net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42 #include "aosp.h"
  43
  44 #define MGMT_VERSION    1
  45 #define MGMT_REVISION   22
  46
  47 static const u16 mgmt_commands[] = {
  48         MGMT_OP_READ_INDEX_LIST,
  49         MGMT_OP_READ_INFO,
  50         MGMT_OP_SET_POWERED,
  51         MGMT_OP_SET_DISCOVERABLE,
  52         MGMT_OP_SET_CONNECTABLE,
  53         MGMT_OP_SET_FAST_CONNECTABLE,
  54         MGMT_OP_SET_BONDABLE,
  55         MGMT_OP_SET_LINK_SECURITY,
  56         MGMT_OP_SET_SSP,
  57         MGMT_OP_SET_HS,
  58         MGMT_OP_SET_LE,
  59         MGMT_OP_SET_DEV_CLASS,
  60         MGMT_OP_SET_LOCAL_NAME,
  61         MGMT_OP_ADD_UUID,
  62         MGMT_OP_REMOVE_UUID,
  63         MGMT_OP_LOAD_LINK_KEYS,
  64         MGMT_OP_LOAD_LONG_TERM_KEYS,
  65         MGMT_OP_DISCONNECT,
  66         MGMT_OP_GET_CONNECTIONS,
  67         MGMT_OP_PIN_CODE_REPLY,
  68         MGMT_OP_PIN_CODE_NEG_REPLY,
  69         MGMT_OP_SET_IO_CAPABILITY,
  70         MGMT_OP_PAIR_DEVICE,
  71         MGMT_OP_CANCEL_PAIR_DEVICE,
  72         MGMT_OP_UNPAIR_DEVICE,
  73         MGMT_OP_USER_CONFIRM_REPLY,
  74         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  75         MGMT_OP_USER_PASSKEY_REPLY,
  76         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  77         MGMT_OP_READ_LOCAL_OOB_DATA,
  78         MGMT_OP_ADD_REMOTE_OOB_DATA,
  79         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  80         MGMT_OP_START_DISCOVERY,
  81         MGMT_OP_STOP_DISCOVERY,
  82         MGMT_OP_CONFIRM_NAME,
  83         MGMT_OP_BLOCK_DEVICE,
  84         MGMT_OP_UNBLOCK_DEVICE,
  85         MGMT_OP_SET_DEVICE_ID,
  86         MGMT_OP_SET_ADVERTISING,
  87         MGMT_OP_SET_BREDR,
  88         MGMT_OP_SET_STATIC_ADDRESS,
  89         MGMT_OP_SET_SCAN_PARAMS,
  90         MGMT_OP_SET_SECURE_CONN,
  91         MGMT_OP_SET_DEBUG_KEYS,
  92         MGMT_OP_SET_PRIVACY,
  93         MGMT_OP_LOAD_IRKS,
  94         MGMT_OP_GET_CONN_INFO,
  95         MGMT_OP_GET_CLOCK_INFO,
  96         MGMT_OP_ADD_DEVICE,
  97         MGMT_OP_REMOVE_DEVICE,
  98         MGMT_OP_LOAD_CONN_PARAM,
  99         MGMT_OP_READ_UNCONF_INDEX_LIST,
 100         MGMT_OP_READ_CONFIG_INFO,
 101         MGMT_OP_SET_EXTERNAL_CONFIG,
 102         MGMT_OP_SET_PUBLIC_ADDRESS,
 103         MGMT_OP_START_SERVICE_DISCOVERY,
 104         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 105         MGMT_OP_READ_EXT_INDEX_LIST,
 106         MGMT_OP_READ_ADV_FEATURES,
 107         MGMT_OP_ADD_ADVERTISING,
 108         MGMT_OP_REMOVE_ADVERTISING,
 109         MGMT_OP_GET_ADV_SIZE_INFO,
 110         MGMT_OP_START_LIMITED_DISCOVERY,
 111         MGMT_OP_READ_EXT_INFO,
 112         MGMT_OP_SET_APPEARANCE,
 113         MGMT_OP_GET_PHY_CONFIGURATION,
 114         MGMT_OP_SET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_BLOCKED_KEYS,
 116         MGMT_OP_SET_WIDEBAND_SPEECH,
 117         MGMT_OP_READ_CONTROLLER_CAP,
 118         MGMT_OP_READ_EXP_FEATURES_INFO,
 119         MGMT_OP_SET_EXP_FEATURE,
 120         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_GET_DEVICE_FLAGS,
 125         MGMT_OP_SET_DEVICE_FLAGS,
 126         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 127         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 128         MGMT_OP_REMOVE_ADV_MONITOR,
 129         MGMT_OP_ADD_EXT_ADV_PARAMS,
 130         MGMT_OP_ADD_EXT_ADV_DATA,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 132         MGMT_OP_SET_MESH_RECEIVER,
 133         MGMT_OP_MESH_READ_FEATURES,
 134         MGMT_OP_MESH_SEND,
 135         MGMT_OP_MESH_SEND_CANCEL,
 136 };
 137
 138 static const u16 mgmt_events[] = {
 139         MGMT_EV_CONTROLLER_ERROR,
 140         MGMT_EV_INDEX_ADDED,
 141         MGMT_EV_INDEX_REMOVED,
 142         MGMT_EV_NEW_SETTINGS,
 143         MGMT_EV_CLASS_OF_DEV_CHANGED,
 144         MGMT_EV_LOCAL_NAME_CHANGED,
 145         MGMT_EV_NEW_LINK_KEY,
 146         MGMT_EV_NEW_LONG_TERM_KEY,
 147         MGMT_EV_DEVICE_CONNECTED,
 148         MGMT_EV_DEVICE_DISCONNECTED,
 149         MGMT_EV_CONNECT_FAILED,
 150         MGMT_EV_PIN_CODE_REQUEST,
 151         MGMT_EV_USER_CONFIRM_REQUEST,
 152         MGMT_EV_USER_PASSKEY_REQUEST,
 153         MGMT_EV_AUTH_FAILED,
 154         MGMT_EV_DEVICE_FOUND,
 155         MGMT_EV_DISCOVERING,
 156         MGMT_EV_DEVICE_BLOCKED,
 157         MGMT_EV_DEVICE_UNBLOCKED,
 158         MGMT_EV_DEVICE_UNPAIRED,
 159         MGMT_EV_PASSKEY_NOTIFY,
 160         MGMT_EV_NEW_IRK,
 161         MGMT_EV_NEW_CSRK,
 162         MGMT_EV_DEVICE_ADDED,
 163         MGMT_EV_DEVICE_REMOVED,
 164         MGMT_EV_NEW_CONN_PARAM,
 165         MGMT_EV_UNCONF_INDEX_ADDED,
 166         MGMT_EV_UNCONF_INDEX_REMOVED,
 167         MGMT_EV_NEW_CONFIG_OPTIONS,
 168         MGMT_EV_EXT_INDEX_ADDED,
 169         MGMT_EV_EXT_INDEX_REMOVED,
 170         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 171         MGMT_EV_ADVERTISING_ADDED,
 172         MGMT_EV_ADVERTISING_REMOVED,
 173         MGMT_EV_EXT_INFO_CHANGED,
 174         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 175         MGMT_EV_EXP_FEATURE_CHANGED,
 176         MGMT_EV_DEVICE_FLAGS_CHANGED,
 177         MGMT_EV_ADV_MONITOR_ADDED,
 178         MGMT_EV_ADV_MONITOR_REMOVED,
 179         MGMT_EV_CONTROLLER_SUSPEND,
 180         MGMT_EV_CONTROLLER_RESUME,
 181         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 182         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 183 };
 184
 185 static const u16 mgmt_untrusted_commands[] = {
 186         MGMT_OP_READ_INDEX_LIST,
 187         MGMT_OP_READ_INFO,
 188         MGMT_OP_READ_UNCONF_INDEX_LIST,
 189         MGMT_OP_READ_CONFIG_INFO,
 190         MGMT_OP_READ_EXT_INDEX_LIST,
 191         MGMT_OP_READ_EXT_INFO,
 192         MGMT_OP_READ_CONTROLLER_CAP,
 193         MGMT_OP_READ_EXP_FEATURES_INFO,
 194         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 195         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 196 };
 197
 198 static const u16 mgmt_untrusted_events[] = {
 199         MGMT_EV_INDEX_ADDED,
 200         MGMT_EV_INDEX_REMOVED,
 201         MGMT_EV_NEW_SETTINGS,
 202         MGMT_EV_CLASS_OF_DEV_CHANGED,
 203         MGMT_EV_LOCAL_NAME_CHANGED,
 204         MGMT_EV_UNCONF_INDEX_ADDED,
 205         MGMT_EV_UNCONF_INDEX_REMOVED,
 206         MGMT_EV_NEW_CONFIG_OPTIONS,
 207         MGMT_EV_EXT_INDEX_ADDED,
 208         MGMT_EV_EXT_INDEX_REMOVED,
 209         MGMT_EV_EXT_INFO_CHANGED,
 210         MGMT_EV_EXP_FEATURE_CHANGED,
 211 };
 212
 213 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 214
 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 216                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 217
 218 /* HCI to MGMT error code conversion table */
 219 static const u8 mgmt_status_table[] = {
 220         MGMT_STATUS_SUCCESS,
 221         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 222         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 223         MGMT_STATUS_FAILED,             /* Hardware Failure */
 224         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 225         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 226         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 227         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 228         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 229         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 230         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 231         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 232         MGMT_STATUS_BUSY,               /* Command Disallowed */
 233         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 234         MGMT_STATUS_REJECTED,           /* Rejected Security */
 235         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 236         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 237         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 239         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 240         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 241         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 242         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 243         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 244         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 245         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 246         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 247         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 248         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 249         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 250         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 251         MGMT_STATUS_FAILED,             /* Unspecified Error */
 252         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 253         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 254         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 255         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 256         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 257         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 258         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 259         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 260         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 262         MGMT_STATUS_FAILED,             /* Transaction Collision */
 263         MGMT_STATUS_FAILED,             /* Reserved for future use */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 265         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 266         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 267         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 269         MGMT_STATUS_FAILED,             /* Reserved for future use */
 270         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 271         MGMT_STATUS_FAILED,             /* Reserved for future use */
 272         MGMT_STATUS_FAILED,             /* Slot Violation */
 273         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 274         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 275         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 276         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 277         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 278         MGMT_STATUS_BUSY,               /* Controller Busy */
 279         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 280         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 281         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 282         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 283         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 284 };
 285
 286 static u8 mgmt_errno_status(int err)
 287 {
 288         switch (err) {
 289         case 0:
 290                 return MGMT_STATUS_SUCCESS;
 291         case -EPERM:
 292                 return MGMT_STATUS_REJECTED;
 293         case -EINVAL:
 294                 return MGMT_STATUS_INVALID_PARAMS;
 295         case -EOPNOTSUPP:
 296                 return MGMT_STATUS_NOT_SUPPORTED;
 297         case -EBUSY:
 298                 return MGMT_STATUS_BUSY;
 299         case -ETIMEDOUT:
 300                 return MGMT_STATUS_AUTH_FAILED;
 301         case -ENOMEM:
 302                 return MGMT_STATUS_NO_RESOURCES;
 303         case -EISCONN:
 304                 return MGMT_STATUS_ALREADY_CONNECTED;
 305         case -ENOTCONN:
 306                 return MGMT_STATUS_DISCONNECTED;
 307         }
 308
 309         return MGMT_STATUS_FAILED;
 310 }
 311
 312 static u8 mgmt_status(int err)
 313 {
 314         if (err < 0)
 315                 return mgmt_errno_status(err);
 316
 317         if (err < ARRAY_SIZE(mgmt_status_table))
 318                 return mgmt_status_table[err];
 319
 320         return MGMT_STATUS_FAILED;
 321 }
 322
 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 324                             u16 len, int flag)
 325 {
 326         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 327                                flag, NULL);
 328 }
 329
 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 331                               u16 len, int flag, struct sock *skip_sk)
 332 {
 333         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 334                                flag, skip_sk);
 335 }
 336
 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 338                       struct sock *skip_sk)
 339 {
 340         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 341                                HCI_SOCK_TRUSTED, skip_sk);
 342 }
 343
 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 345 {
 346         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 347                                    skip_sk);
 348 }
 349
 350 static u8 le_addr_type(u8 mgmt_addr_type)
 351 {
 352         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 353                 return ADDR_LE_DEV_PUBLIC;
 354         else
 355                 return ADDR_LE_DEV_RANDOM;
 356 }
 357
 358 void mgmt_fill_version_info(void *ver)
 359 {
 360         struct mgmt_rp_read_version *rp = ver;
 361
 362         rp->version = MGMT_VERSION;
 363         rp->revision = cpu_to_le16(MGMT_REVISION);
 364 }
 365
 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 367                         u16 data_len)
 368 {
 369         struct mgmt_rp_read_version rp;
 370
 371         bt_dev_dbg(hdev, "sock %p", sk);
 372
 373         mgmt_fill_version_info(&rp);
 374
 375         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 376                                  &rp, sizeof(rp));
 377 }
 378
 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 380                          u16 data_len)
 381 {
 382         struct mgmt_rp_read_commands *rp;
 383         u16 num_commands, num_events;
 384         size_t rp_size;
 385         int i, err;
 386
 387         bt_dev_dbg(hdev, "sock %p", sk);
 388
 389         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 390                 num_commands = ARRAY_SIZE(mgmt_commands);
 391                 num_events = ARRAY_SIZE(mgmt_events);
 392         } else {
 393                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 394                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 395         }
 396
 397         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 398
 399         rp = kmalloc(rp_size, GFP_KERNEL);
 400         if (!rp)
 401                 return -ENOMEM;
 402
 403         rp->num_commands = cpu_to_le16(num_commands);
 404         rp->num_events = cpu_to_le16(num_events);
 405
 406         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 407                 __le16 *opcode = rp->opcodes;
 408
 409                 for (i = 0; i < num_commands; i++, opcode++)
 410                         put_unaligned_le16(mgmt_commands[i], opcode);
 411
 412                 for (i = 0; i < num_events; i++, opcode++)
 413                         put_unaligned_le16(mgmt_events[i], opcode);
 414         } else {
 415                 __le16 *opcode = rp->opcodes;
 416
 417                 for (i = 0; i < num_commands; i++, opcode++)
 418                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 419
 420                 for (i = 0; i < num_events; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 422         }
 423
 424         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 425                                 rp, rp_size);
 426         kfree(rp);
 427
 428         return err;
 429 }
 430
 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 432                            u16 data_len)
 433 {
 434         struct mgmt_rp_read_index_list *rp;
 435         struct hci_dev *d;
 436         size_t rp_len;
 437         u16 count;
 438         int err;
 439
 440         bt_dev_dbg(hdev, "sock %p", sk);
 441
 442         read_lock(&hci_dev_list_lock);
 443
 444         count = 0;
 445         list_for_each_entry(d, &hci_dev_list, list) {
 446                 if (d->dev_type == HCI_PRIMARY &&
 447                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 448                         count++;
 449         }
 450
 451         rp_len = sizeof(*rp) + (2 * count);
 452         rp = kmalloc(rp_len, GFP_ATOMIC);
 453         if (!rp) {
 454                 read_unlock(&hci_dev_list_lock);
 455                 return -ENOMEM;
 456         }
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 461                     hci_dev_test_flag(d, HCI_CONFIG) ||
 462                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 463                         continue;
 464
 465                 /* Devices marked as raw-only are neither configured
 466                  * nor unconfigured controllers.
 467                  */
 468                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 469                         continue;
 470
 471                 if (d->dev_type == HCI_PRIMARY &&
 472                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 473                         rp->index[count++] = cpu_to_le16(d->id);
 474                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 475                 }
 476         }
 477
 478         rp->num_controllers = cpu_to_le16(count);
 479         rp_len = sizeof(*rp) + (2 * count);
 480
 481         read_unlock(&hci_dev_list_lock);
 482
 483         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 484                                 0, rp, rp_len);
 485
 486         kfree(rp);
 487
 488         return err;
 489 }
 490
 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 492                                   void *data, u16 data_len)
 493 {
 494         struct mgmt_rp_read_unconf_index_list *rp;
 495         struct hci_dev *d;
 496         size_t rp_len;
 497         u16 count;
 498         int err;
 499
 500         bt_dev_dbg(hdev, "sock %p", sk);
 501
 502         read_lock(&hci_dev_list_lock);
 503
 504         count = 0;
 505         list_for_each_entry(d, &hci_dev_list, list) {
 506                 if (d->dev_type == HCI_PRIMARY &&
 507                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 508                         count++;
 509         }
 510
 511         rp_len = sizeof(*rp) + (2 * count);
 512         rp = kmalloc(rp_len, GFP_ATOMIC);
 513         if (!rp) {
 514                 read_unlock(&hci_dev_list_lock);
 515                 return -ENOMEM;
 516         }
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 521                     hci_dev_test_flag(d, HCI_CONFIG) ||
 522                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 523                         continue;
 524
 525                 /* Devices marked as raw-only are neither configured
 526                  * nor unconfigured controllers.
 527                  */
 528                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 529                         continue;
 530
 531                 if (d->dev_type == HCI_PRIMARY &&
 532                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 533                         rp->index[count++] = cpu_to_le16(d->id);
 534                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 535                 }
 536         }
 537
 538         rp->num_controllers = cpu_to_le16(count);
 539         rp_len = sizeof(*rp) + (2 * count);
 540
 541         read_unlock(&hci_dev_list_lock);
 542
 543         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 544                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 545
 546         kfree(rp);
 547
 548         return err;
 549 }
 550
 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 552                                void *data, u16 data_len)
 553 {
 554         struct mgmt_rp_read_ext_index_list *rp;
 555         struct hci_dev *d;
 556         u16 count;
 557         int err;
 558
 559         bt_dev_dbg(hdev, "sock %p", sk);
 560
 561         read_lock(&hci_dev_list_lock);
 562
 563         count = 0;
 564         list_for_each_entry(d, &hci_dev_list, list) {
 565                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 566                         count++;
 567         }
 568
 569         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 570         if (!rp) {
 571                 read_unlock(&hci_dev_list_lock);
 572                 return -ENOMEM;
 573         }
 574
 575         count = 0;
 576         list_for_each_entry(d, &hci_dev_list, list) {
 577                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 578                     hci_dev_test_flag(d, HCI_CONFIG) ||
 579                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 580                         continue;
 581
 582                 /* Devices marked as raw-only are neither configured
 583                  * nor unconfigured controllers.
 584                  */
 585                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 586                         continue;
 587
 588                 if (d->dev_type == HCI_PRIMARY) {
 589                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 590                                 rp->entry[count].type = 0x01;
 591                         else
 592                                 rp->entry[count].type = 0x00;
 593                 } else if (d->dev_type == HCI_AMP) {
 594                         rp->entry[count].type = 0x02;
 595                 } else {
 596                         continue;
 597                 }
 598
 599                 rp->entry[count].bus = d->bus;
 600                 rp->entry[count++].index = cpu_to_le16(d->id);
 601                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 602         }
 603
 604         rp->num_controllers = cpu_to_le16(count);
 605
 606         read_unlock(&hci_dev_list_lock);
 607
 608         /* If this command is called at least once, then all the
 609          * default index and unconfigured index events are disabled
 610          * and from now on only extended index events are used.
 611          */
 612         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 613         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 614         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 615
 616         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 617                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 618                                 struct_size(rp, entry, count));
 619
 620         kfree(rp);
 621
 622         return err;
 623 }
 624
 625 static bool is_configured(struct hci_dev *hdev)
 626 {
 627         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 628             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 629                 return false;
 630
 631         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 632              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 633             !bacmp(&hdev->public_addr, BDADDR_ANY))
 634                 return false;
 635
 636         return true;
 637 }
 638
 639 static __le32 get_missing_options(struct hci_dev *hdev)
 640 {
 641         u32 options = 0;
 642
 643         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 644             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 648              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 649             !bacmp(&hdev->public_addr, BDADDR_ANY))
 650                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 651
 652         return cpu_to_le32(options);
 653 }
 654
 655 static int new_options(struct hci_dev *hdev, struct sock *skip)
 656 {
 657         __le32 options = get_missing_options(hdev);
 658
 659         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 660                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 661 }
 662
 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 664 {
 665         __le32 options = get_missing_options(hdev);
 666
 667         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 668                                  sizeof(options));
 669 }
 670
 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 672                             void *data, u16 data_len)
 673 {
 674         struct mgmt_rp_read_config_info rp;
 675         u32 options = 0;
 676
 677         bt_dev_dbg(hdev, "sock %p", sk);
 678
 679         hci_dev_lock(hdev);
 680
 681         memset(&rp, 0, sizeof(rp));
 682         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 683
 684         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 685                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 686
 687         if (hdev->set_bdaddr)
 688                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 689
 690         rp.supported_options = cpu_to_le32(options);
 691         rp.missing_options = get_missing_options(hdev);
 692
 693         hci_dev_unlock(hdev);
 694
 695         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 696                                  &rp, sizeof(rp));
 697 }
 698
 699 static u32 get_supported_phys(struct hci_dev *hdev)
 700 {
 701         u32 supported_phys = 0;
 702
 703         if (lmp_bredr_capable(hdev)) {
 704                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 705
 706                 if (hdev->features[0][0] & LMP_3SLOT)
 707                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_5SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 711
 712                 if (lmp_edr_2m_capable(hdev)) {
 713                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 714
 715                         if (lmp_edr_3slot_capable(hdev))
 716                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 717
 718                         if (lmp_edr_5slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 720
 721                         if (lmp_edr_3m_capable(hdev)) {
 722                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 723
 724                                 if (lmp_edr_3slot_capable(hdev))
 725                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 726
 727                                 if (lmp_edr_5slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 729                         }
 730                 }
 731         }
 732
 733         if (lmp_le_capable(hdev)) {
 734                 supported_phys |= MGMT_PHY_LE_1M_TX;
 735                 supported_phys |= MGMT_PHY_LE_1M_RX;
 736
 737                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 738                         supported_phys |= MGMT_PHY_LE_2M_TX;
 739                         supported_phys |= MGMT_PHY_LE_2M_RX;
 740                 }
 741
 742                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 743                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 744                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 745                 }
 746         }
 747
 748         return supported_phys;
 749 }
 750
 751 static u32 get_selected_phys(struct hci_dev *hdev)
 752 {
 753         u32 selected_phys = 0;
 754
 755         if (lmp_bredr_capable(hdev)) {
 756                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 757
 758                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 759                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 762                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 763
 764                 if (lmp_edr_2m_capable(hdev)) {
 765                         if (!(hdev->pkt_type & HCI_2DH1))
 766                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 767
 768                         if (lmp_edr_3slot_capable(hdev) &&
 769                             !(hdev->pkt_type & HCI_2DH3))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 771
 772                         if (lmp_edr_5slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH5))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 775
 776                         if (lmp_edr_3m_capable(hdev)) {
 777                                 if (!(hdev->pkt_type & HCI_3DH1))
 778                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 779
 780                                 if (lmp_edr_3slot_capable(hdev) &&
 781                                     !(hdev->pkt_type & HCI_3DH3))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 783
 784                                 if (lmp_edr_5slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH5))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 787                         }
 788                 }
 789         }
 790
 791         if (lmp_le_capable(hdev)) {
 792                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 793                         selected_phys |= MGMT_PHY_LE_1M_TX;
 794
 795                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_RX;
 797
 798                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 799                         selected_phys |= MGMT_PHY_LE_2M_TX;
 800
 801                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_RX;
 803
 804                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 805                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 806
 807                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 809         }
 810
 811         return selected_phys;
 812 }
 813
 814 static u32 get_configurable_phys(struct hci_dev *hdev)
 815 {
 816         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 817                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 818 }
 819
 820 static u32 get_supported_settings(struct hci_dev *hdev)
 821 {
 822         u32 settings = 0;
 823
 824         settings |= MGMT_SETTING_POWERED;
 825         settings |= MGMT_SETTING_BONDABLE;
 826         settings |= MGMT_SETTING_DEBUG_KEYS;
 827         settings |= MGMT_SETTING_CONNECTABLE;
 828         settings |= MGMT_SETTING_DISCOVERABLE;
 829
 830         if (lmp_bredr_capable(hdev)) {
 831                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 832                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 833                 settings |= MGMT_SETTING_BREDR;
 834                 settings |= MGMT_SETTING_LINK_SECURITY;
 835
 836                 if (lmp_ssp_capable(hdev)) {
 837                         settings |= MGMT_SETTING_SSP;
 838                 }
 839
 840                 if (lmp_sc_capable(hdev))
 841                         settings |= MGMT_SETTING_SECURE_CONN;
 842
 843                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 844                              &hdev->quirks))
 845                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 846         }
 847
 848         if (lmp_le_capable(hdev)) {
 849                 settings |= MGMT_SETTING_LE;
 850                 settings |= MGMT_SETTING_SECURE_CONN;
 851                 settings |= MGMT_SETTING_PRIVACY;
 852                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 853                 settings |= MGMT_SETTING_ADVERTISING;
 854         }
 855
 856         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 857             hdev->set_bdaddr)
 858                 settings |= MGMT_SETTING_CONFIGURATION;
 859
 860         if (cis_central_capable(hdev))
 861                 settings |= MGMT_SETTING_CIS_CENTRAL;
 862
 863         if (cis_peripheral_capable(hdev))
 864                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 865
 866         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 867
 868         return settings;
 869 }
 870
 871 static u32 get_current_settings(struct hci_dev *hdev)
 872 {
 873         u32 settings = 0;
 874
 875         if (hdev_is_powered(hdev))
 876                 settings |= MGMT_SETTING_POWERED;
 877
 878         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 879                 settings |= MGMT_SETTING_CONNECTABLE;
 880
 881         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 882                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 883
 884         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 885                 settings |= MGMT_SETTING_DISCOVERABLE;
 886
 887         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 888                 settings |= MGMT_SETTING_BONDABLE;
 889
 890         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 891                 settings |= MGMT_SETTING_BREDR;
 892
 893         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 894                 settings |= MGMT_SETTING_LE;
 895
 896         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 897                 settings |= MGMT_SETTING_LINK_SECURITY;
 898
 899         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 900                 settings |= MGMT_SETTING_SSP;
 901
 902         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 903                 settings |= MGMT_SETTING_ADVERTISING;
 904
 905         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 906                 settings |= MGMT_SETTING_SECURE_CONN;
 907
 908         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 909                 settings |= MGMT_SETTING_DEBUG_KEYS;
 910
 911         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 912                 settings |= MGMT_SETTING_PRIVACY;
 913
 914         /* The current setting for static address has two purposes. The
 915          * first is to indicate if the static address will be used and
 916          * the second is to indicate if it is actually set.
 917          *
 918          * This means if the static address is not configured, this flag
 919          * will never be set. If the address is configured, then if the
 920          * address is actually used decides if the flag is set or not.
 921          *
 922          * For single mode LE only controllers and dual-mode controllers
 923          * with BR/EDR disabled, the existence of the static address will
 924          * be evaluated.
 925          */
 926         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 927             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 928             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 929                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 930                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 931         }
 932
 933         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 934                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 935
 936         if (cis_central_capable(hdev))
 937                 settings |= MGMT_SETTING_CIS_CENTRAL;
 938
 939         if (cis_peripheral_capable(hdev))
 940                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 941
 942         if (bis_capable(hdev))
 943                 settings |= MGMT_SETTING_ISO_BROADCASTER;
 944
 945         if (sync_recv_capable(hdev))
 946                 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
 947
 948         return settings;
 949 }
 950
 951 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 952 {
 953         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 954 }
 955
 956 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 957 {
 958         struct mgmt_pending_cmd *cmd;
 959
 960         /* If there's a pending mgmt command the flags will not yet have
 961          * their final values, so check for this first.
