEBUG
3878 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3879 {
3880         struct mgmt_ev_exp_feature_changed ev;
3881
3882         memset(&ev, 0, sizeof(ev));
3883         memcpy(ev.uuid, debug_uuid, 16);
3884         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3885
3886         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3887                                   &ev, sizeof(ev),
3888                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3889 }
3890 #endif
3891
3892 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3893                            void *data, u16 data_len)
3894 {
3895         struct mgmt_cp_set_exp_feature *cp = data;
3896         struct mgmt_rp_set_exp_feature rp;
3897
3898         bt_dev_dbg(hdev, "sock %p", sk);
3899
3900         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3901                 memset(rp.uuid, 0, 16);
3902                 rp.flags = cpu_to_le32(0);
3903
3904 #ifdef CONFIG_BT_FEATURE_DEBUG
3905                 if (!hdev) {
3906                         bool changed = bt_dbg_get();
3907
3908                         bt_dbg_set(false);
3909
3910                         if (changed)
3911                                 exp_debug_feature_changed(false, sk);
3912                 }
3913 #endif
3914
3915                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3916                         bool changed = hci_dev_test_flag(hdev,
3917                                                          HCI_ENABLE_LL_PRIVACY);
3918
3919                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3920
3921                         if (changed)
3922                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3923                 }
3924
3925                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3926
3927                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3928                                          MGMT_OP_SET_EXP_FEATURE, 0,
3929                                          &rp, sizeof(rp));
3930         }
3931
3932 #ifdef CONFIG_BT_FEATURE_DEBUG
3933         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3934                 bool val, changed;
3935                 int err;
3936
3937                 /* Command requires to use the non-controller index */
3938                 if (hdev)
3939                         return mgmt_cmd_status(sk, hdev->id,
3940                                                MGMT_OP_SET_EXP_FEATURE,
3941                                                MGMT_STATUS_INVALID_INDEX);
3942
3943                 /* Parameters are limited to a single octet */
3944                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3945                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3946                                                MGMT_OP_SET_EXP_FEATURE,
3947                                                MGMT_STATUS_INVALID_PARAMS);
3948
3949                 /* Only boolean on/off is supported */
3950                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3951                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3952                                                MGMT_OP_SET_EXP_FEATURE,
3953                                                MGMT_STATUS_INVALID_PARAMS);
3954
3955                 val = !!cp->param[0];
3956                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3957                 bt_dbg_set(val);
3958
3959                 memcpy(rp.uuid, debug_uuid, 16);
3960                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3961
3962                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3963
3964                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3965                                         MGMT_OP_SET_EXP_FEATURE, 0,
3966                                         &rp, sizeof(rp));
3967
3968                 if (changed)
3969                         exp_debug_feature_changed(val, sk);
3970
3971                 return err;
3972         }
3973 #endif
3974
3975         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3976                 bool val, changed;
3977                 int err;
3978                 u32 flags;
3979
3980                 /* Command requires to use the controller index */
3981                 if (!hdev)
3982                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3983                                                MGMT_OP_SET_EXP_FEATURE,
3984                                                MGMT_STATUS_INVALID_INDEX);
3985
3986                 /* Changes can only be made when controller is powered down */
3987                 if (hdev_is_powered(hdev))
3988                         return mgmt_cmd_status(sk, hdev->id,
3989                                                MGMT_OP_SET_EXP_FEATURE,
3990                                                MGMT_STATUS_REJECTED);
3991
3992                 /* Parameters are limited to a single octet */
3993                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3994                         return mgmt_cmd_status(sk, hdev->id,
3995                                                MGMT_OP_SET_EXP_FEATURE,
3996                                                MGMT_STATUS_INVALID_PARAMS);
3997
3998                 /* Only boolean on/off is supported */
3999                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4000                         return mgmt_cmd_status(sk, hdev->id,
4001                                                MGMT_OP_SET_EXP_FEATURE,
4002                                                MGMT_STATUS_INVALID_PARAMS);
4003
4004                 val = !!cp->param[0];
4005
4006                 if (val) {
4007                         changed = !hci_dev_test_flag(hdev,
4008                                                      HCI_ENABLE_LL_PRIVACY);
4009                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4010                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4011
4012                         /* Enable LL privacy + supported settings changed */
4013                         flags = BIT(0) | BIT(1);
4014                 } else {
4015                         changed = hci_dev_test_flag(hdev,
4016                                                     HCI_ENABLE_LL_PRIVACY);
4017                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4018
4019                         /* Disable LL privacy + supported settings changed */
4020                         flags = BIT(1);
4021                 }
4022
4023                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4024                 rp.flags = cpu_to_le32(flags);
4025
4026                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4027
4028                 err = mgmt_cmd_complete(sk, hdev->id,
4029                                         MGMT_OP_SET_EXP_FEATURE, 0,
4030                                         &rp, sizeof(rp));
4031
4032                 if (changed)
4033                         exp_ll_privacy_feature_changed(val, hdev, sk);
4034
4035                 return err;
4036         }
4037
4038         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4039                                MGMT_OP_SET_EXP_FEATURE,
4040                                MGMT_STATUS_NOT_SUPPORTED);
4041 }
4042
4043 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4044
4045 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4046                             u16 data_len)
4047 {
4048         struct mgmt_cp_get_device_flags *cp = data;
4049         struct mgmt_rp_get_device_flags rp;
4050         struct bdaddr_list_with_flags *br_params;
4051         struct hci_conn_params *params;
4052         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4053         u32 current_flags = 0;
4054         u8 status = MGMT_STATUS_INVALID_PARAMS;
4055
4056         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4057                    &cp->addr.bdaddr, cp->addr.type);
4058
4059         hci_dev_lock(hdev);
4060
4061         if (cp->addr.type == BDADDR_BREDR) {
4062                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4063                                                               &cp->addr.bdaddr,
4064                                                               cp->addr.type);
4065                 if (!br_params)
4066                         goto done;
4067
4068                 current_flags = br_params->current_flags;
4069         } else {
4070                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4071                                                 le_addr_type(cp->addr.type));
4072
4073                 if (!params)
4074                         goto done;
4075
4076                 current_flags = params->current_flags;
4077         }
4078
4079         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4080         rp.addr.type = cp->addr.type;
4081         rp.supported_flags = cpu_to_le32(supported_flags);
4082         rp.current_flags = cpu_to_le32(current_flags);
4083
4084         status = MGMT_STATUS_SUCCESS;
4085
4086 done:
4087         hci_dev_unlock(hdev);
4088
4089         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4090                                 &rp, sizeof(rp));
4091 }
4092
4093 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4094                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4095                                  u32 supported_flags, u32 current_flags)
4096 {
4097         struct mgmt_ev_device_flags_changed ev;
4098
4099         bacpy(&ev.addr.bdaddr, bdaddr);
4100         ev.addr.type = bdaddr_type;
4101         ev.supported_flags = cpu_to_le32(supported_flags);
4102         ev.current_flags = cpu_to_le32(current_flags);
4103
4104         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4105 }
4106
4107 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4108                             u16 len)
4109 {
4110         struct mgmt_cp_set_device_flags *cp = data;
4111         struct bdaddr_list_with_flags *br_params;
4112         struct hci_conn_params *params;
4113         u8 status = MGMT_STATUS_INVALID_PARAMS;
4114         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4115         u32 current_flags = __le32_to_cpu(cp->current_flags);
4116
4117         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4118                    &cp->addr.bdaddr, cp->addr.type,
4119                    __le32_to_cpu(current_flags));
4120
4121         if ((supported_flags | current_flags) != supported_flags) {
4122                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4123                             current_flags, supported_flags);
4124                 goto done;
4125         }
4126
4127         hci_dev_lock(hdev);
4128
4129         if (cp->addr.type == BDADDR_BREDR) {
4130                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4131                                                               &cp->addr.bdaddr,
4132                                                               cp->addr.type);
4133
4134                 if (br_params) {
4135                         br_params->current_flags = current_flags;
4136                         status = MGMT_STATUS_SUCCESS;
4137                 } else {
4138                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4139                                     &cp->addr.bdaddr, cp->addr.type);
4140                 }
4141         } else {
4142                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4143                                                 le_addr_type(cp->addr.type));
4144                 if (params) {
4145                         params->current_flags = current_flags;
4146                         status = MGMT_STATUS_SUCCESS;
4147                 } else {
4148                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4149                                     &cp->addr.bdaddr,
4150                                     le_addr_type(cp->addr.type));
4151                 }
4152         }
4153
4154 done:
4155         hci_dev_unlock(hdev);
4156
4157         if (status == MGMT_STATUS_SUCCESS)
4158                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4159                                      supported_flags, current_flags);
4160
4161         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4162                                  &cp->addr, sizeof(cp->addr));
4163 }
4164
4165 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4166                                    u16 handle)
4167 {
4168         struct mgmt_ev_adv_monitor_added ev;
4169
4170         ev.monitor_handle = cpu_to_le16(handle);
4171
4172         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4173 }
4174
4175 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4176 {
4177         struct mgmt_ev_adv_monitor_removed ev;
4178         struct mgmt_pending_cmd *cmd;
4179         struct sock *sk_skip = NULL;
4180         struct mgmt_cp_remove_adv_monitor *cp;
4181
4182         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4183         if (cmd) {
4184                 cp = cmd->param;
4185
4186                 if (cp->monitor_handle)
4187                         sk_skip = cmd->sk;
4188         }
4189
4190         ev.monitor_handle = cpu_to_le16(handle);
4191
4192         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4193 }
4194
4195 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4196                                  void *data, u16 len)
4197 {
4198         struct adv_monitor *monitor = NULL;
4199         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4200         int handle, err;
4201         size_t rp_size = 0;
4202         __u32 supported = 0;
4203         __u32 enabled = 0;
4204         __u16 num_handles = 0;
4205         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4206
4207         BT_DBG("request for %s", hdev->name);
4208
4209         hci_dev_lock(hdev);
4210
4211         if (msft_monitor_supported(hdev))
4212                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4213
4214         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4215                 handles[num_handles++] = monitor->handle;
4216
4217         hci_dev_unlock(hdev);
4218
4219         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4220         rp = kmalloc(rp_size, GFP_KERNEL);
4221         if (!rp)
4222                 return -ENOMEM;
4223
4224         /* All supported features are currently enabled */
4225         enabled = supported;
4226
4227         rp->supported_features = cpu_to_le32(supported);
4228         rp->enabled_features = cpu_to_le32(enabled);
4229         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4230         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4231         rp->num_handles = cpu_to_le16(num_handles);
4232         if (num_handles)
4233                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4234
4235         err = mgmt_cmd_complete(sk, hdev->id,
4236                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4237                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4238
4239         kfree(rp);
4240
4241         return err;
4242 }
4243
4244 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4245 {
4246         struct mgmt_rp_add_adv_patterns_monitor rp;
4247         struct mgmt_pending_cmd *cmd;
4248         struct adv_monitor *monitor;
4249         int err = 0;
4250
4251         hci_dev_lock(hdev);
4252
4253         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4254         if (!cmd) {
4255                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4256                 if (!cmd)
4257                         goto done;
4258         }
4259
4260         monitor = cmd->user_data;
4261         rp.monitor_handle = cpu_to_le16(monitor->handle);
4262
4263         if (!status) {
4264                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4265                 hdev->adv_monitors_cnt++;
4266                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4267                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4268                 hci_update_background_scan(hdev);
4269         }
4270
4271         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4272                                 mgmt_status(status), &rp, sizeof(rp));
4273         mgmt_pending_remove(cmd);
4274
4275 done:
4276         hci_dev_unlock(hdev);
4277         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
4278                    rp.monitor_handle, status);
4279
4280         return err;
4281 }
4282
4283 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4284                                       struct adv_monitor *m, u8 status,
4285                                       void *data, u16 len, u16 op)
4286 {
4287         struct mgmt_rp_add_adv_patterns_monitor rp;
4288         struct mgmt_pending_cmd *cmd;
4289         int err;
4290         bool pending;
4291
4292         hci_dev_lock(hdev);
4293
4294         if (status)
4295                 goto unlock;
4296
4297         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4298             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4299             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4300             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4301                 status = MGMT_STATUS_BUSY;
4302                 goto unlock;
4303         }
4304
4305         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4306         if (!cmd) {
4307                 status = MGMT_STATUS_NO_RESOURCES;
4308                 goto unlock;
4309         }
4310
4311         cmd->user_data = m;
4312         pending = hci_add_adv_monitor(hdev, m, &err);
4313         if (err) {
4314                 if (err == -ENOSPC || err == -ENOMEM)
4315                         status = MGMT_STATUS_NO_RESOURCES;
4316                 else if (err == -EINVAL)
4317                         status = MGMT_STATUS_INVALID_PARAMS;
4318                 else
4319                         status = MGMT_STATUS_FAILED;
4320
4321                 mgmt_pending_remove(cmd);
4322                 goto unlock;
4323         }
4324
4325         if (!pending) {
4326                 mgmt_pending_remove(cmd);
4327                 rp.monitor_handle = cpu_to_le16(m->handle);
4328                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4329                 m->state = ADV_MONITOR_STATE_REGISTERED;
4330                 hdev->adv_monitors_cnt++;
4331
4332                 hci_dev_unlock(hdev);
4333                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4334                                          &rp, sizeof(rp));
4335         }
4336
4337         hci_dev_unlock(hdev);
4338
4339         return 0;
4340
4341 unlock:
4342         hci_free_adv_monitor(hdev, m);
4343         hci_dev_unlock(hdev);
4344         return mgmt_cmd_status(sk, hdev->id, op, status);
4345 }
4346
4347 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4348                                    struct mgmt_adv_rssi_thresholds *rssi)
4349 {
4350         if (rssi) {
4351                 m->rssi.low_threshold = rssi->low_threshold;
4352                 m->rssi.low_threshold_timeout =
4353                     __le16_to_cpu(rssi->low_threshold_timeout);
4354                 m->rssi.high_threshold = rssi->high_threshold;
4355                 m->rssi.high_threshold_timeout =
4356                     __le16_to_cpu(rssi->high_threshold_timeout);
4357                 m->rssi.sampling_period = rssi->sampling_period;
4358         } else {
4359                 /* Default values. These numbers are the least constricting
4360                  * parameters for MSFT API to work, so it behaves as if there
4361                  * are no rssi parameter to consider. May need to be changed
4362                  * if other API are to be supported.
4363                  */
4364                 m->rssi.low_threshold = -127;
4365                 m->rssi.low_threshold_timeout = 60;
4366                 m->rssi.high_threshold = -127;
4367                 m->rssi.high_threshold_timeout = 0;
4368                 m->rssi.sampling_period = 0;
4369         }
4370 }
4371
4372 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4373                                     struct mgmt_adv_pattern *patterns)
4374 {
4375         u8 offset = 0, length = 0;
4376         struct adv_pattern *p = NULL;
4377         int i;
4378
4379         for (i = 0; i < pattern_count; i++) {
4380                 offset = patterns[i].offset;
4381                 length = patterns[i].length;
4382                 if (offset >= HCI_MAX_AD_LENGTH ||
4383                     length > HCI_MAX_AD_LENGTH ||
4384                     (offset + length) > HCI_MAX_AD_LENGTH)
4385                         return MGMT_STATUS_INVALID_PARAMS;
4386
4387                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4388                 if (!p)
4389                         return MGMT_STATUS_NO_RESOURCES;
4390
4391                 p->ad_type = patterns[i].ad_type;
4392                 p->offset = patterns[i].offset;
4393                 p->length = patterns[i].length;
4394                 memcpy(p->value, patterns[i].value, p->length);
4395
4396                 INIT_LIST_HEAD(&p->list);
4397                 list_add(&p->list, &m->patterns);
4398         }
4399
4400         return MGMT_STATUS_SUCCESS;
4401 }
4402
4403 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4404                                     void *data, u16 len)
4405 {
4406         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4407         struct adv_monitor *m = NULL;
4408         u8 status = MGMT_STATUS_SUCCESS;
4409         size_t expected_size = sizeof(*cp);
4410
4411         BT_DBG("request for %s", hdev->name);
4412
4413         if (len <= sizeof(*cp)) {
4414                 status = MGMT_STATUS_INVALID_PARAMS;
4415                 goto done;
4416         }
4417
4418         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4419         if (len != expected_size) {
4420                 status = MGMT_STATUS_INVALID_PARAMS;
4421                 goto done;
4422         }
4423
4424         m = kzalloc(sizeof(*m), GFP_KERNEL);
4425         if (!m) {
4426                 status = MGMT_STATUS_NO_RESOURCES;
4427                 goto done;
4428         }
4429
4430         INIT_LIST_HEAD(&m->patterns);
4431
4432         parse_adv_monitor_rssi(m, NULL);
4433         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4434
4435 done:
4436         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4437                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4438 }
4439
4440 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4441                                          void *data, u16 len)
4442 {
4443         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4444         struct adv_monitor *m = NULL;
4445         u8 status = MGMT_STATUS_SUCCESS;
4446         size_t expected_size = sizeof(*cp);
4447
4448         BT_DBG("request for %s", hdev->name);
4449
4450         if (len <= sizeof(*cp)) {
4451                 status = MGMT_STATUS_INVALID_PARAMS;
4452                 goto done;
4453         }
4454
4455         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4456         if (len != expected_size) {
4457                 status = MGMT_STATUS_INVALID_PARAMS;
4458                 goto done;
4459         }
4460
4461         m = kzalloc(sizeof(*m), GFP_KERNEL);
4462         if (!m) {
4463                 status = MGMT_STATUS_NO_RESOURCES;
4464                 goto done;
4465         }
4466
4467         INIT_LIST_HEAD(&m->patterns);
4468
4469         parse_adv_monitor_rssi(m, &cp->rssi);
4470         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4471
4472 done:
4473         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4474                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4475 }
4476
4477 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4478 {
4479         struct mgmt_rp_remove_adv_monitor rp;
4480         struct mgmt_cp_remove_adv_monitor *cp;
4481         struct mgmt_pending_cmd *cmd;
4482         int err = 0;
4483
4484         hci_dev_lock(hdev);
4485
4486         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4487         if (!cmd)
4488                 goto done;
4489
4490         cp = cmd->param;
4491         rp.monitor_handle = cp->monitor_handle;
4492
4493         if (!status)
4494                 hci_update_background_scan(hdev);
4495
4496         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4497                                 mgmt_status(status), &rp, sizeof(rp));
4498         mgmt_pending_remove(cmd);
4499
4500 done:
4501         hci_dev_unlock(hdev);
4502         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
4503                    rp.monitor_handle, status);
4504
4505         return err;
4506 }
4507
4508 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4509                               void *data, u16 len)
4510 {
4511         struct mgmt_cp_remove_adv_monitor *cp = data;
4512         struct mgmt_rp_remove_adv_monitor rp;
4513         struct mgmt_pending_cmd *cmd;
4514         u16 handle = __le16_to_cpu(cp->monitor_handle);
4515         int err, status;
4516         bool pending;
4517
4518         BT_DBG("request for %s", hdev->name);
4519         rp.monitor_handle = cp->monitor_handle;
4520
4521         hci_dev_lock(hdev);
4522
4523         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4524             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4525             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4526             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4527                 status = MGMT_STATUS_BUSY;
4528                 goto unlock;
4529         }
4530
4531         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4532         if (!cmd) {
4533                 status = MGMT_STATUS_NO_RESOURCES;
4534                 goto unlock;
4535         }
4536
4537         if (handle)
4538                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4539         else
4540                 pending = hci_remove_all_adv_monitor(hdev, &err);
4541
4542         if (err) {
4543                 mgmt_pending_remove(cmd);
4544
4545                 if (err == -ENOENT)
4546                         status = MGMT_STATUS_INVALID_INDEX;
4547                 else
4548                         status = MGMT_STATUS_FAILED;
4549
4550                 goto unlock;
4551         }
4552
4553         /* monitor can be removed without forwarding request to controller */
4554         if (!pending) {
4555                 mgmt_pending_remove(cmd);
4556                 hci_dev_unlock(hdev);
4557
4558                 return mgmt_cmd_complete(sk, hdev->id,
4559                                          MGMT_OP_REMOVE_ADV_MONITOR,
4560                                          MGMT_STATUS_SUCCESS,
4561                                          &rp, sizeof(rp));
4562         }
4563
4564         hci_dev_unlock(hdev);
4565         return 0;
4566
4567 unlock:
4568         hci_dev_unlock(hdev);
4569         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4570                                status);
4571 }
4572
4573 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4574                                          u16 opcode, struct sk_buff *skb)
4575 {
4576         struct mgmt_rp_read_local_oob_data mgmt_rp;
4577         size_t rp_size = sizeof(mgmt_rp);
4578         struct mgmt_pending_cmd *cmd;
4579
4580         bt_dev_dbg(hdev, "status %u", status);
4581
4582         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4583         if (!cmd)
4584                 return;
4585
4586         if (status || !skb) {
4587                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4588                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4589                 goto remove;
4590         }
4591
4592         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4593
4594         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4595                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4596
4597                 if (skb->len < sizeof(*rp)) {
4598                         mgmt_cmd_status(cmd->sk, hdev->id,
4599                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4600                                         MGMT_STATUS_FAILED);
4601                         goto remove;
4602                 }
4603
4604                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4605                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4606
4607                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4608         } else {
4609                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4610
4611                 if (skb->len < sizeof(*rp)) {
4612                         mgmt_cmd_status(cmd->sk, hdev->id,
4613                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4614                                         MGMT_STATUS_FAILED);
4615                         goto remove;
4616                 }
4617
4618                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4619                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4620
4621                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4622                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4623         }
4624
4625         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4626                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4627
4628 remove:
4629         mgmt_pending_remove(cmd);
4630 }
4631
4632 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4633                                void *data, u16 data_len)
4634 {
4635         struct mgmt_pending_cmd *cmd;
4636         struct hci_request req;
4637         int err;
4638
4639         bt_dev_dbg(hdev, "sock %p", sk);
4640
4641         hci_dev_lock(hdev);
4642
4643         if (!hdev_is_powered(hdev)) {
4644                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4645                                       MGMT_STATUS_NOT_POWERED);
4646                 goto unlock;
4647         }
4648
4649         if (!lmp_ssp_capable(hdev)) {
4650                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4651                                       MGMT_STATUS_NOT_SUPPORTED);
4652                 goto unlock;
4653         }
4654
4655         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4656                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4657                                       MGMT_STATUS_BUSY);
4658                 goto unlock;
4659         }
4660
4661         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4662         if (!cmd) {
4663                 err = -ENOMEM;
4664                 goto unlock;
4665         }
4666
4667         hci_req_init(&req, hdev);
4668
4669         if (bredr_sc_enabled(hdev))
4670                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4671         else
4672                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4673
4674         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4675         if (err < 0)
4676                 mgmt_pending_remove(cmd);
4677
4678 unlock:
4679         hci_dev_unlock(hdev);
4680         return err;
4681 }
4682
4683 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4684                                void *data, u16 len)
4685 {
4686         struct mgmt_addr_info *addr = data;
4687         int err;
4688
4689         bt_dev_dbg(hdev, "sock %p", sk);
4690
4691         if (!bdaddr_type_is_valid(addr->type))
4692                 return mgmt_cmd_complete(sk, hdev->id,
4693                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4694                                          MGMT_STATUS_INVALID_PARAMS,
4695                                          addr, sizeof(*addr));
4696
4697         hci_dev_lock(hdev);
4698
4699         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4700                 struct mgmt_cp_add_remote_oob_data *cp = data;
4701                 u8 status;
4702
4703                 if (cp->addr.type != BDADDR_BREDR) {
4704                         err = mgmt_cmd_complete(sk, hdev->id,
4705                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4706                                                 MGMT_STATUS_INVALID_PARAMS,
4707                                                 &cp->addr, sizeof(cp->addr));
4708                         goto unlock;
4709                 }
4710
4711                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4712                                               cp->addr.type, cp->hash,
4713                                               cp->rand, NULL, NULL);
4714                 if (err < 0)
4715                         status = MGMT_STATUS_FAILED;
4716                 else
4717                         status = MGMT_STATUS_SUCCESS;
4718
4719                 err = mgmt_cmd_complete(sk, hdev->id,
4720                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4721                                         &cp->addr, sizeof(cp->addr));
4722         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4723                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4724                 u8 *rand192, *hash192, *rand256, *hash256;
4725                 u8 status;
4726
4727                 if (bdaddr_type_is_le(cp->addr.type)) {
4728                         /* Enforce zero-valued 192-bit parameters as
4729                          * long as legacy SMP OOB isn't implemented.