 962          */
 963         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 964         if (cmd) {
 965                 struct mgmt_mode *cp = cmd->param;
 966                 if (cp->val == 0x01)
 967                         return LE_AD_GENERAL;
 968                 else if (cp->val == 0x02)
 969                         return LE_AD_LIMITED;
 970         } else {
 971                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 972                         return LE_AD_LIMITED;
 973                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 974                         return LE_AD_GENERAL;
 975         }
 976
 977         return 0;
 978 }
 979
 980 bool mgmt_get_connectable(struct hci_dev *hdev)
 981 {
 982         struct mgmt_pending_cmd *cmd;
 983
 984         /* If there's a pending mgmt command the flag will not yet have
 985          * it's final value, so check for this first.
 986          */
 987         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 988         if (cmd) {
 989                 struct mgmt_mode *cp = cmd->param;
 990
 991                 return cp->val;
 992         }
 993
 994         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 995 }
 996
 997 static int service_cache_sync(struct hci_dev *hdev, void *data)
 998 {
 999         hci_update_eir_sync(hdev);
1000         hci_update_class_sync(hdev);
1001
1002         return 0;
1003 }
1004
1005 static void service_cache_off(struct work_struct *work)
1006 {
1007         struct hci_dev *hdev = container_of(work, struct hci_dev,
1008                                             service_cache.work);
1009
1010         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1011                 return;
1012
1013         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1014 }
1015
1016 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1017 {
1018         /* The generation of a new RPA and programming it into the
1019          * controller happens in the hci_req_enable_advertising()
1020          * function.
1021          */
1022         if (ext_adv_capable(hdev))
1023                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1024         else
1025                 return hci_enable_advertising_sync(hdev);
1026 }
1027
1028 static void rpa_expired(struct work_struct *work)
1029 {
1030         struct hci_dev *hdev = container_of(work, struct hci_dev,
1031                                             rpa_expired.work);
1032
1033         bt_dev_dbg(hdev, "");
1034
1035         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1036
1037         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1038                 return;
1039
1040         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1041 }
1042
1043 static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1044
1045 static void discov_off(struct work_struct *work)
1046 {
1047         struct hci_dev *hdev = container_of(work, struct hci_dev,
1048                                             discov_off.work);
1049
1050         bt_dev_dbg(hdev, "");
1051
1052         hci_dev_lock(hdev);
1053
1054         /* When discoverable timeout triggers, then just make sure
1055          * the limited discoverable flag is cleared. Even in the case
1056          * of a timeout triggered from general discoverable, it is
1057          * safe to unconditionally clear the flag.
1058          */
1059         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1060         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1061         hdev->discov_timeout = 0;
1062
1063         hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
1064
1065         mgmt_new_settings(hdev);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1071
1072 static void mesh_send_complete(struct hci_dev *hdev,
1073                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1074 {
1075         u8 handle = mesh_tx->handle;
1076
1077         if (!silent)
1078                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1079                            sizeof(handle), NULL);
1080
1081         mgmt_mesh_remove(mesh_tx);
1082 }
1083
1084 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1085 {
1086         struct mgmt_mesh_tx *mesh_tx;
1087
1088         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1089         hci_disable_advertising_sync(hdev);
1090         mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092         if (mesh_tx)
1093                 mesh_send_complete(hdev, mesh_tx, false);
1094
1095         return 0;
1096 }
1097
1098 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1099 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1100 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1101 {
1102         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1103
1104         if (!mesh_tx)
1105                 return;
1106
1107         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1108                                  mesh_send_start_complete);
1109
1110         if (err < 0)
1111                 mesh_send_complete(hdev, mesh_tx, false);
1112         else
1113                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1114 }
1115
1116 static void mesh_send_done(struct work_struct *work)
1117 {
1118         struct hci_dev *hdev = container_of(work, struct hci_dev,
1119                                             mesh_send_done.work);
1120
1121         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1122                 return;
1123
1124         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1125 }
1126
1127 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1128 {
1129         if (hci_dev_test_flag(hdev, HCI_MGMT))
1130                 return;
1131
1132         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1133
1134         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1135         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1136         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1137         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1138
1139         /* Non-mgmt controlled devices get this bit set
1140          * implicitly so that pairing works for them, however
1141          * for mgmt we require user-space to explicitly enable
1142          * it
1143          */
1144         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1145
1146         hci_dev_set_flag(hdev, HCI_MGMT);
1147 }
1148
1149 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1150                                 void *data, u16 data_len)
1151 {
1152         struct mgmt_rp_read_info rp;
1153
1154         bt_dev_dbg(hdev, "sock %p", sk);
1155
1156         hci_dev_lock(hdev);
1157
1158         memset(&rp, 0, sizeof(rp));
1159
1160         bacpy(&rp.bdaddr, &hdev->bdaddr);
1161
1162         rp.version = hdev->hci_ver;
1163         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1164
1165         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1166         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1167
1168         memcpy(rp.dev_class, hdev->dev_class, 3);
1169
1170         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1171         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1172
1173         hci_dev_unlock(hdev);
1174
1175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1176                                  sizeof(rp));
1177 }
1178
1179 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1180 {
1181         u16 eir_len = 0;
1182         size_t name_len;
1183
1184         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1185                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1186                                           hdev->dev_class, 3);
1187
1188         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1189                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1190                                           hdev->appearance);
1191
1192         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1193         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1194                                   hdev->dev_name, name_len);
1195
1196         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1197         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1198                                   hdev->short_name, name_len);
1199
1200         return eir_len;
1201 }
1202
1203 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1204                                     void *data, u16 data_len)
1205 {
1206         char buf[512];
1207         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1208         u16 eir_len;
1209
1210         bt_dev_dbg(hdev, "sock %p", sk);
1211
1212         memset(&buf, 0, sizeof(buf));
1213
1214         hci_dev_lock(hdev);
1215
1216         bacpy(&rp->bdaddr, &hdev->bdaddr);
1217
1218         rp->version = hdev->hci_ver;
1219         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1220
1221         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1222         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1223
1224
1225         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1226         rp->eir_len = cpu_to_le16(eir_len);
1227
1228         hci_dev_unlock(hdev);
1229
1230         /* If this command is called at least once, then the events
1231          * for class of device and local name changes are disabled
1232          * and only the new extended controller information event
1233          * is used.
1234          */
1235         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1236         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1238
1239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1240                                  sizeof(*rp) + eir_len);
1241 }
1242
1243 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1244 {
1245         char buf[512];
1246         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1247         u16 eir_len;
1248
1249         memset(buf, 0, sizeof(buf));
1250
1251         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1252         ev->eir_len = cpu_to_le16(eir_len);
1253
1254         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1255                                   sizeof(*ev) + eir_len,
1256                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1257 }
1258
1259 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1260 {
1261         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1262
1263         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1264                                  sizeof(settings));
1265 }
1266
1267 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1268 {
1269         struct mgmt_ev_advertising_added ev;
1270
1271         ev.instance = instance;
1272
1273         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1274 }
1275
1276 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1277                               u8 instance)
1278 {
1279         struct mgmt_ev_advertising_removed ev;
1280
1281         ev.instance = instance;
1282
1283         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1284 }
1285
1286 static void cancel_adv_timeout(struct hci_dev *hdev)
1287 {
1288         if (hdev->adv_instance_timeout) {
1289                 hdev->adv_instance_timeout = 0;
1290                 cancel_delayed_work(&hdev->adv_instance_expire);
1291         }
1292 }
1293
1294 /* This function requires the caller holds hdev->lock */
1295 static void restart_le_actions(struct hci_dev *hdev)
1296 {
1297         struct hci_conn_params *p;
1298
1299         list_for_each_entry(p, &hdev->le_conn_params, list) {
1300                 /* Needed for AUTO_OFF case where might not "really"
1301                  * have been powered off.
1302                  */
1303                 hci_pend_le_list_del_init(p);
1304
1305                 switch (p->auto_connect) {
1306                 case HCI_AUTO_CONN_DIRECT:
1307                 case HCI_AUTO_CONN_ALWAYS:
1308                         hci_pend_le_list_add(p, &hdev->pend_le_conns);
1309                         break;
1310                 case HCI_AUTO_CONN_REPORT:
1311                         hci_pend_le_list_add(p, &hdev->pend_le_reports);
1312                         break;
1313                 default:
1314                         break;
1315                 }
1316         }
1317 }
1318
1319 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1320 {
1321         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1322
1323         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1324                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1325 }
1326
1327 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1328 {
1329         struct mgmt_pending_cmd *cmd = data;
1330         struct mgmt_mode *cp;
1331
1332         /* Make sure cmd still outstanding. */
1333         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1334                 return;
1335
1336         cp = cmd->param;
1337
1338         bt_dev_dbg(hdev, "err %d", err);
1339
1340         if (!err) {
1341                 if (cp->val) {
1342                         hci_dev_lock(hdev);
1343                         restart_le_actions(hdev);
1344                         hci_update_passive_scan(hdev);
1345                         hci_dev_unlock(hdev);
1346                 }
1347
1348                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1349
1350                 /* Only call new_setting for power on as power off is deferred
1351                  * to hdev->power_off work which does call hci_dev_do_close.
1352                  */
1353                 if (cp->val)
1354                         new_settings(hdev, cmd->sk);
1355         } else {
1356                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1357                                 mgmt_status(err));
1358         }
1359
1360         mgmt_pending_remove(cmd);
1361 }
1362
1363 static int set_powered_sync(struct hci_dev *hdev, void *data)
1364 {
1365         struct mgmt_pending_cmd *cmd = data;
1366         struct mgmt_mode *cp = cmd->param;
1367
1368         BT_DBG("%s", hdev->name);
1369
1370         return hci_set_powered_sync(hdev, cp->val);
1371 }
1372
1373 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1374                        u16 len)
1375 {
1376         struct mgmt_mode *cp = data;
1377         struct mgmt_pending_cmd *cmd;
1378         int err;
1379
1380         bt_dev_dbg(hdev, "sock %p", sk);
1381
1382         if (cp->val != 0x00 && cp->val != 0x01)
1383                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1384                                        MGMT_STATUS_INVALID_PARAMS);
1385
1386         hci_dev_lock(hdev);
1387
1388         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1389                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1390                                       MGMT_STATUS_BUSY);
1391                 goto failed;
1392         }
1393
1394         if (!!cp->val == hdev_is_powered(hdev)) {
1395                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1396                 goto failed;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 goto failed;
1403         }
1404
1405         /* Cancel potentially blocking sync operation before power off */
1406         if (cp->val == 0x00) {
1407                 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
1408                 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1409                                          mgmt_set_powered_complete);
1410         } else {
1411                 /* Use hci_cmd_sync_submit since hdev might not be running */
1412                 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1413                                           mgmt_set_powered_complete);
1414         }
1415
1416         if (err < 0)
1417                 mgmt_pending_remove(cmd);
1418
1419 failed:
1420         hci_dev_unlock(hdev);
1421         return err;
1422 }
1423
1424 int mgmt_new_settings(struct hci_dev *hdev)
1425 {
1426         return new_settings(hdev, NULL);
1427 }
1428
1429 struct cmd_lookup {
1430         struct sock *sk;
1431         struct hci_dev *hdev;
1432         u8 mgmt_status;
1433 };
1434
1435 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1436 {
1437         struct cmd_lookup *match = data;
1438
1439         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1440
1441         list_del(&cmd->list);
1442
1443         if (match->sk == NULL) {
1444                 match->sk = cmd->sk;
1445                 sock_hold(match->sk);
1446         }
1447
1448         mgmt_pending_free(cmd);
1449 }
1450
1451 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1452 {
1453         u8 *status = data;
1454
1455         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1456         mgmt_pending_remove(cmd);
1457 }
1458
1459 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1460 {
1461         if (cmd->cmd_complete) {
1462                 u8 *status = data;
1463
1464                 cmd->cmd_complete(cmd, *status);
1465                 mgmt_pending_remove(cmd);
1466
1467                 return;
1468         }
1469
1470         cmd_status_rsp(cmd, data);
1471 }
1472
1473 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1474 {
1475         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1476                                  cmd->param, cmd->param_len);
1477 }
1478
1479 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1480 {
1481         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1482                                  cmd->param, sizeof(struct mgmt_addr_info));
1483 }
1484
1485 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1486 {
1487         if (!lmp_bredr_capable(hdev))
1488                 return MGMT_STATUS_NOT_SUPPORTED;
1489         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1490                 return MGMT_STATUS_REJECTED;
1491         else
1492                 return MGMT_STATUS_SUCCESS;
1493 }
1494
1495 static u8 mgmt_le_support(struct hci_dev *hdev)
1496 {
1497         if (!lmp_le_capable(hdev))
1498                 return MGMT_STATUS_NOT_SUPPORTED;
1499         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1500                 return MGMT_STATUS_REJECTED;
1501         else
1502                 return MGMT_STATUS_SUCCESS;
1503 }
1504
1505 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1506                                            int err)
1507 {
1508         struct mgmt_pending_cmd *cmd = data;
1509
1510         bt_dev_dbg(hdev, "err %d", err);
1511
1512         /* Make sure cmd still outstanding. */
1513         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1514                 return;
1515
1516         hci_dev_lock(hdev);
1517
1518         if (err) {
1519                 u8 mgmt_err = mgmt_status(err);
1520                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1521                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1522                 goto done;
1523         }
1524
1525         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1526             hdev->discov_timeout > 0) {
1527                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1528                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1529         }
1530
1531         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1532         new_settings(hdev, cmd->sk);
1533
1534 done:
1535         mgmt_pending_remove(cmd);
1536         hci_dev_unlock(hdev);
1537 }
1538
1539 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1540 {
1541         BT_DBG("%s", hdev->name);
1542
1543         return hci_update_discoverable_sync(hdev);
1544 }
1545
1546 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1547                             u16 len)
1548 {
1549         struct mgmt_cp_set_discoverable *cp = data;
1550         struct mgmt_pending_cmd *cmd;
1551         u16 timeout;
1552         int err;
1553
1554         bt_dev_dbg(hdev, "sock %p", sk);
1555
1556         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1557             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1558                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1559                                        MGMT_STATUS_REJECTED);
1560
1561         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1562                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1563                                        MGMT_STATUS_INVALID_PARAMS);
1564
1565         timeout = __le16_to_cpu(cp->timeout);
1566
1567         /* Disabling discoverable requires that no timeout is set,
1568          * and enabling limited discoverable requires a timeout.
1569          */
1570         if ((cp->val == 0x00 && timeout > 0) ||
1571             (cp->val == 0x02 && timeout == 0))
1572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1573                                        MGMT_STATUS_INVALID_PARAMS);
1574
1575         hci_dev_lock(hdev);
1576
1577         if (!hdev_is_powered(hdev) && timeout > 0) {
1578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1579                                       MGMT_STATUS_NOT_POWERED);
1580                 goto failed;
1581         }
1582
1583         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1584             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1586                                       MGMT_STATUS_BUSY);
1587                 goto failed;
1588         }
1589
1590         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1591                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1592                                       MGMT_STATUS_REJECTED);
1593                 goto failed;
1594         }
1595
1596         if (hdev->advertising_paused) {
1597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1598                                       MGMT_STATUS_BUSY);
1599                 goto failed;
1600         }
1601
1602         if (!hdev_is_powered(hdev)) {
1603                 bool changed = false;
1604
1605                 /* Setting limited discoverable when powered off is
1606                  * not a valid operation since it requires a timeout
1607                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1608                  */
1609                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1610                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1611                         changed = true;
1612                 }
1613
1614                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1615                 if (err < 0)
1616                         goto failed;
1617
1618                 if (changed)
1619                         err = new_settings(hdev, sk);
1620
1621                 goto failed;
1622         }
1623
1624         /* If the current mode is the same, then just update the timeout
1625          * value with the new value. And if only the timeout gets updated,
1626          * then no need for any HCI transactions.
1627          */
1628         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1629             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1630                                                    HCI_LIMITED_DISCOVERABLE)) {
1631                 cancel_delayed_work(&hdev->discov_off);
1632                 hdev->discov_timeout = timeout;
1633
1634                 if (cp->val && hdev->discov_timeout > 0) {
1635                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1636                         queue_delayed_work(hdev->req_workqueue,
1637                                            &hdev->discov_off, to);
1638                 }
1639
1640                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1641                 goto failed;
1642         }
1643
1644         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1645         if (!cmd) {
1646                 err = -ENOMEM;
1647                 goto failed;
1648         }
1649
1650         /* Cancel any potential discoverable timeout that might be
1651          * still active and store new timeout value. The arming of
1652          * the timeout happens in the complete handler.
1653          */
1654         cancel_delayed_work(&hdev->discov_off);
1655         hdev->discov_timeout = timeout;
1656
1657         if (cp->val)
1658                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1659         else
1660                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1661
1662         /* Limited discoverable mode */
1663         if (cp->val == 0x02)
1664                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1665         else
1666                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1667
1668         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1669                                  mgmt_set_discoverable_complete);
1670
1671         if (err < 0)
1672                 mgmt_pending_remove(cmd);
1673
1674 failed:
1675         hci_dev_unlock(hdev);
1676         return err;
1677 }
1678
1679 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1680                                           int err)
1681 {
1682         struct mgmt_pending_cmd *cmd = data;
1683
1684         bt_dev_dbg(hdev, "err %d", err);
1685
1686         /* Make sure cmd still outstanding. */
1687         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1688                 return;
1689
1690         hci_dev_lock(hdev);
1691
1692         if (err) {
1693                 u8 mgmt_err = mgmt_status(err);
1694                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1695                 goto done;
1696         }
1697
1698         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1699         new_settings(hdev, cmd->sk);
1700
1701 done:
1702         if (cmd)
1703                 mgmt_pending_remove(cmd);
1704
1705         hci_dev_unlock(hdev);
1706 }
1707
1708 static int set_connectable_update_settings(struct hci_dev *hdev,
1709                                            struct sock *sk, u8 val)
1710 {
1711         bool changed = false;
1712         int err;
1713
1714         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1715                 changed = true;
1716
1717         if (val) {
1718                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1719         } else {
1720                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1721                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1722         }
1723
1724         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1725         if (err < 0)
1726                 return err;
1727
1728         if (changed) {
1729                 hci_update_scan(hdev);
1730                 hci_update_passive_scan(hdev);
1731                 return new_settings(hdev, sk);
1732         }
1733
1734         return 0;
1735 }
1736
1737 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1738 {
1739         BT_DBG("%s", hdev->name);
1740
1741         return hci_update_connectable_sync(hdev);
1742 }
1743
1744 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1745                            u16 len)
1746 {
1747         struct mgmt_mode *cp = data;
1748         struct mgmt_pending_cmd *cmd;
1749         int err;
1750
1751         bt_dev_dbg(hdev, "sock %p", sk);
1752
1753         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1754             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1755                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1756                                        MGMT_STATUS_REJECTED);
1757
1758         if (cp->val != 0x00 && cp->val != 0x01)
1759                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1760                                        MGMT_STATUS_INVALID_PARAMS);
1761
1762         hci_dev_lock(hdev);
1763
1764         if (!hdev_is_powered(hdev)) {
1765                 err = set_connectable_update_settings(hdev, sk, cp->val);
1766                 goto failed;
1767         }
1768
1769         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1770             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1771                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1772                                       MGMT_STATUS_BUSY);
1773                 goto failed;
1774         }
1775
1776         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1777         if (!cmd) {
1778                 err = -ENOMEM;
1779                 goto failed;
1780         }
1781
1782         if (cp->val) {
1783                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1784         } else {
1785                 if (hdev->discov_timeout > 0)
1786                         cancel_delayed_work(&hdev->discov_off);
1787
1788                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1789                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1790                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1791         }
1792
1793         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1794                                  mgmt_set_connectable_complete);
1795
1796         if (err < 0)
1797                 mgmt_pending_remove(cmd);
1798
1799 failed:
1800         hci_dev_unlock(hdev);
1801         return err;
1802 }
1803
1804 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1805                         u16 len)
1806 {
1807         struct mgmt_mode *cp = data;
1808         bool changed;
1809         int err;
1810
1811         bt_dev_dbg(hdev, "sock %p", sk);
1812
1813         if (cp->val != 0x00 && cp->val != 0x01)
1814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1815                                        MGMT_STATUS_INVALID_PARAMS);
1816
1817         hci_dev_lock(hdev);
1818
1819         if (cp->val)
1820                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1821         else
1822                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1823
1824         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1825         if (err < 0)
1826                 goto unlock;
1827
1828         if (changed) {
1829                 /* In limited privacy mode the change of bondable mode
1830                  * may affect the local advertising address.
1831                  */
1832                 hci_update_discoverable(hdev);
1833
1834                 err = new_settings(hdev, sk);
1835         }
1836
1837 unlock:
1838         hci_dev_unlock(hdev);
1839         return err;
1840 }
1841
1842 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1843                              u16 len)
1844 {
1845         struct mgmt_mode *cp = data;
1846         struct mgmt_pending_cmd *cmd;
1847         u8 val, status;
1848         int err;
1849
1850         bt_dev_dbg(hdev, "sock %p", sk);
1851
1852         status = mgmt_bredr_support(hdev);
1853         if (status)
1854                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1855                                        status);
1856
1857         if (cp->val != 0x00 && cp->val != 0x01)
1858                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1859                                        MGMT_STATUS_INVALID_PARAMS);
1860
1861         hci_dev_lock(hdev);
1862
1863         if (!hdev_is_powered(hdev)) {
1864                 bool changed = false;
1865
1866                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1867                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1868                         changed = true;
1869                 }
1870
1871                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1872                 if (err < 0)
1873                         goto failed;
1874
1875                 if (changed)
1876                         err = new_settings(hdev, sk);
1877
1878                 goto failed;
1879         }
1880
1881         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1882                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1883                                       MGMT_STATUS_BUSY);
1884                 goto failed;
1885         }
1886
1887         val = !!cp->val;
1888
1889         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1890                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1891                 goto failed;
1892         }
1893
1894         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1895         if (!cmd) {
1896                 err = -ENOMEM;
1897                 goto failed;
1898         }
1899
1900         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1901         if (err < 0) {
1902                 mgmt_pending_remove(cmd);
1903                 goto failed;
1904         }
1905
1906 failed:
1907         hci_dev_unlock(hdev);
1908         return err;
1909 }
1910
1911 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1912 {
1913         struct cmd_lookup match = { NULL, hdev };
1914         struct mgmt_pending_cmd *cmd = data;
1915         struct mgmt_mode *cp = cmd->param;
1916         u8 enable = cp->val;
1917         bool changed;
1918
1919         /* Make sure cmd still outstanding. */
1920         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1921                 return;
1922
1923         if (err) {
1924                 u8 mgmt_err = mgmt_status(err);
1925
1926                 if (enable && hci_dev_test_and_clear_flag(hdev,
1927                                                           HCI_SSP_ENABLED)) {
1928                         new_settings(hdev, NULL);
1929                 }
1930
1931                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1932                                      &mgmt_err);
1933                 return;
1934         }
1935
1936         if (enable) {
1937                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1938         } else {
1939                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1940         }
1941
1942         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1943
1944         if (changed)
1945                 new_settings(hdev, match.sk);
1946
1947         if (match.sk)
1948                 sock_put(match.sk);
1949
1950         hci_update_eir_sync(hdev);
1951 }
1952
1953 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1954 {
1955         struct mgmt_pending_cmd *cmd = data;
1956         struct mgmt_mode *cp = cmd->param;
1957         bool changed = false;
1958         int err;
1959
1960         if (cp->val)
1961                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1962
1963         err = hci_write_ssp_mode_sync(hdev, cp->val);
1964
1965         if (!err && changed)
1966                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1967
1968         return err;
1969 }
1970
1971 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1972 {
1973         struct mgmt_mode *cp = data;
1974         struct mgmt_pending_cmd *cmd;
1975         u8 status;
1976         int err;
1977
1978         bt_dev_dbg(hdev, "sock %p", sk);
1979
1980         status = mgmt_bredr_support(hdev);
1981         if (status)
1982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1983
1984         if (!lmp_ssp_capable(hdev))
1985                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1986                                        MGMT_STATUS_NOT_SUPPORTED);
1987
1988         if (cp->val != 0x00 && cp->val != 0x01)
1989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1990                                        MGMT_STATUS_INVALID_PARAMS);
1991
1992         hci_dev_lock(hdev);
1993
1994         if (!hdev_is_powered(hdev)) {
1995                 bool changed;
1996
1997                 if (cp->val) {
1998                         changed = !hci_dev_test_and_set_flag(hdev,
1999                                                              HCI_SSP_ENABLED);
2000                 } else {
2001                         changed = hci_dev_test_and_clear_flag(hdev,
2002                                                               HCI_SSP_ENABLED);
2003                 }
2004
2005                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2006                 if (err < 0)
2007                         goto failed;
2008
2009                 if (changed)
2010                         err = new_settings(hdev, sk);
2011
2012                 goto failed;
2013         }
2014
2015         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2016                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2017                                       MGMT_STATUS_BUSY);
2018                 goto failed;
2019         }
2020
2021         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2022                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2023                 goto failed;
2024         }
2025
2026         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2027         if (!cmd)
2028                 err = -ENOMEM;
2029         else
2030                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2031                                          set_ssp_complete);
2032
2033         if (err < 0) {
2034                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2035                                       MGMT_STATUS_FAILED);
2036
2037                 if (cmd)
2038                         mgmt_pending_remove(cmd);
2039         }
2040
2041 failed:
2042         hci_dev_unlock(hdev);
2043         return err;
2044 }
2045
2046 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2047 {
2048         bt_dev_dbg(hdev, "sock %p", sk);
2049
2050         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2051                                        MGMT_STATUS_NOT_SUPPORTED);
2052 }
2053
2054 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2055 {
2056         struct cmd_lookup match = { NULL, hdev };
2057         u8 status = mgmt_status(err);
2058
2059         bt_dev_dbg(hdev, "err %d", err);
2060
2061         if (status) {
2062                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2063                                                         &status);
2064                 return;
2065         }
2066
2067         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2068
2069         new_settings(hdev, match.sk);
2070
2071         if (match.sk)
2072                 sock_put(match.sk);
2073 }
2074
2075 static int set_le_sync(struct hci_dev *hdev, void *data)
2076 {
2077         struct mgmt_pending_cmd *cmd = data;
2078         struct mgmt_mode *cp = cmd->param;
2079         u8 val = !!cp->val;
2080         int err;
2081
2082         if (!val) {
2083                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2084
2085                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2086                         hci_disable_advertising_sync(hdev);
2087
2088                 if (ext_adv_capable(hdev))
2089                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2090         } else {
2091                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2092         }
2093
2094         err = hci_write_le_host_supported_sync(hdev, val, 0);
2095
2096         /* Make sure the controller has a good default for
2097          * advertising data. Restrict the update to when LE
2098          * has actually been enabled. During power on, the
2099          * update in powered_update_hci will take care of it.