4730                          */
4731                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4732                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4733                                 err = mgmt_cmd_complete(sk, hdev->id,
4734                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4735                                                         MGMT_STATUS_INVALID_PARAMS,
4736                                                         addr, sizeof(*addr));
4737                                 goto unlock;
4738                         }
4739
4740                         rand192 = NULL;
4741                         hash192 = NULL;
4742                 } else {
4743                         /* In case one of the P-192 values is set to zero,
4744                          * then just disable OOB data for P-192.
4745                          */
4746                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4747                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4748                                 rand192 = NULL;
4749                                 hash192 = NULL;
4750                         } else {
4751                                 rand192 = cp->rand192;
4752                                 hash192 = cp->hash192;
4753                         }
4754                 }
4755
4756                 /* In case one of the P-256 values is set to zero, then just
4757                  * disable OOB data for P-256.
4758                  */
4759                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4760                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4761                         rand256 = NULL;
4762                         hash256 = NULL;
4763                 } else {
4764                         rand256 = cp->rand256;
4765                         hash256 = cp->hash256;
4766                 }
4767
4768                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4769                                               cp->addr.type, hash192, rand192,
4770                                               hash256, rand256);
4771                 if (err < 0)
4772                         status = MGMT_STATUS_FAILED;
4773                 else
4774                         status = MGMT_STATUS_SUCCESS;
4775
4776                 err = mgmt_cmd_complete(sk, hdev->id,
4777                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4778                                         status, &cp->addr, sizeof(cp->addr));
4779         } else {
4780                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4781                            len);
4782                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4783                                       MGMT_STATUS_INVALID_PARAMS);
4784         }
4785
4786 unlock:
4787         hci_dev_unlock(hdev);
4788         return err;
4789 }
4790
4791 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4792                                   void *data, u16 len)
4793 {
4794         struct mgmt_cp_remove_remote_oob_data *cp = data;
4795         u8 status;
4796         int err;
4797
4798         bt_dev_dbg(hdev, "sock %p", sk);
4799
4800         if (cp->addr.type != BDADDR_BREDR)
4801                 return mgmt_cmd_complete(sk, hdev->id,
4802                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4803                                          MGMT_STATUS_INVALID_PARAMS,
4804                                          &cp->addr, sizeof(cp->addr));
4805
4806         hci_dev_lock(hdev);
4807
4808         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4809                 hci_remote_oob_data_clear(hdev);
4810                 status = MGMT_STATUS_SUCCESS;
4811                 goto done;
4812         }
4813
4814         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4815         if (err < 0)
4816                 status = MGMT_STATUS_INVALID_PARAMS;
4817         else
4818                 status = MGMT_STATUS_SUCCESS;
4819
4820 done:
4821         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4822                                 status, &cp->addr, sizeof(cp->addr));
4823
4824         hci_dev_unlock(hdev);
4825         return err;
4826 }
4827
4828 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4829 {
4830         struct mgmt_pending_cmd *cmd;
4831
4832         bt_dev_dbg(hdev, "status %d", status);
4833
4834         hci_dev_lock(hdev);
4835
4836         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4837         if (!cmd)
4838                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4839
4840         if (!cmd)
4841                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4842
4843         if (cmd) {
4844                 cmd->cmd_complete(cmd, mgmt_status(status));
4845                 mgmt_pending_remove(cmd);
4846         }
4847
4848         hci_dev_unlock(hdev);
4849
4850         /* Handle suspend notifier */
4851         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4852                                hdev->suspend_tasks)) {
4853                 bt_dev_dbg(hdev, "Unpaused discovery");
4854                 wake_up(&hdev->suspend_wait_q);
4855         }
4856 }
4857
4858 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4859                                     uint8_t *mgmt_status)
4860 {
4861         switch (type) {
4862         case DISCOV_TYPE_LE:
4863                 *mgmt_status = mgmt_le_support(hdev);
4864                 if (*mgmt_status)
4865                         return false;
4866                 break;
4867         case DISCOV_TYPE_INTERLEAVED:
4868                 *mgmt_status = mgmt_le_support(hdev);
4869                 if (*mgmt_status)
4870                         return false;
4871                 fallthrough;
4872         case DISCOV_TYPE_BREDR:
4873                 *mgmt_status = mgmt_bredr_support(hdev);
4874                 if (*mgmt_status)
4875                         return false;
4876                 break;
4877         default:
4878                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4879                 return false;
4880         }
4881
4882         return true;
4883 }
4884
4885 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4886                                     u16 op, void *data, u16 len)
4887 {
4888         struct mgmt_cp_start_discovery *cp = data;
4889         struct mgmt_pending_cmd *cmd;
4890         u8 status;
4891         int err;
4892
4893         bt_dev_dbg(hdev, "sock %p", sk);
4894
4895         hci_dev_lock(hdev);
4896
4897         if (!hdev_is_powered(hdev)) {
4898                 err = mgmt_cmd_complete(sk, hdev->id, op,
4899                                         MGMT_STATUS_NOT_POWERED,
4900                                         &cp->type, sizeof(cp->type));
4901                 goto failed;
4902         }
4903
4904         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4905             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4906                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4907                                         &cp->type, sizeof(cp->type));
4908                 goto failed;
4909         }
4910
4911         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4912                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4913                                         &cp->type, sizeof(cp->type));
4914                 goto failed;
4915         }
4916
4917         /* Can't start discovery when it is paused */
4918         if (hdev->discovery_paused) {
4919                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4920                                         &cp->type, sizeof(cp->type));
4921                 goto failed;
4922         }
4923
4924         /* Clear the discovery filter first to free any previously
4925          * allocated memory for the UUID list.
4926          */
4927         hci_discovery_filter_clear(hdev);
4928
4929         hdev->discovery.type = cp->type;
4930         hdev->discovery.report_invalid_rssi = false;
4931         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4932                 hdev->discovery.limited = true;
4933         else
4934                 hdev->discovery.limited = false;
4935
4936         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4937         if (!cmd) {
4938                 err = -ENOMEM;
4939                 goto failed;
4940         }
4941
4942         cmd->cmd_complete = generic_cmd_complete;
4943
4944         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4945         queue_work(hdev->req_workqueue, &hdev->discov_update);
4946         err = 0;
4947
4948 failed:
4949         hci_dev_unlock(hdev);
4950         return err;
4951 }
4952
4953 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4954                            void *data, u16 len)
4955 {
4956         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4957                                         data, len);
4958 }
4959
4960 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4961                                    void *data, u16 len)
4962 {
4963         return start_discovery_internal(sk, hdev,
4964                                         MGMT_OP_START_LIMITED_DISCOVERY,
4965                                         data, len);
4966 }
4967
4968 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4969                                           u8 status)
4970 {
4971         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4972                                  cmd->param, 1);
4973 }
4974
4975 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4976                                    void *data, u16 len)
4977 {
4978         struct mgmt_cp_start_service_discovery *cp = data;
4979         struct mgmt_pending_cmd *cmd;
4980         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4981         u16 uuid_count, expected_len;
4982         u8 status;
4983         int err;
4984
4985         bt_dev_dbg(hdev, "sock %p", sk);
4986
4987         hci_dev_lock(hdev);
4988
4989         if (!hdev_is_powered(hdev)) {
4990                 err = mgmt_cmd_complete(sk, hdev->id,
4991                                         MGMT_OP_START_SERVICE_DISCOVERY,
4992                                         MGMT_STATUS_NOT_POWERED,
4993                                         &cp->type, sizeof(cp->type));
4994                 goto failed;
4995         }
4996
4997         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4998             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4999                 err = mgmt_cmd_complete(sk, hdev->id,
5000                                         MGMT_OP_START_SERVICE_DISCOVERY,
5001                                         MGMT_STATUS_BUSY, &cp->type,
5002                                         sizeof(cp->type));
5003                 goto failed;
5004         }
5005
5006         if (hdev->discovery_paused) {
5007                 err = mgmt_cmd_complete(sk, hdev->id,
5008                                         MGMT_OP_START_SERVICE_DISCOVERY,
5009                                         MGMT_STATUS_BUSY, &cp->type,
5010                                         sizeof(cp->type));
5011                 goto failed;
5012         }
5013
5014         uuid_count = __le16_to_cpu(cp->uuid_count);
5015         if (uuid_count > max_uuid_count) {
5016                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5017                            uuid_count);
5018                 err = mgmt_cmd_complete(sk, hdev->id,
5019                                         MGMT_OP_START_SERVICE_DISCOVERY,
5020                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5021                                         sizeof(cp->type));
5022                 goto failed;
5023         }
5024
5025         expected_len = sizeof(*cp) + uuid_count * 16;
5026         if (expected_len != len) {
5027                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5028                            expected_len, len);
5029                 err = mgmt_cmd_complete(sk, hdev->id,
5030                                         MGMT_OP_START_SERVICE_DISCOVERY,
5031                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5032                                         sizeof(cp->type));
5033                 goto failed;
5034         }
5035
5036         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5037                 err = mgmt_cmd_complete(sk, hdev->id,
5038                                         MGMT_OP_START_SERVICE_DISCOVERY,
5039                                         status, &cp->type, sizeof(cp->type));
5040                 goto failed;
5041         }
5042
5043         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5044                                hdev, data, len);
5045         if (!cmd) {
5046                 err = -ENOMEM;
5047                 goto failed;
5048         }
5049
5050         cmd->cmd_complete = service_discovery_cmd_complete;
5051
5052         /* Clear the discovery filter first to free any previously
5053          * allocated memory for the UUID list.
5054          */
5055         hci_discovery_filter_clear(hdev);
5056
5057         hdev->discovery.result_filtering = true;
5058         hdev->discovery.type = cp->type;
5059         hdev->discovery.rssi = cp->rssi;
5060         hdev->discovery.uuid_count = uuid_count;
5061
5062         if (uuid_count > 0) {
5063                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5064                                                 GFP_KERNEL);
5065                 if (!hdev->discovery.uuids) {
5066                         err = mgmt_cmd_complete(sk, hdev->id,
5067                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5068                                                 MGMT_STATUS_FAILED,
5069                                                 &cp->type, sizeof(cp->type));
5070                         mgmt_pending_remove(cmd);
5071                         goto failed;
5072                 }
5073         }
5074
5075         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5076         queue_work(hdev->req_workqueue, &hdev->discov_update);
5077         err = 0;
5078
5079 failed:
5080         hci_dev_unlock(hdev);
5081         return err;
5082 }
5083
5084 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5085 {
5086         struct mgmt_pending_cmd *cmd;
5087
5088         bt_dev_dbg(hdev, "status %d", status);
5089
5090         hci_dev_lock(hdev);
5091
5092         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5093         if (cmd) {
5094                 cmd->cmd_complete(cmd, mgmt_status(status));
5095                 mgmt_pending_remove(cmd);
5096         }
5097
5098         hci_dev_unlock(hdev);
5099
5100         /* Handle suspend notifier */
5101         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5102                 bt_dev_dbg(hdev, "Paused discovery");
5103                 wake_up(&hdev->suspend_wait_q);
5104         }
5105 }
5106
5107 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5108                           u16 len)
5109 {
5110         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5111         struct mgmt_pending_cmd *cmd;
5112         int err;
5113
5114         bt_dev_dbg(hdev, "sock %p", sk);
5115
5116         hci_dev_lock(hdev);
5117
5118         if (!hci_discovery_active(hdev)) {
5119                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5120                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5121                                         sizeof(mgmt_cp->type));
5122                 goto unlock;
5123         }
5124
5125         if (hdev->discovery.type != mgmt_cp->type) {
5126                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5127                                         MGMT_STATUS_INVALID_PARAMS,
5128                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5129                 goto unlock;
5130         }
5131
5132         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5133         if (!cmd) {
5134                 err = -ENOMEM;
5135                 goto unlock;
5136         }
5137
5138         cmd->cmd_complete = generic_cmd_complete;
5139
5140         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5141         queue_work(hdev->req_workqueue, &hdev->discov_update);
5142         err = 0;
5143
5144 unlock:
5145         hci_dev_unlock(hdev);
5146         return err;
5147 }
5148
5149 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5150                         u16 len)
5151 {
5152         struct mgmt_cp_confirm_name *cp = data;
5153         struct inquiry_entry *e;
5154         int err;
5155
5156         bt_dev_dbg(hdev, "sock %p", sk);
5157
5158         hci_dev_lock(hdev);
5159
5160         if (!hci_discovery_active(hdev)) {
5161                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5162                                         MGMT_STATUS_FAILED, &cp->addr,
5163                                         sizeof(cp->addr));
5164                 goto failed;
5165         }
5166
5167         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5168         if (!e) {
5169                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5170                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5171                                         sizeof(cp->addr));
5172                 goto failed;
5173         }
5174
5175         if (cp->name_known) {
5176                 e->name_state = NAME_KNOWN;
5177                 list_del(&e->list);
5178         } else {
5179                 e->name_state = NAME_NEEDED;
5180                 hci_inquiry_cache_update_resolve(hdev, e);
5181         }
5182
5183         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5184                                 &cp->addr, sizeof(cp->addr));
5185
5186 failed:
5187         hci_dev_unlock(hdev);
5188         return err;
5189 }
5190
5191 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5192                         u16 len)
5193 {
5194         struct mgmt_cp_block_device *cp = data;
5195         u8 status;
5196         int err;
5197
5198         bt_dev_dbg(hdev, "sock %p", sk);
5199
5200         if (!bdaddr_type_is_valid(cp->addr.type))
5201                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5202                                          MGMT_STATUS_INVALID_PARAMS,
5203                                          &cp->addr, sizeof(cp->addr));
5204
5205         hci_dev_lock(hdev);
5206
5207         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
5208                                   cp->addr.type);
5209         if (err < 0) {
5210                 status = MGMT_STATUS_FAILED;
5211                 goto done;
5212         }
5213
5214         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5215                    sk);
5216         status = MGMT_STATUS_SUCCESS;
5217
5218 done:
5219         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5220                                 &cp->addr, sizeof(cp->addr));
5221
5222         hci_dev_unlock(hdev);
5223
5224         return err;
5225 }
5226
5227 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5228                           u16 len)
5229 {
5230         struct mgmt_cp_unblock_device *cp = data;
5231         u8 status;
5232         int err;
5233
5234         bt_dev_dbg(hdev, "sock %p", sk);
5235
5236         if (!bdaddr_type_is_valid(cp->addr.type))
5237                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5238                                          MGMT_STATUS_INVALID_PARAMS,
5239                                          &cp->addr, sizeof(cp->addr));
5240
5241         hci_dev_lock(hdev);
5242
5243         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5244                                   cp->addr.type);
5245         if (err < 0) {
5246                 status = MGMT_STATUS_INVALID_PARAMS;
5247                 goto done;
5248         }
5249
5250         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5251                    sk);
5252         status = MGMT_STATUS_SUCCESS;
5253
5254 done:
5255         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5256                                 &cp->addr, sizeof(cp->addr));
5257
5258         hci_dev_unlock(hdev);
5259
5260         return err;
5261 }
5262
5263 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5264                          u16 len)
5265 {
5266         struct mgmt_cp_set_device_id *cp = data;
5267         struct hci_request req;
5268         int err;
5269         __u16 source;
5270
5271         bt_dev_dbg(hdev, "sock %p", sk);
5272
5273         source = __le16_to_cpu(cp->source);
5274
5275         if (source > 0x0002)
5276                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5277                                        MGMT_STATUS_INVALID_PARAMS);
5278
5279         hci_dev_lock(hdev);
5280
5281         hdev->devid_source = source;
5282         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5283         hdev->devid_product = __le16_to_cpu(cp->product);
5284         hdev->devid_version = __le16_to_cpu(cp->version);
5285
5286         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5287                                 NULL, 0);
5288
5289         hci_req_init(&req, hdev);
5290         __hci_req_update_eir(&req);
5291         hci_req_run(&req, NULL);
5292
5293         hci_dev_unlock(hdev);
5294
5295         return err;
5296 }
5297
5298 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5299                                         u16 opcode)
5300 {
5301         bt_dev_dbg(hdev, "status %d", status);
5302 }
5303
5304 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5305                                      u16 opcode)
5306 {
5307         struct cmd_lookup match = { NULL, hdev };
5308         struct hci_request req;
5309         u8 instance;
5310         struct adv_info *adv_instance;
5311         int err;
5312
5313         hci_dev_lock(hdev);
5314
5315         if (status) {
5316                 u8 mgmt_err = mgmt_status(status);
5317
5318                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5319                                      cmd_status_rsp, &mgmt_err);
5320                 goto unlock;
5321         }
5322
5323         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5324                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5325         else
5326                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5327
5328         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5329                              &match);
5330
5331         new_settings(hdev, match.sk);
5332
5333         if (match.sk)
5334                 sock_put(match.sk);
5335
5336         /* Handle suspend notifier */
5337         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5338                                hdev->suspend_tasks)) {
5339                 bt_dev_dbg(hdev, "Paused advertising");
5340                 wake_up(&hdev->suspend_wait_q);
5341         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5342                                       hdev->suspend_tasks)) {
5343                 bt_dev_dbg(hdev, "Unpaused advertising");
5344                 wake_up(&hdev->suspend_wait_q);
5345         }
5346
5347         /* If "Set Advertising" was just disabled and instance advertising was
5348          * set up earlier, then re-enable multi-instance advertising.
5349          */
5350         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5351             list_empty(&hdev->adv_instances))
5352                 goto unlock;
5353
5354         instance = hdev->cur_adv_instance;
5355         if (!instance) {
5356                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5357                                                         struct adv_info, list);
5358                 if (!adv_instance)
5359                         goto unlock;
5360
5361                 instance = adv_instance->instance;
5362         }
5363
5364         hci_req_init(&req, hdev);
5365
5366         err = __hci_req_schedule_adv_instance(&req, instance, true);
5367
5368         if (!err)
5369                 err = hci_req_run(&req, enable_advertising_instance);
5370
5371         if (err)
5372                 bt_dev_err(hdev, "failed to re-configure advertising");
5373
5374 unlock:
5375         hci_dev_unlock(hdev);
5376 }
5377
5378 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5379                            u16 len)
5380 {
5381         struct mgmt_mode *cp = data;
5382         struct mgmt_pending_cmd *cmd;
5383         struct hci_request req;
5384         u8 val, status;
5385         int err;
5386
5387         bt_dev_dbg(hdev, "sock %p", sk);
5388
5389         status = mgmt_le_support(hdev);
5390         if (status)
5391                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5392                                        status);
5393
5394         /* Enabling the experimental LL Privay support disables support for
5395          * advertising.
5396          */
5397         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5399                                        MGMT_STATUS_NOT_SUPPORTED);
5400
5401         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5403                                        MGMT_STATUS_INVALID_PARAMS);
5404
5405         if (hdev->advertising_paused)
5406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5407                                        MGMT_STATUS_BUSY);
5408
5409         hci_dev_lock(hdev);
5410
5411         val = !!cp->val;
5412
5413         /* The following conditions are ones which mean that we should
5414          * not do any HCI communication but directly send a mgmt
5415          * response to user space (after toggling the flag if
5416          * necessary).
5417          */
5418         if (!hdev_is_powered(hdev) ||
5419             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5420              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5421             hci_conn_num(hdev, LE_LINK) > 0 ||
5422             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5423              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5424                 bool changed;
5425
5426                 if (cp->val) {
5427                         hdev->cur_adv_instance = 0x00;
5428                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5429                         if (cp->val == 0x02)
5430                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5431                         else
5432                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5433                 } else {
5434                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5435                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5436                 }
5437
5438                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5439                 if (err < 0)
5440                         goto unlock;
5441
5442                 if (changed)
5443                         err = new_settings(hdev, sk);
5444
5445                 goto unlock;
5446         }
5447
5448         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5449             pending_find(MGMT_OP_SET_LE, hdev)) {
5450                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5451                                       MGMT_STATUS_BUSY);
5452                 goto unlock;
5453         }
5454
5455         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5456         if (!cmd) {
5457                 err = -ENOMEM;
5458                 goto unlock;
5459         }
5460
5461         hci_req_init(&req, hdev);
5462
5463         if (cp->val == 0x02)
5464                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5465         else
5466                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5467
5468         cancel_adv_timeout(hdev);
5469
5470         if (val) {
5471                 /* Switch to instance "0" for the Set Advertising setting.
5472                  * We cannot use update_[adv|scan_rsp]_data() here as the
5473                  * HCI_ADVERTISING flag is not yet set.
5474                  */
5475                 hdev->cur_adv_instance = 0x00;
5476
5477                 if (ext_adv_capable(hdev)) {
5478                         __hci_req_start_ext_adv(&req, 0x00);
5479                 } else {
5480                         __hci_req_update_adv_data(&req, 0x00);
5481                         __hci_req_update_scan_rsp_data(&req, 0x00);
5482                         __hci_req_enable_advertising(&req);
5483                 }
5484         } else {
5485                 __hci_req_disable_advertising(&req);
5486         }
5487
5488         err = hci_req_run(&req, set_advertising_complete);
5489         if (err < 0)
5490                 mgmt_pending_remove(cmd);
5491
5492 unlock:
5493         hci_dev_unlock(hdev);
5494         return err;
5495 }
5496
5497 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5498                               void *data, u16 len)
5499 {
5500         struct mgmt_cp_set_static_address *cp = data;
5501         int err;
5502
5503         bt_dev_dbg(hdev, "sock %p", sk);
5504
5505         if (!lmp_le_capable(hdev))
5506                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5507                                        MGMT_STATUS_NOT_SUPPORTED);
5508
5509         if (hdev_is_powered(hdev))
5510                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5511                                        MGMT_STATUS_REJECTED);
5512
5513         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5514                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5515                         return mgmt_cmd_status(sk, hdev->id,
5516                                                MGMT_OP_SET_STATIC_ADDRESS,
5517                                                MGMT_STATUS_INVALID_PARAMS);
5518
5519                 /* Two most significant bits shall be set */
5520                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5521                         return mgmt_cmd_status(sk, hdev->id,
5522                                                MGMT_OP_SET_STATIC_ADDRESS,
5523                                                MGMT_STATUS_INVALID_PARAMS);
5524         }
5525
5526         hci_dev_lock(hdev);
5527
5528         bacpy(&hdev->static_addr, &cp->bdaddr);
5529
5530         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5531         if (err < 0)
5532                 goto unlock;
5533
5534         err = new_settings(hdev, sk);
5535
5536 unlock:
5537         hci_dev_unlock(hdev);
5538         return err;
5539 }
5540
5541 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5542                            void *data, u16 len)
5543 {
5544         struct mgmt_cp_set_scan_params *cp = data;
5545         __u16 interval, window;
5546         int err;
5547
5548         bt_dev_dbg(hdev, "sock %p", sk);
5549
5550         if (!lmp_le_capable(hdev))
5551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5552                                        MGMT_STATUS_NOT_SUPPORTED);
5553
5554         interval = __le16_to_cpu(cp->interval);
5555
5556         if (interval < 0x0004 || interval > 0x4000)
5557                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5558                                        MGMT_STATUS_INVALID_PARAMS);
5559
5560         window = __le16_to_cpu(cp->window);
5561
5562         if (window < 0x0004 || window > 0x4000)
5563                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5564                                        MGMT_STATUS_INVALID_PARAMS);
5565
5566         if (window > interval)
5567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5568                                        MGMT_STATUS_INVALID_PARAMS);
5569
5570         hci_dev_lock(hdev);
5571
5572         hdev->le_scan_interval = interval;
5573         hdev->le_scan_window = window;
5574
5575         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5576                                 NULL, 0);
5577
5578         /* If background scan is running, restart it so new parameters are
5579          * loaded.
5580          */
5581         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5582             hdev->discovery.state == DISCOVERY_STOPPED) {
5583                 struct hci_request req;
5584
5585                 hci_req_init(&req, hdev);
5586
5587                 hci_req_add_le_scan_disable(&req, false);
5588                 hci_req_add_le_passive_scan(&req);
5589
5590                 hci_req_run(&req, NULL);
5591         }
5592
5593         hci_dev_unlock(hdev);
5594
5595         return err;
5596 }
5597
5598 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5599                                       u16 opcode)
5600 {
5601         struct mgmt_pending_cmd *cmd;
5602
5603         bt_dev_dbg(hdev, "status 0x%02x", status);
5604
5605         hci_dev_lock(hdev);
5606
5607         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5608         if (!cmd)
5609                 goto unlock;
5610
5611         if (status) {
5612                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5613                                 mgmt_status(status));
5614         } else {
5615                 struct mgmt_mode *cp = cmd->param;
5616
5617                 if (cp->val)
5618                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5619                 else
5620                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5621
5622                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5623                 new_settings(hdev, cmd->sk);
5624         }
5625
5626         mgmt_pending_remove(cmd);
5627
5628 unlock:
5629         hci_dev_unlock(hdev);
5630 }
5631
5632 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5633                                 void *data, u16 len)
5634 {
5635         struct mgmt_mode *cp = data;
5636         struct mgmt_pending_cmd *cmd;
5637         struct hci_request req;
5638         int err;
5639
5640         bt_dev_dbg(hdev, "sock %p", sk);
5641
5642         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5643             hdev->hci_ver < BLUETOOTH_VER_1_2)
5644                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5645                                        MGMT_STATUS_NOT_SUPPORTED);
5646
5647         if (cp->val != 0x00 && cp->val != 0x01)
5648                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5649                                        MGMT_STATUS_INVALID_PARAMS);
5650
5651         hci_dev_lock(hdev);
5652
5653         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5654                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5655                                       MGMT_STATUS_BUSY);
5656                 goto unlock;
5657         }
5658
5659         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5660                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5661                                         hdev);
5662                 goto unlock;
5663         }
5664
5665         if (!hdev_is_powered(hdev)) {
5666                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5667                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5668                                         hdev);
5669                 new_settings(hdev, sk);
5670                 goto unlock;
5671         }
5672
5673         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5674                                data, len);
5675         if (!cmd) {
5676                 err = -ENOMEM;
5677                 goto unlock;
5678         }
5679
5680         hci_req_init(&req, hdev);
5681
5682         __hci_req_write_fast_connectable(&req, cp->val);
5683
5684         err = hci_req_run(&req, fast_connectable_complete);
5685         if (err < 0) {
5686                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5687                                       MGMT_STATUS_FAILED);
5688                 mgmt_pending_remove(cmd);
5689         }
5690
5691 unlock:
5692         hci_dev_unlock(hdev);
5693
5694         return err;
5695 }
5696
5697 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5698 {
5699         struct mgmt_pending_cmd *cmd;
5700
5701         bt_dev_dbg(hdev, "status 0x%02x", status);
5702
5703         hci_dev_lock(hdev);
5704
5705         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5706         if (!cmd)
5707                 goto unlock;
5708
5709         if (status) {
5710                 u8 mgmt_err = mgmt_status(status);
5711
5712                 /* We need to restore the flag if related HCI commands
5713                  * failed.
5714                  */
5715                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5716
5717                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5718         } else {
5719                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5720                 new_settings(hdev, cmd->sk);
5721         }
5722
5723         mgmt_pending_remove(cmd);
5724
5725 unlock:
5726         hci_dev_unlock(hdev);
5727 }
5728
5729 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5730 {
5731         struct mgmt_mode *cp = data;
5732         struct mgmt_pending_cmd *cmd;
5733         struct hci_request req;
5734         int err;
5735
5736         bt_dev_dbg(hdev, "sock %p", sk);
5737
5738         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5740                                        MGMT_STATUS_NOT_SUPPORTED);
5741
5742         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5744                                        MGMT_STATUS_REJECTED);
5745
5746         if (cp->val != 0x00 && cp->val != 0x01)
5747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5748                                        MGMT_STATUS_INVALID_PARAMS);
5749
5750         hci_dev_lock(hdev);
5751
5752         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5753                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5754                 goto unlock;
5755         }
5756
5757         if (!hdev_is_powered(hdev)) {
5758                 if (!cp->val) {
5759                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5760                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5761                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5762                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5763                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5764                 }
5765
5766                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5767
5768                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5769                 if (err < 0)
5770                         goto unlock;
5771
5772                 err = new_settings(hdev, sk);
5773                 goto unlock;
5774         }
5775
5776         /* Reject disabling when powered on */
5777         if (!cp->val) {
5778                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5779                                       MGMT_STATUS_REJECTED);
5780                 goto unlock;
5781         } else {
5782                 /* When configuring a dual-mode controller to operate
5783                  * with LE only and using a static address, then switching
5784                  * BR/EDR back on is not allowed.
5785                  *
5786                  * Dual-mode controllers shall operate with the public
5787                  * address as its identity address for BR/EDR and LE. So
5788                  * reject the attempt to create an invalid configuration.
5789                  *
5790                  * The same restrictions applies when secure connections
5791                  * has been enabled. For BR/EDR this is a controller feature
5792                  * while for LE it is a host stack feature. This means that
5793                  * switching BR/EDR back on when secure connections has been
5794                  * enabled is not a supported transaction.
5795                  */
5796                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5797                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5798                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5799                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5800                                               MGMT_STATUS_REJECTED);
5801                         goto unlock;
5802                 }
5803         }
5804
5805         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5806                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5807                                       MGMT_STATUS_BUSY);
5808                 goto unlock;
5809         }
5810
5811         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5812         if (!cmd) {
5813                 err = -ENOMEM;
5814                 goto unlock;
5815         }
5816
5817         /* We need to flip the bit already here so that
5818          * hci_req_update_adv_data generates the correct flags.
5819          */
5820         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5821
5822         hci_req_init(&req, hdev);
5823
5824         __hci_req_write_fast_connectable(&req, false);
5825         __hci_req_update_scan(&req);
5826
5827         /* Since only the advertising data flags will change, there
5828          * is no need to update the scan response data.