2100          */
2101         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2102                 if (ext_adv_capable(hdev)) {
2103                         int status;
2104
2105                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2106                         if (!status)
2107                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2108                 } else {
2109                         hci_update_adv_data_sync(hdev, 0x00);
2110                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2111                 }
2112
2113                 hci_update_passive_scan(hdev);
2114         }
2115
2116         return err;
2117 }
2118
2119 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2120 {
2121         struct mgmt_pending_cmd *cmd = data;
2122         u8 status = mgmt_status(err);
2123         struct sock *sk = cmd->sk;
2124
2125         if (status) {
2126                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2127                                      cmd_status_rsp, &status);
2128                 return;
2129         }
2130
2131         mgmt_pending_remove(cmd);
2132         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2133 }
2134
2135 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2136 {
2137         struct mgmt_pending_cmd *cmd = data;
2138         struct mgmt_cp_set_mesh *cp = cmd->param;
2139         size_t len = cmd->param_len;
2140
2141         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2142
2143         if (cp->enable)
2144                 hci_dev_set_flag(hdev, HCI_MESH);
2145         else
2146                 hci_dev_clear_flag(hdev, HCI_MESH);
2147
2148         len -= sizeof(*cp);
2149
2150         /* If filters don't fit, forward all adv pkts */
2151         if (len <= sizeof(hdev->mesh_ad_types))
2152                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2153
2154         hci_update_passive_scan_sync(hdev);
2155         return 0;
2156 }
2157
2158 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2159 {
2160         struct mgmt_cp_set_mesh *cp = data;
2161         struct mgmt_pending_cmd *cmd;
2162         int err = 0;
2163
2164         bt_dev_dbg(hdev, "sock %p", sk);
2165
2166         if (!lmp_le_capable(hdev) ||
2167             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2168                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2169                                        MGMT_STATUS_NOT_SUPPORTED);
2170
2171         if (cp->enable != 0x00 && cp->enable != 0x01)
2172                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2173                                        MGMT_STATUS_INVALID_PARAMS);
2174
2175         hci_dev_lock(hdev);
2176
2177         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2178         if (!cmd)
2179                 err = -ENOMEM;
2180         else
2181                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2182                                          set_mesh_complete);
2183
2184         if (err < 0) {
2185                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2186                                       MGMT_STATUS_FAILED);
2187
2188                 if (cmd)
2189                         mgmt_pending_remove(cmd);
2190         }
2191
2192         hci_dev_unlock(hdev);
2193         return err;
2194 }
2195
2196 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2197 {
2198         struct mgmt_mesh_tx *mesh_tx = data;
2199         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2200         unsigned long mesh_send_interval;
2201         u8 mgmt_err = mgmt_status(err);
2202
2203         /* Report any errors here, but don't report completion */
2204
2205         if (mgmt_err) {
2206                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2207                 /* Send Complete Error Code for handle */
2208                 mesh_send_complete(hdev, mesh_tx, false);
2209                 return;
2210         }
2211
2212         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2213         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2214                            mesh_send_interval);
2215 }
2216
2217 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2218 {
2219         struct mgmt_mesh_tx *mesh_tx = data;
2220         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2221         struct adv_info *adv, *next_instance;
2222         u8 instance = hdev->le_num_of_adv_sets + 1;
2223         u16 timeout, duration;
2224         int err = 0;
2225
2226         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2227                 return MGMT_STATUS_BUSY;
2228
2229         timeout = 1000;
2230         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2231         adv = hci_add_adv_instance(hdev, instance, 0,
2232                                    send->adv_data_len, send->adv_data,
2233                                    0, NULL,
2234                                    timeout, duration,
2235                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2236                                    hdev->le_adv_min_interval,
2237                                    hdev->le_adv_max_interval,
2238                                    mesh_tx->handle);
2239
2240         if (!IS_ERR(adv))
2241                 mesh_tx->instance = instance;
2242         else
2243                 err = PTR_ERR(adv);
2244
2245         if (hdev->cur_adv_instance == instance) {
2246                 /* If the currently advertised instance is being changed then
2247                  * cancel the current advertising and schedule the next
2248                  * instance. If there is only one instance then the overridden
2249                  * advertising data will be visible right away.
2250                  */
2251                 cancel_adv_timeout(hdev);
2252
2253                 next_instance = hci_get_next_instance(hdev, instance);
2254                 if (next_instance)
2255                         instance = next_instance->instance;
2256                 else
2257                         instance = 0;
2258         } else if (hdev->adv_instance_timeout) {
2259                 /* Immediately advertise the new instance if no other, or
2260                  * let it go naturally from queue if ADV is already happening
2261                  */
2262                 instance = 0;
2263         }
2264
2265         if (instance)
2266                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2267
2268         return err;
2269 }
2270
2271 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2272 {
2273         struct mgmt_rp_mesh_read_features *rp = data;
2274
2275         if (rp->used_handles >= rp->max_handles)
2276                 return;
2277
2278         rp->handles[rp->used_handles++] = mesh_tx->handle;
2279 }
2280
2281 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2282                          void *data, u16 len)
2283 {
2284         struct mgmt_rp_mesh_read_features rp;
2285
2286         if (!lmp_le_capable(hdev) ||
2287             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2288                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2289                                        MGMT_STATUS_NOT_SUPPORTED);
2290
2291         memset(&rp, 0, sizeof(rp));
2292         rp.index = cpu_to_le16(hdev->id);
2293         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2294                 rp.max_handles = MESH_HANDLES_MAX;
2295
2296         hci_dev_lock(hdev);
2297
2298         if (rp.max_handles)
2299                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2300
2301         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2302                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2303
2304         hci_dev_unlock(hdev);
2305         return 0;
2306 }
2307
2308 static int send_cancel(struct hci_dev *hdev, void *data)
2309 {
2310         struct mgmt_pending_cmd *cmd = data;
2311         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2312         struct mgmt_mesh_tx *mesh_tx;
2313
2314         if (!cancel->handle) {
2315                 do {
2316                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2317
2318                         if (mesh_tx)
2319                                 mesh_send_complete(hdev, mesh_tx, false);
2320                 } while (mesh_tx);
2321         } else {
2322                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2323
2324                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2325                         mesh_send_complete(hdev, mesh_tx, false);
2326         }
2327
2328         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2329                           0, NULL, 0);
2330         mgmt_pending_free(cmd);
2331
2332         return 0;
2333 }
2334
2335 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2336                             void *data, u16 len)
2337 {
2338         struct mgmt_pending_cmd *cmd;
2339         int err;
2340
2341         if (!lmp_le_capable(hdev) ||
2342             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2344                                        MGMT_STATUS_NOT_SUPPORTED);
2345
2346         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2347                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2348                                        MGMT_STATUS_REJECTED);
2349
2350         hci_dev_lock(hdev);
2351         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2352         if (!cmd)
2353                 err = -ENOMEM;
2354         else
2355                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2356
2357         if (err < 0) {
2358                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2359                                       MGMT_STATUS_FAILED);
2360
2361                 if (cmd)
2362                         mgmt_pending_free(cmd);
2363         }
2364
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2370 {
2371         struct mgmt_mesh_tx *mesh_tx;
2372         struct mgmt_cp_mesh_send *send = data;
2373         struct mgmt_rp_mesh_read_features rp;
2374         bool sending;
2375         int err = 0;
2376
2377         if (!lmp_le_capable(hdev) ||
2378             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2379                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2380                                        MGMT_STATUS_NOT_SUPPORTED);
2381         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2382             len <= MGMT_MESH_SEND_SIZE ||
2383             len > (MGMT_MESH_SEND_SIZE + 31))
2384                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2385                                        MGMT_STATUS_REJECTED);
2386
2387         hci_dev_lock(hdev);
2388
2389         memset(&rp, 0, sizeof(rp));
2390         rp.max_handles = MESH_HANDLES_MAX;
2391
2392         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2393
2394         if (rp.max_handles <= rp.used_handles) {
2395                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2396                                       MGMT_STATUS_BUSY);
2397                 goto done;
2398         }
2399
2400         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2401         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2402
2403         if (!mesh_tx)
2404                 err = -ENOMEM;
2405         else if (!sending)
2406                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2407                                          mesh_send_start_complete);
2408
2409         if (err < 0) {
2410                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2411                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2412                                       MGMT_STATUS_FAILED);
2413
2414                 if (mesh_tx) {
2415                         if (sending)
2416                                 mgmt_mesh_remove(mesh_tx);
2417                 }
2418         } else {
2419                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2420
2421                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2422                                   &mesh_tx->handle, 1);
2423         }
2424
2425 done:
2426         hci_dev_unlock(hdev);
2427         return err;
2428 }
2429
2430 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2431 {
2432         struct mgmt_mode *cp = data;
2433         struct mgmt_pending_cmd *cmd;
2434         int err;
2435         u8 val, enabled;
2436
2437         bt_dev_dbg(hdev, "sock %p", sk);
2438
2439         if (!lmp_le_capable(hdev))
2440                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2441                                        MGMT_STATUS_NOT_SUPPORTED);
2442
2443         if (cp->val != 0x00 && cp->val != 0x01)
2444                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2445                                        MGMT_STATUS_INVALID_PARAMS);
2446
2447         /* Bluetooth single mode LE only controllers or dual-mode
2448          * controllers configured as LE only devices, do not allow
2449          * switching LE off. These have either LE enabled explicitly
2450          * or BR/EDR has been previously switched off.
2451          *
2452          * When trying to enable an already enabled LE, then gracefully
2453          * send a positive response. Trying to disable it however will
2454          * result into rejection.
2455          */
2456         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2457                 if (cp->val == 0x01)
2458                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2459
2460                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2461                                        MGMT_STATUS_REJECTED);
2462         }
2463
2464         hci_dev_lock(hdev);
2465
2466         val = !!cp->val;
2467         enabled = lmp_host_le_capable(hdev);
2468
2469         if (!hdev_is_powered(hdev) || val == enabled) {
2470                 bool changed = false;
2471
2472                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2473                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2474                         changed = true;
2475                 }
2476
2477                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2478                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2479                         changed = true;
2480                 }
2481
2482                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2483                 if (err < 0)
2484                         goto unlock;
2485
2486                 if (changed)
2487                         err = new_settings(hdev, sk);
2488
2489                 goto unlock;
2490         }
2491
2492         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2493             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2494                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2495                                       MGMT_STATUS_BUSY);
2496                 goto unlock;
2497         }
2498
2499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2500         if (!cmd)
2501                 err = -ENOMEM;
2502         else
2503                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2504                                          set_le_complete);
2505
2506         if (err < 0) {
2507                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2508                                       MGMT_STATUS_FAILED);
2509
2510                 if (cmd)
2511                         mgmt_pending_remove(cmd);
2512         }
2513
2514 unlock:
2515         hci_dev_unlock(hdev);
2516         return err;
2517 }
2518
2519 /* This is a helper function to test for pending mgmt commands that can
2520  * cause CoD or EIR HCI commands. We can only allow one such pending
2521  * mgmt command at a time since otherwise we cannot easily track what
2522  * the current values are, will be, and based on that calculate if a new
2523  * HCI command needs to be sent and if yes with what value.
2524  */
2525 static bool pending_eir_or_class(struct hci_dev *hdev)
2526 {
2527         struct mgmt_pending_cmd *cmd;
2528
2529         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2530                 switch (cmd->opcode) {
2531                 case MGMT_OP_ADD_UUID:
2532                 case MGMT_OP_REMOVE_UUID:
2533                 case MGMT_OP_SET_DEV_CLASS:
2534                 case MGMT_OP_SET_POWERED:
2535                         return true;
2536                 }
2537         }
2538
2539         return false;
2540 }
2541
2542 static const u8 bluetooth_base_uuid[] = {
2543                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2544                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2545 };
2546
2547 static u8 get_uuid_size(const u8 *uuid)
2548 {
2549         u32 val;
2550
2551         if (memcmp(uuid, bluetooth_base_uuid, 12))
2552                 return 128;
2553
2554         val = get_unaligned_le32(&uuid[12]);
2555         if (val > 0xffff)
2556                 return 32;
2557
2558         return 16;
2559 }
2560
2561 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2562 {
2563         struct mgmt_pending_cmd *cmd = data;
2564
2565         bt_dev_dbg(hdev, "err %d", err);
2566
2567         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2568                           mgmt_status(err), hdev->dev_class, 3);
2569
2570         mgmt_pending_free(cmd);
2571 }
2572
2573 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2574 {
2575         int err;
2576
2577         err = hci_update_class_sync(hdev);
2578         if (err)
2579                 return err;
2580
2581         return hci_update_eir_sync(hdev);
2582 }
2583
2584 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2585 {
2586         struct mgmt_cp_add_uuid *cp = data;
2587         struct mgmt_pending_cmd *cmd;
2588         struct bt_uuid *uuid;
2589         int err;
2590
2591         bt_dev_dbg(hdev, "sock %p", sk);
2592
2593         hci_dev_lock(hdev);
2594
2595         if (pending_eir_or_class(hdev)) {
2596                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2597                                       MGMT_STATUS_BUSY);
2598                 goto failed;
2599         }
2600
2601         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2602         if (!uuid) {
2603                 err = -ENOMEM;
2604                 goto failed;
2605         }
2606
2607         memcpy(uuid->uuid, cp->uuid, 16);
2608         uuid->svc_hint = cp->svc_hint;
2609         uuid->size = get_uuid_size(cp->uuid);
2610
2611         list_add_tail(&uuid->list, &hdev->uuids);
2612
2613         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2614         if (!cmd) {
2615                 err = -ENOMEM;
2616                 goto failed;
2617         }
2618
2619         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2620         if (err < 0) {
2621                 mgmt_pending_free(cmd);
2622                 goto failed;
2623         }
2624
2625 failed:
2626         hci_dev_unlock(hdev);
2627         return err;
2628 }
2629
2630 static bool enable_service_cache(struct hci_dev *hdev)
2631 {
2632         if (!hdev_is_powered(hdev))
2633                 return false;
2634
2635         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2636                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2637                                    CACHE_TIMEOUT);
2638                 return true;
2639         }
2640
2641         return false;
2642 }
2643
2644 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2645 {
2646         int err;
2647
2648         err = hci_update_class_sync(hdev);
2649         if (err)
2650                 return err;
2651
2652         return hci_update_eir_sync(hdev);
2653 }
2654
2655 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2656                        u16 len)
2657 {
2658         struct mgmt_cp_remove_uuid *cp = data;
2659         struct mgmt_pending_cmd *cmd;
2660         struct bt_uuid *match, *tmp;
2661         static const u8 bt_uuid_any[] = {
2662                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2663         };
2664         int err, found;
2665
2666         bt_dev_dbg(hdev, "sock %p", sk);
2667
2668         hci_dev_lock(hdev);
2669
2670         if (pending_eir_or_class(hdev)) {
2671                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2672                                       MGMT_STATUS_BUSY);
2673                 goto unlock;
2674         }
2675
2676         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2677                 hci_uuids_clear(hdev);
2678
2679                 if (enable_service_cache(hdev)) {
2680                         err = mgmt_cmd_complete(sk, hdev->id,
2681                                                 MGMT_OP_REMOVE_UUID,
2682                                                 0, hdev->dev_class, 3);
2683                         goto unlock;
2684                 }
2685
2686                 goto update_class;
2687         }
2688
2689         found = 0;
2690
2691         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2692                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2693                         continue;
2694
2695                 list_del(&match->list);
2696                 kfree(match);
2697                 found++;
2698         }
2699
2700         if (found == 0) {
2701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2702                                       MGMT_STATUS_INVALID_PARAMS);
2703                 goto unlock;
2704         }
2705
2706 update_class:
2707         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2708         if (!cmd) {
2709                 err = -ENOMEM;
2710                 goto unlock;
2711         }
2712
2713         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2714                                  mgmt_class_complete);
2715         if (err < 0)
2716                 mgmt_pending_free(cmd);
2717
2718 unlock:
2719         hci_dev_unlock(hdev);
2720         return err;
2721 }
2722
2723 static int set_class_sync(struct hci_dev *hdev, void *data)
2724 {
2725         int err = 0;
2726
2727         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2728                 cancel_delayed_work_sync(&hdev->service_cache);
2729                 err = hci_update_eir_sync(hdev);
2730         }
2731
2732         if (err)
2733                 return err;
2734
2735         return hci_update_class_sync(hdev);
2736 }
2737
2738 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2739                          u16 len)
2740 {
2741         struct mgmt_cp_set_dev_class *cp = data;
2742         struct mgmt_pending_cmd *cmd;
2743         int err;
2744
2745         bt_dev_dbg(hdev, "sock %p", sk);
2746
2747         if (!lmp_bredr_capable(hdev))
2748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2749                                        MGMT_STATUS_NOT_SUPPORTED);
2750
2751         hci_dev_lock(hdev);
2752
2753         if (pending_eir_or_class(hdev)) {
2754                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2755                                       MGMT_STATUS_BUSY);
2756                 goto unlock;
2757         }
2758
2759         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2760                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2761                                       MGMT_STATUS_INVALID_PARAMS);
2762                 goto unlock;
2763         }
2764
2765         hdev->major_class = cp->major;
2766         hdev->minor_class = cp->minor;
2767
2768         if (!hdev_is_powered(hdev)) {
2769                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2770                                         hdev->dev_class, 3);
2771                 goto unlock;
2772         }
2773
2774         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2775         if (!cmd) {
2776                 err = -ENOMEM;
2777                 goto unlock;
2778         }
2779
2780         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2781                                  mgmt_class_complete);
2782         if (err < 0)
2783                 mgmt_pending_free(cmd);
2784
2785 unlock:
2786         hci_dev_unlock(hdev);
2787         return err;
2788 }
2789
2790 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2791                           u16 len)
2792 {
2793         struct mgmt_cp_load_link_keys *cp = data;
2794         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2795                                    sizeof(struct mgmt_link_key_info));
2796         u16 key_count, expected_len;
2797         bool changed;
2798         int i;
2799
2800         bt_dev_dbg(hdev, "sock %p", sk);
2801
2802         if (!lmp_bredr_capable(hdev))
2803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2804                                        MGMT_STATUS_NOT_SUPPORTED);
2805
2806         key_count = __le16_to_cpu(cp->key_count);
2807         if (key_count > max_key_count) {
2808                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2809                            key_count);
2810                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2811                                        MGMT_STATUS_INVALID_PARAMS);
2812         }
2813
2814         expected_len = struct_size(cp, keys, key_count);
2815         if (expected_len != len) {
2816                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2817                            expected_len, len);
2818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2819                                        MGMT_STATUS_INVALID_PARAMS);
2820         }
2821
2822         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2823                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2824                                        MGMT_STATUS_INVALID_PARAMS);
2825
2826         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2827                    key_count);
2828
2829         for (i = 0; i < key_count; i++) {
2830                 struct mgmt_link_key_info *key = &cp->keys[i];
2831
2832                 /* Considering SMP over BREDR/LE, there is no need to check addr_type */
2833                 if (key->type > 0x08)
2834                         return mgmt_cmd_status(sk, hdev->id,
2835                                                MGMT_OP_LOAD_LINK_KEYS,
2836                                                MGMT_STATUS_INVALID_PARAMS);
2837         }
2838
2839         hci_dev_lock(hdev);
2840
2841         hci_link_keys_clear(hdev);
2842
2843         if (cp->debug_keys)
2844                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2845         else
2846                 changed = hci_dev_test_and_clear_flag(hdev,
2847                                                       HCI_KEEP_DEBUG_KEYS);
2848
2849         if (changed)
2850                 new_settings(hdev, NULL);
2851
2852         for (i = 0; i < key_count; i++) {
2853                 struct mgmt_link_key_info *key = &cp->keys[i];
2854
2855                 if (hci_is_blocked_key(hdev,
2856                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2857                                        key->val)) {
2858                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2859                                     &key->addr.bdaddr);
2860                         continue;
2861                 }
2862
2863                 /* Always ignore debug keys and require a new pairing if
2864                  * the user wants to use them.
2865                  */
2866                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2867                         continue;
2868
2869                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2870                                  key->type, key->pin_len, NULL);
2871         }
2872
2873         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2874
2875         hci_dev_unlock(hdev);
2876
2877         return 0;
2878 }
2879
2880 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2881                            u8 addr_type, struct sock *skip_sk)
2882 {
2883         struct mgmt_ev_device_unpaired ev;
2884
2885         bacpy(&ev.addr.bdaddr, bdaddr);
2886         ev.addr.type = addr_type;
2887
2888         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2889                           skip_sk);
2890 }
2891
2892 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2893 {
2894         struct mgmt_pending_cmd *cmd = data;
2895         struct mgmt_cp_unpair_device *cp = cmd->param;
2896
2897         if (!err)
2898                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2899
2900         cmd->cmd_complete(cmd, err);
2901         mgmt_pending_free(cmd);
2902 }
2903
2904 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2905 {
2906         struct mgmt_pending_cmd *cmd = data;
2907         struct mgmt_cp_unpair_device *cp = cmd->param;
2908         struct hci_conn *conn;
2909
2910         if (cp->addr.type == BDADDR_BREDR)
2911                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2912                                                &cp->addr.bdaddr);
2913         else
2914                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2915                                                le_addr_type(cp->addr.type));
2916
2917         if (!conn)
2918                 return 0;
2919
2920         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2921 }
2922
2923 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2924                          u16 len)
2925 {
2926         struct mgmt_cp_unpair_device *cp = data;
2927         struct mgmt_rp_unpair_device rp;
2928         struct hci_conn_params *params;
2929         struct mgmt_pending_cmd *cmd;
2930         struct hci_conn *conn;
2931         u8 addr_type;
2932         int err;
2933
2934         memset(&rp, 0, sizeof(rp));
2935         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2936         rp.addr.type = cp->addr.type;
2937
2938         if (!bdaddr_type_is_valid(cp->addr.type))
2939                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2940                                          MGMT_STATUS_INVALID_PARAMS,
2941                                          &rp, sizeof(rp));
2942
2943         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2944                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2945                                          MGMT_STATUS_INVALID_PARAMS,
2946                                          &rp, sizeof(rp));
2947
2948         hci_dev_lock(hdev);
2949
2950         if (!hdev_is_powered(hdev)) {
2951                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2952                                         MGMT_STATUS_NOT_POWERED, &rp,
2953                                         sizeof(rp));
2954                 goto unlock;
2955         }
2956
2957         if (cp->addr.type == BDADDR_BREDR) {
2958                 /* If disconnection is requested, then look up the
2959                  * connection. If the remote device is connected, it
2960                  * will be later used to terminate the link.
2961                  *
2962                  * Setting it to NULL explicitly will cause no
2963                  * termination of the link.
2964                  */
2965                 if (cp->disconnect)
2966                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2967                                                        &cp->addr.bdaddr);
2968                 else
2969                         conn = NULL;
2970
2971                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2972                 if (err < 0) {
2973                         err = mgmt_cmd_complete(sk, hdev->id,
2974                                                 MGMT_OP_UNPAIR_DEVICE,
2975                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2976                                                 sizeof(rp));
2977                         goto unlock;
2978                 }
2979
2980                 goto done;
2981         }
2982
2983         /* LE address type */
2984         addr_type = le_addr_type(cp->addr.type);
2985
2986         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2987         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2988         if (err < 0) {
2989                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2990                                         MGMT_STATUS_NOT_PAIRED, &rp,
2991                                         sizeof(rp));
2992                 goto unlock;
2993         }
2994
2995         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2996         if (!conn) {
2997                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2998                 goto done;
2999         }
3000
3001
3002         /* Defer clearing up the connection parameters until closing to
3003          * give a chance of keeping them if a repairing happens.
3004          */
3005         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3006
3007         /* Disable auto-connection parameters if present */
3008         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3009         if (params) {
3010                 if (params->explicit_connect)
3011                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3012                 else
3013                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3014         }
3015
3016         /* If disconnection is not requested, then clear the connection
3017          * variable so that the link is not terminated.
3018          */
3019         if (!cp->disconnect)
3020                 conn = NULL;
3021
3022 done:
3023         /* If the connection variable is set, then termination of the
3024          * link is requested.
3025          */
3026         if (!conn) {
3027                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3028                                         &rp, sizeof(rp));
3029                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3030                 goto unlock;
3031         }
3032
3033         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3034                                sizeof(*cp));
3035         if (!cmd) {
3036                 err = -ENOMEM;
3037                 goto unlock;
3038         }
3039
3040         cmd->cmd_complete = addr_cmd_complete;
3041
3042         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3043                                  unpair_device_complete);
3044         if (err < 0)
3045                 mgmt_pending_free(cmd);
3046
3047 unlock:
3048         hci_dev_unlock(hdev);
3049         return err;
3050 }
3051
3052 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3053                       u16 len)
3054 {
3055         struct mgmt_cp_disconnect *cp = data;
3056         struct mgmt_rp_disconnect rp;
3057         struct mgmt_pending_cmd *cmd;
3058         struct hci_conn *conn;
3059         int err;
3060
3061         bt_dev_dbg(hdev, "sock %p", sk);
3062
3063         memset(&rp, 0, sizeof(rp));
3064         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3065         rp.addr.type = cp->addr.type;
3066
3067         if (!bdaddr_type_is_valid(cp->addr.type))
3068                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3069                                          MGMT_STATUS_INVALID_PARAMS,
3070                                          &rp, sizeof(rp));
3071
3072         hci_dev_lock(hdev);
3073
3074         if (!test_bit(HCI_UP, &hdev->flags)) {
3075                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3076                                         MGMT_STATUS_NOT_POWERED, &rp,
3077                                         sizeof(rp));
3078                 goto failed;
3079         }
3080
3081         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3082                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3083                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3084                 goto failed;
3085         }
3086
3087         if (cp->addr.type == BDADDR_BREDR)
3088                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3089                                                &cp->addr.bdaddr);
3090         else
3091                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3092                                                le_addr_type(cp->addr.type));
3093
3094         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3095                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3096                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3097                                         sizeof(rp));
3098                 goto failed;
3099         }
3100
3101         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3102         if (!cmd) {
3103                 err = -ENOMEM;
3104                 goto failed;
3105         }
3106
3107         cmd->cmd_complete = generic_cmd_complete;
3108
3109         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3110         if (err < 0)
3111                 mgmt_pending_remove(cmd);
3112
3113 failed:
3114         hci_dev_unlock(hdev);
3115         return err;
3116 }
3117
3118 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3119 {
3120         switch (link_type) {
3121         case ISO_LINK:
3122         case LE_LINK:
3123                 switch (addr_type) {
3124                 case ADDR_LE_DEV_PUBLIC:
3125                         return BDADDR_LE_PUBLIC;
3126
3127                 default:
3128                         /* Fallback to LE Random address type */
3129                         return BDADDR_LE_RANDOM;
3130                 }
3131
3132         default:
3133                 /* Fallback to BR/EDR type */
3134                 return BDADDR_BREDR;
3135         }
3136 }
3137
3138 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3139                            u16 data_len)
3140 {
3141         struct mgmt_rp_get_connections *rp;
3142         struct hci_conn *c;
3143         int err;
3144         u16 i;
3145
3146         bt_dev_dbg(hdev, "sock %p", sk);
3147
3148         hci_dev_lock(hdev);
3149
3150         if (!hdev_is_powered(hdev)) {
3151                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3152                                       MGMT_STATUS_NOT_POWERED);
3153                 goto unlock;
3154         }
3155
3156         i = 0;
3157         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3158                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3159                         i++;
3160         }
3161
3162         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3163         if (!rp) {
3164                 err = -ENOMEM;
3165                 goto unlock;
3166         }
3167
3168         i = 0;
3169         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3170                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3171                         continue;
3172                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3173                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3174                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3175                         continue;
3176                 i++;
3177         }
3178
3179         rp->conn_count = cpu_to_le16(i);
3180
3181         /* Recalculate length in case of filtered SCO connections, etc */
3182         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3183                                 struct_size(rp, addr, i));
3184
3185         kfree(rp);
3186
3187 unlock:
3188         hci_dev_unlock(hdev);
3189         return err;
3190 }
3191
3192 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3193                                    struct mgmt_cp_pin_code_neg_reply *cp)
3194 {
3195         struct mgmt_pending_cmd *cmd;
3196         int err;
3197
3198         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3199                                sizeof(*cp));
3200         if (!cmd)
3201                 return -ENOMEM;
3202
3203         cmd->cmd_complete = addr_cmd_complete;
3204
3205         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3206                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3207         if (err < 0)
3208                 mgmt_pending_remove(cmd);
3209
3210         return err;
3211 }
3212
3213 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3214                           u16 len)
3215 {
3216         struct hci_conn *conn;
3217         struct mgmt_cp_pin_code_reply *cp = data;
3218         struct hci_cp_pin_code_reply reply;
3219         struct mgmt_pending_cmd *cmd;
3220         int err;
3221
3222         bt_dev_dbg(hdev, "sock %p", sk);
3223
3224         hci_dev_lock(hdev);
3225
3226         if (!hdev_is_powered(hdev)) {
3227                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3228                                       MGMT_STATUS_NOT_POWERED);
3229                 goto failed;
3230         }
3231
3232         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3233         if (!conn) {
3234                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3235                                       MGMT_STATUS_NOT_CONNECTED);
3236                 goto failed;
3237         }
3238
3239         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3240                 struct mgmt_cp_pin_code_neg_reply ncp;
3241
3242                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3243
3244                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3245
3246                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3247                 if (err >= 0)
3248                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3249                                               MGMT_STATUS_INVALID_PARAMS);
3250
3251                 goto failed;
3252         }
3253
3254         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3255         if (!cmd) {
3256                 err = -ENOMEM;
3257                 goto failed;
3258         }
3259
3260         cmd->cmd_complete = addr_cmd_complete;
3261
3262         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3263         reply.pin_len = cp->pin_len;
3264         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3265
3266         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3267         if (err < 0)
3268                 mgmt_pending_remove(cmd);
3269
3270 failed:
3271         hci_dev_unlock(hdev);
3272         return err;
3273 }
3274
3275 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3276                              u16 len)
3277 {
3278         struct mgmt_cp_set_io_capability *cp = data;
3279
3280         bt_dev_dbg(hdev, "sock %p", sk);
3281
3282         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3284                                        MGMT_STATUS_INVALID_PARAMS);
3285
3286         hci_dev_lock(hdev);
3287
3288         hdev->io_capability = cp->io_capability;
3289
3290         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3291
3292         hci_dev_unlock(hdev);
3293
3294         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3295                                  NULL, 0);
3296 }
3297
3298 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3299 {
3300         struct hci_dev *hdev = conn->hdev;
3301         struct mgmt_pending_cmd *cmd;
3302
3303         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3304                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3305                         continue;
3306
3307                 if (cmd->user_data != conn)
3308                         continue;
3309
3310                 return cmd;
3311         }
3312
3313         return NULL;
3314 }
3315
3316 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3317 {
3318         struct mgmt_rp_pair_device rp;
3319         struct hci_conn *conn = cmd->user_data;
3320         int err;
3321
3322         bacpy(&rp.addr.bdaddr, &conn->dst);
3323         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3324
3325         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3326                                 status, &rp, sizeof(rp));
3327
3328         /* So we don't get further callbacks for this connection */
3329         conn->connect_cfm_cb = NULL;
3330         conn->security_cfm_cb = NULL;
3331         conn->disconn_cfm_cb = NULL;
3332
3333         hci_conn_drop(conn);
3334
3335         /* The device is paired so there is no need to remove
3336          * its connection parameters anymore.