5829          */
5830         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5831
5832         err = hci_req_run(&req, set_bredr_complete);
5833         if (err < 0)
5834                 mgmt_pending_remove(cmd);
5835
5836 unlock:
5837         hci_dev_unlock(hdev);
5838         return err;
5839 }
5840
5841 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5842 {
5843         struct mgmt_pending_cmd *cmd;
5844         struct mgmt_mode *cp;
5845
5846         bt_dev_dbg(hdev, "status %u", status);
5847
5848         hci_dev_lock(hdev);
5849
5850         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5851         if (!cmd)
5852                 goto unlock;
5853
5854         if (status) {
5855                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5856                                 mgmt_status(status));
5857                 goto remove;
5858         }
5859
5860         cp = cmd->param;
5861
5862         switch (cp->val) {
5863         case 0x00:
5864                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5865                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5866                 break;
5867         case 0x01:
5868                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5869                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5870                 break;
5871         case 0x02:
5872                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5873                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5874                 break;
5875         }
5876
5877         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5878         new_settings(hdev, cmd->sk);
5879
5880 remove:
5881         mgmt_pending_remove(cmd);
5882 unlock:
5883         hci_dev_unlock(hdev);
5884 }
5885
5886 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5887                            void *data, u16 len)
5888 {
5889         struct mgmt_mode *cp = data;
5890         struct mgmt_pending_cmd *cmd;
5891         struct hci_request req;
5892         u8 val;
5893         int err;
5894
5895         bt_dev_dbg(hdev, "sock %p", sk);
5896
5897         if (!lmp_sc_capable(hdev) &&
5898             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5900                                        MGMT_STATUS_NOT_SUPPORTED);
5901
5902         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5903             lmp_sc_capable(hdev) &&
5904             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5905                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5906                                        MGMT_STATUS_REJECTED);
5907
5908         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5910                                   MGMT_STATUS_INVALID_PARAMS);
5911
5912         hci_dev_lock(hdev);
5913
5914         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5915             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5916                 bool changed;
5917
5918                 if (cp->val) {
5919                         changed = !hci_dev_test_and_set_flag(hdev,
5920                                                              HCI_SC_ENABLED);
5921                         if (cp->val == 0x02)
5922                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5923                         else
5924                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5925                 } else {
5926                         changed = hci_dev_test_and_clear_flag(hdev,
5927                                                               HCI_SC_ENABLED);
5928                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5929                 }
5930
5931                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5932                 if (err < 0)
5933                         goto failed;
5934
5935                 if (changed)
5936                         err = new_settings(hdev, sk);
5937
5938                 goto failed;
5939         }
5940
5941         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5942                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5943                                       MGMT_STATUS_BUSY);
5944                 goto failed;
5945         }
5946
5947         val = !!cp->val;
5948
5949         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5950             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5951                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5952                 goto failed;
5953         }
5954
5955         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5956         if (!cmd) {
5957                 err = -ENOMEM;
5958                 goto failed;
5959         }
5960
5961         hci_req_init(&req, hdev);
5962         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5963         err = hci_req_run(&req, sc_enable_complete);
5964         if (err < 0) {
5965                 mgmt_pending_remove(cmd);
5966                 goto failed;
5967         }
5968
5969 failed:
5970         hci_dev_unlock(hdev);
5971         return err;
5972 }
5973
5974 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5975                           void *data, u16 len)
5976 {
5977         struct mgmt_mode *cp = data;
5978         bool changed, use_changed;
5979         int err;
5980
5981         bt_dev_dbg(hdev, "sock %p", sk);
5982
5983         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5985                                        MGMT_STATUS_INVALID_PARAMS);
5986
5987         hci_dev_lock(hdev);
5988
5989         if (cp->val)
5990                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5991         else
5992                 changed = hci_dev_test_and_clear_flag(hdev,
5993                                                       HCI_KEEP_DEBUG_KEYS);
5994
5995         if (cp->val == 0x02)
5996                 use_changed = !hci_dev_test_and_set_flag(hdev,
5997                                                          HCI_USE_DEBUG_KEYS);
5998         else
5999                 use_changed = hci_dev_test_and_clear_flag(hdev,
6000                                                           HCI_USE_DEBUG_KEYS);
6001
6002         if (hdev_is_powered(hdev) && use_changed &&
6003             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6004                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6005                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6006                              sizeof(mode), &mode);
6007         }
6008
6009         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6010         if (err < 0)
6011                 goto unlock;
6012
6013         if (changed)
6014                 err = new_settings(hdev, sk);
6015
6016 unlock:
6017         hci_dev_unlock(hdev);
6018         return err;
6019 }
6020
6021 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6022                        u16 len)
6023 {
6024         struct mgmt_cp_set_privacy *cp = cp_data;
6025         bool changed;
6026         int err;
6027
6028         bt_dev_dbg(hdev, "sock %p", sk);
6029
6030         if (!lmp_le_capable(hdev))
6031                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6032                                        MGMT_STATUS_NOT_SUPPORTED);
6033
6034         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6035                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6036                                        MGMT_STATUS_INVALID_PARAMS);
6037
6038         if (hdev_is_powered(hdev))
6039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6040                                        MGMT_STATUS_REJECTED);
6041
6042         hci_dev_lock(hdev);
6043
6044         /* If user space supports this command it is also expected to
6045          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6046          */
6047         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6048
6049         if (cp->privacy) {
6050                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6051                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6052                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6053                 hci_adv_instances_set_rpa_expired(hdev, true);
6054                 if (cp->privacy == 0x02)
6055                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6056                 else
6057                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6058         } else {
6059                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6060                 memset(hdev->irk, 0, sizeof(hdev->irk));
6061                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6062                 hci_adv_instances_set_rpa_expired(hdev, false);
6063                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6064         }
6065
6066         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6067         if (err < 0)
6068                 goto unlock;
6069
6070         if (changed)
6071                 err = new_settings(hdev, sk);
6072
6073 unlock:
6074         hci_dev_unlock(hdev);
6075         return err;
6076 }
6077
6078 static bool irk_is_valid(struct mgmt_irk_info *irk)
6079 {
6080         switch (irk->addr.type) {
6081         case BDADDR_LE_PUBLIC:
6082                 return true;
6083
6084         case BDADDR_LE_RANDOM:
6085                 /* Two most significant bits shall be set */
6086                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6087                         return false;
6088                 return true;
6089         }
6090
6091         return false;
6092 }
6093
6094 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6095                      u16 len)
6096 {
6097         struct mgmt_cp_load_irks *cp = cp_data;
6098         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6099                                    sizeof(struct mgmt_irk_info));
6100         u16 irk_count, expected_len;
6101         int i, err;
6102
6103         bt_dev_dbg(hdev, "sock %p", sk);
6104
6105         if (!lmp_le_capable(hdev))
6106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6107                                        MGMT_STATUS_NOT_SUPPORTED);
6108
6109         irk_count = __le16_to_cpu(cp->irk_count);
6110         if (irk_count > max_irk_count) {
6111                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6112                            irk_count);
6113                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6114                                        MGMT_STATUS_INVALID_PARAMS);
6115         }
6116
6117         expected_len = struct_size(cp, irks, irk_count);
6118         if (expected_len != len) {
6119                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6120                            expected_len, len);
6121                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6122                                        MGMT_STATUS_INVALID_PARAMS);
6123         }
6124
6125         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6126
6127         for (i = 0; i < irk_count; i++) {
6128                 struct mgmt_irk_info *key = &cp->irks[i];
6129
6130                 if (!irk_is_valid(key))
6131                         return mgmt_cmd_status(sk, hdev->id,
6132                                                MGMT_OP_LOAD_IRKS,
6133                                                MGMT_STATUS_INVALID_PARAMS);
6134         }
6135
6136         hci_dev_lock(hdev);
6137
6138         hci_smp_irks_clear(hdev);
6139
6140         for (i = 0; i < irk_count; i++) {
6141                 struct mgmt_irk_info *irk = &cp->irks[i];
6142
6143                 if (hci_is_blocked_key(hdev,
6144                                        HCI_BLOCKED_KEY_TYPE_IRK,
6145                                        irk->val)) {
6146                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6147                                     &irk->addr.bdaddr);
6148                         continue;
6149                 }
6150
6151                 hci_add_irk(hdev, &irk->addr.bdaddr,
6152                             le_addr_type(irk->addr.type), irk->val,
6153                             BDADDR_ANY);
6154         }
6155
6156         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6157
6158         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6159
6160         hci_dev_unlock(hdev);
6161
6162         return err;
6163 }
6164
6165 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6166 {
6167         if (key->master != 0x00 && key->master != 0x01)
6168                 return false;
6169
6170         switch (key->addr.type) {
6171         case BDADDR_LE_PUBLIC:
6172                 return true;
6173
6174         case BDADDR_LE_RANDOM:
6175                 /* Two most significant bits shall be set */
6176                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6177                         return false;
6178                 return true;
6179         }
6180
6181         return false;
6182 }
6183
6184 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6185                                void *cp_data, u16 len)
6186 {
6187         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6188         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6189                                    sizeof(struct mgmt_ltk_info));
6190         u16 key_count, expected_len;
6191         int i, err;
6192
6193         bt_dev_dbg(hdev, "sock %p", sk);
6194
6195         if (!lmp_le_capable(hdev))
6196                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6197                                        MGMT_STATUS_NOT_SUPPORTED);
6198
6199         key_count = __le16_to_cpu(cp->key_count);
6200         if (key_count > max_key_count) {
6201                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6202                            key_count);
6203                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6204                                        MGMT_STATUS_INVALID_PARAMS);
6205         }
6206
6207         expected_len = struct_size(cp, keys, key_count);
6208         if (expected_len != len) {
6209                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6210                            expected_len, len);
6211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6212                                        MGMT_STATUS_INVALID_PARAMS);
6213         }
6214
6215         bt_dev_dbg(hdev, "key_count %u", key_count);
6216
6217         for (i = 0; i < key_count; i++) {
6218                 struct mgmt_ltk_info *key = &cp->keys[i];
6219
6220                 if (!ltk_is_valid(key))
6221                         return mgmt_cmd_status(sk, hdev->id,
6222                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6223                                                MGMT_STATUS_INVALID_PARAMS);
6224         }
6225
6226         hci_dev_lock(hdev);
6227
6228         hci_smp_ltks_clear(hdev);
6229
6230         for (i = 0; i < key_count; i++) {
6231                 struct mgmt_ltk_info *key = &cp->keys[i];
6232                 u8 type, authenticated;
6233
6234                 if (hci_is_blocked_key(hdev,
6235                                        HCI_BLOCKED_KEY_TYPE_LTK,
6236                                        key->val)) {
6237                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6238                                     &key->addr.bdaddr);
6239                         continue;
6240                 }
6241
6242                 switch (key->type) {
6243                 case MGMT_LTK_UNAUTHENTICATED:
6244                         authenticated = 0x00;
6245                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6246                         break;
6247                 case MGMT_LTK_AUTHENTICATED:
6248                         authenticated = 0x01;
6249                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6250                         break;
6251                 case MGMT_LTK_P256_UNAUTH:
6252                         authenticated = 0x00;
6253                         type = SMP_LTK_P256;
6254                         break;
6255                 case MGMT_LTK_P256_AUTH:
6256                         authenticated = 0x01;
6257                         type = SMP_LTK_P256;
6258                         break;
6259                 case MGMT_LTK_P256_DEBUG:
6260                         authenticated = 0x00;
6261                         type = SMP_LTK_P256_DEBUG;
6262                         fallthrough;
6263                 default:
6264                         continue;
6265                 }
6266
6267                 hci_add_ltk(hdev, &key->addr.bdaddr,
6268                             le_addr_type(key->addr.type), type, authenticated,
6269                             key->val, key->enc_size, key->ediv, key->rand);
6270         }
6271
6272         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6273                            NULL, 0);
6274
6275         hci_dev_unlock(hdev);
6276
6277         return err;
6278 }
6279
6280 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6281 {
6282         struct hci_conn *conn = cmd->user_data;
6283         struct mgmt_rp_get_conn_info rp;
6284         int err;
6285
6286         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6287
6288         if (status == MGMT_STATUS_SUCCESS) {
6289                 rp.rssi = conn->rssi;
6290                 rp.tx_power = conn->tx_power;
6291                 rp.max_tx_power = conn->max_tx_power;
6292         } else {
6293                 rp.rssi = HCI_RSSI_INVALID;
6294                 rp.tx_power = HCI_TX_POWER_INVALID;
6295                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6296         }
6297
6298         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6299                                 status, &rp, sizeof(rp));
6300
6301         hci_conn_drop(conn);
6302         hci_conn_put(conn);
6303
6304         return err;
6305 }
6306
6307 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6308                                        u16 opcode)
6309 {
6310         struct hci_cp_read_rssi *cp;
6311         struct mgmt_pending_cmd *cmd;
6312         struct hci_conn *conn;
6313         u16 handle;
6314         u8 status;
6315
6316         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6317
6318         hci_dev_lock(hdev);
6319
6320         /* Commands sent in request are either Read RSSI or Read Transmit Power
6321          * Level so we check which one was last sent to retrieve connection
6322          * handle.  Both commands have handle as first parameter so it's safe to
6323          * cast data on the same command struct.
6324          *
6325          * First command sent is always Read RSSI and we fail only if it fails.
6326          * In other case we simply override error to indicate success as we
6327          * already remembered if TX power value is actually valid.
6328          */
6329         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6330         if (!cp) {
6331                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6332                 status = MGMT_STATUS_SUCCESS;
6333         } else {
6334                 status = mgmt_status(hci_status);
6335         }
6336
6337         if (!cp) {
6338                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6339                 goto unlock;
6340         }
6341
6342         handle = __le16_to_cpu(cp->handle);
6343         conn = hci_conn_hash_lookup_handle(hdev, handle);
6344         if (!conn) {
6345                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6346                            handle);
6347                 goto unlock;
6348         }
6349
6350         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6351         if (!cmd)
6352                 goto unlock;
6353
6354         cmd->cmd_complete(cmd, status);
6355         mgmt_pending_remove(cmd);
6356
6357 unlock:
6358         hci_dev_unlock(hdev);
6359 }
6360
6361 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6362                          u16 len)
6363 {
6364         struct mgmt_cp_get_conn_info *cp = data;
6365         struct mgmt_rp_get_conn_info rp;
6366         struct hci_conn *conn;
6367         unsigned long conn_info_age;
6368         int err = 0;
6369
6370         bt_dev_dbg(hdev, "sock %p", sk);
6371
6372         memset(&rp, 0, sizeof(rp));
6373         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6374         rp.addr.type = cp->addr.type;
6375
6376         if (!bdaddr_type_is_valid(cp->addr.type))
6377                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6378                                          MGMT_STATUS_INVALID_PARAMS,
6379                                          &rp, sizeof(rp));
6380
6381         hci_dev_lock(hdev);
6382
6383         if (!hdev_is_powered(hdev)) {
6384                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6385                                         MGMT_STATUS_NOT_POWERED, &rp,
6386                                         sizeof(rp));
6387                 goto unlock;
6388         }
6389
6390         if (cp->addr.type == BDADDR_BREDR)
6391                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6392                                                &cp->addr.bdaddr);
6393         else
6394                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6395
6396         if (!conn || conn->state != BT_CONNECTED) {
6397                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6398                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6399                                         sizeof(rp));
6400                 goto unlock;
6401         }
6402
6403         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6404                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6405                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6406                 goto unlock;
6407         }
6408
6409         /* To avoid client trying to guess when to poll again for information we
6410          * calculate conn info age as random value between min/max set in hdev.
6411          */
6412         conn_info_age = hdev->conn_info_min_age +
6413                         prandom_u32_max(hdev->conn_info_max_age -
6414                                         hdev->conn_info_min_age);
6415
6416         /* Query controller to refresh cached values if they are too old or were
6417          * never read.
6418          */
6419         if (time_after(jiffies, conn->conn_info_timestamp +
6420                        msecs_to_jiffies(conn_info_age)) ||
6421             !conn->conn_info_timestamp) {
6422                 struct hci_request req;
6423                 struct hci_cp_read_tx_power req_txp_cp;
6424                 struct hci_cp_read_rssi req_rssi_cp;
6425                 struct mgmt_pending_cmd *cmd;
6426
6427                 hci_req_init(&req, hdev);
6428                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6429                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6430                             &req_rssi_cp);
6431
6432                 /* For LE links TX power does not change thus we don't need to
6433                  * query for it once value is known.
6434                  */
6435                 if (!bdaddr_type_is_le(cp->addr.type) ||
6436                     conn->tx_power == HCI_TX_POWER_INVALID) {
6437                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6438                         req_txp_cp.type = 0x00;
6439                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6440                                     sizeof(req_txp_cp), &req_txp_cp);
6441                 }
6442
6443                 /* Max TX power needs to be read only once per connection */
6444                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6445                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6446                         req_txp_cp.type = 0x01;
6447                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6448                                     sizeof(req_txp_cp), &req_txp_cp);
6449                 }
6450
6451                 err = hci_req_run(&req, conn_info_refresh_complete);
6452                 if (err < 0)
6453                         goto unlock;
6454
6455                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6456                                        data, len);
6457                 if (!cmd) {
6458                         err = -ENOMEM;
6459                         goto unlock;
6460                 }
6461
6462                 hci_conn_hold(conn);
6463                 cmd->user_data = hci_conn_get(conn);
6464                 cmd->cmd_complete = conn_info_cmd_complete;
6465
6466                 conn->conn_info_timestamp = jiffies;
6467         } else {
6468                 /* Cache is valid, just reply with values cached in hci_conn */
6469                 rp.rssi = conn->rssi;
6470                 rp.tx_power = conn->tx_power;
6471                 rp.max_tx_power = conn->max_tx_power;
6472
6473                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6474                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6475         }
6476
6477 unlock:
6478         hci_dev_unlock(hdev);
6479         return err;
6480 }
6481
6482 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6483 {
6484         struct hci_conn *conn = cmd->user_data;
6485         struct mgmt_rp_get_clock_info rp;
6486         struct hci_dev *hdev;
6487         int err;
6488
6489         memset(&rp, 0, sizeof(rp));
6490         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6491
6492         if (status)
6493                 goto complete;
6494
6495         hdev = hci_dev_get(cmd->index);
6496         if (hdev) {
6497                 rp.local_clock = cpu_to_le32(hdev->clock);
6498                 hci_dev_put(hdev);
6499         }
6500
6501         if (conn) {
6502                 rp.piconet_clock = cpu_to_le32(conn->clock);
6503                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6504         }
6505
6506 complete:
6507         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6508                                 sizeof(rp));
6509
6510         if (conn) {
6511                 hci_conn_drop(conn);
6512                 hci_conn_put(conn);
6513         }
6514
6515         return err;
6516 }
6517
6518 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6519 {
6520         struct hci_cp_read_clock *hci_cp;
6521         struct mgmt_pending_cmd *cmd;
6522         struct hci_conn *conn;
6523
6524         bt_dev_dbg(hdev, "status %u", status);
6525
6526         hci_dev_lock(hdev);
6527
6528         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6529         if (!hci_cp)
6530                 goto unlock;
6531
6532         if (hci_cp->which) {
6533                 u16 handle = __le16_to_cpu(hci_cp->handle);
6534                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6535         } else {
6536                 conn = NULL;
6537         }
6538
6539         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6540         if (!cmd)
6541                 goto unlock;
6542
6543         cmd->cmd_complete(cmd, mgmt_status(status));
6544         mgmt_pending_remove(cmd);
6545
6546 unlock:
6547         hci_dev_unlock(hdev);
6548 }
6549
6550 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6551                          u16 len)
6552 {
6553         struct mgmt_cp_get_clock_info *cp = data;
6554         struct mgmt_rp_get_clock_info rp;
6555         struct hci_cp_read_clock hci_cp;
6556         struct mgmt_pending_cmd *cmd;
6557         struct hci_request req;
6558         struct hci_conn *conn;
6559         int err;
6560
6561         bt_dev_dbg(hdev, "sock %p", sk);
6562
6563         memset(&rp, 0, sizeof(rp));
6564         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6565         rp.addr.type = cp->addr.type;
6566
6567         if (cp->addr.type != BDADDR_BREDR)
6568                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6569                                          MGMT_STATUS_INVALID_PARAMS,
6570                                          &rp, sizeof(rp));
6571
6572         hci_dev_lock(hdev);
6573
6574         if (!hdev_is_powered(hdev)) {
6575                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6576                                         MGMT_STATUS_NOT_POWERED, &rp,
6577                                         sizeof(rp));
6578                 goto unlock;
6579         }
6580
6581         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6582                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6583                                                &cp->addr.bdaddr);
6584                 if (!conn || conn->state != BT_CONNECTED) {
6585                         err = mgmt_cmd_complete(sk, hdev->id,
6586                                                 MGMT_OP_GET_CLOCK_INFO,
6587                                                 MGMT_STATUS_NOT_CONNECTED,
6588                                                 &rp, sizeof(rp));
6589                         goto unlock;
6590                 }
6591         } else {
6592                 conn = NULL;
6593         }
6594
6595         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6596         if (!cmd) {
6597                 err = -ENOMEM;
6598                 goto unlock;
6599         }
6600
6601         cmd->cmd_complete = clock_info_cmd_complete;
6602
6603         hci_req_init(&req, hdev);
6604
6605         memset(&hci_cp, 0, sizeof(hci_cp));
6606         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6607
6608         if (conn) {
6609                 hci_conn_hold(conn);
6610                 cmd->user_data = hci_conn_get(conn);
6611
6612                 hci_cp.handle = cpu_to_le16(conn->handle);
6613                 hci_cp.which = 0x01; /* Piconet clock */
6614                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6615         }
6616
6617         err = hci_req_run(&req, get_clock_info_complete);
6618         if (err < 0)
6619                 mgmt_pending_remove(cmd);
6620
6621 unlock:
6622         hci_dev_unlock(hdev);
6623         return err;
6624 }
6625
6626 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6627 {
6628         struct hci_conn *conn;
6629
6630         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6631         if (!conn)
6632                 return false;
6633
6634         if (conn->dst_type != type)
6635                 return false;
6636
6637         if (conn->state != BT_CONNECTED)
6638                 return false;
6639
6640         return true;
6641 }
6642
6643 /* This function requires the caller holds hdev->lock */
6644 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6645                                u8 addr_type, u8 auto_connect)
6646 {
6647         struct hci_conn_params *params;
6648
6649         params = hci_conn_params_add(hdev, addr, addr_type);
6650         if (!params)
6651                 return -EIO;
6652
6653         if (params->auto_connect == auto_connect)
6654                 return 0;
6655
6656         list_del_init(&params->action);
6657
6658         switch (auto_connect) {
6659         case HCI_AUTO_CONN_DISABLED:
6660         case HCI_AUTO_CONN_LINK_LOSS:
6661                 /* If auto connect is being disabled when we're trying to
6662                  * connect to device, keep connecting.