3337          */
3338         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3339
3340         hci_conn_put(conn);
3341
3342         return err;
3343 }
3344
3345 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3346 {
3347         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3348         struct mgmt_pending_cmd *cmd;
3349
3350         cmd = find_pairing(conn);
3351         if (cmd) {
3352                 cmd->cmd_complete(cmd, status);
3353                 mgmt_pending_remove(cmd);
3354         }
3355 }
3356
3357 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3358 {
3359         struct mgmt_pending_cmd *cmd;
3360
3361         BT_DBG("status %u", status);
3362
3363         cmd = find_pairing(conn);
3364         if (!cmd) {
3365                 BT_DBG("Unable to find a pending command");
3366                 return;
3367         }
3368
3369         cmd->cmd_complete(cmd, mgmt_status(status));
3370         mgmt_pending_remove(cmd);
3371 }
3372
3373 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3374 {
3375         struct mgmt_pending_cmd *cmd;
3376
3377         BT_DBG("status %u", status);
3378
3379         if (!status)
3380                 return;
3381
3382         cmd = find_pairing(conn);
3383         if (!cmd) {
3384                 BT_DBG("Unable to find a pending command");
3385                 return;
3386         }
3387
3388         cmd->cmd_complete(cmd, mgmt_status(status));
3389         mgmt_pending_remove(cmd);
3390 }
3391
3392 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3393                        u16 len)
3394 {
3395         struct mgmt_cp_pair_device *cp = data;
3396         struct mgmt_rp_pair_device rp;
3397         struct mgmt_pending_cmd *cmd;
3398         u8 sec_level, auth_type;
3399         struct hci_conn *conn;
3400         int err;
3401
3402         bt_dev_dbg(hdev, "sock %p", sk);
3403
3404         memset(&rp, 0, sizeof(rp));
3405         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3406         rp.addr.type = cp->addr.type;
3407
3408         if (!bdaddr_type_is_valid(cp->addr.type))
3409                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3410                                          MGMT_STATUS_INVALID_PARAMS,
3411                                          &rp, sizeof(rp));
3412
3413         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3414                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3415                                          MGMT_STATUS_INVALID_PARAMS,
3416                                          &rp, sizeof(rp));
3417
3418         hci_dev_lock(hdev);
3419
3420         if (!hdev_is_powered(hdev)) {
3421                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3422                                         MGMT_STATUS_NOT_POWERED, &rp,
3423                                         sizeof(rp));
3424                 goto unlock;
3425         }
3426
3427         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3428                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3429                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3430                                         sizeof(rp));
3431                 goto unlock;
3432         }
3433
3434         sec_level = BT_SECURITY_MEDIUM;
3435         auth_type = HCI_AT_DEDICATED_BONDING;
3436
3437         if (cp->addr.type == BDADDR_BREDR) {
3438                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3439                                        auth_type, CONN_REASON_PAIR_DEVICE);
3440         } else {
3441                 u8 addr_type = le_addr_type(cp->addr.type);
3442                 struct hci_conn_params *p;
3443
3444                 /* When pairing a new device, it is expected to remember
3445                  * this device for future connections. Adding the connection
3446                  * parameter information ahead of time allows tracking
3447                  * of the peripheral preferred values and will speed up any
3448                  * further connection establishment.
3449                  *
3450                  * If connection parameters already exist, then they
3451                  * will be kept and this function does nothing.
3452                  */
3453                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3454
3455                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3456                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3457
3458                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3459                                            sec_level, HCI_LE_CONN_TIMEOUT,
3460                                            CONN_REASON_PAIR_DEVICE);
3461         }
3462
3463         if (IS_ERR(conn)) {
3464                 int status;
3465
3466                 if (PTR_ERR(conn) == -EBUSY)
3467                         status = MGMT_STATUS_BUSY;
3468                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3469                         status = MGMT_STATUS_NOT_SUPPORTED;
3470                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3471                         status = MGMT_STATUS_REJECTED;
3472                 else
3473                         status = MGMT_STATUS_CONNECT_FAILED;
3474
3475                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3476                                         status, &rp, sizeof(rp));
3477                 goto unlock;
3478         }
3479
3480         if (conn->connect_cfm_cb) {
3481                 hci_conn_drop(conn);
3482                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3483                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3484                 goto unlock;
3485         }
3486
3487         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3488         if (!cmd) {
3489                 err = -ENOMEM;
3490                 hci_conn_drop(conn);
3491                 goto unlock;
3492         }
3493
3494         cmd->cmd_complete = pairing_complete;
3495
3496         /* For LE, just connecting isn't a proof that the pairing finished */
3497         if (cp->addr.type == BDADDR_BREDR) {
3498                 conn->connect_cfm_cb = pairing_complete_cb;
3499                 conn->security_cfm_cb = pairing_complete_cb;
3500                 conn->disconn_cfm_cb = pairing_complete_cb;
3501         } else {
3502                 conn->connect_cfm_cb = le_pairing_complete_cb;
3503                 conn->security_cfm_cb = le_pairing_complete_cb;
3504                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3505         }
3506
3507         conn->io_capability = cp->io_cap;
3508         cmd->user_data = hci_conn_get(conn);
3509
3510         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3511             hci_conn_security(conn, sec_level, auth_type, true)) {
3512                 cmd->cmd_complete(cmd, 0);
3513                 mgmt_pending_remove(cmd);
3514         }
3515
3516         err = 0;
3517
3518 unlock:
3519         hci_dev_unlock(hdev);
3520         return err;
3521 }
3522
3523 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3524                               u16 len)
3525 {
3526         struct mgmt_addr_info *addr = data;
3527         struct mgmt_pending_cmd *cmd;
3528         struct hci_conn *conn;
3529         int err;
3530
3531         bt_dev_dbg(hdev, "sock %p", sk);
3532
3533         hci_dev_lock(hdev);
3534
3535         if (!hdev_is_powered(hdev)) {
3536                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3537                                       MGMT_STATUS_NOT_POWERED);
3538                 goto unlock;
3539         }
3540
3541         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3542         if (!cmd) {
3543                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3544                                       MGMT_STATUS_INVALID_PARAMS);
3545                 goto unlock;
3546         }
3547
3548         conn = cmd->user_data;
3549
3550         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3551                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3552                                       MGMT_STATUS_INVALID_PARAMS);
3553                 goto unlock;
3554         }
3555
3556         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3557         mgmt_pending_remove(cmd);
3558
3559         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3560                                 addr, sizeof(*addr));
3561
3562         /* Since user doesn't want to proceed with the connection, abort any
3563          * ongoing pairing and then terminate the link if it was created
3564          * because of the pair device action.
3565          */
3566         if (addr->type == BDADDR_BREDR)
3567                 hci_remove_link_key(hdev, &addr->bdaddr);
3568         else
3569                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3570                                               le_addr_type(addr->type));
3571
3572         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3573                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3574
3575 unlock:
3576         hci_dev_unlock(hdev);
3577         return err;
3578 }
3579
3580 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3581                              struct mgmt_addr_info *addr, u16 mgmt_op,
3582                              u16 hci_op, __le32 passkey)
3583 {
3584         struct mgmt_pending_cmd *cmd;
3585         struct hci_conn *conn;
3586         int err;
3587
3588         hci_dev_lock(hdev);
3589
3590         if (!hdev_is_powered(hdev)) {
3591                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3592                                         MGMT_STATUS_NOT_POWERED, addr,
3593                                         sizeof(*addr));
3594                 goto done;
3595         }
3596
3597         if (addr->type == BDADDR_BREDR)
3598                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3599         else
3600                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3601                                                le_addr_type(addr->type));
3602
3603         if (!conn) {
3604                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3605                                         MGMT_STATUS_NOT_CONNECTED, addr,
3606                                         sizeof(*addr));
3607                 goto done;
3608         }
3609
3610         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3611                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3612                 if (!err)
3613                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3614                                                 MGMT_STATUS_SUCCESS, addr,
3615                                                 sizeof(*addr));
3616                 else
3617                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3618                                                 MGMT_STATUS_FAILED, addr,
3619                                                 sizeof(*addr));
3620
3621                 goto done;
3622         }
3623
3624         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3625         if (!cmd) {
3626                 err = -ENOMEM;
3627                 goto done;
3628         }
3629
3630         cmd->cmd_complete = addr_cmd_complete;
3631
3632         /* Continue with pairing via HCI */
3633         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3634                 struct hci_cp_user_passkey_reply cp;
3635
3636                 bacpy(&cp.bdaddr, &addr->bdaddr);
3637                 cp.passkey = passkey;
3638                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3639         } else
3640                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3641                                    &addr->bdaddr);
3642
3643         if (err < 0)
3644                 mgmt_pending_remove(cmd);
3645
3646 done:
3647         hci_dev_unlock(hdev);
3648         return err;
3649 }
3650
3651 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3652                               void *data, u16 len)
3653 {
3654         struct mgmt_cp_pin_code_neg_reply *cp = data;
3655
3656         bt_dev_dbg(hdev, "sock %p", sk);
3657
3658         return user_pairing_resp(sk, hdev, &cp->addr,
3659                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3660                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3661 }
3662
3663 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3664                               u16 len)
3665 {
3666         struct mgmt_cp_user_confirm_reply *cp = data;
3667
3668         bt_dev_dbg(hdev, "sock %p", sk);
3669
3670         if (len != sizeof(*cp))
3671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3672                                        MGMT_STATUS_INVALID_PARAMS);
3673
3674         return user_pairing_resp(sk, hdev, &cp->addr,
3675                                  MGMT_OP_USER_CONFIRM_REPLY,
3676                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3677 }
3678
3679 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3680                                   void *data, u16 len)
3681 {
3682         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3683
3684         bt_dev_dbg(hdev, "sock %p", sk);
3685
3686         return user_pairing_resp(sk, hdev, &cp->addr,
3687                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3688                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3689 }
3690
3691 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3692                               u16 len)
3693 {
3694         struct mgmt_cp_user_passkey_reply *cp = data;
3695
3696         bt_dev_dbg(hdev, "sock %p", sk);
3697
3698         return user_pairing_resp(sk, hdev, &cp->addr,
3699                                  MGMT_OP_USER_PASSKEY_REPLY,
3700                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3701 }
3702
3703 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3704                                   void *data, u16 len)
3705 {
3706         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3707
3708         bt_dev_dbg(hdev, "sock %p", sk);
3709
3710         return user_pairing_resp(sk, hdev, &cp->addr,
3711                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3712                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3713 }
3714
3715 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3716 {
3717         struct adv_info *adv_instance;
3718
3719         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3720         if (!adv_instance)
3721                 return 0;
3722
3723         /* stop if current instance doesn't need to be changed */
3724         if (!(adv_instance->flags & flags))
3725                 return 0;
3726
3727         cancel_adv_timeout(hdev);
3728
3729         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3730         if (!adv_instance)
3731                 return 0;
3732
3733         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3734
3735         return 0;
3736 }
3737
3738 static int name_changed_sync(struct hci_dev *hdev, void *data)
3739 {
3740         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3741 }
3742
3743 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3744 {
3745         struct mgmt_pending_cmd *cmd = data;
3746         struct mgmt_cp_set_local_name *cp = cmd->param;
3747         u8 status = mgmt_status(err);
3748
3749         bt_dev_dbg(hdev, "err %d", err);
3750
3751         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3752                 return;
3753
3754         if (status) {
3755                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3756                                 status);
3757         } else {
3758                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3759                                   cp, sizeof(*cp));
3760
3761                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3762                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3763         }
3764
3765         mgmt_pending_remove(cmd);
3766 }
3767
3768 static int set_name_sync(struct hci_dev *hdev, void *data)
3769 {
3770         if (lmp_bredr_capable(hdev)) {
3771                 hci_update_name_sync(hdev);
3772                 hci_update_eir_sync(hdev);
3773         }
3774
3775         /* The name is stored in the scan response data and so
3776          * no need to update the advertising data here.
3777          */
3778         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3779                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3780
3781         return 0;
3782 }
3783
3784 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3785                           u16 len)
3786 {
3787         struct mgmt_cp_set_local_name *cp = data;
3788         struct mgmt_pending_cmd *cmd;
3789         int err;
3790
3791         bt_dev_dbg(hdev, "sock %p", sk);
3792
3793         hci_dev_lock(hdev);
3794
3795         /* If the old values are the same as the new ones just return a
3796          * direct command complete event.
3797          */
3798         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3799             !memcmp(hdev->short_name, cp->short_name,
3800                     sizeof(hdev->short_name))) {
3801                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3802                                         data, len);
3803                 goto failed;
3804         }
3805
3806         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3807
3808         if (!hdev_is_powered(hdev)) {
3809                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3810
3811                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3812                                         data, len);
3813                 if (err < 0)
3814                         goto failed;
3815
3816                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3817                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3818                 ext_info_changed(hdev, sk);
3819
3820                 goto failed;
3821         }
3822
3823         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3824         if (!cmd)
3825                 err = -ENOMEM;
3826         else
3827                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3828                                          set_name_complete);
3829
3830         if (err < 0) {
3831                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3832                                       MGMT_STATUS_FAILED);
3833
3834                 if (cmd)
3835                         mgmt_pending_remove(cmd);
3836
3837                 goto failed;
3838         }
3839
3840         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3841
3842 failed:
3843         hci_dev_unlock(hdev);
3844         return err;
3845 }
3846
3847 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3848 {
3849         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3850 }
3851
3852 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3853                           u16 len)
3854 {
3855         struct mgmt_cp_set_appearance *cp = data;
3856         u16 appearance;
3857         int err;
3858
3859         bt_dev_dbg(hdev, "sock %p", sk);
3860
3861         if (!lmp_le_capable(hdev))
3862                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3863                                        MGMT_STATUS_NOT_SUPPORTED);
3864
3865         appearance = le16_to_cpu(cp->appearance);
3866
3867         hci_dev_lock(hdev);
3868
3869         if (hdev->appearance != appearance) {
3870                 hdev->appearance = appearance;
3871
3872                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3873                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3874                                            NULL);
3875
3876                 ext_info_changed(hdev, sk);
3877         }
3878
3879         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3880                                 0);
3881
3882         hci_dev_unlock(hdev);
3883
3884         return err;
3885 }
3886
3887 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3888                                  void *data, u16 len)
3889 {
3890         struct mgmt_rp_get_phy_configuration rp;
3891
3892         bt_dev_dbg(hdev, "sock %p", sk);
3893
3894         hci_dev_lock(hdev);
3895
3896         memset(&rp, 0, sizeof(rp));
3897
3898         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3899         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3900         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3901
3902         hci_dev_unlock(hdev);
3903
3904         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3905                                  &rp, sizeof(rp));
3906 }
3907
3908 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3909 {
3910         struct mgmt_ev_phy_configuration_changed ev;
3911
3912         memset(&ev, 0, sizeof(ev));
3913
3914         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3915
3916         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3917                           sizeof(ev), skip);
3918 }
3919
3920 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3921 {
3922         struct mgmt_pending_cmd *cmd = data;
3923         struct sk_buff *skb = cmd->skb;
3924         u8 status = mgmt_status(err);
3925
3926         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3927                 return;
3928
3929         if (!status) {
3930                 if (!skb)
3931                         status = MGMT_STATUS_FAILED;
3932                 else if (IS_ERR(skb))
3933                         status = mgmt_status(PTR_ERR(skb));
3934                 else
3935                         status = mgmt_status(skb->data[0]);
3936         }
3937
3938         bt_dev_dbg(hdev, "status %d", status);
3939
3940         if (status) {
3941                 mgmt_cmd_status(cmd->sk, hdev->id,
3942                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3943         } else {
3944                 mgmt_cmd_complete(cmd->sk, hdev->id,
3945                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3946                                   NULL, 0);
3947
3948                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3949         }
3950
3951         if (skb && !IS_ERR(skb))
3952                 kfree_skb(skb);
3953
3954         mgmt_pending_remove(cmd);
3955 }
3956
3957 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
3958 {
3959         struct mgmt_pending_cmd *cmd = data;
3960         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
3961         struct hci_cp_le_set_default_phy cp_phy;
3962         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
3963
3964         memset(&cp_phy, 0, sizeof(cp_phy));
3965
3966         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3967                 cp_phy.all_phys |= 0x01;
3968
3969         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3970                 cp_phy.all_phys |= 0x02;
3971
3972         if (selected_phys & MGMT_PHY_LE_1M_TX)
3973                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3974
3975         if (selected_phys & MGMT_PHY_LE_2M_TX)
3976                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3977
3978         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3979                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3980
3981         if (selected_phys & MGMT_PHY_LE_1M_RX)
3982                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3983
3984         if (selected_phys & MGMT_PHY_LE_2M_RX)
3985                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3986
3987         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3988                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3989
3990         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
3991                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
3992
3993         return 0;
3994 }
3995
3996 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3997                                  void *data, u16 len)
3998 {
3999         struct mgmt_cp_set_phy_configuration *cp = data;
4000         struct mgmt_pending_cmd *cmd;
4001         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4002         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4003         bool changed = false;
4004         int err;
4005
4006         bt_dev_dbg(hdev, "sock %p", sk);
4007
4008         configurable_phys = get_configurable_phys(hdev);
4009         supported_phys = get_supported_phys(hdev);
4010         selected_phys = __le32_to_cpu(cp->selected_phys);
4011
4012         if (selected_phys & ~supported_phys)
4013                 return mgmt_cmd_status(sk, hdev->id,
4014                                        MGMT_OP_SET_PHY_CONFIGURATION,
4015                                        MGMT_STATUS_INVALID_PARAMS);
4016
4017         unconfigure_phys = supported_phys & ~configurable_phys;
4018
4019         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4020                 return mgmt_cmd_status(sk, hdev->id,
4021                                        MGMT_OP_SET_PHY_CONFIGURATION,
4022                                        MGMT_STATUS_INVALID_PARAMS);
4023
4024         if (selected_phys == get_selected_phys(hdev))
4025                 return mgmt_cmd_complete(sk, hdev->id,
4026                                          MGMT_OP_SET_PHY_CONFIGURATION,
4027                                          0, NULL, 0);
4028
4029         hci_dev_lock(hdev);
4030
4031         if (!hdev_is_powered(hdev)) {
4032                 err = mgmt_cmd_status(sk, hdev->id,
4033                                       MGMT_OP_SET_PHY_CONFIGURATION,
4034                                       MGMT_STATUS_REJECTED);
4035                 goto unlock;
4036         }
4037
4038         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4039                 err = mgmt_cmd_status(sk, hdev->id,
4040                                       MGMT_OP_SET_PHY_CONFIGURATION,
4041                                       MGMT_STATUS_BUSY);
4042                 goto unlock;
4043         }
4044
4045         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4046                 pkt_type |= (HCI_DH3 | HCI_DM3);
4047         else
4048                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4049
4050         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4051                 pkt_type |= (HCI_DH5 | HCI_DM5);
4052         else
4053                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4054
4055         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4056                 pkt_type &= ~HCI_2DH1;
4057         else
4058                 pkt_type |= HCI_2DH1;
4059
4060         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4061                 pkt_type &= ~HCI_2DH3;
4062         else
4063                 pkt_type |= HCI_2DH3;
4064
4065         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4066                 pkt_type &= ~HCI_2DH5;
4067         else
4068                 pkt_type |= HCI_2DH5;
4069
4070         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4071                 pkt_type &= ~HCI_3DH1;
4072         else
4073                 pkt_type |= HCI_3DH1;
4074
4075         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4076                 pkt_type &= ~HCI_3DH3;
4077         else
4078                 pkt_type |= HCI_3DH3;
4079
4080         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4081                 pkt_type &= ~HCI_3DH5;
4082         else
4083                 pkt_type |= HCI_3DH5;
4084
4085         if (pkt_type != hdev->pkt_type) {
4086                 hdev->pkt_type = pkt_type;
4087                 changed = true;
4088         }
4089
4090         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4091             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4092                 if (changed)
4093                         mgmt_phy_configuration_changed(hdev, sk);
4094
4095                 err = mgmt_cmd_complete(sk, hdev->id,
4096                                         MGMT_OP_SET_PHY_CONFIGURATION,
4097                                         0, NULL, 0);
4098
4099                 goto unlock;
4100         }
4101
4102         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4103                                len);
4104         if (!cmd)
4105                 err = -ENOMEM;
4106         else
4107                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4108                                          set_default_phy_complete);
4109
4110         if (err < 0) {
4111                 err = mgmt_cmd_status(sk, hdev->id,
4112                                       MGMT_OP_SET_PHY_CONFIGURATION,
4113                                       MGMT_STATUS_FAILED);
4114
4115                 if (cmd)
4116                         mgmt_pending_remove(cmd);
4117         }
4118
4119 unlock:
4120         hci_dev_unlock(hdev);
4121
4122         return err;
4123 }
4124
4125 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4126                             u16 len)
4127 {
4128         int err = MGMT_STATUS_SUCCESS;
4129         struct mgmt_cp_set_blocked_keys *keys = data;
4130         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4131                                    sizeof(struct mgmt_blocked_key_info));
4132         u16 key_count, expected_len;
4133         int i;
4134
4135         bt_dev_dbg(hdev, "sock %p", sk);
4136
4137         key_count = __le16_to_cpu(keys->key_count);
4138         if (key_count > max_key_count) {
4139                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4140                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4141                                        MGMT_STATUS_INVALID_PARAMS);
4142         }
4143
4144         expected_len = struct_size(keys, keys, key_count);
4145         if (expected_len != len) {
4146                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4147                            expected_len, len);
4148                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4149                                        MGMT_STATUS_INVALID_PARAMS);
4150         }
4151
4152         hci_dev_lock(hdev);
4153
4154         hci_blocked_keys_clear(hdev);
4155
4156         for (i = 0; i < key_count; ++i) {
4157                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4158
4159                 if (!b) {
4160                         err = MGMT_STATUS_NO_RESOURCES;
4161                         break;
4162                 }
4163
4164                 b->type = keys->keys[i].type;
4165                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4166                 list_add_rcu(&b->list, &hdev->blocked_keys);
4167         }
4168         hci_dev_unlock(hdev);
4169
4170         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4171                                 err, NULL, 0);
4172 }
4173
4174 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4175                                void *data, u16 len)
4176 {
4177         struct mgmt_mode *cp = data;
4178         int err;
4179         bool changed = false;
4180
4181         bt_dev_dbg(hdev, "sock %p", sk);
4182
4183         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4184                 return mgmt_cmd_status(sk, hdev->id,
4185                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4186                                        MGMT_STATUS_NOT_SUPPORTED);
4187
4188         if (cp->val != 0x00 && cp->val != 0x01)
4189                 return mgmt_cmd_status(sk, hdev->id,
4190                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4191                                        MGMT_STATUS_INVALID_PARAMS);
4192
4193         hci_dev_lock(hdev);
4194
4195         if (hdev_is_powered(hdev) &&
4196             !!cp->val != hci_dev_test_flag(hdev,
4197                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4198                 err = mgmt_cmd_status(sk, hdev->id,
4199                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4200                                       MGMT_STATUS_REJECTED);
4201                 goto unlock;
4202         }
4203
4204         if (cp->val)
4205                 changed = !hci_dev_test_and_set_flag(hdev,
4206                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4207         else
4208                 changed = hci_dev_test_and_clear_flag(hdev,
4209                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4210
4211         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4212         if (err < 0)
4213                 goto unlock;
4214
4215         if (changed)
4216                 err = new_settings(hdev, sk);
4217
4218 unlock:
4219         hci_dev_unlock(hdev);
4220         return err;
4221 }
4222
4223 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4224                                void *data, u16 data_len)
4225 {
4226         char buf[20];
4227         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4228         u16 cap_len = 0;
4229         u8 flags = 0;
4230         u8 tx_power_range[2];
4231
4232         bt_dev_dbg(hdev, "sock %p", sk);
4233
4234         memset(&buf, 0, sizeof(buf));
4235
4236         hci_dev_lock(hdev);
4237
4238         /* When the Read Simple Pairing Options command is supported, then
4239          * the remote public key validation is supported.
4240          *
4241          * Alternatively, when Microsoft extensions are available, they can
4242          * indicate support for public key validation as well.
4243          */
4244         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4245                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4246
4247         flags |= 0x02;          /* Remote public key validation (LE) */
4248
4249         /* When the Read Encryption Key Size command is supported, then the
4250          * encryption key size is enforced.
4251          */
4252         if (hdev->commands[20] & 0x10)
4253                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4254
4255         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4256
4257         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4258                                   &flags, 1);
4259
4260         /* When the Read Simple Pairing Options command is supported, then
4261          * also max encryption key size information is provided.