6663                  */
6664                 if (params->explicit_connect)
6665                         list_add(&params->action, &hdev->pend_le_conns);
6666                 break;
6667         case HCI_AUTO_CONN_REPORT:
6668                 if (params->explicit_connect)
6669                         list_add(&params->action, &hdev->pend_le_conns);
6670                 else
6671                         list_add(&params->action, &hdev->pend_le_reports);
6672                 break;
6673         case HCI_AUTO_CONN_DIRECT:
6674         case HCI_AUTO_CONN_ALWAYS:
6675                 if (!is_connected(hdev, addr, addr_type))
6676                         list_add(&params->action, &hdev->pend_le_conns);
6677                 break;
6678         }
6679
6680         params->auto_connect = auto_connect;
6681
6682         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6683                    addr, addr_type, auto_connect);
6684
6685         return 0;
6686 }
6687
6688 static void device_added(struct sock *sk, struct hci_dev *hdev,
6689                          bdaddr_t *bdaddr, u8 type, u8 action)
6690 {
6691         struct mgmt_ev_device_added ev;
6692
6693         bacpy(&ev.addr.bdaddr, bdaddr);
6694         ev.addr.type = type;
6695         ev.action = action;
6696
6697         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6698 }
6699
6700 static int add_device(struct sock *sk, struct hci_dev *hdev,
6701                       void *data, u16 len)
6702 {
6703         struct mgmt_cp_add_device *cp = data;
6704         u8 auto_conn, addr_type;
6705         struct hci_conn_params *params;
6706         int err;
6707         u32 current_flags = 0;
6708
6709         bt_dev_dbg(hdev, "sock %p", sk);
6710
6711         if (!bdaddr_type_is_valid(cp->addr.type) ||
6712             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6713                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6714                                          MGMT_STATUS_INVALID_PARAMS,
6715                                          &cp->addr, sizeof(cp->addr));
6716
6717         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6718                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6719                                          MGMT_STATUS_INVALID_PARAMS,
6720                                          &cp->addr, sizeof(cp->addr));
6721
6722         hci_dev_lock(hdev);
6723
6724         if (cp->addr.type == BDADDR_BREDR) {
6725                 /* Only incoming connections action is supported for now */
6726                 if (cp->action != 0x01) {
6727                         err = mgmt_cmd_complete(sk, hdev->id,
6728                                                 MGMT_OP_ADD_DEVICE,
6729                                                 MGMT_STATUS_INVALID_PARAMS,
6730                                                 &cp->addr, sizeof(cp->addr));
6731                         goto unlock;
6732                 }
6733
6734                 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
6735                                                      &cp->addr.bdaddr,
6736                                                      cp->addr.type, 0);
6737                 if (err)
6738                         goto unlock;
6739
6740                 hci_req_update_scan(hdev);
6741
6742                 goto added;
6743         }
6744
6745         addr_type = le_addr_type(cp->addr.type);
6746
6747         if (cp->action == 0x02)
6748                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6749         else if (cp->action == 0x01)
6750                 auto_conn = HCI_AUTO_CONN_DIRECT;
6751         else
6752                 auto_conn = HCI_AUTO_CONN_REPORT;
6753
6754         /* Kernel internally uses conn_params with resolvable private
6755          * address, but Add Device allows only identity addresses.
6756          * Make sure it is enforced before calling
6757          * hci_conn_params_lookup.
6758          */
6759         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6760                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6761                                         MGMT_STATUS_INVALID_PARAMS,
6762                                         &cp->addr, sizeof(cp->addr));
6763                 goto unlock;
6764         }
6765
6766         /* If the connection parameters don't exist for this device,
6767          * they will be created and configured with defaults.
6768          */
6769         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6770                                 auto_conn) < 0) {
6771                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6772                                         MGMT_STATUS_FAILED, &cp->addr,
6773                                         sizeof(cp->addr));
6774                 goto unlock;
6775         } else {
6776                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6777                                                 addr_type);
6778                 if (params)
6779                         current_flags = params->current_flags;
6780         }
6781
6782         hci_update_background_scan(hdev);
6783
6784 added:
6785         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6786         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6787                              SUPPORTED_DEVICE_FLAGS(), current_flags);
6788
6789         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6790                                 MGMT_STATUS_SUCCESS, &cp->addr,
6791                                 sizeof(cp->addr));
6792
6793 unlock:
6794         hci_dev_unlock(hdev);
6795         return err;
6796 }
6797
6798 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6799                            bdaddr_t *bdaddr, u8 type)
6800 {
6801         struct mgmt_ev_device_removed ev;
6802
6803         bacpy(&ev.addr.bdaddr, bdaddr);
6804         ev.addr.type = type;
6805
6806         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6807 }
6808
6809 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6810                          void *data, u16 len)
6811 {
6812         struct mgmt_cp_remove_device *cp = data;
6813         int err;
6814
6815         bt_dev_dbg(hdev, "sock %p", sk);
6816
6817         hci_dev_lock(hdev);
6818
6819         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6820                 struct hci_conn_params *params;
6821                 u8 addr_type;
6822
6823                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6824                         err = mgmt_cmd_complete(sk, hdev->id,
6825                                                 MGMT_OP_REMOVE_DEVICE,
6826                                                 MGMT_STATUS_INVALID_PARAMS,
6827                                                 &cp->addr, sizeof(cp->addr));
6828                         goto unlock;
6829                 }
6830
6831                 if (cp->addr.type == BDADDR_BREDR) {
6832                         err = hci_bdaddr_list_del(&hdev->whitelist,
6833                                                   &cp->addr.bdaddr,
6834                                                   cp->addr.type);
6835                         if (err) {
6836                                 err = mgmt_cmd_complete(sk, hdev->id,
6837                                                         MGMT_OP_REMOVE_DEVICE,
6838                                                         MGMT_STATUS_INVALID_PARAMS,
6839                                                         &cp->addr,
6840                                                         sizeof(cp->addr));
6841                                 goto unlock;
6842                         }
6843
6844                         hci_req_update_scan(hdev);
6845
6846                         device_removed(sk, hdev, &cp->addr.bdaddr,
6847                                        cp->addr.type);
6848                         goto complete;
6849                 }
6850
6851                 addr_type = le_addr_type(cp->addr.type);
6852
6853                 /* Kernel internally uses conn_params with resolvable private
6854                  * address, but Remove Device allows only identity addresses.
6855                  * Make sure it is enforced before calling
6856                  * hci_conn_params_lookup.
6857                  */
6858                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6859                         err = mgmt_cmd_complete(sk, hdev->id,
6860                                                 MGMT_OP_REMOVE_DEVICE,
6861                                                 MGMT_STATUS_INVALID_PARAMS,
6862                                                 &cp->addr, sizeof(cp->addr));
6863                         goto unlock;
6864                 }
6865
6866                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6867                                                 addr_type);
6868                 if (!params) {
6869                         err = mgmt_cmd_complete(sk, hdev->id,
6870                                                 MGMT_OP_REMOVE_DEVICE,
6871                                                 MGMT_STATUS_INVALID_PARAMS,
6872                                                 &cp->addr, sizeof(cp->addr));
6873                         goto unlock;
6874                 }
6875
6876                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6877                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6878                         err = mgmt_cmd_complete(sk, hdev->id,
6879                                                 MGMT_OP_REMOVE_DEVICE,
6880                                                 MGMT_STATUS_INVALID_PARAMS,
6881                                                 &cp->addr, sizeof(cp->addr));
6882                         goto unlock;
6883                 }
6884
6885                 list_del(&params->action);
6886                 list_del(&params->list);
6887                 kfree(params);
6888                 hci_update_background_scan(hdev);
6889
6890                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6891         } else {
6892                 struct hci_conn_params *p, *tmp;
6893                 struct bdaddr_list *b, *btmp;
6894
6895                 if (cp->addr.type) {
6896                         err = mgmt_cmd_complete(sk, hdev->id,
6897                                                 MGMT_OP_REMOVE_DEVICE,
6898                                                 MGMT_STATUS_INVALID_PARAMS,
6899                                                 &cp->addr, sizeof(cp->addr));
6900                         goto unlock;
6901                 }
6902
6903                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6904                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6905                         list_del(&b->list);
6906                         kfree(b);
6907                 }
6908
6909                 hci_req_update_scan(hdev);
6910
6911                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6912                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6913                                 continue;
6914                         device_removed(sk, hdev, &p->addr, p->addr_type);
6915                         if (p->explicit_connect) {
6916                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6917                                 continue;
6918                         }
6919                         list_del(&p->action);
6920                         list_del(&p->list);
6921                         kfree(p);
6922                 }
6923
6924                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6925
6926                 hci_update_background_scan(hdev);
6927         }
6928
6929 complete:
6930         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6931                                 MGMT_STATUS_SUCCESS, &cp->addr,
6932                                 sizeof(cp->addr));
6933 unlock:
6934         hci_dev_unlock(hdev);
6935         return err;
6936 }
6937
6938 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6939                            u16 len)
6940 {
6941         struct mgmt_cp_load_conn_param *cp = data;
6942         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6943                                      sizeof(struct mgmt_conn_param));
6944         u16 param_count, expected_len;
6945         int i;
6946
6947         if (!lmp_le_capable(hdev))
6948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6949                                        MGMT_STATUS_NOT_SUPPORTED);
6950
6951         param_count = __le16_to_cpu(cp->param_count);
6952         if (param_count > max_param_count) {
6953                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6954                            param_count);
6955                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6956                                        MGMT_STATUS_INVALID_PARAMS);
6957         }
6958
6959         expected_len = struct_size(cp, params, param_count);
6960         if (expected_len != len) {
6961                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6962                            expected_len, len);
6963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6964                                        MGMT_STATUS_INVALID_PARAMS);
6965         }
6966
6967         bt_dev_dbg(hdev, "param_count %u", param_count);
6968
6969         hci_dev_lock(hdev);
6970
6971         hci_conn_params_clear_disabled(hdev);
6972
6973         for (i = 0; i < param_count; i++) {
6974                 struct mgmt_conn_param *param = &cp->params[i];
6975                 struct hci_conn_params *hci_param;
6976                 u16 min, max, latency, timeout;
6977                 u8 addr_type;
6978
6979                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
6980                            param->addr.type);
6981
6982                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6983                         addr_type = ADDR_LE_DEV_PUBLIC;
6984                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6985                         addr_type = ADDR_LE_DEV_RANDOM;
6986                 } else {
6987                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6988                         continue;
6989                 }
6990
6991                 min = le16_to_cpu(param->min_interval);
6992                 max = le16_to_cpu(param->max_interval);
6993                 latency = le16_to_cpu(param->latency);
6994                 timeout = le16_to_cpu(param->timeout);
6995
6996                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6997                            min, max, latency, timeout);
6998
6999                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7000                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7001                         continue;
7002                 }
7003
7004                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7005                                                 addr_type);
7006                 if (!hci_param) {
7007                         bt_dev_err(hdev, "failed to add connection parameters");
7008                         continue;
7009                 }
7010
7011                 hci_param->conn_min_interval = min;
7012                 hci_param->conn_max_interval = max;
7013                 hci_param->conn_latency = latency;
7014                 hci_param->supervision_timeout = timeout;
7015         }
7016
7017         hci_dev_unlock(hdev);
7018
7019         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7020                                  NULL, 0);
7021 }
7022
7023 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7024                                void *data, u16 len)
7025 {
7026         struct mgmt_cp_set_external_config *cp = data;
7027         bool changed;
7028         int err;
7029
7030         bt_dev_dbg(hdev, "sock %p", sk);
7031
7032         if (hdev_is_powered(hdev))
7033                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7034                                        MGMT_STATUS_REJECTED);
7035
7036         if (cp->config != 0x00 && cp->config != 0x01)
7037                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7038                                          MGMT_STATUS_INVALID_PARAMS);
7039
7040         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7041                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7042                                        MGMT_STATUS_NOT_SUPPORTED);
7043
7044         hci_dev_lock(hdev);
7045
7046         if (cp->config)
7047                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7048         else
7049                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7050
7051         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7052         if (err < 0)
7053                 goto unlock;
7054
7055         if (!changed)
7056                 goto unlock;
7057
7058         err = new_options(hdev, sk);
7059
7060         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7061                 mgmt_index_removed(hdev);
7062
7063                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7064                         hci_dev_set_flag(hdev, HCI_CONFIG);
7065                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7066
7067                         queue_work(hdev->req_workqueue, &hdev->power_on);
7068                 } else {
7069                         set_bit(HCI_RAW, &hdev->flags);
7070                         mgmt_index_added(hdev);
7071                 }
7072         }
7073
7074 unlock:
7075         hci_dev_unlock(hdev);
7076         return err;
7077 }
7078
7079 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7080                               void *data, u16 len)
7081 {
7082         struct mgmt_cp_set_public_address *cp = data;
7083         bool changed;
7084         int err;
7085
7086         bt_dev_dbg(hdev, "sock %p", sk);
7087
7088         if (hdev_is_powered(hdev))
7089                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7090                                        MGMT_STATUS_REJECTED);
7091
7092         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7093                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7094                                        MGMT_STATUS_INVALID_PARAMS);
7095
7096         if (!hdev->set_bdaddr)
7097                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7098                                        MGMT_STATUS_NOT_SUPPORTED);
7099
7100         hci_dev_lock(hdev);
7101
7102         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7103         bacpy(&hdev->public_addr, &cp->bdaddr);
7104
7105         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7106         if (err < 0)
7107                 goto unlock;
7108
7109         if (!changed)
7110                 goto unlock;
7111
7112         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7113                 err = new_options(hdev, sk);
7114
7115         if (is_configured(hdev)) {
7116                 mgmt_index_removed(hdev);
7117
7118                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7119
7120                 hci_dev_set_flag(hdev, HCI_CONFIG);
7121                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7122
7123                 queue_work(hdev->req_workqueue, &hdev->power_on);
7124         }
7125
7126 unlock:
7127         hci_dev_unlock(hdev);
7128         return err;
7129 }
7130
7131 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
7132                                              u16 opcode, struct sk_buff *skb)
7133 {
7134         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7135         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7136         u8 *h192, *r192, *h256, *r256;
7137         struct mgmt_pending_cmd *cmd;
7138         u16 eir_len;
7139         int err;
7140
7141         bt_dev_dbg(hdev, "status %u", status);
7142
7143         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
7144         if (!cmd)
7145                 return;
7146
7147         mgmt_cp = cmd->param;
7148
7149         if (status) {
7150                 status = mgmt_status(status);
7151                 eir_len = 0;
7152
7153                 h192 = NULL;
7154                 r192 = NULL;
7155                 h256 = NULL;
7156                 r256 = NULL;
7157         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
7158                 struct hci_rp_read_local_oob_data *rp;
7159
7160                 if (skb->len != sizeof(*rp)) {
7161                         status = MGMT_STATUS_FAILED;
7162                         eir_len = 0;
7163                 } else {
7164                         status = MGMT_STATUS_SUCCESS;
7165                         rp = (void *)skb->data;
7166
7167                         eir_len = 5 + 18 + 18;
7168                         h192 = rp->hash;
7169                         r192 = rp->rand;
7170                         h256 = NULL;
7171                         r256 = NULL;
7172                 }
7173         } else {
7174                 struct hci_rp_read_local_oob_ext_data *rp;
7175
7176                 if (skb->len != sizeof(*rp)) {
7177                         status = MGMT_STATUS_FAILED;
7178                         eir_len = 0;
7179                 } else {
7180                         status = MGMT_STATUS_SUCCESS;
7181                         rp = (void *)skb->data;
7182
7183                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7184                                 eir_len = 5 + 18 + 18;
7185                                 h192 = NULL;
7186                                 r192 = NULL;
7187                         } else {
7188                                 eir_len = 5 + 18 + 18 + 18 + 18;
7189                                 h192 = rp->hash192;
7190                                 r192 = rp->rand192;
7191                         }
7192
7193                         h256 = rp->hash256;
7194                         r256 = rp->rand256;
7195                 }
7196         }
7197
7198         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7199         if (!mgmt_rp)
7200                 goto done;
7201
7202         if (status)
7203                 goto send_rsp;
7204
7205         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7206                                   hdev->dev_class, 3);
7207
7208         if (h192 && r192) {
7209                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7210                                           EIR_SSP_HASH_C192, h192, 16);
7211                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7212                                           EIR_SSP_RAND_R192, r192, 16);
7213         }
7214
7215         if (h256 && r256) {
7216                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7217                                           EIR_SSP_HASH_C256, h256, 16);
7218                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7219                                           EIR_SSP_RAND_R256, r256, 16);
7220         }
7221
7222 send_rsp:
7223         mgmt_rp->type = mgmt_cp->type;
7224         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7225
7226         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7227                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7228                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7229         if (err < 0 || status)
7230                 goto done;
7231
7232         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7233
7234         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7235                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7236                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7237 done:
7238         kfree(mgmt_rp);
7239         mgmt_pending_remove(cmd);
7240 }
7241
7242 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7243                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7244 {
7245         struct mgmt_pending_cmd *cmd;
7246         struct hci_request req;
7247         int err;
7248
7249         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7250                                cp, sizeof(*cp));
7251         if (!cmd)
7252                 return -ENOMEM;
7253
7254         hci_req_init(&req, hdev);
7255
7256         if (bredr_sc_enabled(hdev))
7257                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7258         else
7259                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7260
7261         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7262         if (err < 0) {
7263                 mgmt_pending_remove(cmd);
7264                 return err;
7265         }
7266
7267         return 0;
7268 }
7269
7270 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7271                                    void *data, u16 data_len)
7272 {
7273         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7274         struct mgmt_rp_read_local_oob_ext_data *rp;
7275         size_t rp_len;
7276         u16 eir_len;
7277         u8 status, flags, role, addr[7], hash[16], rand[16];
7278         int err;
7279
7280         bt_dev_dbg(hdev, "sock %p", sk);
7281
7282         if (hdev_is_powered(hdev)) {
7283                 switch (cp->type) {
7284                 case BIT(BDADDR_BREDR):
7285                         status = mgmt_bredr_support(hdev);
7286                         if (status)
7287                                 eir_len = 0;
7288                         else
7289                                 eir_len = 5;
7290                         break;
7291                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7292                         status = mgmt_le_support(hdev);
7293                         if (status)
7294                                 eir_len = 0;
7295                         else
7296                                 eir_len = 9 + 3 + 18 + 18 + 3;
7297                         break;
7298                 default:
7299                         status = MGMT_STATUS_INVALID_PARAMS;
7300                         eir_len = 0;
7301                         break;
7302                 }
7303         } else {
7304                 status = MGMT_STATUS_NOT_POWERED;
7305                 eir_len = 0;
7306         }
7307
7308         rp_len = sizeof(*rp) + eir_len;
7309         rp = kmalloc(rp_len, GFP_ATOMIC);
7310         if (!rp)
7311                 return -ENOMEM;
7312
7313         if (status)
7314                 goto complete;
7315
7316         hci_dev_lock(hdev);
7317
7318         eir_len = 0;
7319         switch (cp->type) {
7320         case BIT(BDADDR_BREDR):
7321                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7322                         err = read_local_ssp_oob_req(hdev, sk, cp);
7323                         hci_dev_unlock(hdev);
7324                         if (!err)
7325                                 goto done;
7326
7327                         status = MGMT_STATUS_FAILED;
7328                         goto complete;
7329                 } else {
7330                         eir_len = eir_append_data(rp->eir, eir_len,
7331                                                   EIR_CLASS_OF_DEV,
7332                                                   hdev->dev_class, 3);
7333                 }
7334                 break;
7335         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7336                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7337                     smp_generate_oob(hdev, hash, rand) < 0) {
7338                         hci_dev_unlock(hdev);
7339                         status = MGMT_STATUS_FAILED;
7340                         goto complete;
7341                 }
7342
7343                 /* This should return the active RPA, but since the RPA
7344                  * is only programmed on demand, it is really hard to fill
7345                  * this in at the moment. For now disallow retrieving
7346                  * local out-of-band data when privacy is in use.
7347                  *
7348                  * Returning the identity address will not help here since
7349                  * pairing happens before the identity resolving key is
7350                  * known and thus the connection establishment happens
7351                  * based on the RPA and not the identity address.