4262          */
4263         if (hdev->commands[41] & 0x08)
4264                 cap_len = eir_append_le16(rp->cap, cap_len,
4265                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4266                                           hdev->max_enc_key_size);
4267
4268         cap_len = eir_append_le16(rp->cap, cap_len,
4269                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4270                                   SMP_MAX_ENC_KEY_SIZE);
4271
4272         /* Append the min/max LE tx power parameters if we were able to fetch
4273          * it from the controller
4274          */
4275         if (hdev->commands[38] & 0x80) {
4276                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4277                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4278                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4279                                           tx_power_range, 2);
4280         }
4281
4282         rp->cap_len = cpu_to_le16(cap_len);
4283
4284         hci_dev_unlock(hdev);
4285
4286         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4287                                  rp, sizeof(*rp) + cap_len);
4288 }
4289
4290 #ifdef CONFIG_BT_FEATURE_DEBUG
4291 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4292 static const u8 debug_uuid[16] = {
4293         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4294         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4295 };
4296 #endif
4297
4298 /* 330859bc-7506-492d-9370-9a6f0614037f */
4299 static const u8 quality_report_uuid[16] = {
4300         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4301         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4302 };
4303
4304 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4305 static const u8 offload_codecs_uuid[16] = {
4306         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4307         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4308 };
4309
4310 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4311 static const u8 le_simultaneous_roles_uuid[16] = {
4312         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4313         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4314 };
4315
4316 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4317 static const u8 rpa_resolution_uuid[16] = {
4318         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4319         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4320 };
4321
4322 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4323 static const u8 iso_socket_uuid[16] = {
4324         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4325         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4326 };
4327
4328 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4329 static const u8 mgmt_mesh_uuid[16] = {
4330         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4331         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4332 };
4333
4334 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4335                                   void *data, u16 data_len)
4336 {
4337         struct mgmt_rp_read_exp_features_info *rp;
4338         size_t len;
4339         u16 idx = 0;
4340         u32 flags;
4341         int status;
4342
4343         bt_dev_dbg(hdev, "sock %p", sk);
4344
4345         /* Enough space for 7 features */
4346         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4347         rp = kzalloc(len, GFP_KERNEL);
4348         if (!rp)
4349                 return -ENOMEM;
4350
4351 #ifdef CONFIG_BT_FEATURE_DEBUG
4352         if (!hdev) {
4353                 flags = bt_dbg_get() ? BIT(0) : 0;
4354
4355                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4356                 rp->features[idx].flags = cpu_to_le32(flags);
4357                 idx++;
4358         }
4359 #endif
4360
4361         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4362                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4363                         flags = BIT(0);
4364                 else
4365                         flags = 0;
4366
4367                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4368                 rp->features[idx].flags = cpu_to_le32(flags);
4369                 idx++;
4370         }
4371
4372         if (hdev && ll_privacy_capable(hdev)) {
4373                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4374                         flags = BIT(0) | BIT(1);
4375                 else
4376                         flags = BIT(1);
4377
4378                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4379                 rp->features[idx].flags = cpu_to_le32(flags);
4380                 idx++;
4381         }
4382
4383         if (hdev && (aosp_has_quality_report(hdev) ||
4384                      hdev->set_quality_report)) {
4385                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4386                         flags = BIT(0);
4387                 else
4388                         flags = 0;
4389
4390                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4391                 rp->features[idx].flags = cpu_to_le32(flags);
4392                 idx++;
4393         }
4394
4395         if (hdev && hdev->get_data_path_id) {
4396                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4397                         flags = BIT(0);
4398                 else
4399                         flags = 0;
4400
4401                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4402                 rp->features[idx].flags = cpu_to_le32(flags);
4403                 idx++;
4404         }
4405
4406         if (IS_ENABLED(CONFIG_BT_LE)) {
4407                 flags = iso_enabled() ? BIT(0) : 0;
4408                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4409                 rp->features[idx].flags = cpu_to_le32(flags);
4410                 idx++;
4411         }
4412
4413         if (hdev && lmp_le_capable(hdev)) {
4414                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4415                         flags = BIT(0);
4416                 else
4417                         flags = 0;
4418
4419                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4420                 rp->features[idx].flags = cpu_to_le32(flags);
4421                 idx++;
4422         }
4423
4424         rp->feature_count = cpu_to_le16(idx);
4425
4426         /* After reading the experimental features information, enable
4427          * the events to update client on any future change.
4428          */
4429         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4430
4431         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4432                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4433                                    0, rp, sizeof(*rp) + (20 * idx));
4434
4435         kfree(rp);
4436         return status;
4437 }
4438
4439 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4440                                           struct sock *skip)
4441 {
4442         struct mgmt_ev_exp_feature_changed ev;
4443
4444         memset(&ev, 0, sizeof(ev));
4445         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4446         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4447
4448         // Do we need to be atomic with the conn_flags?
4449         if (enabled && privacy_mode_capable(hdev))
4450                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4451         else
4452                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4453
4454         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4455                                   &ev, sizeof(ev),
4456                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4457
4458 }
4459
4460 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4461                                bool enabled, struct sock *skip)
4462 {
4463         struct mgmt_ev_exp_feature_changed ev;
4464
4465         memset(&ev, 0, sizeof(ev));
4466         memcpy(ev.uuid, uuid, 16);
4467         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4468
4469         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4470                                   &ev, sizeof(ev),
4471                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4472 }
4473
4474 #define EXP_FEAT(_uuid, _set_func)      \
4475 {                                       \
4476         .uuid = _uuid,                  \
4477         .set_func = _set_func,          \
4478 }
4479
4480 /* The zero key uuid is special. Multiple exp features are set through it. */
4481 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4482                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4483 {
4484         struct mgmt_rp_set_exp_feature rp;
4485
4486         memset(rp.uuid, 0, 16);
4487         rp.flags = cpu_to_le32(0);
4488
4489 #ifdef CONFIG_BT_FEATURE_DEBUG
4490         if (!hdev) {
4491                 bool changed = bt_dbg_get();
4492
4493                 bt_dbg_set(false);
4494
4495                 if (changed)
4496                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4497         }
4498 #endif
4499
4500         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4501                 bool changed;
4502
4503                 changed = hci_dev_test_and_clear_flag(hdev,
4504                                                       HCI_ENABLE_LL_PRIVACY);
4505                 if (changed)
4506                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4507                                             sk);
4508         }
4509
4510         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4511
4512         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4513                                  MGMT_OP_SET_EXP_FEATURE, 0,
4514                                  &rp, sizeof(rp));
4515 }
4516
4517 #ifdef CONFIG_BT_FEATURE_DEBUG
4518 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4519                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4520 {
4521         struct mgmt_rp_set_exp_feature rp;
4522
4523         bool val, changed;
4524         int err;
4525
4526         /* Command requires to use the non-controller index */
4527         if (hdev)
4528                 return mgmt_cmd_status(sk, hdev->id,
4529                                        MGMT_OP_SET_EXP_FEATURE,
4530                                        MGMT_STATUS_INVALID_INDEX);
4531
4532         /* Parameters are limited to a single octet */
4533         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4534                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4535                                        MGMT_OP_SET_EXP_FEATURE,
4536                                        MGMT_STATUS_INVALID_PARAMS);
4537
4538         /* Only boolean on/off is supported */
4539         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4540                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4541                                        MGMT_OP_SET_EXP_FEATURE,
4542                                        MGMT_STATUS_INVALID_PARAMS);
4543
4544         val = !!cp->param[0];
4545         changed = val ? !bt_dbg_get() : bt_dbg_get();
4546         bt_dbg_set(val);
4547
4548         memcpy(rp.uuid, debug_uuid, 16);
4549         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4550
4551         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4552
4553         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4554                                 MGMT_OP_SET_EXP_FEATURE, 0,
4555                                 &rp, sizeof(rp));
4556
4557         if (changed)
4558                 exp_feature_changed(hdev, debug_uuid, val, sk);
4559
4560         return err;
4561 }
4562 #endif
4563
4564 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4565                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4566 {
4567         struct mgmt_rp_set_exp_feature rp;
4568         bool val, changed;
4569         int err;
4570
4571         /* Command requires to use the controller index */
4572         if (!hdev)
4573                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4574                                        MGMT_OP_SET_EXP_FEATURE,
4575                                        MGMT_STATUS_INVALID_INDEX);
4576
4577         /* Parameters are limited to a single octet */
4578         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4579                 return mgmt_cmd_status(sk, hdev->id,
4580                                        MGMT_OP_SET_EXP_FEATURE,
4581                                        MGMT_STATUS_INVALID_PARAMS);
4582
4583         /* Only boolean on/off is supported */
4584         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4585                 return mgmt_cmd_status(sk, hdev->id,
4586                                        MGMT_OP_SET_EXP_FEATURE,
4587                                        MGMT_STATUS_INVALID_PARAMS);
4588
4589         val = !!cp->param[0];
4590
4591         if (val) {
4592                 changed = !hci_dev_test_and_set_flag(hdev,
4593                                                      HCI_MESH_EXPERIMENTAL);
4594         } else {
4595                 hci_dev_clear_flag(hdev, HCI_MESH);
4596                 changed = hci_dev_test_and_clear_flag(hdev,
4597                                                       HCI_MESH_EXPERIMENTAL);
4598         }
4599
4600         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4601         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4602
4603         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4604
4605         err = mgmt_cmd_complete(sk, hdev->id,
4606                                 MGMT_OP_SET_EXP_FEATURE, 0,
4607                                 &rp, sizeof(rp));
4608
4609         if (changed)
4610                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4611
4612         return err;
4613 }
4614
4615 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4616                                    struct mgmt_cp_set_exp_feature *cp,
4617                                    u16 data_len)
4618 {
4619         struct mgmt_rp_set_exp_feature rp;
4620         bool val, changed;
4621         int err;
4622         u32 flags;
4623
4624         /* Command requires to use the controller index */
4625         if (!hdev)
4626                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4627                                        MGMT_OP_SET_EXP_FEATURE,
4628                                        MGMT_STATUS_INVALID_INDEX);
4629
4630         /* Changes can only be made when controller is powered down */
4631         if (hdev_is_powered(hdev))
4632                 return mgmt_cmd_status(sk, hdev->id,
4633                                        MGMT_OP_SET_EXP_FEATURE,
4634                                        MGMT_STATUS_REJECTED);
4635
4636         /* Parameters are limited to a single octet */
4637         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4638                 return mgmt_cmd_status(sk, hdev->id,
4639                                        MGMT_OP_SET_EXP_FEATURE,
4640                                        MGMT_STATUS_INVALID_PARAMS);
4641
4642         /* Only boolean on/off is supported */
4643         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4644                 return mgmt_cmd_status(sk, hdev->id,
4645                                        MGMT_OP_SET_EXP_FEATURE,
4646                                        MGMT_STATUS_INVALID_PARAMS);
4647
4648         val = !!cp->param[0];
4649
4650         if (val) {
4651                 changed = !hci_dev_test_and_set_flag(hdev,
4652                                                      HCI_ENABLE_LL_PRIVACY);
4653                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4654
4655                 /* Enable LL privacy + supported settings changed */
4656                 flags = BIT(0) | BIT(1);
4657         } else {
4658                 changed = hci_dev_test_and_clear_flag(hdev,
4659                                                       HCI_ENABLE_LL_PRIVACY);
4660
4661                 /* Disable LL privacy + supported settings changed */
4662                 flags = BIT(1);
4663         }
4664
4665         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4666         rp.flags = cpu_to_le32(flags);
4667
4668         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4669
4670         err = mgmt_cmd_complete(sk, hdev->id,
4671                                 MGMT_OP_SET_EXP_FEATURE, 0,
4672                                 &rp, sizeof(rp));
4673
4674         if (changed)
4675                 exp_ll_privacy_feature_changed(val, hdev, sk);
4676
4677         return err;
4678 }
4679
4680 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4681                                    struct mgmt_cp_set_exp_feature *cp,
4682                                    u16 data_len)
4683 {
4684         struct mgmt_rp_set_exp_feature rp;
4685         bool val, changed;
4686         int err;
4687
4688         /* Command requires to use a valid controller index */
4689         if (!hdev)
4690                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4691                                        MGMT_OP_SET_EXP_FEATURE,
4692                                        MGMT_STATUS_INVALID_INDEX);
4693
4694         /* Parameters are limited to a single octet */
4695         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4696                 return mgmt_cmd_status(sk, hdev->id,
4697                                        MGMT_OP_SET_EXP_FEATURE,
4698                                        MGMT_STATUS_INVALID_PARAMS);
4699
4700         /* Only boolean on/off is supported */
4701         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4702                 return mgmt_cmd_status(sk, hdev->id,
4703                                        MGMT_OP_SET_EXP_FEATURE,
4704                                        MGMT_STATUS_INVALID_PARAMS);
4705
4706         hci_req_sync_lock(hdev);
4707
4708         val = !!cp->param[0];
4709         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4710
4711         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4712                 err = mgmt_cmd_status(sk, hdev->id,
4713                                       MGMT_OP_SET_EXP_FEATURE,
4714                                       MGMT_STATUS_NOT_SUPPORTED);
4715                 goto unlock_quality_report;
4716         }
4717
4718         if (changed) {
4719                 if (hdev->set_quality_report)
4720                         err = hdev->set_quality_report(hdev, val);
4721                 else
4722                         err = aosp_set_quality_report(hdev, val);
4723
4724                 if (err) {
4725                         err = mgmt_cmd_status(sk, hdev->id,
4726                                               MGMT_OP_SET_EXP_FEATURE,
4727                                               MGMT_STATUS_FAILED);
4728                         goto unlock_quality_report;
4729                 }
4730
4731                 if (val)
4732                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4733                 else
4734                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4735         }
4736
4737         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4738
4739         memcpy(rp.uuid, quality_report_uuid, 16);
4740         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4741         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4742
4743         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4744                                 &rp, sizeof(rp));
4745
4746         if (changed)
4747                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4748
4749 unlock_quality_report:
4750         hci_req_sync_unlock(hdev);
4751         return err;
4752 }
4753
4754 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4755                                   struct mgmt_cp_set_exp_feature *cp,
4756                                   u16 data_len)
4757 {
4758         bool val, changed;
4759         int err;
4760         struct mgmt_rp_set_exp_feature rp;
4761
4762         /* Command requires to use a valid controller index */
4763         if (!hdev)
4764                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4765                                        MGMT_OP_SET_EXP_FEATURE,
4766                                        MGMT_STATUS_INVALID_INDEX);
4767
4768         /* Parameters are limited to a single octet */
4769         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4770                 return mgmt_cmd_status(sk, hdev->id,
4771                                        MGMT_OP_SET_EXP_FEATURE,
4772                                        MGMT_STATUS_INVALID_PARAMS);
4773
4774         /* Only boolean on/off is supported */
4775         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4776                 return mgmt_cmd_status(sk, hdev->id,
4777                                        MGMT_OP_SET_EXP_FEATURE,
4778                                        MGMT_STATUS_INVALID_PARAMS);
4779
4780         val = !!cp->param[0];
4781         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4782
4783         if (!hdev->get_data_path_id) {
4784                 return mgmt_cmd_status(sk, hdev->id,
4785                                        MGMT_OP_SET_EXP_FEATURE,
4786                                        MGMT_STATUS_NOT_SUPPORTED);
4787         }
4788
4789         if (changed) {
4790                 if (val)
4791                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4792                 else
4793                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4794         }
4795
4796         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4797                     val, changed);
4798
4799         memcpy(rp.uuid, offload_codecs_uuid, 16);
4800         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4801         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4802         err = mgmt_cmd_complete(sk, hdev->id,
4803                                 MGMT_OP_SET_EXP_FEATURE, 0,
4804                                 &rp, sizeof(rp));
4805
4806         if (changed)
4807                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4808
4809         return err;
4810 }
4811
4812 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4813                                           struct mgmt_cp_set_exp_feature *cp,
4814                                           u16 data_len)
4815 {
4816         bool val, changed;
4817         int err;
4818         struct mgmt_rp_set_exp_feature rp;
4819
4820         /* Command requires to use a valid controller index */
4821         if (!hdev)
4822                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4823                                        MGMT_OP_SET_EXP_FEATURE,
4824                                        MGMT_STATUS_INVALID_INDEX);
4825
4826         /* Parameters are limited to a single octet */
4827         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4828                 return mgmt_cmd_status(sk, hdev->id,
4829                                        MGMT_OP_SET_EXP_FEATURE,
4830                                        MGMT_STATUS_INVALID_PARAMS);
4831
4832         /* Only boolean on/off is supported */
4833         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4834                 return mgmt_cmd_status(sk, hdev->id,
4835                                        MGMT_OP_SET_EXP_FEATURE,
4836                                        MGMT_STATUS_INVALID_PARAMS);
4837
4838         val = !!cp->param[0];
4839         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4840
4841         if (!hci_dev_le_state_simultaneous(hdev)) {
4842                 return mgmt_cmd_status(sk, hdev->id,
4843                                        MGMT_OP_SET_EXP_FEATURE,
4844                                        MGMT_STATUS_NOT_SUPPORTED);
4845         }
4846
4847         if (changed) {
4848                 if (val)
4849                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4850                 else
4851                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4852         }
4853
4854         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4855                     val, changed);
4856
4857         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4858         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4859         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4860         err = mgmt_cmd_complete(sk, hdev->id,
4861                                 MGMT_OP_SET_EXP_FEATURE, 0,
4862                                 &rp, sizeof(rp));
4863
4864         if (changed)
4865                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4866
4867         return err;
4868 }
4869
4870 #ifdef CONFIG_BT_LE
4871 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4872                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4873 {
4874         struct mgmt_rp_set_exp_feature rp;
4875         bool val, changed = false;
4876         int err;
4877
4878         /* Command requires to use the non-controller index */
4879         if (hdev)
4880                 return mgmt_cmd_status(sk, hdev->id,
4881                                        MGMT_OP_SET_EXP_FEATURE,
4882                                        MGMT_STATUS_INVALID_INDEX);
4883
4884         /* Parameters are limited to a single octet */
4885         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4886                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4887                                        MGMT_OP_SET_EXP_FEATURE,
4888                                        MGMT_STATUS_INVALID_PARAMS);
4889
4890         /* Only boolean on/off is supported */
4891         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4892                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4893                                        MGMT_OP_SET_EXP_FEATURE,
4894                                        MGMT_STATUS_INVALID_PARAMS);
4895
4896         val = cp->param[0] ? true : false;
4897         if (val)
4898                 err = iso_init();
4899         else
4900                 err = iso_exit();
4901
4902         if (!err)
4903                 changed = true;
4904
4905         memcpy(rp.uuid, iso_socket_uuid, 16);
4906         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4907
4908         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4909
4910         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4911                                 MGMT_OP_SET_EXP_FEATURE, 0,
4912                                 &rp, sizeof(rp));
4913
4914         if (changed)
4915                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4916
4917         return err;
4918 }
4919 #endif
4920
4921 static const struct mgmt_exp_feature {
4922         const u8 *uuid;
4923         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4924                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4925 } exp_features[] = {
4926         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4927 #ifdef CONFIG_BT_FEATURE_DEBUG
4928         EXP_FEAT(debug_uuid, set_debug_func),
4929 #endif
4930         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4931         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4932         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4933         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4934         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4935 #ifdef CONFIG_BT_LE
4936         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4937 #endif
4938
4939         /* end with a null feature */
4940         EXP_FEAT(NULL, NULL)
4941 };
4942
4943 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4944                            void *data, u16 data_len)
4945 {
4946         struct mgmt_cp_set_exp_feature *cp = data;
4947         size_t i = 0;
4948
4949         bt_dev_dbg(hdev, "sock %p", sk);
4950
4951         for (i = 0; exp_features[i].uuid; i++) {
4952                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4953                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4954         }
4955
4956         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4957                                MGMT_OP_SET_EXP_FEATURE,
4958                                MGMT_STATUS_NOT_SUPPORTED);
4959 }
4960
4961 static u32 get_params_flags(struct hci_dev *hdev,
4962                             struct hci_conn_params *params)
4963 {
4964         u32 flags = hdev->conn_flags;
4965
4966         /* Devices using RPAs can only be programmed in the acceptlist if
4967          * LL Privacy has been enable otherwise they cannot mark
4968          * HCI_CONN_FLAG_REMOTE_WAKEUP.
4969          */
4970         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
4971             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
4972                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
4973
4974         return flags;
4975 }
4976
4977 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4978                             u16 data_len)
4979 {
4980         struct mgmt_cp_get_device_flags *cp = data;
4981         struct mgmt_rp_get_device_flags rp;
4982         struct bdaddr_list_with_flags *br_params;
4983         struct hci_conn_params *params;
4984         u32 supported_flags;
4985         u32 current_flags = 0;
4986         u8 status = MGMT_STATUS_INVALID_PARAMS;
4987
4988         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4989                    &cp->addr.bdaddr, cp->addr.type);
4990
4991         hci_dev_lock(hdev);
4992
4993         supported_flags = hdev->conn_flags;
4994
4995         memset(&rp, 0, sizeof(rp));
4996
4997         if (cp->addr.type == BDADDR_BREDR) {
4998                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4999                                                               &cp->addr.bdaddr,
5000                                                               cp->addr.type);
5001                 if (!br_params)
5002                         goto done;
5003
5004                 current_flags = br_params->flags;
5005         } else {
5006                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5007                                                 le_addr_type(cp->addr.type));
5008                 if (!params)
5009                         goto done;
5010
5011                 supported_flags = get_params_flags(hdev, params);
5012                 current_flags = params->flags;
5013         }
5014
5015         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5016         rp.addr.type = cp->addr.type;
5017         rp.supported_flags = cpu_to_le32(supported_flags);
5018         rp.current_flags = cpu_to_le32(current_flags);
5019
5020         status = MGMT_STATUS_SUCCESS;
5021
5022 done:
5023         hci_dev_unlock(hdev);
5024
5025         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5026                                 &rp, sizeof(rp));
5027 }
5028
5029 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5030                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5031                                  u32 supported_flags, u32 current_flags)
5032 {
5033         struct mgmt_ev_device_flags_changed ev;
5034
5035         bacpy(&ev.addr.bdaddr, bdaddr);
5036         ev.addr.type = bdaddr_type;
5037         ev.supported_flags = cpu_to_le32(supported_flags);
5038         ev.current_flags = cpu_to_le32(current_flags);
5039
5040         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5041 }
5042
5043 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5044                             u16 len)
5045 {
5046         struct mgmt_cp_set_device_flags *cp = data;
5047         struct bdaddr_list_with_flags *br_params;
5048         struct hci_conn_params *params;
5049         u8 status = MGMT_STATUS_INVALID_PARAMS;
5050         u32 supported_flags;
5051         u32 current_flags = __le32_to_cpu(cp->current_flags);
5052
5053         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5054                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5055
5056         // We should take hci_dev_lock() early, I think.. conn_flags can change
5057         supported_flags = hdev->conn_flags;
5058
5059         if ((supported_flags | current_flags) != supported_flags) {
5060                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5061                             current_flags, supported_flags);
5062                 goto done;
5063         }
5064
5065         hci_dev_lock(hdev);
5066
5067         if (cp->addr.type == BDADDR_BREDR) {
5068                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5069                                                               &cp->addr.bdaddr,
5070                                                               cp->addr.type);
5071
5072                 if (br_params) {
5073                         br_params->flags = current_flags;
5074                         status = MGMT_STATUS_SUCCESS;
5075                 } else {
5076                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5077                                     &cp->addr.bdaddr, cp->addr.type);
5078                 }
5079
5080                 goto unlock;
5081         }
5082
5083         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5084                                         le_addr_type(cp->addr.type));
5085         if (!params) {
5086                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5087                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5088                 goto unlock;
5089         }
5090
5091         supported_flags = get_params_flags(hdev, params);
5092
5093         if ((supported_flags | current_flags) != supported_flags) {
5094                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5095                             current_flags, supported_flags);
5096                 goto unlock;
5097         }
5098
5099         WRITE_ONCE(params->flags, current_flags);
5100         status = MGMT_STATUS_SUCCESS;
5101
5102         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5103          * has been set.
5104          */
5105         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5106                 hci_update_passive_scan(hdev);
5107
5108 unlock:
5109         hci_dev_unlock(hdev);
5110
5111 done:
5112         if (status == MGMT_STATUS_SUCCESS)
5113                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5114                                      supported_flags, current_flags);
5115
5116         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5117                                  &cp->addr, sizeof(cp->addr));
5118 }
5119
5120 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5121                                    u16 handle)
5122 {
5123         struct mgmt_ev_adv_monitor_added ev;
5124
5125         ev.monitor_handle = cpu_to_le16(handle);
5126
5127         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5128 }
5129
5130 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5131 {
5132         struct mgmt_ev_adv_monitor_removed ev;
5133         struct mgmt_pending_cmd *cmd;
5134         struct sock *sk_skip = NULL;
5135         struct mgmt_cp_remove_adv_monitor *cp;
5136
5137         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5138         if (cmd) {
5139                 cp = cmd->param;
5140
5141                 if (cp->monitor_handle)
5142                         sk_skip = cmd->sk;
5143         }
5144
5145         ev.monitor_handle = cpu_to_le16(handle);
5146
5147         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5148 }
5149
5150 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5151                                  void *data, u16 len)
5152 {
5153         struct adv_monitor *monitor = NULL;
5154         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5155         int handle, err;
5156         size_t rp_size = 0;
5157         __u32 supported = 0;
5158         __u32 enabled = 0;
5159         __u16 num_handles = 0;
5160         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5161
5162         BT_DBG("request for %s", hdev->name);
5163
5164         hci_dev_lock(hdev);
5165
5166         if (msft_monitor_supported(hdev))
5167                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5168
5169         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5170                 handles[num_handles++] = monitor->handle;
5171
5172         hci_dev_unlock(hdev);
5173
5174         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5175         rp = kmalloc(rp_size, GFP_KERNEL);
5176         if (!rp)
5177                 return -ENOMEM;
5178
5179         /* All supported features are currently enabled */
5180         enabled = supported;
5181
5182         rp->supported_features = cpu_to_le32(supported);
5183         rp->enabled_features = cpu_to_le32(enabled);
5184         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5185         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5186         rp->num_handles = cpu_to_le16(num_handles);
5187         if (num_handles)
5188                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5189
5190         err = mgmt_cmd_complete(sk, hdev->id,
5191                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5192                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5193
5194         kfree(rp);
5195
5196         return err;
5197 }
5198
5199 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5200                                                    void *data, int status)
5201 {
5202         struct mgmt_rp_add_adv_patterns_monitor rp;
5203         struct mgmt_pending_cmd *cmd = data;
5204         struct adv_monitor *monitor = cmd->user_data;
5205
5206         hci_dev_lock(hdev);
5207
5208         rp.monitor_handle = cpu_to_le16(monitor->handle);
5209
5210         if (!status) {
5211                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5212                 hdev->adv_monitors_cnt++;
5213                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5214                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5215                 hci_update_passive_scan(hdev);
5216         }
5217
5218         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5219                           mgmt_status(status), &rp, sizeof(rp));
5220         mgmt_pending_remove(cmd);
5221
5222         hci_dev_unlock(hdev);
5223         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5224                    rp.monitor_handle, status);
5225 }
5226
5227 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5228 {
5229         struct mgmt_pending_cmd *cmd = data;
5230         struct adv_monitor *monitor = cmd->user_data;
5231
5232         return hci_add_adv_monitor(hdev, monitor);
5233 }
5234
5235 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5236                                       struct adv_monitor *m, u8 status,
5237                                       void *data, u16 len, u16 op)
5238 {
5239         struct mgmt_pending_cmd *cmd;
5240         int err;
5241
5242         hci_dev_lock(hdev);
5243
5244         if (status)
5245                 goto unlock;
5246
5247         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5248             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5249             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5250             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5251                 status = MGMT_STATUS_BUSY;
5252                 goto unlock;
5253         }
5254
5255         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5256         if (!cmd) {
5257                 status = MGMT_STATUS_NO_RESOURCES;
5258                 goto unlock;
5259         }
5260
5261         cmd->user_data = m;
5262         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5263                                  mgmt_add_adv_patterns_monitor_complete);
5264         if (err) {
5265                 if (err == -ENOMEM)
5266                         status = MGMT_STATUS_NO_RESOURCES;
5267                 else
5268                         status = MGMT_STATUS_FAILED;
5269
5270                 goto unlock;
5271         }
5272
5273         hci_dev_unlock(hdev);
5274
5275         return 0;
5276
5277 unlock:
5278         hci_free_adv_monitor(hdev, m);
5279         hci_dev_unlock(hdev);
5280         return mgmt_cmd_status(sk, hdev->id, op, status);
5281 }
5282
5283 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5284                                    struct mgmt_adv_rssi_thresholds *rssi)
5285 {
5286         if (rssi) {
5287                 m->rssi.low_threshold = rssi->low_threshold;
5288                 m->rssi.low_threshold_timeout =
5289                     __le16_to_cpu(rssi->low_threshold_timeout);
5290                 m->rssi.high_threshold = rssi->high_threshold;
5291                 m->rssi.high_threshold_timeout =
5292                     __le16_to_cpu(rssi->high_threshold_timeout);
5293                 m->rssi.sampling_period = rssi->sampling_period;
5294         } else {
5295                 /* Default values. These numbers are the least constricting
5296                  * parameters for MSFT API to work, so it behaves as if there
5297                  * are no rssi parameter to consider. May need to be changed
5298                  * if other API are to be supported.
5299                  */
5300                 m->rssi.low_threshold = -127;
5301                 m->rssi.low_threshold_timeout = 60;
5302                 m->rssi.high_threshold = -127;
5303                 m->rssi.high_threshold_timeout = 0;
5304                 m->rssi.sampling_period = 0;
5305         }
5306 }
5307
5308 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5309                                     struct mgmt_adv_pattern *patterns)
5310 {
5311         u8 offset = 0, length = 0;
5312         struct adv_pattern *p = NULL;
5313         int i;
5314
5315         for (i = 0; i < pattern_count; i++) {
5316                 offset = patterns[i].offset;
5317                 length = patterns[i].length;
5318                 if (offset >= HCI_MAX_EXT_AD_LENGTH ||
5319                     length > HCI_MAX_EXT_AD_LENGTH ||
5320                     (offset + length) > HCI_MAX_EXT_AD_LENGTH)
5321                         return MGMT_STATUS_INVALID_PARAMS;
5322
5323                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5324                 if (!p)
5325                         return MGMT_STATUS_NO_RESOURCES;
5326
5327                 p->ad_type = patterns[i].ad_type;
5328                 p->offset = patterns[i].offset;
5329                 p->length = patterns[i].length;
5330                 memcpy(p->value, patterns[i].value, p->length);
5331
5332                 INIT_LIST_HEAD(&p->list);
5333                 list_add(&p->list, &m->patterns);
5334         }
5335
5336         return MGMT_STATUS_SUCCESS;
5337 }
5338
5339 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5340                                     void *data, u16 len)
5341 {
5342         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5343         struct adv_monitor *m = NULL;
5344         u8 status = MGMT_STATUS_SUCCESS;
5345         size_t expected_size = sizeof(*cp);
5346
5347         BT_DBG("request for %s", hdev->name);
5348
5349         if (len <= sizeof(*cp)) {
5350                 status = MGMT_STATUS_INVALID_PARAMS;
5351                 goto done;
5352         }
5353
5354         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5355         if (len != expected_size) {
5356                 status = MGMT_STATUS_INVALID_PARAMS;
5357                 goto done;
5358         }
5359
5360         m = kzalloc(sizeof(*m), GFP_KERNEL);
5361         if (!m) {
5362                 status = MGMT_STATUS_NO_RESOURCES;
5363                 goto done;
5364         }
5365
5366         INIT_LIST_HEAD(&m->patterns);
5367
5368         parse_adv_monitor_rssi(m, NULL);
5369         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5370
5371 done:
5372         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5373                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5374 }
5375
5376 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5377                                          void *data, u16 len)
5378 {
5379         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5380         struct adv_monitor *m = NULL;
5381         u8 status = MGMT_STATUS_SUCCESS;
5382         size_t expected_size = sizeof(*cp);
5383
5384         BT_DBG("request for %s", hdev->name);
5385
5386         if (len <= sizeof(*cp)) {
5387                 status = MGMT_STATUS_INVALID_PARAMS;
5388                 goto done;
5389         }
5390
5391         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5392         if (len != expected_size) {
5393                 status = MGMT_STATUS_INVALID_PARAMS;
5394                 goto done;
5395         }
5396
5397         m = kzalloc(sizeof(*m), GFP_KERNEL);
5398         if (!m) {
5399                 status = MGMT_STATUS_NO_RESOURCES;
5400                 goto done;
5401         }
5402
5403         INIT_LIST_HEAD(&m->patterns);
5404
5405         parse_adv_monitor_rssi(m, &cp->rssi);
5406         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5407
5408 done:
5409         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5410                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5411 }
5412
5413 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5414                                              void *data, int status)
5415 {
5416         struct mgmt_rp_remove_adv_monitor rp;
5417         struct mgmt_pending_cmd *cmd = data;
5418         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5419
5420         hci_dev_lock(hdev);
5421
5422         rp.monitor_handle = cp->monitor_handle;
5423
5424         if (!status)
5425                 hci_update_passive_scan(hdev);
5426
5427         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5428                           mgmt_status(status), &rp, sizeof(rp));
5429         mgmt_pending_remove(cmd);
5430
5431         hci_dev_unlock(hdev);
5432         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5433                    rp.monitor_handle, status);
5434 }
5435
5436 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5437 {
5438         struct mgmt_pending_cmd *cmd = data;
5439         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5440         u16 handle = __le16_to_cpu(cp->monitor_handle);
5441
5442         if (!handle)
5443                 return hci_remove_all_adv_monitor(hdev);
5444
5445         return hci_remove_single_adv_monitor(hdev, handle);
5446 }
5447
5448 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5449                               void *data, u16 len)
5450 {
5451         struct mgmt_pending_cmd *cmd;
5452         int err, status;
5453
5454         hci_dev_lock(hdev);
5455
5456         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5457             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5458             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5459             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5460                 status = MGMT_STATUS_BUSY;
5461                 goto unlock;
5462         }
5463
5464         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5465         if (!cmd) {
5466                 status = MGMT_STATUS_NO_RESOURCES;
5467                 goto unlock;
5468         }
5469
5470         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5471                                  mgmt_remove_adv_monitor_complete);
5472
5473         if (err) {
5474                 mgmt_pending_remove(cmd);
5475
5476                 if (err == -ENOMEM)
5477                         status = MGMT_STATUS_NO_RESOURCES;
5478                 else
5479                         status = MGMT_STATUS_FAILED;
5480
5481                 goto unlock;
5482         }
5483
5484         hci_dev_unlock(hdev);
5485
5486         return 0;
5487
5488 unlock:
5489         hci_dev_unlock(hdev);
5490         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5491                                status);
5492 }
5493
5494 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5495 {
5496         struct mgmt_rp_read_local_oob_data mgmt_rp;
5497         size_t rp_size = sizeof(mgmt_rp);
5498         struct mgmt_pending_cmd *cmd = data;
5499         struct sk_buff *skb = cmd->skb;
5500         u8 status = mgmt_status(err);
5501
5502         if (!status) {
5503                 if (!skb)
5504                         status = MGMT_STATUS_FAILED;
5505                 else if (IS_ERR(skb))
5506                         status = mgmt_status(PTR_ERR(skb));
5507                 else
5508                         status = mgmt_status(skb->data[0]);
5509         }
5510
5511         bt_dev_dbg(hdev, "status %d", status);
5512
5513         if (status) {
5514                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5515                 goto remove;
5516         }
5517
5518         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5519
5520         if (!bredr_sc_enabled(hdev)) {
5521                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5522
5523                 if (skb->len < sizeof(*rp)) {
5524                         mgmt_cmd_status(cmd->sk, hdev->id,
5525                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5526                                         MGMT_STATUS_FAILED);
5527                         goto remove;
5528                 }
5529
5530                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5531                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5532
5533                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5534         } else {
5535                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5536
5537                 if (skb->len < sizeof(*rp)) {
5538                         mgmt_cmd_status(cmd->sk, hdev->id,
5539                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5540                                         MGMT_STATUS_FAILED);
5541                         goto remove;
5542                 }
5543
5544                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5545                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5546
5547                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5548                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5549         }
5550
5551         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5552                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5553
5554 remove:
5555         if (skb && !IS_ERR(skb))
5556                 kfree_skb(skb);
5557
5558         mgmt_pending_free(cmd);
5559 }
5560
5561 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5562 {
5563         struct mgmt_pending_cmd *cmd = data;
5564
5565         if (bredr_sc_enabled(hdev))
5566                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5567         else
5568                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5569
5570         if (IS_ERR(cmd->skb))
5571                 return PTR_ERR(cmd->skb);
5572         else
5573                 return 0;
5574 }
5575
5576 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5577                                void *data, u16 data_len)
5578 {
5579         struct mgmt_pending_cmd *cmd;
5580         int err;
5581
5582         bt_dev_dbg(hdev, "sock %p", sk);
5583
5584         hci_dev_lock(hdev);
5585
5586         if (!hdev_is_powered(hdev)) {
5587                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5588                                       MGMT_STATUS_NOT_POWERED);
5589                 goto unlock;
5590         }
5591
5592         if (!lmp_ssp_capable(hdev)) {
5593                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5594                                       MGMT_STATUS_NOT_SUPPORTED);
5595                 goto unlock;
5596         }
5597
5598         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5599         if (!cmd)
5600                 err = -ENOMEM;
5601         else
5602                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5603                                          read_local_oob_data_complete);
5604
5605         if (err < 0) {
5606                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5607                                       MGMT_STATUS_FAILED);
5608
5609                 if (cmd)
5610                         mgmt_pending_free(cmd);
5611         }
5612
5613 unlock:
5614         hci_dev_unlock(hdev);
5615         return err;
5616 }
5617
5618 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5619                                void *data, u16 len)
5620 {
5621         struct mgmt_addr_info *addr = data;
5622         int err;
5623
5624         bt_dev_dbg(hdev, "sock %p", sk);
5625
5626         if (!bdaddr_type_is_valid(addr->type))
5627                 return mgmt_cmd_complete(sk, hdev->id,
5628                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5629                                          MGMT_STATUS_INVALID_PARAMS,
5630                                          addr, sizeof(*addr));
5631
5632         hci_dev_lock(hdev);
5633
5634         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5635                 struct mgmt_cp_add_remote_oob_data *cp = data;
5636                 u8 status;
5637
5638                 if (cp->addr.type != BDADDR_BREDR) {
5639                         err = mgmt_cmd_complete(sk, hdev->id,
5640                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5641                                                 MGMT_STATUS_INVALID_PARAMS,
5642                                                 &cp->addr, sizeof(cp->addr));
5643                         goto unlock;
5644                 }
5645
5646                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5647                                               cp->addr.type, cp->hash,
5648                                               cp->rand, NULL, NULL);
5649                 if (err < 0)
5650                         status = MGMT_STATUS_FAILED;
5651                 else
5652                         status = MGMT_STATUS_SUCCESS;
5653
5654                 err = mgmt_cmd_complete(sk, hdev->id,
5655                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5656                                         &cp->addr, sizeof(cp->addr));
5657         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5658                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5659                 u8 *rand192, *hash192, *rand256, *hash256;
5660                 u8 status;
5661
5662                 if (bdaddr_type_is_le(cp->addr.type)) {
5663                         /* Enforce zero-valued 192-bit parameters as
5664                          * long as legacy SMP OOB isn't implemented.
5665                          */
5666                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5667                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5668                                 err = mgmt_cmd_complete(sk, hdev->id,
5669                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5670                                                         MGMT_STATUS_INVALID_PARAMS,
5671                                                         addr, sizeof(*addr));
5672                                 goto unlock;
5673                         }
5674
5675                         rand192 = NULL;
5676                         hash192 = NULL;
5677                 } else {
5678                         /* In case one of the P-192 values is set to zero,
5679                          * then just disable OOB data for P-192.
5680                          */
5681                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5682                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5683                                 rand192 = NULL;
5684                                 hash192 = NULL;
5685                         } else {
5686                                 rand192 = cp->rand192;
5687                                 hash192 = cp->hash192;
5688                         }
5689                 }
5690
5691                 /* In case one of the P-256 values is set to zero, then just
5692                  * disable OOB data for P-256.
5693                  */
5694                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5695                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5696                         rand256 = NULL;
5697                         hash256 = NULL;
5698                 } else {
5699                         rand256 = cp->rand256;
5700                         hash256 = cp->hash256;
5701                 }
5702
5703                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5704                                               cp->addr.type, hash192, rand192,
5705                                               hash256, rand256);
5706                 if (err < 0)
5707                         status = MGMT_STATUS_FAILED;
5708                 else
5709                         status = MGMT_STATUS_SUCCESS;
5710
5711                 err = mgmt_cmd_complete(sk, hdev->id,
5712                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5713                                         status, &cp->addr, sizeof(cp->addr));
5714         } else {
5715                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5716                            len);
5717                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5718                                       MGMT_STATUS_INVALID_PARAMS);
5719         }
5720
5721 unlock:
5722         hci_dev_unlock(hdev);
5723         return err;
5724 }
5725
5726 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5727                                   void *data, u16 len)
5728 {
5729         struct mgmt_cp_remove_remote_oob_data *cp = data;
5730         u8 status;
5731         int err;
5732
5733         bt_dev_dbg(hdev, "sock %p", sk);
5734
5735         if (cp->addr.type != BDADDR_BREDR)
5736                 return mgmt_cmd_complete(sk, hdev->id,
5737                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5738                                          MGMT_STATUS_INVALID_PARAMS,
5739                                          &cp->addr, sizeof(cp->addr));
5740
5741         hci_dev_lock(hdev);
5742
5743         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5744                 hci_remote_oob_data_clear(hdev);
5745                 status = MGMT_STATUS_SUCCESS;
5746                 goto done;
5747         }
5748
5749         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5750         if (err < 0)
5751                 status = MGMT_STATUS_INVALID_PARAMS;
5752         else
5753                 status = MGMT_STATUS_SUCCESS;
5754
5755 done:
5756         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5757                                 status, &cp->addr, sizeof(cp->addr));
5758
5759         hci_dev_unlock(hdev);
5760         return err;
5761 }
5762
5763 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5764 {
5765         struct mgmt_pending_cmd *cmd;
5766
5767         bt_dev_dbg(hdev, "status %u", status);
5768
5769         hci_dev_lock(hdev);
5770
5771         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5772         if (!cmd)
5773                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5774
5775         if (!cmd)
5776                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5777
5778         if (cmd) {
5779                 cmd->cmd_complete(cmd, mgmt_status(status));
5780                 mgmt_pending_remove(cmd);
5781         }
5782
5783         hci_dev_unlock(hdev);
5784 }
5785
5786 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5787                                     uint8_t *mgmt_status)
5788 {
5789         switch (type) {
5790         case DISCOV_TYPE_LE:
5791                 *mgmt_status = mgmt_le_support(hdev);
5792                 if (*mgmt_status)
5793                         return false;
5794                 break;
5795         case DISCOV_TYPE_INTERLEAVED:
5796                 *mgmt_status = mgmt_le_support(hdev);
5797                 if (*mgmt_status)
5798                         return false;
5799                 fallthrough;
5800         case DISCOV_TYPE_BREDR:
5801                 *mgmt_status = mgmt_bredr_support(hdev);
5802                 if (*mgmt_status)
5803                         return false;
5804                 break;
5805         default:
5806                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5807                 return false;
5808         }
5809
5810         return true;
5811 }
5812
5813 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5814 {
5815         struct mgmt_pending_cmd *cmd = data;
5816
5817         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5818             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5819             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5820                 return;
5821
5822         bt_dev_dbg(hdev, "err %d", err);
5823
5824         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5825                           cmd->param, 1);
5826         mgmt_pending_remove(cmd);
5827
5828         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5829                                 DISCOVERY_FINDING);
5830 }
5831
5832 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5833 {
5834         return hci_start_discovery_sync(hdev);
5835 }
5836
5837 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5838                                     u16 op, void *data, u16 len)
5839 {
5840         struct mgmt_cp_start_discovery *cp = data;
5841         struct mgmt_pending_cmd *cmd;
5842         u8 status;
5843         int err;
5844
5845         bt_dev_dbg(hdev, "sock %p", sk);
5846
5847         hci_dev_lock(hdev);
5848
5849         if (!hdev_is_powered(hdev)) {
5850                 err = mgmt_cmd_complete(sk, hdev->id, op,
5851                                         MGMT_STATUS_NOT_POWERED,
5852                                         &cp->type, sizeof(cp->type));
5853                 goto failed;
5854         }
5855
5856         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5857             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5858                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5859                                         &cp->type, sizeof(cp->type));
5860                 goto failed;
5861         }
5862
5863         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5864                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5865                                         &cp->type, sizeof(cp->type));
5866                 goto failed;
5867         }
5868
5869         /* Can't start discovery when it is paused */
5870         if (hdev->discovery_paused) {
5871                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5872                                         &cp->type, sizeof(cp->type));
5873                 goto failed;
5874         }
5875
5876         /* Clear the discovery filter first to free any previously
5877          * allocated memory for the UUID list.
5878          */
5879         hci_discovery_filter_clear(hdev);
5880
5881         hdev->discovery.type = cp->type;
5882         hdev->discovery.report_invalid_rssi = false;
5883         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5884                 hdev->discovery.limited = true;
5885         else
5886                 hdev->discovery.limited = false;
5887
5888         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5889         if (!cmd) {
5890                 err = -ENOMEM;
5891                 goto failed;
5892         }
5893
5894         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5895                                  start_discovery_complete);
5896         if (err < 0) {
5897                 mgmt_pending_remove(cmd);
5898                 goto failed;
5899         }
5900
5901         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5902
5903 failed:
5904         hci_dev_unlock(hdev);
5905         return err;
5906 }
5907
5908 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5909                            void *data, u16 len)
5910 {
5911         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5912                                         data, len);
5913 }
5914
5915 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5916                                    void *data, u16 len)
5917 {
5918         return start_discovery_internal(sk, hdev,
5919                                         MGMT_OP_START_LIMITED_DISCOVERY,
5920                                         data, len);
5921 }
5922
5923 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5924                                    void *data, u16 len)
5925 {
5926         struct mgmt_cp_start_service_discovery *cp = data;
5927         struct mgmt_pending_cmd *cmd;
5928         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5929         u16 uuid_count, expected_len;
5930         u8 status;
5931         int err;
5932
5933         bt_dev_dbg(hdev, "sock %p", sk);
5934
5935         hci_dev_lock(hdev);
5936
5937         if (!hdev_is_powered(hdev)) {
5938                 err = mgmt_cmd_complete(sk, hdev->id,
5939                                         MGMT_OP_START_SERVICE_DISCOVERY,
5940                                         MGMT_STATUS_NOT_POWERED,
5941                                         &cp->type, sizeof(cp->type));
5942                 goto failed;
5943         }
5944
5945         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5946             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5947                 err = mgmt_cmd_complete(sk, hdev->id,
5948                                         MGMT_OP_START_SERVICE_DISCOVERY,
5949                                         MGMT_STATUS_BUSY, &cp->type,
5950                                         sizeof(cp->type));
5951                 goto failed;
5952         }
5953
5954         if (hdev->discovery_paused) {
5955                 err = mgmt_cmd_complete(sk, hdev->id,
5956                                         MGMT_OP_START_SERVICE_DISCOVERY,
5957                                         MGMT_STATUS_BUSY, &cp->type,
5958                                         sizeof(cp->type));
5959                 goto failed;
5960         }
5961
5962         uuid_count = __le16_to_cpu(cp->uuid_count);
5963         if (uuid_count > max_uuid_count) {
5964                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5965                            uuid_count);
5966                 err = mgmt_cmd_complete(sk, hdev->id,
5967                                         MGMT_OP_START_SERVICE_DISCOVERY,
5968                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5969                                         sizeof(cp->type));
5970                 goto failed;
5971         }
5972
5973         expected_len = sizeof(*cp) + uuid_count * 16;
5974         if (expected_len != len) {
5975                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5976                            expected_len, len);
5977                 err = mgmt_cmd_complete(sk, hdev->id,
5978                                         MGMT_OP_START_SERVICE_DISCOVERY,
5979                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5980                                         sizeof(cp->type));
5981                 goto failed;
5982         }
5983
5984         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5985                 err = mgmt_cmd_complete(sk, hdev->id,
5986                                         MGMT_OP_START_SERVICE_DISCOVERY,
5987                                         status, &cp->type, sizeof(cp->type));
5988                 goto failed;
5989         }
5990
5991         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5992                                hdev, data, len);
5993         if (!cmd) {
5994                 err = -ENOMEM;
5995                 goto failed;
5996         }
5997
5998         /* Clear the discovery filter first to free any previously
5999          * allocated memory for the UUID list.
6000          */
6001         hci_discovery_filter_clear(hdev);
6002
6003         hdev->discovery.result_filtering = true;
6004         hdev->discovery.type = cp->type;
6005         hdev->discovery.rssi = cp->rssi;
6006         hdev->discovery.uuid_count = uuid_count;
6007
6008         if (uuid_count > 0) {
6009                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6010                                                 GFP_KERNEL);
6011                 if (!hdev->discovery.uuids) {
6012                         err = mgmt_cmd_complete(sk, hdev->id,
6013                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6014                                                 MGMT_STATUS_FAILED,
6015                                                 &cp->type, sizeof(cp->type));
6016                         mgmt_pending_remove(cmd);
6017                         goto failed;
6018                 }
6019         }
6020
6021         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6022                                  start_discovery_complete);
6023         if (err < 0) {
6024                 mgmt_pending_remove(cmd);
6025                 goto failed;
6026         }
6027
6028         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6029
6030 failed:
6031         hci_dev_unlock(hdev);
6032         return err;
6033 }
6034
6035 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6036 {
6037         struct mgmt_pending_cmd *cmd;
6038
6039         bt_dev_dbg(hdev, "status %u", status);
6040
6041         hci_dev_lock(hdev);
6042
6043         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6044         if (cmd) {
6045                 cmd->cmd_complete(cmd, mgmt_status(status));
6046                 mgmt_pending_remove(cmd);
6047         }
6048
6049         hci_dev_unlock(hdev);
6050 }
6051
6052 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6053 {
6054         struct mgmt_pending_cmd *cmd = data;
6055
6056         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6057                 return;
6058
6059         bt_dev_dbg(hdev, "err %d", err);
6060
6061         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6062                           cmd->param, 1);
6063         mgmt_pending_remove(cmd);
6064
6065         if (!err)
6066                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6067 }
6068
6069 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6070 {
6071         return hci_stop_discovery_sync(hdev);
6072 }
6073
6074 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6075                           u16 len)
6076 {
6077         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6078         struct mgmt_pending_cmd *cmd;
6079         int err;
6080
6081         bt_dev_dbg(hdev, "sock %p", sk);
6082
6083         hci_dev_lock(hdev);
6084
6085         if (!hci_discovery_active(hdev)) {
6086                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6087                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6088                                         sizeof(mgmt_cp->type));
6089                 goto unlock;
6090         }
6091
6092         if (hdev->discovery.type != mgmt_cp->type) {
6093                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6094                                         MGMT_STATUS_INVALID_PARAMS,
6095                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6096                 goto unlock;
6097         }
6098
6099         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6100         if (!cmd) {
6101                 err = -ENOMEM;
6102                 goto unlock;
6103         }
6104
6105         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6106                                  stop_discovery_complete);
6107         if (err < 0) {
6108                 mgmt_pending_remove(cmd);
6109                 goto unlock;
6110         }
6111
6112         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6113
6114 unlock:
6115         hci_dev_unlock(hdev);
6116         return err;
6117 }
6118
6119 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6120                         u16 len)
6121 {
6122         struct mgmt_cp_confirm_name *cp = data;
6123         struct inquiry_entry *e;
6124         int err;
6125
6126         bt_dev_dbg(hdev, "sock %p", sk);
6127
6128         hci_dev_lock(hdev);
6129
6130         if (!hci_discovery_active(hdev)) {
6131                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6132                                         MGMT_STATUS_FAILED, &cp->addr,
6133                                         sizeof(cp->addr));
6134                 goto failed;
6135         }
6136
6137         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6138         if (!e) {
6139                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6140                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6141                                         sizeof(cp->addr));
6142                 goto failed;
6143         }
6144
6145         if (cp->name_known) {
6146                 e->name_state = NAME_KNOWN;
6147                 list_del(&e->list);
6148         } else {
6149                 e->name_state = NAME_NEEDED;
6150                 hci_inquiry_cache_update_resolve(hdev, e);
6151         }
6152
6153         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6154                                 &cp->addr, sizeof(cp->addr));
6155
6156 failed:
6157         hci_dev_unlock(hdev);
6158         return err;
6159 }
6160
6161 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6162                         u16 len)
6163 {
6164         struct mgmt_cp_block_device *cp = data;
6165         u8 status;
6166         int err;
6167
6168         bt_dev_dbg(hdev, "sock %p", sk);
6169
6170         if (!bdaddr_type_is_valid(cp->addr.type))
6171                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6172                                          MGMT_STATUS_INVALID_PARAMS,
6173                                          &cp->addr, sizeof(cp->addr));
6174
6175         hci_dev_lock(hdev);
6176
6177         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6178                                   cp->addr.type);
6179         if (err < 0) {
6180                 status = MGMT_STATUS_FAILED;
6181                 goto done;
6182         }
6183
6184         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6185                    sk);
6186         status = MGMT_STATUS_SUCCESS;
6187
6188 done:
6189         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6190                                 &cp->addr, sizeof(cp->addr));
6191
6192         hci_dev_unlock(hdev);
6193
6194         return err;
6195 }
6196
6197 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6198                           u16 len)
6199 {
6200         struct mgmt_cp_unblock_device *cp = data;
6201         u8 status;
6202         int err;
6203
6204         bt_dev_dbg(hdev, "sock %p", sk);
6205
6206         if (!bdaddr_type_is_valid(cp->addr.type))
6207                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6208                                          MGMT_STATUS_INVALID_PARAMS,
6209                                          &cp->addr, sizeof(cp->addr));
6210
6211         hci_dev_lock(hdev);
6212
6213         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6214                                   cp->addr.type);
6215         if (err < 0) {
6216                 status = MGMT_STATUS_INVALID_PARAMS;
6217                 goto done;
6218         }
6219
6220         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6221                    sk);
6222         status = MGMT_STATUS_SUCCESS;
6223
6224 done:
6225         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6226                                 &cp->addr, sizeof(cp->addr));
6227
6228         hci_dev_unlock(hdev);
6229
6230         return err;
6231 }
6232
6233 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6234 {
6235         return hci_update_eir_sync(hdev);
6236 }
6237
6238 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6239                          u16 len)
6240 {
6241         struct mgmt_cp_set_device_id *cp = data;
6242         int err;
6243         __u16 source;
6244
6245         bt_dev_dbg(hdev, "sock %p", sk);
6246
6247         source = __le16_to_cpu(cp->source);
6248
6249         if (source > 0x0002)
6250                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6251                                        MGMT_STATUS_INVALID_PARAMS);
6252
6253         hci_dev_lock(hdev);
6254
6255         hdev->devid_source = source;
6256         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6257         hdev->devid_product = __le16_to_cpu(cp->product);
6258         hdev->devid_version = __le16_to_cpu(cp->version);
6259
6260         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6261                                 NULL, 0);
6262
6263         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6264
6265         hci_dev_unlock(hdev);
6266
6267         return err;
6268 }
6269
6270 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6271 {
6272         if (err)
6273                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6274         else
6275                 bt_dev_dbg(hdev, "status %d", err);
6276 }
6277
6278 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6279 {
6280         struct cmd_lookup match = { NULL, hdev };
6281         u8 instance;
6282         struct adv_info *adv_instance;
6283         u8 status = mgmt_status(err);
6284
6285         if (status) {
6286                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6287                                      cmd_status_rsp, &status);
6288                 return;
6289         }
6290
6291         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6292                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6293         else
6294                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6295
6296         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6297                              &match);
6298
6299         new_settings(hdev, match.sk);
6300
6301         if (match.sk)
6302                 sock_put(match.sk);
6303
6304         /* If "Set Advertising" was just disabled and instance advertising was
6305          * set up earlier, then re-enable multi-instance advertising.