7352                  */
7353                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7354                         hci_dev_unlock(hdev);
7355                         status = MGMT_STATUS_REJECTED;
7356                         goto complete;
7357                 }
7358
7359                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7360                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7361                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7362                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7363                         memcpy(addr, &hdev->static_addr, 6);
7364                         addr[6] = 0x01;
7365                 } else {
7366                         memcpy(addr, &hdev->bdaddr, 6);
7367                         addr[6] = 0x00;
7368                 }
7369
7370                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7371                                           addr, sizeof(addr));
7372
7373                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7374                         role = 0x02;
7375                 else
7376                         role = 0x01;
7377
7378                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7379                                           &role, sizeof(role));
7380
7381                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7382                         eir_len = eir_append_data(rp->eir, eir_len,
7383                                                   EIR_LE_SC_CONFIRM,
7384                                                   hash, sizeof(hash));
7385
7386                         eir_len = eir_append_data(rp->eir, eir_len,
7387                                                   EIR_LE_SC_RANDOM,
7388                                                   rand, sizeof(rand));
7389                 }
7390
7391                 flags = mgmt_get_adv_discov_flags(hdev);
7392
7393                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7394                         flags |= LE_AD_NO_BREDR;
7395
7396                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7397                                           &flags, sizeof(flags));
7398                 break;
7399         }
7400
7401         hci_dev_unlock(hdev);
7402
7403         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7404
7405         status = MGMT_STATUS_SUCCESS;
7406
7407 complete:
7408         rp->type = cp->type;
7409         rp->eir_len = cpu_to_le16(eir_len);
7410
7411         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7412                                 status, rp, sizeof(*rp) + eir_len);
7413         if (err < 0 || status)
7414                 goto done;
7415
7416         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7417                                  rp, sizeof(*rp) + eir_len,
7418                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7419
7420 done:
7421         kfree(rp);
7422
7423         return err;
7424 }
7425
7426 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7427 {
7428         u32 flags = 0;
7429
7430         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7431         flags |= MGMT_ADV_FLAG_DISCOV;
7432         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7433         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7434         flags |= MGMT_ADV_FLAG_APPEARANCE;
7435         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7436         flags |= MGMT_ADV_PARAM_DURATION;
7437         flags |= MGMT_ADV_PARAM_TIMEOUT;
7438         flags |= MGMT_ADV_PARAM_INTERVALS;
7439         flags |= MGMT_ADV_PARAM_TX_POWER;
7440         flags |= MGMT_ADV_PARAM_SCAN_RSP;
7441
7442         /* In extended adv TX_POWER returned from Set Adv Param
7443          * will be always valid.
7444          */
7445         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7446             ext_adv_capable(hdev))
7447                 flags |= MGMT_ADV_FLAG_TX_POWER;
7448
7449         if (ext_adv_capable(hdev)) {
7450                 flags |= MGMT_ADV_FLAG_SEC_1M;
7451                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7452                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7453
7454                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7455                         flags |= MGMT_ADV_FLAG_SEC_2M;
7456
7457                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7458                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7459         }
7460
7461         return flags;
7462 }
7463
7464 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7465                              void *data, u16 data_len)
7466 {
7467         struct mgmt_rp_read_adv_features *rp;
7468         size_t rp_len;
7469         int err;
7470         struct adv_info *adv_instance;
7471         u32 supported_flags;
7472         u8 *instance;
7473
7474         bt_dev_dbg(hdev, "sock %p", sk);
7475
7476         if (!lmp_le_capable(hdev))
7477                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7478                                        MGMT_STATUS_REJECTED);
7479
7480         /* Enabling the experimental LL Privay support disables support for
7481          * advertising.
7482          */
7483         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7484                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7485                                        MGMT_STATUS_NOT_SUPPORTED);
7486
7487         hci_dev_lock(hdev);
7488
7489         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7490         rp = kmalloc(rp_len, GFP_ATOMIC);
7491         if (!rp) {
7492                 hci_dev_unlock(hdev);
7493                 return -ENOMEM;
7494         }
7495
7496         supported_flags = get_supported_adv_flags(hdev);
7497
7498         rp->supported_flags = cpu_to_le32(supported_flags);
7499         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7500         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7501         rp->max_instances = hdev->le_num_of_adv_sets;
7502         rp->num_instances = hdev->adv_instance_cnt;
7503
7504         instance = rp->instance;
7505         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7506                 *instance = adv_instance->instance;
7507                 instance++;
7508         }
7509
7510         hci_dev_unlock(hdev);
7511
7512         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7513                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7514
7515         kfree(rp);
7516
7517         return err;
7518 }
7519
7520 static u8 calculate_name_len(struct hci_dev *hdev)
7521 {
7522         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7523
7524         return append_local_name(hdev, buf, 0);
7525 }
7526
7527 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7528                            bool is_adv_data)
7529 {
7530         u8 max_len = HCI_MAX_AD_LENGTH;
7531
7532         if (is_adv_data) {
7533                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7534                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7535                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7536                         max_len -= 3;
7537
7538                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7539                         max_len -= 3;
7540         } else {
7541                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7542                         max_len -= calculate_name_len(hdev);
7543
7544                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7545                         max_len -= 4;
7546         }
7547
7548         return max_len;
7549 }
7550
7551 static bool flags_managed(u32 adv_flags)
7552 {
7553         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7554                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7555                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7556 }
7557
7558 static bool tx_power_managed(u32 adv_flags)
7559 {
7560         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7561 }
7562
7563 static bool name_managed(u32 adv_flags)
7564 {
7565         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7566 }
7567
7568 static bool appearance_managed(u32 adv_flags)
7569 {
7570         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7571 }
7572
7573 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7574                               u8 len, bool is_adv_data)
7575 {
7576         int i, cur_len;
7577         u8 max_len;
7578
7579         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7580
7581         if (len > max_len)
7582                 return false;
7583
7584         /* Make sure that the data is correctly formatted. */
7585         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7586                 cur_len = data[i];
7587
7588                 if (data[i + 1] == EIR_FLAGS &&
7589                     (!is_adv_data || flags_managed(adv_flags)))
7590                         return false;
7591
7592                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7593                         return false;
7594
7595                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7596                         return false;
7597
7598                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7599                         return false;
7600
7601                 if (data[i + 1] == EIR_APPEARANCE &&
7602                     appearance_managed(adv_flags))
7603                         return false;
7604
7605                 /* If the current field length would exceed the total data
7606                  * length, then it's invalid.
7607                  */
7608                 if (i + cur_len >= len)
7609                         return false;
7610         }
7611
7612         return true;
7613 }
7614
7615 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7616 {
7617         u32 supported_flags, phy_flags;
7618
7619         /* The current implementation only supports a subset of the specified
7620          * flags. Also need to check mutual exclusiveness of sec flags.
7621          */
7622         supported_flags = get_supported_adv_flags(hdev);
7623         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7624         if (adv_flags & ~supported_flags ||
7625             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7626                 return false;
7627
7628         return true;
7629 }
7630
7631 static bool adv_busy(struct hci_dev *hdev)
7632 {
7633         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7634                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7635                 pending_find(MGMT_OP_SET_LE, hdev) ||
7636                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7637                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7638 }
7639
7640 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7641                                      u16 opcode)
7642 {
7643         struct mgmt_pending_cmd *cmd;
7644         struct mgmt_cp_add_advertising *cp;
7645         struct mgmt_rp_add_advertising rp;
7646         struct adv_info *adv_instance, *n;
7647         u8 instance;
7648
7649         bt_dev_dbg(hdev, "status %d", status);
7650
7651         hci_dev_lock(hdev);
7652
7653         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7654         if (!cmd)
7655                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
7656
7657         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7658                 if (!adv_instance->pending)
7659                         continue;
7660
7661                 if (!status) {
7662                         adv_instance->pending = false;
7663                         continue;
7664                 }
7665
7666                 instance = adv_instance->instance;
7667
7668                 if (hdev->cur_adv_instance == instance)
7669                         cancel_adv_timeout(hdev);
7670
7671                 hci_remove_adv_instance(hdev, instance);
7672                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7673         }
7674
7675         if (!cmd)
7676                 goto unlock;
7677
7678         cp = cmd->param;
7679         rp.instance = cp->instance;
7680
7681         if (status)
7682                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7683                                 mgmt_status(status));
7684         else
7685                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7686                                   mgmt_status(status), &rp, sizeof(rp));
7687
7688         mgmt_pending_remove(cmd);
7689
7690 unlock:
7691         hci_dev_unlock(hdev);
7692 }
7693
7694 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7695                            void *data, u16 data_len)
7696 {
7697         struct mgmt_cp_add_advertising *cp = data;
7698         struct mgmt_rp_add_advertising rp;
7699         u32 flags;
7700         u8 status;
7701         u16 timeout, duration;
7702         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7703         u8 schedule_instance = 0;
7704         struct adv_info *next_instance;
7705         int err;
7706         struct mgmt_pending_cmd *cmd;
7707         struct hci_request req;
7708
7709         bt_dev_dbg(hdev, "sock %p", sk);
7710
7711         status = mgmt_le_support(hdev);
7712         if (status)
7713                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7714                                        status);
7715
7716         /* Enabling the experimental LL Privay support disables support for
7717          * advertising.
7718          */
7719         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7720                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7721                                        MGMT_STATUS_NOT_SUPPORTED);
7722
7723         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7725                                        MGMT_STATUS_INVALID_PARAMS);
7726
7727         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7728                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7729                                        MGMT_STATUS_INVALID_PARAMS);
7730
7731         flags = __le32_to_cpu(cp->flags);
7732         timeout = __le16_to_cpu(cp->timeout);
7733         duration = __le16_to_cpu(cp->duration);
7734
7735         if (!requested_adv_flags_are_valid(hdev, flags))
7736                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7737                                        MGMT_STATUS_INVALID_PARAMS);
7738
7739         hci_dev_lock(hdev);
7740
7741         if (timeout && !hdev_is_powered(hdev)) {
7742                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7743                                       MGMT_STATUS_REJECTED);
7744                 goto unlock;
7745         }
7746
7747         if (adv_busy(hdev)) {
7748                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7749                                       MGMT_STATUS_BUSY);
7750                 goto unlock;
7751         }
7752
7753         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7754             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7755                                cp->scan_rsp_len, false)) {
7756                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7757                                       MGMT_STATUS_INVALID_PARAMS);
7758                 goto unlock;
7759         }
7760
7761         err = hci_add_adv_instance(hdev, cp->instance, flags,
7762                                    cp->adv_data_len, cp->data,
7763                                    cp->scan_rsp_len,
7764                                    cp->data + cp->adv_data_len,
7765                                    timeout, duration,
7766                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
7767                                    hdev->le_adv_min_interval,
7768                                    hdev->le_adv_max_interval);
7769         if (err < 0) {
7770                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7771                                       MGMT_STATUS_FAILED);
7772                 goto unlock;
7773         }
7774
7775         /* Only trigger an advertising added event if a new instance was
7776          * actually added.
7777          */
7778         if (hdev->adv_instance_cnt > prev_instance_cnt)
7779                 mgmt_advertising_added(sk, hdev, cp->instance);
7780
7781         if (hdev->cur_adv_instance == cp->instance) {
7782                 /* If the currently advertised instance is being changed then
7783                  * cancel the current advertising and schedule the next
7784                  * instance. If there is only one instance then the overridden
7785                  * advertising data will be visible right away.
7786                  */
7787                 cancel_adv_timeout(hdev);
7788
7789                 next_instance = hci_get_next_instance(hdev, cp->instance);
7790                 if (next_instance)
7791                         schedule_instance = next_instance->instance;
7792         } else if (!hdev->adv_instance_timeout) {
7793                 /* Immediately advertise the new instance if no other
7794                  * instance is currently being advertised.
7795                  */
7796                 schedule_instance = cp->instance;
7797         }
7798
7799         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7800          * there is no instance to be advertised then we have no HCI
7801          * communication to make. Simply return.
7802          */
7803         if (!hdev_is_powered(hdev) ||
7804             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7805             !schedule_instance) {
7806                 rp.instance = cp->instance;
7807                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7808                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7809                 goto unlock;
7810         }
7811
7812         /* We're good to go, update advertising data, parameters, and start
7813          * advertising.
7814          */
7815         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7816                                data_len);
7817         if (!cmd) {
7818                 err = -ENOMEM;
7819                 goto unlock;
7820         }
7821
7822         hci_req_init(&req, hdev);
7823
7824         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7825
7826         if (!err)
7827                 err = hci_req_run(&req, add_advertising_complete);
7828
7829         if (err < 0) {
7830                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7831                                       MGMT_STATUS_FAILED);
7832                 mgmt_pending_remove(cmd);
7833         }
7834
7835 unlock:
7836         hci_dev_unlock(hdev);
7837
7838         return err;
7839 }
7840
7841 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
7842                                         u16 opcode)
7843 {
7844         struct mgmt_pending_cmd *cmd;
7845         struct mgmt_cp_add_ext_adv_params *cp;
7846         struct mgmt_rp_add_ext_adv_params rp;
7847         struct adv_info *adv_instance;
7848         u32 flags;
7849
7850         BT_DBG("%s", hdev->name);
7851
7852         hci_dev_lock(hdev);
7853
7854         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
7855         if (!cmd)
7856                 goto unlock;
7857
7858         cp = cmd->param;
7859         adv_instance = hci_find_adv_instance(hdev, cp->instance);
7860         if (!adv_instance)
7861                 goto unlock;
7862
7863         rp.instance = cp->instance;
7864         rp.tx_power = adv_instance->tx_power;
7865
7866         /* While we're at it, inform userspace of the available space for this
7867          * advertisement, given the flags that will be used.
7868          */
7869         flags = __le32_to_cpu(cp->flags);
7870         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7871         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7872
7873         if (status) {
7874                 /* If this advertisement was previously advertising and we
7875                  * failed to update it, we signal that it has been removed and
7876                  * delete its structure
7877                  */
7878                 if (!adv_instance->pending)
7879                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
7880
7881                 hci_remove_adv_instance(hdev, cp->instance);
7882
7883                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7884                                 mgmt_status(status));
7885
7886         } else {
7887                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7888                                   mgmt_status(status), &rp, sizeof(rp));
7889         }
7890
7891 unlock:
7892         if (cmd)
7893                 mgmt_pending_remove(cmd);
7894
7895         hci_dev_unlock(hdev);
7896 }
7897
7898 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
7899                               void *data, u16 data_len)
7900 {
7901         struct mgmt_cp_add_ext_adv_params *cp = data;
7902         struct mgmt_rp_add_ext_adv_params rp;
7903         struct mgmt_pending_cmd *cmd = NULL;
7904         struct adv_info *adv_instance;
7905         struct hci_request req;
7906         u32 flags, min_interval, max_interval;
7907         u16 timeout, duration;
7908         u8 status;
7909         s8 tx_power;
7910         int err;
7911
7912         BT_DBG("%s", hdev->name);
7913
7914         status = mgmt_le_support(hdev);
7915         if (status)
7916                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7917                                        status);
7918
7919         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7920                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7921                                        MGMT_STATUS_INVALID_PARAMS);
7922
7923         /* The purpose of breaking add_advertising into two separate MGMT calls
7924          * for params and data is to allow more parameters to be added to this
7925          * structure in the future. For this reason, we verify that we have the
7926          * bare minimum structure we know of when the interface was defined. Any
7927          * extra parameters we don't know about will be ignored in this request.
7928          */
7929         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
7930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7931                                        MGMT_STATUS_INVALID_PARAMS);
7932
7933         flags = __le32_to_cpu(cp->flags);
7934
7935         if (!requested_adv_flags_are_valid(hdev, flags))
7936                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7937                                        MGMT_STATUS_INVALID_PARAMS);
7938
7939         hci_dev_lock(hdev);
7940
7941         /* In new interface, we require that we are powered to register */
7942         if (!hdev_is_powered(hdev)) {
7943                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7944                                       MGMT_STATUS_REJECTED);
7945                 goto unlock;
7946         }
7947
7948         if (adv_busy(hdev)) {
7949                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7950                                       MGMT_STATUS_BUSY);
7951                 goto unlock;
7952         }
7953
7954         /* Parse defined parameters from request, use defaults otherwise */
7955         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
7956                   __le16_to_cpu(cp->timeout) : 0;
7957
7958         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
7959                    __le16_to_cpu(cp->duration) :
7960                    hdev->def_multi_adv_rotation_duration;
7961
7962         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7963                        __le32_to_cpu(cp->min_interval) :
7964                        hdev->le_adv_min_interval;
7965
7966         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7967                        __le32_to_cpu(cp->max_interval) :
7968                        hdev->le_adv_max_interval;
7969
7970         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
7971                    cp->tx_power :
7972                    HCI_ADV_TX_POWER_NO_PREFERENCE;
7973
7974         /* Create advertising instance with no advertising or response data */
7975         err = hci_add_adv_instance(hdev, cp->instance, flags,
7976                                    0, NULL, 0, NULL, timeout, duration,
7977                                    tx_power, min_interval, max_interval);
7978
7979         if (err < 0) {
7980                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7981                                       MGMT_STATUS_FAILED);
7982                 goto unlock;
7983         }
7984
7985         /* Submit request for advertising params if ext adv available */
7986         if (ext_adv_capable(hdev)) {
7987                 hci_req_init(&req, hdev);
7988                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7989
7990                 /* Updating parameters of an active instance will return a
7991                  * Command Disallowed error, so we must first disable the
7992                  * instance if it is active.
7993                  */
7994                 if (!adv_instance->pending)
7995                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
7996
7997                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
7998
7999                 err = hci_req_run(&req, add_ext_adv_params_complete);
8000
8001                 if (!err)
8002                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
8003                                                hdev, data, data_len);
8004                 if (!cmd) {
8005                         err = -ENOMEM;
8006                         hci_remove_adv_instance(hdev, cp->instance);
8007                         goto unlock;
8008                 }
8009
8010         } else {
8011                 rp.instance = cp->instance;
8012                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8013                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8014                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8015                 err = mgmt_cmd_complete(sk, hdev->id,
8016                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8017                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8018         }
8019
8020 unlock:
8021         hci_dev_unlock(hdev);
8022
8023         return err;
8024 }
8025
8026 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8027                             u16 data_len)
8028 {
8029         struct mgmt_cp_add_ext_adv_data *cp = data;
8030         struct mgmt_rp_add_ext_adv_data rp;
8031         u8 schedule_instance = 0;
8032         struct adv_info *next_instance;
8033         struct adv_info *adv_instance;
8034         int err = 0;
8035         struct mgmt_pending_cmd *cmd;
8036         struct hci_request req;
8037
8038         BT_DBG("%s", hdev->name);
8039
8040         hci_dev_lock(hdev);
8041
8042         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8043
8044         if (!adv_instance) {
8045                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8046                                       MGMT_STATUS_INVALID_PARAMS);
8047                 goto unlock;
8048         }
8049
8050         /* In new interface, we require that we are powered to register */
8051         if (!hdev_is_powered(hdev)) {
8052                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8053                                       MGMT_STATUS_REJECTED);
8054                 goto clear_new_instance;
8055         }
8056
8057         if (adv_busy(hdev)) {
8058                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8059                                       MGMT_STATUS_BUSY);
8060                 goto clear_new_instance;
8061         }
8062
8063         /* Validate new data */
8064         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8065                                cp->adv_data_len, true) ||
8066             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8067                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8068                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8069                                       MGMT_STATUS_INVALID_PARAMS);
8070                 goto clear_new_instance;
8071         }
8072
8073         /* Set the data in the advertising instance */
8074         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8075                                   cp->data, cp->scan_rsp_len,
8076                                   cp->data + cp->adv_data_len);
8077
8078         /* We're good to go, update advertising data, parameters, and start
8079          * advertising.
8080          */
8081
8082         hci_req_init(&req, hdev);
8083
8084         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
8085
8086         if (ext_adv_capable(hdev)) {
8087                 __hci_req_update_adv_data(&req, cp->instance);
8088                 __hci_req_update_scan_rsp_data(&req, cp->instance);
8089                 __hci_req_enable_ext_advertising(&req, cp->instance);
8090
8091         } else {
8092                 /* If using software rotation, determine next instance to use */
8093
8094                 if (hdev->cur_adv_instance == cp->instance) {
8095                         /* If the currently advertised instance is being changed
8096                          * then cancel the current advertising and schedule the
8097                          * next instance. If there is only one instance then the
8098                          * overridden advertising data will be visible right
8099                          * away
8100                          */
8101                         cancel_adv_timeout(hdev);
8102
8103                         next_instance = hci_get_next_instance(hdev,
8104                                                               cp->instance);
8105                         if (next_instance)
8106                                 schedule_instance = next_instance->instance;
8107                 } else if (!hdev->adv_instance_timeout) {
8108                         /* Immediately advertise the new instance if no other
8109                          * instance is currently being advertised.
8110                          */
8111                         schedule_instance = cp->instance;
8112                 }
8113
8114                 /* If the HCI_ADVERTISING flag is set or there is no instance to
8115                  * be advertised then we have no HCI communication to make.
8116                  * Simply return.
8117                  */
8118                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8119                     !schedule_instance) {
8120                         if (adv_instance->pending) {
8121                                 mgmt_advertising_added(sk, hdev, cp->instance);
8122                                 adv_instance->pending = false;
8123                         }
8124                         rp.instance = cp->instance;
8125                         err = mgmt_cmd_complete(sk, hdev->id,
8126                                                 MGMT_OP_ADD_EXT_ADV_DATA,
8127                                                 MGMT_STATUS_SUCCESS, &rp,
8128                                                 sizeof(rp));
8129                         goto unlock;
8130                 }
8131
8132                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
8133                                                       true);
8134         }
8135
8136         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8137                                data_len);
8138         if (!cmd) {
8139                 err = -ENOMEM;
8140                 goto clear_new_instance;
8141         }
8142
8143         if (!err)
8144                 err = hci_req_run(&req, add_advertising_complete);
8145
8146         if (err < 0) {
8147                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8148                                       MGMT_STATUS_FAILED);
8149                 mgmt_pending_remove(cmd);
8150                 goto clear_new_instance;
8151         }
8152
8153         /* We were successful in updating data, so trigger advertising_added
8154          * event if this is an instance that wasn't previously advertising. If
8155          * a failure occurs in the requests we initiated, we will remove the
8156          * instance again in add_advertising_complete
8157          */
8158         if (adv_instance->pending)
8159                 mgmt_advertising_added(sk, hdev, cp->instance);
8160
8161         goto unlock;
8162
8163 clear_new_instance:
8164         hci_remove_adv_instance(hdev, cp->instance);
8165
8166 unlock:
8167         hci_dev_unlock(hdev);
8168
8169         return err;
8170 }
8171
8172 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
8173                                         u16 opcode)
8174 {
8175         struct mgmt_pending_cmd *cmd;
8176         struct mgmt_cp_remove_advertising *cp;
8177         struct mgmt_rp_remove_advertising rp;
8178
8179         bt_dev_dbg(hdev, "status %d", status);
8180
8181         hci_dev_lock(hdev);
8182
8183         /* A failure status here only means that we failed to disable
8184          * advertising. Otherwise, the advertising instance has been removed,
8185          * so report success.
8186          */
8187         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
8188         if (!cmd)
8189                 goto unlock;
8190
8191         cp = cmd->param;
8192         rp.instance = cp->instance;
8193
8194         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
8195                           &rp, sizeof(rp));
8196         mgmt_pending_remove(cmd);
8197
8198 unlock:
8199         hci_dev_unlock(hdev);
8200 }
8201
8202 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8203                               void *data, u16 data_len)
8204 {
8205         struct mgmt_cp_remove_advertising *cp = data;
8206         struct mgmt_rp_remove_advertising rp;
8207         struct mgmt_pending_cmd *cmd;
8208         struct hci_request req;
8209         int err;
8210
8211         bt_dev_dbg(hdev, "sock %p", sk);
8212
8213         /* Enabling the experimental LL Privay support disables support for
8214          * advertising.
8215          */
8216         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8218                                        MGMT_STATUS_NOT_SUPPORTED);
8219
8220         hci_dev_lock(hdev);
8221
8222         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8223                 err = mgmt_cmd_status(sk, hdev->id,
8224                                       MGMT_OP_REMOVE_ADVERTISING,
8225                                       MGMT_STATUS_INVALID_PARAMS);
8226                 goto unlock;
8227         }
8228
8229         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8230             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8231             pending_find(MGMT_OP_SET_LE, hdev)) {
8232                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8233                                       MGMT_STATUS_BUSY);
8234                 goto unlock;
8235         }
8236
8237         if (list_empty(&hdev->adv_instances)) {
8238                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8239                                       MGMT_STATUS_INVALID_PARAMS);
8240                 goto unlock;
8241         }
8242
8243         hci_req_init(&req, hdev);
8244
8245         /* If we use extended advertising, instance is disabled and removed */
8246         if (ext_adv_capable(hdev)) {
8247                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
8248                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
8249         }
8250
8251         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8252
8253         if (list_empty(&hdev->adv_instances))
8254                 __hci_req_disable_advertising(&req);
8255
8256         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8257          * flag is set or the device isn't powered then we have no HCI
8258          * communication to make. Simply return.
8259          */
8260         if (skb_queue_empty(&req.cmd_q) ||
8261             !hdev_is_powered(hdev) ||
8262             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8263                 hci_req_purge(&req);
8264                 rp.instance = cp->instance;
8265                 err = mgmt_cmd_complete(sk, hdev->id,
8266                                         MGMT_OP_REMOVE_ADVERTISING,
8267                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8268                 goto unlock;
8269         }
8270
8271         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8272                                data_len);
8273         if (!cmd) {
8274                 err = -ENOMEM;
8275                 goto unlock;
8276         }
8277
8278         err = hci_req_run(&req, remove_advertising_complete);
8279         if (err < 0)
8280                 mgmt_pending_remove(cmd);
8281
8282 unlock:
8283         hci_dev_unlock(hdev);
8284
8285         return err;
8286 }
8287
8288 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8289                              void *data, u16 data_len)
8290 {
8291         struct mgmt_cp_get_adv_size_info *cp = data;
8292         struct mgmt_rp_get_adv_size_info rp;
8293         u32 flags, supported_flags;
8294         int err;
8295
8296         bt_dev_dbg(hdev, "sock %p", sk);
8297
8298         if (!lmp_le_capable(hdev))
8299                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8300                                        MGMT_STATUS_REJECTED);
8301
8302         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8303                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8304                                        MGMT_STATUS_INVALID_PARAMS);
8305
8306         flags = __le32_to_cpu(cp->flags);
8307
8308         /* The current implementation only supports a subset of the specified
8309          * flags.
8310          */
8311         supported_flags = get_supported_adv_flags(hdev);
8312         if (flags & ~supported_flags)
8313                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8314                                        MGMT_STATUS_INVALID_PARAMS);
8315
8316         rp.instance = cp->instance;
8317         rp.flags = cp->flags;
8318         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8319         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8320
8321         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8322                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8323
8324         return err;
8325 }
8326
8327 static const struct hci_mgmt_handler mgmt_handlers[] = {
8328         { NULL }, /* 0x0000 (no command) */
8329         { read_version,            MGMT_READ_VERSION_SIZE,
8330                                                 HCI_MGMT_NO_HDEV |
8331                                                 HCI_MGMT_UNTRUSTED },
8332         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8333                                                 HCI_MGMT_NO_HDEV |
8334                                                 HCI_MGMT_UNTRUSTED },
8335         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8336                                                 HCI_MGMT_NO_HDEV |
8337                                                 HCI_MGMT_UNTRUSTED },
8338         { read_controller_info,    MGMT_READ_INFO_SIZE,
8339                                                 HCI_MGMT_UNTRUSTED },
8340         { set_powered,             MGMT_SETTING_SIZE },
8341         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8342         { set_connectable,         MGMT_SETTING_SIZE },
8343         { set_fast_connectable,    MGMT_SETTING_SIZE },
8344         { set_bondable,            MGMT_SETTING_SIZE },
8345         { set_link_security,       MGMT_SETTING_SIZE },
8346         { set_ssp,                 MGMT_SETTING_SIZE },
8347         { set_hs,                  MGMT_SETTING_SIZE },
8348         { set_le,                  MGMT_SETTING_SIZE },
8349         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8350         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8351         { add_uuid,                MGMT_ADD_UUID_SIZE },
8352         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8353         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8354                                                 HCI_MGMT_VAR_LEN },
8355         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8356                                                 HCI_MGMT_VAR_LEN },
8357         { disconnect,              MGMT_DISCONNECT_SIZE },
8358         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8359         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8360         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8361         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8362         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8363         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8364         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8365         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8366         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8367         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8368         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8369         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8370         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8371                                                 HCI_MGMT_VAR_LEN },
8372         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8373         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8374         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8375         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8376         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8377         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8378         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8379         { set_advertising,         MGMT_SETTING_SIZE },
8380         { set_bredr,               MGMT_SETTING_SIZE },
8381         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8382         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8383         { set_secure_conn,         MGMT_SETTING_SIZE },
8384         { set_debug_keys,          MGMT_SETTING_SIZE },
8385         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8386         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8387                                                 HCI_MGMT_VAR_LEN },
8388         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8389         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8390         { add_device,              MGMT_ADD_DEVICE_SIZE },
8391         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8392         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8393                                                 HCI_MGMT_VAR_LEN },
8394         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8395                                                 HCI_MGMT_NO_HDEV |
8396                                                 HCI_MGMT_UNTRUSTED },
8397         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8398                                                 HCI_MGMT_UNCONFIGURED |
8399                                                 HCI_MGMT_UNTRUSTED },
8400         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8401                                                 HCI_MGMT_UNCONFIGURED },
8402         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8403                                                 HCI_MGMT_UNCONFIGURED },
8404         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8405                                                 HCI_MGMT_VAR_LEN },
8406         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8407         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8408                                                 HCI_MGMT_NO_HDEV |
8409                                                 HCI_MGMT_UNTRUSTED },
8410         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8411         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8412                                                 HCI_MGMT_VAR_LEN },
8413         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8414         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8415         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8416         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8417                                                 HCI_MGMT_UNTRUSTED },
8418         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8419         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8420         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8421         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8422                                                 HCI_MGMT_VAR_LEN },
8423         { set_wideband_speech,     MGMT_SETTING_SIZE },
8424         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8425                                                 HCI_MGMT_UNTRUSTED },
8426         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8427                                                 HCI_MGMT_UNTRUSTED |
8428                                                 HCI_MGMT_HDEV_OPTIONAL },
8429         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8430                                                 HCI_MGMT_VAR_LEN |
8431                                                 HCI_MGMT_HDEV_OPTIONAL },
8432         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8433                                                 HCI_MGMT_UNTRUSTED },
8434         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8435                                                 HCI_MGMT_VAR_LEN },
8436         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8437                                                 HCI_MGMT_UNTRUSTED },
8438         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8439                                                 HCI_MGMT_VAR_LEN },
8440         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8441         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8442         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8443         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8444                                                 HCI_MGMT_VAR_LEN },
8445         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8446         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8447                                                 HCI_MGMT_VAR_LEN },
8448         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8449                                                 HCI_MGMT_VAR_LEN },
8450         { add_adv_patterns_monitor_rssi,
8451                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8452                                                 HCI_MGMT_VAR_LEN },
8453 };
8454
8455 void mgmt_index_added(struct hci_dev *hdev)
8456 {
8457         struct mgmt_ev_ext_index ev;
8458
8459         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8460                 return;
8461
8462         switch (hdev->dev_type) {
8463         case HCI_PRIMARY:
8464                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8465                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8466                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8467                         ev.type = 0x01;
8468                 } else {
8469                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8470                                          HCI_MGMT_INDEX_EVENTS);
8471                         ev.type = 0x00;
8472                 }
8473                 break;
8474         case HCI_AMP:
8475                 ev.type = 0x02;
8476                 break;
8477         default:
8478                 return;
8479         }
8480
8481         ev.bus = hdev->bus;
8482
8483         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8484                          HCI_MGMT_EXT_INDEX_EVENTS);
8485 }
8486
8487 void mgmt_index_removed(struct hci_dev *hdev)
8488 {
8489         struct mgmt_ev_ext_index ev;
8490         u8 status = MGMT_STATUS_INVALID_INDEX;
8491
8492         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8493                 return;
8494
8495         switch (hdev->dev_type) {
8496         case HCI_PRIMARY:
8497                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8498
8499                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8500                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8501                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8502                         ev.type = 0x01;
8503                 } else {
8504                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8505                                          HCI_MGMT_INDEX_EVENTS);
8506                         ev.type = 0x00;
8507                 }
8508                 break;
8509         case HCI_AMP:
8510                 ev.type = 0x02;
8511                 break;
8512         default:
8513                 return;
8514         }
8515
8516         ev.bus = hdev->bus;
8517
8518         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8519                          HCI_MGMT_EXT_INDEX_EVENTS);
8520 }
8521
8522 /* This function requires the caller holds hdev->lock */
8523 static void restart_le_actions(struct hci_dev *hdev)
8524 {
8525         struct hci_conn_params *p;
8526
8527         list_for_each_entry(p, &hdev->le_conn_params, list) {
8528                 /* Needed for AUTO_OFF case where might not "really"
8529                  * have been powered off.
8530                  */
8531                 list_del_init(&p->action);
8532
8533                 switch (p->auto_connect) {
8534                 case HCI_AUTO_CONN_DIRECT:
8535                 case HCI_AUTO_CONN_ALWAYS:
8536                         list_add(&p->action, &hdev->pend_le_conns);
8537                         break;
8538                 case HCI_AUTO_CONN_REPORT:
8539                         list_add(&p->action, &hdev->pend_le_reports);
8540                         break;
8541                 default:
8542                         break;
8543                 }
8544         }
8545 }
8546
8547 void mgmt_power_on(struct hci_dev *hdev, int err)
8548 {
8549         struct cmd_lookup match = { NULL, hdev };
8550
8551         bt_dev_dbg(hdev, "err %d", err);
8552
8553         hci_dev_lock(hdev);
8554
8555         if (!err) {
8556                 restart_le_actions(hdev);
8557                 hci_update_background_scan(hdev);
8558         }
8559
8560         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8561
8562         new_settings(hdev, match.sk);
8563
8564         if (match.sk)
8565                 sock_put(match.sk);
8566
8567         hci_dev_unlock(hdev);
8568 }
8569
8570 void __mgmt_power_off(struct hci_dev *hdev)
8571 {
8572         struct cmd_lookup match = { NULL, hdev };
8573         u8 status, zero_cod[] = { 0, 0, 0 };
8574
8575         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8576
8577         /* If the power off is because of hdev unregistration let
8578          * use the appropriate INVALID_INDEX status. Otherwise use
8579          * NOT_POWERED. We cover both scenarios here since later in
8580          * mgmt_index_removed() any hci_conn callbacks will have already
8581          * been triggered, potentially causing misleading DISCONNECTED
8582          * status responses.
8583          */
8584         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8585                 status = MGMT_STATUS_INVALID_INDEX;
8586         else
8587                 status = MGMT_STATUS_NOT_POWERED;
8588
8589         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8590
8591         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8592                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8593                                    zero_cod, sizeof(zero_cod),
8594                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8595                 ext_info_changed(hdev, NULL);
8596         }
8597
8598         new_settings(hdev, match.sk);
8599
8600         if (match.sk)
8601                 sock_put(match.sk);
8602 }
8603
8604 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8605 {
8606         struct mgmt_pending_cmd *cmd;
8607         u8 status;
8608
8609         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8610         if (!cmd)
8611                 return;
8612
8613         if (err == -ERFKILL)
8614                 status = MGMT_STATUS_RFKILLED;
8615         else
8616                 status = MGMT_STATUS_FAILED;
8617
8618         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8619
8620         mgmt_pending_remove(cmd);
8621 }
8622
8623 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8624                        bool persistent)
8625 {
8626         struct mgmt_ev_new_link_key ev;
8627
8628         memset(&ev, 0, sizeof(ev));
8629
8630         ev.store_hint = persistent;
8631         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8632         ev.key.addr.type = BDADDR_BREDR;
8633         ev.key.type = key->type;
8634         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8635         ev.key.pin_len = key->pin_len;
8636
8637         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8638 }
8639
8640 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8641 {
8642         switch (ltk->type) {
8643         case SMP_LTK:
8644         case SMP_LTK_SLAVE:
8645                 if (ltk->authenticated)
8646                         return MGMT_LTK_AUTHENTICATED;
8647                 return MGMT_LTK_UNAUTHENTICATED;
8648         case SMP_LTK_P256:
8649                 if (ltk->authenticated)
8650                         return MGMT_LTK_P256_AUTH;
8651                 return MGMT_LTK_P256_UNAUTH;
8652         case SMP_LTK_P256_DEBUG:
8653                 return MGMT_LTK_P256_DEBUG;
8654         }
8655
8656         return MGMT_LTK_UNAUTHENTICATED;
8657 }
8658
8659 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8660 {
8661         struct mgmt_ev_new_long_term_key ev;
8662
8663         memset(&ev, 0, sizeof(ev));
8664
8665         /* Devices using resolvable or non-resolvable random addresses
8666          * without providing an identity resolving key don't require
8667          * to store long term keys. Their addresses will change the
8668          * next time around.
8669          *
8670          * Only when a remote device provides an identity address
8671          * make sure the long term key is stored. If the remote
8672          * identity is known, the long term keys are internally
8673          * mapped to the identity address. So allow static random
8674          * and public addresses here.
8675          */
8676         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8677             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8678                 ev.store_hint = 0x00;
8679         else
8680                 ev.store_hint = persistent;
8681
8682         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8683         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8684         ev.key.type = mgmt_ltk_type(key);
8685         ev.key.enc_size = key->enc_size;
8686         ev.key.ediv = key->ediv;
8687         ev.key.rand = key->rand;
8688
8689         if (key->type == SMP_LTK)
8690                 ev.key.master = 1;
8691
8692         /* Make sure we copy only the significant bytes based on the
8693          * encryption key size, and set the rest of the value to zeroes.
8694          */
8695         memcpy(ev.key.val, key->val, key->enc_size);
8696         memset(ev.key.val + key->enc_size, 0,
8697                sizeof(ev.key.val) - key->enc_size);
8698
8699         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8700 }
8701
8702 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8703 {
8704         struct mgmt_ev_new_irk ev;
8705
8706         memset(&ev, 0, sizeof(ev));
8707
8708         ev.store_hint = persistent;
8709
8710         bacpy(&ev.rpa, &irk->rpa);
8711         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8712         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8713         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8714
8715         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8716 }
8717
8718 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8719                    bool persistent)
8720 {
8721         struct mgmt_ev_new_csrk ev;
8722
8723         memset(&ev, 0, sizeof(ev));
8724
8725         /* Devices using resolvable or non-resolvable random addresses
8726          * without providing an identity resolving key don't require
8727          * to store signature resolving keys. Their addresses will change
8728          * the next time around.
8729          *
8730          * Only when a remote device provides an identity address
8731          * make sure the signature resolving key is stored. So allow
8732          * static random and public addresses here.