6306          */
6307         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6308             list_empty(&hdev->adv_instances))
6309                 return;
6310
6311         instance = hdev->cur_adv_instance;
6312         if (!instance) {
6313                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6314                                                         struct adv_info, list);
6315                 if (!adv_instance)
6316                         return;
6317
6318                 instance = adv_instance->instance;
6319         }
6320
6321         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6322
6323         enable_advertising_instance(hdev, err);
6324 }
6325
6326 static int set_adv_sync(struct hci_dev *hdev, void *data)
6327 {
6328         struct mgmt_pending_cmd *cmd = data;
6329         struct mgmt_mode *cp = cmd->param;
6330         u8 val = !!cp->val;
6331
6332         if (cp->val == 0x02)
6333                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6334         else
6335                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6336
6337         cancel_adv_timeout(hdev);
6338
6339         if (val) {
6340                 /* Switch to instance "0" for the Set Advertising setting.
6341                  * We cannot use update_[adv|scan_rsp]_data() here as the
6342                  * HCI_ADVERTISING flag is not yet set.
6343                  */
6344                 hdev->cur_adv_instance = 0x00;
6345
6346                 if (ext_adv_capable(hdev)) {
6347                         hci_start_ext_adv_sync(hdev, 0x00);
6348                 } else {
6349                         hci_update_adv_data_sync(hdev, 0x00);
6350                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6351                         hci_enable_advertising_sync(hdev);
6352                 }
6353         } else {
6354                 hci_disable_advertising_sync(hdev);
6355         }
6356
6357         return 0;
6358 }
6359
6360 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6361                            u16 len)
6362 {
6363         struct mgmt_mode *cp = data;
6364         struct mgmt_pending_cmd *cmd;
6365         u8 val, status;
6366         int err;
6367
6368         bt_dev_dbg(hdev, "sock %p", sk);
6369
6370         status = mgmt_le_support(hdev);
6371         if (status)
6372                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6373                                        status);
6374
6375         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6377                                        MGMT_STATUS_INVALID_PARAMS);
6378
6379         if (hdev->advertising_paused)
6380                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6381                                        MGMT_STATUS_BUSY);
6382
6383         hci_dev_lock(hdev);
6384
6385         val = !!cp->val;
6386
6387         /* The following conditions are ones which mean that we should
6388          * not do any HCI communication but directly send a mgmt
6389          * response to user space (after toggling the flag if
6390          * necessary).
6391          */
6392         if (!hdev_is_powered(hdev) ||
6393             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6394              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6395             hci_dev_test_flag(hdev, HCI_MESH) ||
6396             hci_conn_num(hdev, LE_LINK) > 0 ||
6397             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6398              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6399                 bool changed;
6400
6401                 if (cp->val) {
6402                         hdev->cur_adv_instance = 0x00;
6403                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6404                         if (cp->val == 0x02)
6405                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6406                         else
6407                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6408                 } else {
6409                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6410                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6411                 }
6412
6413                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6414                 if (err < 0)
6415                         goto unlock;
6416
6417                 if (changed)
6418                         err = new_settings(hdev, sk);
6419
6420                 goto unlock;
6421         }
6422
6423         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6424             pending_find(MGMT_OP_SET_LE, hdev)) {
6425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6426                                       MGMT_STATUS_BUSY);
6427                 goto unlock;
6428         }
6429
6430         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6431         if (!cmd)
6432                 err = -ENOMEM;
6433         else
6434                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6435                                          set_advertising_complete);
6436
6437         if (err < 0 && cmd)
6438                 mgmt_pending_remove(cmd);
6439
6440 unlock:
6441         hci_dev_unlock(hdev);
6442         return err;
6443 }
6444
6445 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6446                               void *data, u16 len)
6447 {
6448         struct mgmt_cp_set_static_address *cp = data;
6449         int err;
6450
6451         bt_dev_dbg(hdev, "sock %p", sk);
6452
6453         if (!lmp_le_capable(hdev))
6454                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6455                                        MGMT_STATUS_NOT_SUPPORTED);
6456
6457         if (hdev_is_powered(hdev))
6458                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6459                                        MGMT_STATUS_REJECTED);
6460
6461         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6462                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6463                         return mgmt_cmd_status(sk, hdev->id,
6464                                                MGMT_OP_SET_STATIC_ADDRESS,
6465                                                MGMT_STATUS_INVALID_PARAMS);
6466
6467                 /* Two most significant bits shall be set */
6468                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6469                         return mgmt_cmd_status(sk, hdev->id,
6470                                                MGMT_OP_SET_STATIC_ADDRESS,
6471                                                MGMT_STATUS_INVALID_PARAMS);
6472         }
6473
6474         hci_dev_lock(hdev);
6475
6476         bacpy(&hdev->static_addr, &cp->bdaddr);
6477
6478         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6479         if (err < 0)
6480                 goto unlock;
6481
6482         err = new_settings(hdev, sk);
6483
6484 unlock:
6485         hci_dev_unlock(hdev);
6486         return err;
6487 }
6488
6489 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6490                            void *data, u16 len)
6491 {
6492         struct mgmt_cp_set_scan_params *cp = data;
6493         __u16 interval, window;
6494         int err;
6495
6496         bt_dev_dbg(hdev, "sock %p", sk);
6497
6498         if (!lmp_le_capable(hdev))
6499                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6500                                        MGMT_STATUS_NOT_SUPPORTED);
6501
6502         interval = __le16_to_cpu(cp->interval);
6503
6504         if (interval < 0x0004 || interval > 0x4000)
6505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6506                                        MGMT_STATUS_INVALID_PARAMS);
6507
6508         window = __le16_to_cpu(cp->window);
6509
6510         if (window < 0x0004 || window > 0x4000)
6511                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6512                                        MGMT_STATUS_INVALID_PARAMS);
6513
6514         if (window > interval)
6515                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6516                                        MGMT_STATUS_INVALID_PARAMS);
6517
6518         hci_dev_lock(hdev);
6519
6520         hdev->le_scan_interval = interval;
6521         hdev->le_scan_window = window;
6522
6523         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6524                                 NULL, 0);
6525
6526         /* If background scan is running, restart it so new parameters are
6527          * loaded.
6528          */
6529         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6530             hdev->discovery.state == DISCOVERY_STOPPED)
6531                 hci_update_passive_scan(hdev);
6532
6533         hci_dev_unlock(hdev);
6534
6535         return err;
6536 }
6537
6538 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6539 {
6540         struct mgmt_pending_cmd *cmd = data;
6541
6542         bt_dev_dbg(hdev, "err %d", err);
6543
6544         if (err) {
6545                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6546                                 mgmt_status(err));
6547         } else {
6548                 struct mgmt_mode *cp = cmd->param;
6549
6550                 if (cp->val)
6551                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6552                 else
6553                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6554
6555                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6556                 new_settings(hdev, cmd->sk);
6557         }
6558
6559         mgmt_pending_free(cmd);
6560 }
6561
6562 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6563 {
6564         struct mgmt_pending_cmd *cmd = data;
6565         struct mgmt_mode *cp = cmd->param;
6566
6567         return hci_write_fast_connectable_sync(hdev, cp->val);
6568 }
6569
6570 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6571                                 void *data, u16 len)
6572 {
6573         struct mgmt_mode *cp = data;
6574         struct mgmt_pending_cmd *cmd;
6575         int err;
6576
6577         bt_dev_dbg(hdev, "sock %p", sk);
6578
6579         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6580             hdev->hci_ver < BLUETOOTH_VER_1_2)
6581                 return mgmt_cmd_status(sk, hdev->id,
6582                                        MGMT_OP_SET_FAST_CONNECTABLE,
6583                                        MGMT_STATUS_NOT_SUPPORTED);
6584
6585         if (cp->val != 0x00 && cp->val != 0x01)
6586                 return mgmt_cmd_status(sk, hdev->id,
6587                                        MGMT_OP_SET_FAST_CONNECTABLE,
6588                                        MGMT_STATUS_INVALID_PARAMS);
6589
6590         hci_dev_lock(hdev);
6591
6592         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6593                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6594                 goto unlock;
6595         }
6596
6597         if (!hdev_is_powered(hdev)) {
6598                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6599                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6600                 new_settings(hdev, sk);
6601                 goto unlock;
6602         }
6603
6604         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6605                                len);
6606         if (!cmd)
6607                 err = -ENOMEM;
6608         else
6609                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6610                                          fast_connectable_complete);
6611
6612         if (err < 0) {
6613                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6614                                 MGMT_STATUS_FAILED);
6615
6616                 if (cmd)
6617                         mgmt_pending_free(cmd);
6618         }
6619
6620 unlock:
6621         hci_dev_unlock(hdev);
6622
6623         return err;
6624 }
6625
6626 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6627 {
6628         struct mgmt_pending_cmd *cmd = data;
6629
6630         bt_dev_dbg(hdev, "err %d", err);
6631
6632         if (err) {
6633                 u8 mgmt_err = mgmt_status(err);
6634
6635                 /* We need to restore the flag if related HCI commands
6636                  * failed.
6637                  */
6638                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6639
6640                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6641         } else {
6642                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6643                 new_settings(hdev, cmd->sk);
6644         }
6645
6646         mgmt_pending_free(cmd);
6647 }
6648
6649 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6650 {
6651         int status;
6652
6653         status = hci_write_fast_connectable_sync(hdev, false);
6654
6655         if (!status)
6656                 status = hci_update_scan_sync(hdev);
6657
6658         /* Since only the advertising data flags will change, there
6659          * is no need to update the scan response data.
6660          */
6661         if (!status)
6662                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6663
6664         return status;
6665 }
6666
6667 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6668 {
6669         struct mgmt_mode *cp = data;
6670         struct mgmt_pending_cmd *cmd;
6671         int err;
6672
6673         bt_dev_dbg(hdev, "sock %p", sk);
6674
6675         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6676                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6677                                        MGMT_STATUS_NOT_SUPPORTED);
6678
6679         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6680                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6681                                        MGMT_STATUS_REJECTED);
6682
6683         if (cp->val != 0x00 && cp->val != 0x01)
6684                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6685                                        MGMT_STATUS_INVALID_PARAMS);
6686
6687         hci_dev_lock(hdev);
6688
6689         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6690                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6691                 goto unlock;
6692         }
6693
6694         if (!hdev_is_powered(hdev)) {
6695                 if (!cp->val) {
6696                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6697                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6698                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6699                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6700                 }
6701
6702                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6703
6704                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6705                 if (err < 0)
6706                         goto unlock;
6707
6708                 err = new_settings(hdev, sk);
6709                 goto unlock;
6710         }
6711
6712         /* Reject disabling when powered on */
6713         if (!cp->val) {
6714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6715                                       MGMT_STATUS_REJECTED);
6716                 goto unlock;
6717         } else {
6718                 /* When configuring a dual-mode controller to operate
6719                  * with LE only and using a static address, then switching
6720                  * BR/EDR back on is not allowed.
6721                  *
6722                  * Dual-mode controllers shall operate with the public
6723                  * address as its identity address for BR/EDR and LE. So
6724                  * reject the attempt to create an invalid configuration.
6725                  *
6726                  * The same restrictions applies when secure connections
6727                  * has been enabled. For BR/EDR this is a controller feature
6728                  * while for LE it is a host stack feature. This means that
6729                  * switching BR/EDR back on when secure connections has been
6730                  * enabled is not a supported transaction.
6731                  */
6732                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6733                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6734                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6735                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6736                                               MGMT_STATUS_REJECTED);
6737                         goto unlock;
6738                 }
6739         }
6740
6741         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6742         if (!cmd)
6743                 err = -ENOMEM;
6744         else
6745                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6746                                          set_bredr_complete);
6747
6748         if (err < 0) {
6749                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6750                                 MGMT_STATUS_FAILED);
6751                 if (cmd)
6752                         mgmt_pending_free(cmd);
6753
6754                 goto unlock;
6755         }
6756
6757         /* We need to flip the bit already here so that
6758          * hci_req_update_adv_data generates the correct flags.
6759          */
6760         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6761
6762 unlock:
6763         hci_dev_unlock(hdev);
6764         return err;
6765 }
6766
6767 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6768 {
6769         struct mgmt_pending_cmd *cmd = data;
6770         struct mgmt_mode *cp;
6771
6772         bt_dev_dbg(hdev, "err %d", err);
6773
6774         if (err) {
6775                 u8 mgmt_err = mgmt_status(err);
6776
6777                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6778                 goto done;
6779         }
6780
6781         cp = cmd->param;
6782
6783         switch (cp->val) {
6784         case 0x00:
6785                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6786                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6787                 break;
6788         case 0x01:
6789                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6790                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6791                 break;
6792         case 0x02:
6793                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6794                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6795                 break;
6796         }
6797
6798         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6799         new_settings(hdev, cmd->sk);
6800
6801 done:
6802         mgmt_pending_free(cmd);
6803 }
6804
6805 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6806 {
6807         struct mgmt_pending_cmd *cmd = data;
6808         struct mgmt_mode *cp = cmd->param;
6809         u8 val = !!cp->val;
6810
6811         /* Force write of val */
6812         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6813
6814         return hci_write_sc_support_sync(hdev, val);
6815 }
6816
6817 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6818                            void *data, u16 len)
6819 {
6820         struct mgmt_mode *cp = data;
6821         struct mgmt_pending_cmd *cmd;
6822         u8 val;
6823         int err;
6824
6825         bt_dev_dbg(hdev, "sock %p", sk);
6826
6827         if (!lmp_sc_capable(hdev) &&
6828             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6829                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6830                                        MGMT_STATUS_NOT_SUPPORTED);
6831
6832         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6833             lmp_sc_capable(hdev) &&
6834             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6836                                        MGMT_STATUS_REJECTED);
6837
6838         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6840                                        MGMT_STATUS_INVALID_PARAMS);
6841
6842         hci_dev_lock(hdev);
6843
6844         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6845             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6846                 bool changed;
6847
6848                 if (cp->val) {
6849                         changed = !hci_dev_test_and_set_flag(hdev,
6850                                                              HCI_SC_ENABLED);
6851                         if (cp->val == 0x02)
6852                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6853                         else
6854                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6855                 } else {
6856                         changed = hci_dev_test_and_clear_flag(hdev,
6857                                                               HCI_SC_ENABLED);
6858                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6859                 }
6860
6861                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6862                 if (err < 0)
6863                         goto failed;
6864
6865                 if (changed)
6866                         err = new_settings(hdev, sk);
6867
6868                 goto failed;
6869         }
6870
6871         val = !!cp->val;
6872
6873         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6874             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6875                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6876                 goto failed;
6877         }
6878
6879         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6880         if (!cmd)
6881                 err = -ENOMEM;
6882         else
6883                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6884                                          set_secure_conn_complete);
6885
6886         if (err < 0) {
6887                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6888                                 MGMT_STATUS_FAILED);
6889                 if (cmd)
6890                         mgmt_pending_free(cmd);
6891         }
6892
6893 failed:
6894         hci_dev_unlock(hdev);
6895         return err;
6896 }
6897
6898 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6899                           void *data, u16 len)
6900 {
6901         struct mgmt_mode *cp = data;
6902         bool changed, use_changed;
6903         int err;
6904
6905         bt_dev_dbg(hdev, "sock %p", sk);
6906
6907         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6909                                        MGMT_STATUS_INVALID_PARAMS);
6910
6911         hci_dev_lock(hdev);
6912
6913         if (cp->val)
6914                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6915         else
6916                 changed = hci_dev_test_and_clear_flag(hdev,
6917                                                       HCI_KEEP_DEBUG_KEYS);
6918
6919         if (cp->val == 0x02)
6920                 use_changed = !hci_dev_test_and_set_flag(hdev,
6921                                                          HCI_USE_DEBUG_KEYS);
6922         else
6923                 use_changed = hci_dev_test_and_clear_flag(hdev,
6924                                                           HCI_USE_DEBUG_KEYS);
6925
6926         if (hdev_is_powered(hdev) && use_changed &&
6927             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6928                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6929                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6930                              sizeof(mode), &mode);
6931         }
6932
6933         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6934         if (err < 0)
6935                 goto unlock;
6936
6937         if (changed)
6938                 err = new_settings(hdev, sk);
6939
6940 unlock:
6941         hci_dev_unlock(hdev);
6942         return err;
6943 }
6944
6945 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6946                        u16 len)
6947 {
6948         struct mgmt_cp_set_privacy *cp = cp_data;
6949         bool changed;
6950         int err;
6951
6952         bt_dev_dbg(hdev, "sock %p", sk);
6953
6954         if (!lmp_le_capable(hdev))
6955                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6956                                        MGMT_STATUS_NOT_SUPPORTED);
6957
6958         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6959                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6960                                        MGMT_STATUS_INVALID_PARAMS);
6961
6962         if (hdev_is_powered(hdev))
6963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6964                                        MGMT_STATUS_REJECTED);
6965
6966         hci_dev_lock(hdev);
6967
6968         /* If user space supports this command it is also expected to
6969          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6970          */
6971         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6972
6973         if (cp->privacy) {
6974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6975                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6976                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6977                 hci_adv_instances_set_rpa_expired(hdev, true);
6978                 if (cp->privacy == 0x02)
6979                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6980                 else
6981                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6982         } else {
6983                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6984                 memset(hdev->irk, 0, sizeof(hdev->irk));
6985                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6986                 hci_adv_instances_set_rpa_expired(hdev, false);
6987                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6988         }
6989
6990         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6991         if (err < 0)
6992                 goto unlock;
6993
6994         if (changed)
6995                 err = new_settings(hdev, sk);
6996
6997 unlock:
6998         hci_dev_unlock(hdev);
6999         return err;
7000 }
7001
7002 static bool irk_is_valid(struct mgmt_irk_info *irk)
7003 {
7004         switch (irk->addr.type) {
7005         case BDADDR_LE_PUBLIC:
7006                 return true;
7007
7008         case BDADDR_LE_RANDOM:
7009                 /* Two most significant bits shall be set */
7010                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7011                         return false;
7012                 return true;
7013         }
7014
7015         return false;
7016 }
7017
7018 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7019                      u16 len)
7020 {
7021         struct mgmt_cp_load_irks *cp = cp_data;
7022         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7023                                    sizeof(struct mgmt_irk_info));
7024         u16 irk_count, expected_len;
7025         int i, err;
7026
7027         bt_dev_dbg(hdev, "sock %p", sk);
7028
7029         if (!lmp_le_capable(hdev))
7030                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7031                                        MGMT_STATUS_NOT_SUPPORTED);
7032
7033         irk_count = __le16_to_cpu(cp->irk_count);
7034         if (irk_count > max_irk_count) {
7035                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7036                            irk_count);
7037                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7038                                        MGMT_STATUS_INVALID_PARAMS);
7039         }
7040
7041         expected_len = struct_size(cp, irks, irk_count);
7042         if (expected_len != len) {
7043                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7044                            expected_len, len);
7045                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7046                                        MGMT_STATUS_INVALID_PARAMS);
7047         }
7048
7049         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7050
7051         for (i = 0; i < irk_count; i++) {
7052                 struct mgmt_irk_info *key = &cp->irks[i];
7053
7054                 if (!irk_is_valid(key))
7055                         return mgmt_cmd_status(sk, hdev->id,
7056                                                MGMT_OP_LOAD_IRKS,
7057                                                MGMT_STATUS_INVALID_PARAMS);
7058         }
7059
7060         hci_dev_lock(hdev);
7061
7062         hci_smp_irks_clear(hdev);
7063
7064         for (i = 0; i < irk_count; i++) {
7065                 struct mgmt_irk_info *irk = &cp->irks[i];
7066                 u8 addr_type = le_addr_type(irk->addr.type);
7067
7068                 if (hci_is_blocked_key(hdev,
7069                                        HCI_BLOCKED_KEY_TYPE_IRK,
7070                                        irk->val)) {
7071                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7072                                     &irk->addr.bdaddr);
7073                         continue;
7074                 }
7075
7076                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7077                 if (irk->addr.type == BDADDR_BREDR)
7078                         addr_type = BDADDR_BREDR;
7079
7080                 hci_add_irk(hdev, &irk->addr.bdaddr,
7081                             addr_type, irk->val,
7082                             BDADDR_ANY);
7083         }
7084
7085         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7086
7087         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7088
7089         hci_dev_unlock(hdev);
7090
7091         return err;
7092 }
7093
7094 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7095 {
7096         if (key->initiator != 0x00 && key->initiator != 0x01)
7097                 return false;
7098
7099         switch (key->addr.type) {
7100         case BDADDR_LE_PUBLIC:
7101                 return true;
7102
7103         case BDADDR_LE_RANDOM:
7104                 /* Two most significant bits shall be set */
7105                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7106                         return false;
7107                 return true;
7108         }
7109
7110         return false;
7111 }
7112
7113 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7114                                void *cp_data, u16 len)
7115 {
7116         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7117         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7118                                    sizeof(struct mgmt_ltk_info));
7119         u16 key_count, expected_len;
7120         int i, err;
7121
7122         bt_dev_dbg(hdev, "sock %p", sk);
7123
7124         if (!lmp_le_capable(hdev))
7125                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7126                                        MGMT_STATUS_NOT_SUPPORTED);
7127
7128         key_count = __le16_to_cpu(cp->key_count);
7129         if (key_count > max_key_count) {
7130                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7131                            key_count);
7132                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7133                                        MGMT_STATUS_INVALID_PARAMS);
7134         }
7135
7136         expected_len = struct_size(cp, keys, key_count);
7137         if (expected_len != len) {
7138                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7139                            expected_len, len);
7140                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7141                                        MGMT_STATUS_INVALID_PARAMS);
7142         }
7143
7144         bt_dev_dbg(hdev, "key_count %u", key_count);
7145
7146         for (i = 0; i < key_count; i++) {
7147                 struct mgmt_ltk_info *key = &cp->keys[i];
7148
7149                 if (!ltk_is_valid(key))
7150                         return mgmt_cmd_status(sk, hdev->id,
7151                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7152                                                MGMT_STATUS_INVALID_PARAMS);
7153         }
7154
7155         hci_dev_lock(hdev);
7156
7157         hci_smp_ltks_clear(hdev);
7158
7159         for (i = 0; i < key_count; i++) {
7160                 struct mgmt_ltk_info *key = &cp->keys[i];
7161                 u8 type, authenticated;
7162                 u8 addr_type = le_addr_type(key->addr.type);
7163
7164                 if (hci_is_blocked_key(hdev,
7165                                        HCI_BLOCKED_KEY_TYPE_LTK,
7166                                        key->val)) {
7167                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7168                                     &key->addr.bdaddr);
7169                         continue;
7170                 }
7171
7172                 switch (key->type) {
7173                 case MGMT_LTK_UNAUTHENTICATED:
7174                         authenticated = 0x00;
7175                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7176                         break;
7177                 case MGMT_LTK_AUTHENTICATED:
7178                         authenticated = 0x01;
7179                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7180                         break;
7181                 case MGMT_LTK_P256_UNAUTH:
7182                         authenticated = 0x00;
7183                         type = SMP_LTK_P256;
7184                         break;
7185                 case MGMT_LTK_P256_AUTH:
7186                         authenticated = 0x01;
7187                         type = SMP_LTK_P256;
7188                         break;
7189                 case MGMT_LTK_P256_DEBUG:
7190                         authenticated = 0x00;
7191                         type = SMP_LTK_P256_DEBUG;
7192                         fallthrough;
7193                 default:
7194                         continue;
7195                 }
7196
7197                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7198                 if (key->addr.type == BDADDR_BREDR)
7199                         addr_type = BDADDR_BREDR;
7200
7201                 hci_add_ltk(hdev, &key->addr.bdaddr,
7202                             addr_type, type, authenticated,
7203                             key->val, key->enc_size, key->ediv, key->rand);
7204         }
7205
7206         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7207                            NULL, 0);
7208
7209         hci_dev_unlock(hdev);
7210
7211         return err;
7212 }
7213
7214 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7215 {
7216         struct mgmt_pending_cmd *cmd = data;
7217         struct hci_conn *conn = cmd->user_data;
7218         struct mgmt_cp_get_conn_info *cp = cmd->param;
7219         struct mgmt_rp_get_conn_info rp;
7220         u8 status;
7221
7222         bt_dev_dbg(hdev, "err %d", err);
7223
7224         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
7225
7226         status = mgmt_status(err);
7227         if (status == MGMT_STATUS_SUCCESS) {
7228                 rp.rssi = conn->rssi;
7229                 rp.tx_power = conn->tx_power;
7230                 rp.max_tx_power = conn->max_tx_power;
7231         } else {
7232                 rp.rssi = HCI_RSSI_INVALID;
7233                 rp.tx_power = HCI_TX_POWER_INVALID;
7234                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7235         }
7236
7237         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7238                           &rp, sizeof(rp));
7239
7240         mgmt_pending_free(cmd);
7241 }
7242
7243 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7244 {
7245         struct mgmt_pending_cmd *cmd = data;
7246         struct mgmt_cp_get_conn_info *cp = cmd->param;
7247         struct hci_conn *conn;
7248         int err;
7249         __le16   handle;
7250
7251         /* Make sure we are still connected */
7252         if (cp->addr.type == BDADDR_BREDR)
7253                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7254                                                &cp->addr.bdaddr);
7255         else
7256                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7257
7258         if (!conn || conn->state != BT_CONNECTED)
7259                 return MGMT_STATUS_NOT_CONNECTED;
7260
7261         cmd->user_data = conn;
7262         handle = cpu_to_le16(conn->handle);
7263
7264         /* Refresh RSSI each time */
7265         err = hci_read_rssi_sync(hdev, handle);
7266
7267         /* For LE links TX power does not change thus we don't need to
7268          * query for it once value is known.
7269          */
7270         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7271                      conn->tx_power == HCI_TX_POWER_INVALID))
7272                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7273
7274         /* Max TX power needs to be read only once per connection */
7275         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7276                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7277
7278         return err;
7279 }
7280
7281 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7282                          u16 len)
7283 {
7284         struct mgmt_cp_get_conn_info *cp = data;
7285         struct mgmt_rp_get_conn_info rp;
7286         struct hci_conn *conn;
7287         unsigned long conn_info_age;
7288         int err = 0;
7289
7290         bt_dev_dbg(hdev, "sock %p", sk);
7291
7292         memset(&rp, 0, sizeof(rp));
7293         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7294         rp.addr.type = cp->addr.type;
7295
7296         if (!bdaddr_type_is_valid(cp->addr.type))
7297                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7298                                          MGMT_STATUS_INVALID_PARAMS,
7299                                          &rp, sizeof(rp));
7300
7301         hci_dev_lock(hdev);
7302
7303         if (!hdev_is_powered(hdev)) {
7304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7305                                         MGMT_STATUS_NOT_POWERED, &rp,
7306                                         sizeof(rp));
7307                 goto unlock;
7308         }
7309
7310         if (cp->addr.type == BDADDR_BREDR)
7311                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7312                                                &cp->addr.bdaddr);
7313         else
7314                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7315
7316         if (!conn || conn->state != BT_CONNECTED) {
7317                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7318                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7319                                         sizeof(rp));
7320                 goto unlock;
7321         }
7322
7323         /* To avoid client trying to guess when to poll again for information we
7324          * calculate conn info age as random value between min/max set in hdev.
7325          */
7326         conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7327                                                  hdev->conn_info_max_age - 1);
7328
7329         /* Query controller to refresh cached values if they are too old or were
7330          * never read.