8733          */
8734         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8735             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8736                 ev.store_hint = 0x00;
8737         else
8738                 ev.store_hint = persistent;
8739
8740         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8741         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8742         ev.key.type = csrk->type;
8743         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8744
8745         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8746 }
8747
8748 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8749                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8750                          u16 max_interval, u16 latency, u16 timeout)
8751 {
8752         struct mgmt_ev_new_conn_param ev;
8753
8754         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8755                 return;
8756
8757         memset(&ev, 0, sizeof(ev));
8758         bacpy(&ev.addr.bdaddr, bdaddr);
8759         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8760         ev.store_hint = store_hint;
8761         ev.min_interval = cpu_to_le16(min_interval);
8762         ev.max_interval = cpu_to_le16(max_interval);
8763         ev.latency = cpu_to_le16(latency);
8764         ev.timeout = cpu_to_le16(timeout);
8765
8766         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8767 }
8768
8769 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8770                            u32 flags, u8 *name, u8 name_len)
8771 {
8772         char buf[512];
8773         struct mgmt_ev_device_connected *ev = (void *) buf;
8774         u16 eir_len = 0;
8775
8776         bacpy(&ev->addr.bdaddr, &conn->dst);
8777         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8778
8779         ev->flags = __cpu_to_le32(flags);
8780
8781         /* We must ensure that the EIR Data fields are ordered and
8782          * unique. Keep it simple for now and avoid the problem by not
8783          * adding any BR/EDR data to the LE adv.
8784          */
8785         if (conn->le_adv_data_len > 0) {
8786                 memcpy(&ev->eir[eir_len],
8787                        conn->le_adv_data, conn->le_adv_data_len);
8788                 eir_len = conn->le_adv_data_len;
8789         } else {
8790                 if (name_len > 0)
8791                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8792                                                   name, name_len);
8793
8794                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8795                         eir_len = eir_append_data(ev->eir, eir_len,
8796                                                   EIR_CLASS_OF_DEV,
8797                                                   conn->dev_class, 3);
8798         }
8799
8800         ev->eir_len = cpu_to_le16(eir_len);
8801
8802         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8803                     sizeof(*ev) + eir_len, NULL);
8804 }
8805
8806 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8807 {
8808         struct sock **sk = data;
8809
8810         cmd->cmd_complete(cmd, 0);
8811
8812         *sk = cmd->sk;
8813         sock_hold(*sk);
8814
8815         mgmt_pending_remove(cmd);
8816 }
8817
8818 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8819 {
8820         struct hci_dev *hdev = data;
8821         struct mgmt_cp_unpair_device *cp = cmd->param;
8822
8823         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8824
8825         cmd->cmd_complete(cmd, 0);
8826         mgmt_pending_remove(cmd);
8827 }
8828
8829 bool mgmt_powering_down(struct hci_dev *hdev)
8830 {
8831         struct mgmt_pending_cmd *cmd;
8832         struct mgmt_mode *cp;
8833
8834         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8835         if (!cmd)
8836                 return false;
8837
8838         cp = cmd->param;
8839         if (!cp->val)
8840                 return true;
8841
8842         return false;
8843 }
8844
8845 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8846                               u8 link_type, u8 addr_type, u8 reason,
8847                               bool mgmt_connected)
8848 {
8849         struct mgmt_ev_device_disconnected ev;
8850         struct sock *sk = NULL;
8851
8852         /* The connection is still in hci_conn_hash so test for 1
8853          * instead of 0 to know if this is the last one.
8854          */
8855         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8856                 cancel_delayed_work(&hdev->power_off);
8857                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8858         }
8859
8860         if (!mgmt_connected)
8861                 return;
8862
8863         if (link_type != ACL_LINK && link_type != LE_LINK)
8864                 return;
8865
8866         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8867
8868         bacpy(&ev.addr.bdaddr, bdaddr);
8869         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8870         ev.reason = reason;
8871
8872         /* Report disconnects due to suspend */
8873         if (hdev->suspended)
8874                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8875
8876         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8877
8878         if (sk)
8879                 sock_put(sk);
8880
8881         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8882                              hdev);
8883 }
8884
8885 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8886                             u8 link_type, u8 addr_type, u8 status)
8887 {
8888         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8889         struct mgmt_cp_disconnect *cp;
8890         struct mgmt_pending_cmd *cmd;
8891
8892         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8893                              hdev);
8894
8895         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8896         if (!cmd)
8897                 return;
8898
8899         cp = cmd->param;
8900
8901         if (bacmp(bdaddr, &cp->addr.bdaddr))
8902                 return;
8903
8904         if (cp->addr.type != bdaddr_type)
8905                 return;
8906
8907         cmd->cmd_complete(cmd, mgmt_status(status));
8908         mgmt_pending_remove(cmd);
8909 }
8910
8911 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8912                          u8 addr_type, u8 status)
8913 {
8914         struct mgmt_ev_connect_failed ev;
8915
8916         /* The connection is still in hci_conn_hash so test for 1
8917          * instead of 0 to know if this is the last one.
8918          */
8919         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8920                 cancel_delayed_work(&hdev->power_off);
8921                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8922         }
8923
8924         bacpy(&ev.addr.bdaddr, bdaddr);
8925         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8926         ev.status = mgmt_status(status);
8927
8928         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8929 }
8930
8931 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8932 {
8933         struct mgmt_ev_pin_code_request ev;
8934
8935         bacpy(&ev.addr.bdaddr, bdaddr);
8936         ev.addr.type = BDADDR_BREDR;
8937         ev.secure = secure;
8938
8939         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8940 }
8941
8942 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8943                                   u8 status)
8944 {
8945         struct mgmt_pending_cmd *cmd;
8946
8947         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8948         if (!cmd)
8949                 return;
8950
8951         cmd->cmd_complete(cmd, mgmt_status(status));
8952         mgmt_pending_remove(cmd);
8953 }
8954
8955 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8956                                       u8 status)
8957 {
8958         struct mgmt_pending_cmd *cmd;
8959
8960         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8961         if (!cmd)
8962                 return;
8963
8964         cmd->cmd_complete(cmd, mgmt_status(status));
8965         mgmt_pending_remove(cmd);
8966 }
8967
8968 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8969                               u8 link_type, u8 addr_type, u32 value,
8970                               u8 confirm_hint)
8971 {
8972         struct mgmt_ev_user_confirm_request ev;
8973
8974         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8975
8976         bacpy(&ev.addr.bdaddr, bdaddr);
8977         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8978         ev.confirm_hint = confirm_hint;
8979         ev.value = cpu_to_le32(value);
8980
8981         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8982                           NULL);
8983 }
8984
8985 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8986                               u8 link_type, u8 addr_type)
8987 {
8988         struct mgmt_ev_user_passkey_request ev;
8989
8990         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8991
8992         bacpy(&ev.addr.bdaddr, bdaddr);
8993         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8994
8995         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8996                           NULL);
8997 }
8998
8999 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9000                                       u8 link_type, u8 addr_type, u8 status,
9001                                       u8 opcode)
9002 {
9003         struct mgmt_pending_cmd *cmd;
9004
9005         cmd = pending_find(opcode, hdev);
9006         if (!cmd)
9007                 return -ENOENT;
9008
9009         cmd->cmd_complete(cmd, mgmt_status(status));
9010         mgmt_pending_remove(cmd);
9011
9012         return 0;
9013 }
9014
9015 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9016                                      u8 link_type, u8 addr_type, u8 status)
9017 {
9018         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9019                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9020 }
9021
9022 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9023                                          u8 link_type, u8 addr_type, u8 status)
9024 {
9025         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9026                                           status,
9027                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9028 }
9029
9030 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9031                                      u8 link_type, u8 addr_type, u8 status)
9032 {
9033         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9034                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9035 }
9036
9037 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9038                                          u8 link_type, u8 addr_type, u8 status)
9039 {
9040         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9041                                           status,
9042                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9043 }
9044
9045 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9046                              u8 link_type, u8 addr_type, u32 passkey,
9047                              u8 entered)
9048 {
9049         struct mgmt_ev_passkey_notify ev;
9050
9051         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9052
9053         bacpy(&ev.addr.bdaddr, bdaddr);
9054         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9055         ev.passkey = __cpu_to_le32(passkey);
9056         ev.entered = entered;
9057
9058         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9059 }
9060
9061 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9062 {
9063         struct mgmt_ev_auth_failed ev;
9064         struct mgmt_pending_cmd *cmd;
9065         u8 status = mgmt_status(hci_status);
9066
9067         bacpy(&ev.addr.bdaddr, &conn->dst);
9068         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9069         ev.status = status;
9070
9071         cmd = find_pairing(conn);
9072
9073         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9074                     cmd ? cmd->sk : NULL);
9075
9076         if (cmd) {
9077                 cmd->cmd_complete(cmd, status);
9078                 mgmt_pending_remove(cmd);
9079         }
9080 }
9081
9082 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9083 {
9084         struct cmd_lookup match = { NULL, hdev };
9085         bool changed;
9086
9087         if (status) {
9088                 u8 mgmt_err = mgmt_status(status);
9089                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9090                                      cmd_status_rsp, &mgmt_err);
9091                 return;
9092         }
9093
9094         if (test_bit(HCI_AUTH, &hdev->flags))
9095                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9096         else
9097                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9098
9099         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9100                              &match);
9101
9102         if (changed)
9103                 new_settings(hdev, match.sk);
9104
9105         if (match.sk)
9106                 sock_put(match.sk);
9107 }
9108
9109 static void clear_eir(struct hci_request *req)
9110 {
9111         struct hci_dev *hdev = req->hdev;
9112         struct hci_cp_write_eir cp;
9113
9114         if (!lmp_ext_inq_capable(hdev))
9115                 return;
9116
9117         memset(hdev->eir, 0, sizeof(hdev->eir));
9118
9119         memset(&cp, 0, sizeof(cp));
9120
9121         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9122 }
9123
9124 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9125 {
9126         struct cmd_lookup match = { NULL, hdev };
9127         struct hci_request req;
9128         bool changed = false;
9129
9130         if (status) {
9131                 u8 mgmt_err = mgmt_status(status);
9132
9133                 if (enable && hci_dev_test_and_clear_flag(hdev,
9134                                                           HCI_SSP_ENABLED)) {
9135                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9136                         new_settings(hdev, NULL);
9137                 }
9138
9139                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9140                                      &mgmt_err);
9141                 return;
9142         }
9143
9144         if (enable) {
9145                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
9146         } else {
9147                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9148                 if (!changed)
9149                         changed = hci_dev_test_and_clear_flag(hdev,
9150                                                               HCI_HS_ENABLED);
9151                 else
9152                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9153         }
9154
9155         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9156
9157         if (changed)
9158                 new_settings(hdev, match.sk);
9159
9160         if (match.sk)
9161                 sock_put(match.sk);
9162
9163         hci_req_init(&req, hdev);
9164
9165         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9166                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
9167                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9168                                     sizeof(enable), &enable);
9169                 __hci_req_update_eir(&req);
9170         } else {
9171                 clear_eir(&req);
9172         }
9173
9174         hci_req_run(&req, NULL);
9175 }
9176
9177 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9178 {
9179         struct cmd_lookup *match = data;
9180
9181         if (match->sk == NULL) {
9182                 match->sk = cmd->sk;
9183                 sock_hold(match->sk);
9184         }
9185 }
9186
9187 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9188                                     u8 status)
9189 {
9190         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9191
9192         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9193         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9194         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9195
9196         if (!status) {
9197                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9198                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9199                 ext_info_changed(hdev, NULL);
9200         }
9201
9202         if (match.sk)
9203                 sock_put(match.sk);
9204 }
9205
9206 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9207 {
9208         struct mgmt_cp_set_local_name ev;
9209         struct mgmt_pending_cmd *cmd;
9210
9211         if (status)
9212                 return;
9213
9214         memset(&ev, 0, sizeof(ev));
9215         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9216         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9217
9218         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9219         if (!cmd) {
9220                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9221
9222                 /* If this is a HCI command related to powering on the
9223                  * HCI dev don't send any mgmt signals.
9224                  */
9225                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9226                         return;
9227         }
9228
9229         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9230                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9231         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9232 }
9233
9234 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9235 {
9236         int i;
9237
9238         for (i = 0; i < uuid_count; i++) {
9239                 if (!memcmp(uuid, uuids[i], 16))
9240                         return true;
9241         }
9242
9243         return false;
9244 }
9245
9246 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9247 {
9248         u16 parsed = 0;
9249
9250         while (parsed < eir_len) {
9251                 u8 field_len = eir[0];
9252                 u8 uuid[16];
9253                 int i;
9254
9255                 if (field_len == 0)
9256                         break;
9257
9258                 if (eir_len - parsed < field_len + 1)
9259                         break;
9260
9261                 switch (eir[1]) {
9262                 case EIR_UUID16_ALL:
9263                 case EIR_UUID16_SOME:
9264                         for (i = 0; i + 3 <= field_len; i += 2) {
9265                                 memcpy(uuid, bluetooth_base_uuid, 16);
9266                                 uuid[13] = eir[i + 3];
9267                                 uuid[12] = eir[i + 2];
9268                                 if (has_uuid(uuid, uuid_count, uuids))
9269                                         return true;
9270                         }
9271                         break;
9272                 case EIR_UUID32_ALL:
9273                 case EIR_UUID32_SOME:
9274                         for (i = 0; i + 5 <= field_len; i += 4) {
9275                                 memcpy(uuid, bluetooth_base_uuid, 16);
9276                                 uuid[15] = eir[i + 5];
9277                                 uuid[14] = eir[i + 4];
9278                                 uuid[13] = eir[i + 3];
9279                                 uuid[12] = eir[i + 2];
9280                                 if (has_uuid(uuid, uuid_count, uuids))
9281                                         return true;
9282                         }
9283                         break;
9284                 case EIR_UUID128_ALL:
9285                 case EIR_UUID128_SOME:
9286                         for (i = 0; i + 17 <= field_len; i += 16) {
9287                                 memcpy(uuid, eir + i + 2, 16);
9288                                 if (has_uuid(uuid, uuid_count, uuids))
9289                                         return true;
9290                         }
9291                         break;
9292                 }
9293
9294                 parsed += field_len + 1;
9295                 eir += field_len + 1;
9296         }
9297
9298         return false;
9299 }
9300
9301 static void restart_le_scan(struct hci_dev *hdev)
9302 {
9303         /* If controller is not scanning we are done. */
9304         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9305                 return;
9306
9307         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9308                        hdev->discovery.scan_start +
9309                        hdev->discovery.scan_duration))
9310                 return;
9311
9312         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9313                            DISCOV_LE_RESTART_DELAY);
9314 }
9315
9316 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9317                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9318 {
9319         /* If a RSSI threshold has been specified, and
9320          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9321          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9322          * is set, let it through for further processing, as we might need to
9323          * restart the scan.
9324          *
9325          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9326          * the results are also dropped.
9327          */
9328         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9329             (rssi == HCI_RSSI_INVALID ||
9330             (rssi < hdev->discovery.rssi &&
9331              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9332                 return  false;
9333
9334         if (hdev->discovery.uuid_count != 0) {
9335                 /* If a list of UUIDs is provided in filter, results with no
9336                  * matching UUID should be dropped.
9337                  */
9338                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9339                                    hdev->discovery.uuids) &&
9340                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9341                                    hdev->discovery.uuid_count,
9342                                    hdev->discovery.uuids))
9343                         return false;
9344         }
9345
9346         /* If duplicate filtering does not report RSSI changes, then restart
9347          * scanning to ensure updated result with updated RSSI values.
9348          */
9349         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9350                 restart_le_scan(hdev);
9351
9352                 /* Validate RSSI value against the RSSI threshold once more. */
9353                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9354                     rssi < hdev->discovery.rssi)
9355                         return false;
9356         }
9357
9358         return true;
9359 }
9360
9361 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9362                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9363                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9364 {
9365         char buf[512];
9366         struct mgmt_ev_device_found *ev = (void *)buf;
9367         size_t ev_size;
9368
9369         /* Don't send events for a non-kernel initiated discovery. With
9370          * LE one exception is if we have pend_le_reports > 0 in which
9371          * case we're doing passive scanning and want these events.
9372          */
9373         if (!hci_discovery_active(hdev)) {
9374                 if (link_type == ACL_LINK)
9375                         return;
9376                 if (link_type == LE_LINK &&
9377                     list_empty(&hdev->pend_le_reports) &&
9378                     !hci_is_adv_monitoring(hdev)) {
9379                         return;
9380                 }
9381         }
9382
9383         if (hdev->discovery.result_filtering) {
9384                 /* We are using service discovery */
9385                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9386                                      scan_rsp_len))
9387                         return;
9388         }
9389
9390         if (hdev->discovery.limited) {
9391                 /* Check for limited discoverable bit */
9392                 if (dev_class) {
9393                         if (!(dev_class[1] & 0x20))
9394                                 return;
9395                 } else {
9396                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9397                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9398                                 return;
9399                 }
9400         }
9401
9402         /* Make sure that the buffer is big enough. The 5 extra bytes
9403          * are for the potential CoD field.
9404          */
9405         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9406                 return;
9407
9408         memset(buf, 0, sizeof(buf));
9409
9410         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9411          * RSSI value was reported as 0 when not available. This behavior
9412          * is kept when using device discovery. This is required for full
9413          * backwards compatibility with the API.
9414          *
9415          * However when using service discovery, the value 127 will be
9416          * returned when the RSSI is not available.
9417          */
9418         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9419             link_type == ACL_LINK)
9420                 rssi = 0;
9421
9422         bacpy(&ev->addr.bdaddr, bdaddr);
9423         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9424         ev->rssi = rssi;
9425         ev->flags = cpu_to_le32(flags);
9426
9427         if (eir_len > 0)
9428                 /* Copy EIR or advertising data into event */
9429                 memcpy(ev->eir, eir, eir_len);
9430
9431         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9432                                        NULL))
9433                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9434                                           dev_class, 3);
9435
9436         if (scan_rsp_len > 0)
9437                 /* Append scan response data to event */
9438                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9439
9440         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9441         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9442
9443         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9444 }
9445
9446 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9447                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9448 {
9449         struct mgmt_ev_device_found *ev;
9450         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9451         u16 eir_len;
9452
9453         ev = (struct mgmt_ev_device_found *) buf;
9454
9455         memset(buf, 0, sizeof(buf));
9456
9457         bacpy(&ev->addr.bdaddr, bdaddr);
9458         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9459         ev->rssi = rssi;
9460
9461         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9462                                   name_len);
9463
9464         ev->eir_len = cpu_to_le16(eir_len);
9465
9466         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9467 }
9468
9469 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9470 {
9471         struct mgmt_ev_discovering ev;
9472
9473         bt_dev_dbg(hdev, "discovering %u", discovering);
9474
9475         memset(&ev, 0, sizeof(ev));
9476         ev.type = hdev->discovery.type;
9477         ev.discovering = discovering;
9478
9479         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9480 }
9481
9482 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9483 {
9484         struct mgmt_ev_controller_suspend ev;
9485
9486         ev.suspend_state = state;
9487         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9488 }
9489
9490 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9491                    u8 addr_type)
9492 {
9493         struct mgmt_ev_controller_resume ev;
9494
9495         ev.wake_reason = reason;
9496         if (bdaddr) {
9497                 bacpy(&ev.addr.bdaddr, bdaddr);
9498                 ev.addr.type = addr_type;
9499         } else {
9500                 memset(&ev.addr, 0, sizeof(ev.addr));
9501         }
9502
9503         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9504 }
9505
9506 static struct hci_mgmt_chan chan = {
9507         .channel        = HCI_CHANNEL_CONTROL,
9508         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9509         .handlers       = mgmt_handlers,
9510         .hdev_init      = mgmt_init_hdev,
9511 };
9512
9513 int mgmt_init(void)
9514 {
9515         return hci_mgmt_chan_register(&chan);
9516 }
9517
9518 void mgmt_exit(void)
9519 {
9520         hci_mgmt_chan_unregister(&chan);
9521 }