7331          */
7332         if (time_after(jiffies, conn->conn_info_timestamp +
7333                        msecs_to_jiffies(conn_info_age)) ||
7334             !conn->conn_info_timestamp) {
7335                 struct mgmt_pending_cmd *cmd;
7336
7337                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7338                                        len);
7339                 if (!cmd) {
7340                         err = -ENOMEM;
7341                 } else {
7342                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7343                                                  cmd, get_conn_info_complete);
7344                 }
7345
7346                 if (err < 0) {
7347                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7348                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
7349
7350                         if (cmd)
7351                                 mgmt_pending_free(cmd);
7352
7353                         goto unlock;
7354                 }
7355
7356                 conn->conn_info_timestamp = jiffies;
7357         } else {
7358                 /* Cache is valid, just reply with values cached in hci_conn */
7359                 rp.rssi = conn->rssi;
7360                 rp.tx_power = conn->tx_power;
7361                 rp.max_tx_power = conn->max_tx_power;
7362
7363                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7364                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7365         }
7366
7367 unlock:
7368         hci_dev_unlock(hdev);
7369         return err;
7370 }
7371
7372 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7373 {
7374         struct mgmt_pending_cmd *cmd = data;
7375         struct mgmt_cp_get_clock_info *cp = cmd->param;
7376         struct mgmt_rp_get_clock_info rp;
7377         struct hci_conn *conn = cmd->user_data;
7378         u8 status = mgmt_status(err);
7379
7380         bt_dev_dbg(hdev, "err %d", err);
7381
7382         memset(&rp, 0, sizeof(rp));
7383         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7384         rp.addr.type = cp->addr.type;
7385
7386         if (err)
7387                 goto complete;
7388
7389         rp.local_clock = cpu_to_le32(hdev->clock);
7390
7391         if (conn) {
7392                 rp.piconet_clock = cpu_to_le32(conn->clock);
7393                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7394         }
7395
7396 complete:
7397         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7398                           sizeof(rp));
7399
7400         mgmt_pending_free(cmd);
7401 }
7402
7403 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7404 {
7405         struct mgmt_pending_cmd *cmd = data;
7406         struct mgmt_cp_get_clock_info *cp = cmd->param;
7407         struct hci_cp_read_clock hci_cp;
7408         struct hci_conn *conn;
7409
7410         memset(&hci_cp, 0, sizeof(hci_cp));
7411         hci_read_clock_sync(hdev, &hci_cp);
7412
7413         /* Make sure connection still exists */
7414         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7415         if (!conn || conn->state != BT_CONNECTED)
7416                 return MGMT_STATUS_NOT_CONNECTED;
7417
7418         cmd->user_data = conn;
7419         hci_cp.handle = cpu_to_le16(conn->handle);
7420         hci_cp.which = 0x01; /* Piconet clock */
7421
7422         return hci_read_clock_sync(hdev, &hci_cp);
7423 }
7424
7425 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7426                                                                 u16 len)
7427 {
7428         struct mgmt_cp_get_clock_info *cp = data;
7429         struct mgmt_rp_get_clock_info rp;
7430         struct mgmt_pending_cmd *cmd;
7431         struct hci_conn *conn;
7432         int err;
7433
7434         bt_dev_dbg(hdev, "sock %p", sk);
7435
7436         memset(&rp, 0, sizeof(rp));
7437         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7438         rp.addr.type = cp->addr.type;
7439
7440         if (cp->addr.type != BDADDR_BREDR)
7441                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7442                                          MGMT_STATUS_INVALID_PARAMS,
7443                                          &rp, sizeof(rp));
7444
7445         hci_dev_lock(hdev);
7446
7447         if (!hdev_is_powered(hdev)) {
7448                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7449                                         MGMT_STATUS_NOT_POWERED, &rp,
7450                                         sizeof(rp));
7451                 goto unlock;
7452         }
7453
7454         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7455                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7456                                                &cp->addr.bdaddr);
7457                 if (!conn || conn->state != BT_CONNECTED) {
7458                         err = mgmt_cmd_complete(sk, hdev->id,
7459                                                 MGMT_OP_GET_CLOCK_INFO,
7460                                                 MGMT_STATUS_NOT_CONNECTED,
7461                                                 &rp, sizeof(rp));
7462                         goto unlock;
7463                 }
7464         } else {
7465                 conn = NULL;
7466         }
7467
7468         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7469         if (!cmd)
7470                 err = -ENOMEM;
7471         else
7472                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7473                                          get_clock_info_complete);
7474
7475         if (err < 0) {
7476                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7477                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
7478
7479                 if (cmd)
7480                         mgmt_pending_free(cmd);
7481         }
7482
7483
7484 unlock:
7485         hci_dev_unlock(hdev);
7486         return err;
7487 }
7488
7489 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7490 {
7491         struct hci_conn *conn;
7492
7493         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7494         if (!conn)
7495                 return false;
7496
7497         if (conn->dst_type != type)
7498                 return false;
7499
7500         if (conn->state != BT_CONNECTED)
7501                 return false;
7502
7503         return true;
7504 }
7505
7506 /* This function requires the caller holds hdev->lock */
7507 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7508                                u8 addr_type, u8 auto_connect)
7509 {
7510         struct hci_conn_params *params;
7511
7512         params = hci_conn_params_add(hdev, addr, addr_type);
7513         if (!params)
7514                 return -EIO;
7515
7516         if (params->auto_connect == auto_connect)
7517                 return 0;
7518
7519         hci_pend_le_list_del_init(params);
7520
7521         switch (auto_connect) {
7522         case HCI_AUTO_CONN_DISABLED:
7523         case HCI_AUTO_CONN_LINK_LOSS:
7524                 /* If auto connect is being disabled when we're trying to
7525                  * connect to device, keep connecting.
7526                  */
7527                 if (params->explicit_connect)
7528                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7529                 break;
7530         case HCI_AUTO_CONN_REPORT:
7531                 if (params->explicit_connect)
7532                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7533                 else
7534                         hci_pend_le_list_add(params, &hdev->pend_le_reports);
7535                 break;
7536         case HCI_AUTO_CONN_DIRECT:
7537         case HCI_AUTO_CONN_ALWAYS:
7538                 if (!is_connected(hdev, addr, addr_type))
7539                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7540                 break;
7541         }
7542
7543         params->auto_connect = auto_connect;
7544
7545         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7546                    addr, addr_type, auto_connect);
7547
7548         return 0;
7549 }
7550
7551 static void device_added(struct sock *sk, struct hci_dev *hdev,
7552                          bdaddr_t *bdaddr, u8 type, u8 action)
7553 {
7554         struct mgmt_ev_device_added ev;
7555
7556         bacpy(&ev.addr.bdaddr, bdaddr);
7557         ev.addr.type = type;
7558         ev.action = action;
7559
7560         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7561 }
7562
7563 static int add_device_sync(struct hci_dev *hdev, void *data)
7564 {
7565         return hci_update_passive_scan_sync(hdev);
7566 }
7567
7568 static int add_device(struct sock *sk, struct hci_dev *hdev,
7569                       void *data, u16 len)
7570 {
7571         struct mgmt_cp_add_device *cp = data;
7572         u8 auto_conn, addr_type;
7573         struct hci_conn_params *params;
7574         int err;
7575         u32 current_flags = 0;
7576         u32 supported_flags;
7577
7578         bt_dev_dbg(hdev, "sock %p", sk);
7579
7580         if (!bdaddr_type_is_valid(cp->addr.type) ||
7581             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7582                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7583                                          MGMT_STATUS_INVALID_PARAMS,
7584                                          &cp->addr, sizeof(cp->addr));
7585
7586         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7587                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7588                                          MGMT_STATUS_INVALID_PARAMS,
7589                                          &cp->addr, sizeof(cp->addr));
7590
7591         hci_dev_lock(hdev);
7592
7593         if (cp->addr.type == BDADDR_BREDR) {
7594                 /* Only incoming connections action is supported for now */
7595                 if (cp->action != 0x01) {
7596                         err = mgmt_cmd_complete(sk, hdev->id,
7597                                                 MGMT_OP_ADD_DEVICE,
7598                                                 MGMT_STATUS_INVALID_PARAMS,
7599                                                 &cp->addr, sizeof(cp->addr));
7600                         goto unlock;
7601                 }
7602
7603                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7604                                                      &cp->addr.bdaddr,
7605                                                      cp->addr.type, 0);
7606                 if (err)
7607                         goto unlock;
7608
7609                 hci_update_scan(hdev);
7610
7611                 goto added;
7612         }
7613
7614         addr_type = le_addr_type(cp->addr.type);
7615
7616         if (cp->action == 0x02)
7617                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7618         else if (cp->action == 0x01)
7619                 auto_conn = HCI_AUTO_CONN_DIRECT;
7620         else
7621                 auto_conn = HCI_AUTO_CONN_REPORT;
7622
7623         /* Kernel internally uses conn_params with resolvable private
7624          * address, but Add Device allows only identity addresses.
7625          * Make sure it is enforced before calling
7626          * hci_conn_params_lookup.
7627          */
7628         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7629                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7630                                         MGMT_STATUS_INVALID_PARAMS,
7631                                         &cp->addr, sizeof(cp->addr));
7632                 goto unlock;
7633         }
7634
7635         /* If the connection parameters don't exist for this device,
7636          * they will be created and configured with defaults.
7637          */
7638         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7639                                 auto_conn) < 0) {
7640                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7641                                         MGMT_STATUS_FAILED, &cp->addr,
7642                                         sizeof(cp->addr));
7643                 goto unlock;
7644         } else {
7645                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7646                                                 addr_type);
7647                 if (params)
7648                         current_flags = params->flags;
7649         }
7650
7651         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7652         if (err < 0)
7653                 goto unlock;
7654
7655 added:
7656         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7657         supported_flags = hdev->conn_flags;
7658         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7659                              supported_flags, current_flags);
7660
7661         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7662                                 MGMT_STATUS_SUCCESS, &cp->addr,
7663                                 sizeof(cp->addr));
7664
7665 unlock:
7666         hci_dev_unlock(hdev);
7667         return err;
7668 }
7669
7670 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7671                            bdaddr_t *bdaddr, u8 type)
7672 {
7673         struct mgmt_ev_device_removed ev;
7674
7675         bacpy(&ev.addr.bdaddr, bdaddr);
7676         ev.addr.type = type;
7677
7678         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7679 }
7680
7681 static int remove_device_sync(struct hci_dev *hdev, void *data)
7682 {
7683         return hci_update_passive_scan_sync(hdev);
7684 }
7685
7686 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7687                          void *data, u16 len)
7688 {
7689         struct mgmt_cp_remove_device *cp = data;
7690         int err;
7691
7692         bt_dev_dbg(hdev, "sock %p", sk);
7693
7694         hci_dev_lock(hdev);
7695
7696         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7697                 struct hci_conn_params *params;
7698                 u8 addr_type;
7699
7700                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7701                         err = mgmt_cmd_complete(sk, hdev->id,
7702                                                 MGMT_OP_REMOVE_DEVICE,
7703                                                 MGMT_STATUS_INVALID_PARAMS,
7704                                                 &cp->addr, sizeof(cp->addr));
7705                         goto unlock;
7706                 }
7707
7708                 if (cp->addr.type == BDADDR_BREDR) {
7709                         err = hci_bdaddr_list_del(&hdev->accept_list,
7710                                                   &cp->addr.bdaddr,
7711                                                   cp->addr.type);
7712                         if (err) {
7713                                 err = mgmt_cmd_complete(sk, hdev->id,
7714                                                         MGMT_OP_REMOVE_DEVICE,
7715                                                         MGMT_STATUS_INVALID_PARAMS,
7716                                                         &cp->addr,
7717                                                         sizeof(cp->addr));
7718                                 goto unlock;
7719                         }
7720
7721                         hci_update_scan(hdev);
7722
7723                         device_removed(sk, hdev, &cp->addr.bdaddr,
7724                                        cp->addr.type);
7725                         goto complete;
7726                 }
7727
7728                 addr_type = le_addr_type(cp->addr.type);
7729
7730                 /* Kernel internally uses conn_params with resolvable private
7731                  * address, but Remove Device allows only identity addresses.
7732                  * Make sure it is enforced before calling
7733                  * hci_conn_params_lookup.
7734                  */
7735                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7736                         err = mgmt_cmd_complete(sk, hdev->id,
7737                                                 MGMT_OP_REMOVE_DEVICE,
7738                                                 MGMT_STATUS_INVALID_PARAMS,
7739                                                 &cp->addr, sizeof(cp->addr));
7740                         goto unlock;
7741                 }
7742
7743                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7744                                                 addr_type);
7745                 if (!params) {
7746                         err = mgmt_cmd_complete(sk, hdev->id,
7747                                                 MGMT_OP_REMOVE_DEVICE,
7748                                                 MGMT_STATUS_INVALID_PARAMS,
7749                                                 &cp->addr, sizeof(cp->addr));
7750                         goto unlock;
7751                 }
7752
7753                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7754                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7755                         err = mgmt_cmd_complete(sk, hdev->id,
7756                                                 MGMT_OP_REMOVE_DEVICE,
7757                                                 MGMT_STATUS_INVALID_PARAMS,
7758                                                 &cp->addr, sizeof(cp->addr));
7759                         goto unlock;
7760                 }
7761
7762                 hci_conn_params_free(params);
7763
7764                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7765         } else {
7766                 struct hci_conn_params *p, *tmp;
7767                 struct bdaddr_list *b, *btmp;
7768
7769                 if (cp->addr.type) {
7770                         err = mgmt_cmd_complete(sk, hdev->id,
7771                                                 MGMT_OP_REMOVE_DEVICE,
7772                                                 MGMT_STATUS_INVALID_PARAMS,
7773                                                 &cp->addr, sizeof(cp->addr));
7774                         goto unlock;
7775                 }
7776
7777                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7778                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7779                         list_del(&b->list);
7780                         kfree(b);
7781                 }
7782
7783                 hci_update_scan(hdev);
7784
7785                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7786                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7787                                 continue;
7788                         device_removed(sk, hdev, &p->addr, p->addr_type);
7789                         if (p->explicit_connect) {
7790                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7791                                 continue;
7792                         }
7793                         hci_conn_params_free(p);
7794                 }
7795
7796                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
7797         }
7798
7799         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7800
7801 complete:
7802         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7803                                 MGMT_STATUS_SUCCESS, &cp->addr,
7804                                 sizeof(cp->addr));
7805 unlock:
7806         hci_dev_unlock(hdev);
7807         return err;
7808 }
7809
7810 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7811                            u16 len)
7812 {
7813         struct mgmt_cp_load_conn_param *cp = data;
7814         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7815                                      sizeof(struct mgmt_conn_param));
7816         u16 param_count, expected_len;
7817         int i;
7818
7819         if (!lmp_le_capable(hdev))
7820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7821                                        MGMT_STATUS_NOT_SUPPORTED);
7822
7823         param_count = __le16_to_cpu(cp->param_count);
7824         if (param_count > max_param_count) {
7825                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7826                            param_count);
7827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7828                                        MGMT_STATUS_INVALID_PARAMS);
7829         }
7830
7831         expected_len = struct_size(cp, params, param_count);
7832         if (expected_len != len) {
7833                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7834                            expected_len, len);
7835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7836                                        MGMT_STATUS_INVALID_PARAMS);
7837         }
7838
7839         bt_dev_dbg(hdev, "param_count %u", param_count);
7840
7841         hci_dev_lock(hdev);
7842
7843         hci_conn_params_clear_disabled(hdev);
7844
7845         for (i = 0; i < param_count; i++) {
7846                 struct mgmt_conn_param *param = &cp->params[i];
7847                 struct hci_conn_params *hci_param;
7848                 u16 min, max, latency, timeout;
7849                 u8 addr_type;
7850
7851                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7852                            param->addr.type);
7853
7854                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7855                         addr_type = ADDR_LE_DEV_PUBLIC;
7856                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7857                         addr_type = ADDR_LE_DEV_RANDOM;
7858                 } else {
7859                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7860                         continue;
7861                 }
7862
7863                 min = le16_to_cpu(param->min_interval);
7864                 max = le16_to_cpu(param->max_interval);
7865                 latency = le16_to_cpu(param->latency);
7866                 timeout = le16_to_cpu(param->timeout);
7867
7868                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7869                            min, max, latency, timeout);
7870
7871                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7872                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7873                         continue;
7874                 }
7875
7876                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7877                                                 addr_type);
7878                 if (!hci_param) {
7879                         bt_dev_err(hdev, "failed to add connection parameters");
7880                         continue;
7881                 }
7882
7883                 hci_param->conn_min_interval = min;
7884                 hci_param->conn_max_interval = max;
7885                 hci_param->conn_latency = latency;
7886                 hci_param->supervision_timeout = timeout;
7887         }
7888
7889         hci_dev_unlock(hdev);
7890
7891         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7892                                  NULL, 0);
7893 }
7894
7895 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7896                                void *data, u16 len)
7897 {
7898         struct mgmt_cp_set_external_config *cp = data;
7899         bool changed;
7900         int err;
7901
7902         bt_dev_dbg(hdev, "sock %p", sk);
7903
7904         if (hdev_is_powered(hdev))
7905                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7906                                        MGMT_STATUS_REJECTED);
7907
7908         if (cp->config != 0x00 && cp->config != 0x01)
7909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7910                                          MGMT_STATUS_INVALID_PARAMS);
7911
7912         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7913                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7914                                        MGMT_STATUS_NOT_SUPPORTED);
7915
7916         hci_dev_lock(hdev);
7917
7918         if (cp->config)
7919                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7920         else
7921                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7922
7923         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7924         if (err < 0)
7925                 goto unlock;
7926
7927         if (!changed)
7928                 goto unlock;
7929
7930         err = new_options(hdev, sk);
7931
7932         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7933                 mgmt_index_removed(hdev);
7934
7935                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7936                         hci_dev_set_flag(hdev, HCI_CONFIG);
7937                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7938
7939                         queue_work(hdev->req_workqueue, &hdev->power_on);
7940                 } else {
7941                         set_bit(HCI_RAW, &hdev->flags);
7942                         mgmt_index_added(hdev);
7943                 }
7944         }
7945
7946 unlock:
7947         hci_dev_unlock(hdev);
7948         return err;
7949 }
7950
7951 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7952                               void *data, u16 len)
7953 {
7954         struct mgmt_cp_set_public_address *cp = data;
7955         bool changed;
7956         int err;
7957
7958         bt_dev_dbg(hdev, "sock %p", sk);
7959
7960         if (hdev_is_powered(hdev))
7961                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7962                                        MGMT_STATUS_REJECTED);
7963
7964         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7965                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7966                                        MGMT_STATUS_INVALID_PARAMS);
7967
7968         if (!hdev->set_bdaddr)
7969                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7970                                        MGMT_STATUS_NOT_SUPPORTED);
7971
7972         hci_dev_lock(hdev);
7973
7974         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7975         bacpy(&hdev->public_addr, &cp->bdaddr);
7976
7977         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7978         if (err < 0)
7979                 goto unlock;
7980
7981         if (!changed)
7982                 goto unlock;
7983
7984         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7985                 err = new_options(hdev, sk);
7986
7987         if (is_configured(hdev)) {
7988                 mgmt_index_removed(hdev);
7989
7990                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7991
7992                 hci_dev_set_flag(hdev, HCI_CONFIG);
7993                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7994
7995                 queue_work(hdev->req_workqueue, &hdev->power_on);
7996         }
7997
7998 unlock:
7999         hci_dev_unlock(hdev);
8000         return err;
8001 }
8002
8003 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8004                                              int err)
8005 {
8006         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8007         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8008         u8 *h192, *r192, *h256, *r256;
8009         struct mgmt_pending_cmd *cmd = data;
8010         struct sk_buff *skb = cmd->skb;
8011         u8 status = mgmt_status(err);
8012         u16 eir_len;
8013
8014         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
8015                 return;
8016
8017         if (!status) {
8018                 if (!skb)
8019                         status = MGMT_STATUS_FAILED;
8020                 else if (IS_ERR(skb))
8021                         status = mgmt_status(PTR_ERR(skb));
8022                 else
8023                         status = mgmt_status(skb->data[0]);
8024         }
8025
8026         bt_dev_dbg(hdev, "status %u", status);
8027
8028         mgmt_cp = cmd->param;
8029
8030         if (status) {
8031                 status = mgmt_status(status);
8032                 eir_len = 0;
8033
8034                 h192 = NULL;
8035                 r192 = NULL;
8036                 h256 = NULL;
8037                 r256 = NULL;
8038         } else if (!bredr_sc_enabled(hdev)) {
8039                 struct hci_rp_read_local_oob_data *rp;
8040
8041                 if (skb->len != sizeof(*rp)) {
8042                         status = MGMT_STATUS_FAILED;
8043                         eir_len = 0;
8044                 } else {
8045                         status = MGMT_STATUS_SUCCESS;
8046                         rp = (void *)skb->data;
8047
8048                         eir_len = 5 + 18 + 18;
8049                         h192 = rp->hash;
8050                         r192 = rp->rand;
8051                         h256 = NULL;
8052                         r256 = NULL;
8053                 }
8054         } else {
8055                 struct hci_rp_read_local_oob_ext_data *rp;
8056
8057                 if (skb->len != sizeof(*rp)) {
8058                         status = MGMT_STATUS_FAILED;
8059                         eir_len = 0;
8060                 } else {
8061                         status = MGMT_STATUS_SUCCESS;
8062                         rp = (void *)skb->data;
8063
8064                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8065                                 eir_len = 5 + 18 + 18;
8066                                 h192 = NULL;
8067                                 r192 = NULL;
8068                         } else {
8069                                 eir_len = 5 + 18 + 18 + 18 + 18;
8070                                 h192 = rp->hash192;
8071                                 r192 = rp->rand192;
8072                         }
8073
8074                         h256 = rp->hash256;
8075                         r256 = rp->rand256;
8076                 }
8077         }
8078
8079         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8080         if (!mgmt_rp)
8081                 goto done;
8082
8083         if (eir_len == 0)
8084                 goto send_rsp;
8085
8086         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8087                                   hdev->dev_class, 3);
8088
8089         if (h192 && r192) {
8090                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8091                                           EIR_SSP_HASH_C192, h192, 16);
8092                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8093                                           EIR_SSP_RAND_R192, r192, 16);
8094         }
8095
8096         if (h256 && r256) {
8097                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8098                                           EIR_SSP_HASH_C256, h256, 16);
8099                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8100                                           EIR_SSP_RAND_R256, r256, 16);
8101         }
8102
8103 send_rsp:
8104         mgmt_rp->type = mgmt_cp->type;
8105         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8106
8107         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8108                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8109                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8110         if (err < 0 || status)
8111                 goto done;
8112
8113         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8114
8115         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8116                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8117                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8118 done:
8119         if (skb && !IS_ERR(skb))
8120                 kfree_skb(skb);
8121
8122         kfree(mgmt_rp);
8123         mgmt_pending_remove(cmd);
8124 }
8125
8126 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8127                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8128 {
8129         struct mgmt_pending_cmd *cmd;
8130         int err;
8131
8132         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8133                                cp, sizeof(*cp));
8134         if (!cmd)
8135                 return -ENOMEM;
8136
8137         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8138                                  read_local_oob_ext_data_complete);
8139
8140         if (err < 0) {
8141                 mgmt_pending_remove(cmd);
8142                 return err;
8143         }
8144
8145         return 0;
8146 }
8147
8148 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8149                                    void *data, u16 data_len)
8150 {
8151         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8152         struct mgmt_rp_read_local_oob_ext_data *rp;
8153         size_t rp_len;
8154         u16 eir_len;
8155         u8 status, flags, role, addr[7], hash[16], rand[16];
8156         int err;
8157
8158         bt_dev_dbg(hdev, "sock %p", sk);
8159
8160         if (hdev_is_powered(hdev)) {
8161                 switch (cp->type) {
8162                 case BIT(BDADDR_BREDR):
8163                         status = mgmt_bredr_support(hdev);
8164                         if (status)
8165                                 eir_len = 0;
8166                         else
8167                                 eir_len = 5;
8168                         break;
8169                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8170                         status = mgmt_le_support(hdev);
8171                         if (status)
8172                                 eir_len = 0;
8173                         else
8174                                 eir_len = 9 + 3 + 18 + 18 + 3;
8175                         break;
8176                 default:
8177                         status = MGMT_STATUS_INVALID_PARAMS;
8178                         eir_len = 0;
8179                         break;
8180                 }
8181         } else {
8182                 status = MGMT_STATUS_NOT_POWERED;
8183                 eir_len = 0;
8184         }
8185
8186         rp_len = sizeof(*rp) + eir_len;
8187         rp = kmalloc(rp_len, GFP_ATOMIC);
8188         if (!rp)
8189                 return -ENOMEM;
8190
8191         if (!status && !lmp_ssp_capable(hdev)) {
8192                 status = MGMT_STATUS_NOT_SUPPORTED;
8193                 eir_len = 0;
8194         }
8195
8196         if (status)
8197                 goto complete;
8198
8199         hci_dev_lock(hdev);
8200
8201         eir_len = 0;
8202         switch (cp->type) {
8203         case BIT(BDADDR_BREDR):
8204                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8205                         err = read_local_ssp_oob_req(hdev, sk, cp);
8206                         hci_dev_unlock(hdev);
8207                         if (!err)
8208                                 goto done;
8209
8210                         status = MGMT_STATUS_FAILED;
8211                         goto complete;
8212                 } else {
8213                         eir_len = eir_append_data(rp->eir, eir_len,
8214                                                   EIR_CLASS_OF_DEV,
8215                                                   hdev->dev_class, 3);
8216                 }
8217                 break;
8218         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8219                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8220                     smp_generate_oob(hdev, hash, rand) < 0) {
8221                         hci_dev_unlock(hdev);
8222                         status = MGMT_STATUS_FAILED;
8223                         goto complete;
8224                 }
8225
8226                 /* This should return the active RPA, but since the RPA
8227                  * is only programmed on demand, it is really hard to fill
8228                  * this in at the moment. For now disallow retrieving
8229                  * local out-of-band data when privacy is in use.
8230                  *
8231                  * Returning the identity address will not help here since
8232                  * pairing happens before the identity resolving key is
8233                  * known and thus the connection establishment happens
8234                  * based on the RPA and not the identity address.
8235                  */
8236                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8237                         hci_dev_unlock(hdev);
8238                         status = MGMT_STATUS_REJECTED;
8239                         goto complete;
8240                 }
8241
8242                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8243                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8244                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8245                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8246                         memcpy(addr, &hdev->static_addr, 6);
8247                         addr[6] = 0x01;
8248                 } else {
8249                         memcpy(addr, &hdev->bdaddr, 6);
8250                         addr[6] = 0x00;
8251                 }
8252
8253                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8254                                           addr, sizeof(addr));
8255
8256                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8257                         role = 0x02;
8258                 else
8259                         role = 0x01;
8260
8261                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8262                                           &role, sizeof(role));
8263
8264                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8265                         eir_len = eir_append_data(rp->eir, eir_len,
8266                                                   EIR_LE_SC_CONFIRM,
8267                                                   hash, sizeof(hash));
8268
8269                         eir_len = eir_append_data(rp->eir, eir_len,
8270                                                   EIR_LE_SC_RANDOM,
8271                                                   rand, sizeof(rand));
8272                 }
8273
8274                 flags = mgmt_get_adv_discov_flags(hdev);
8275
8276                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8277                         flags |= LE_AD_NO_BREDR;
8278
8279                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8280                                           &flags, sizeof(flags));
8281                 break;
8282         }
8283
8284         hci_dev_unlock(hdev);
8285
8286         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8287
8288         status = MGMT_STATUS_SUCCESS;
8289
8290 complete:
8291         rp->type = cp->type;
8292         rp->eir_len = cpu_to_le16(eir_len);
8293
8294         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8295                                 status, rp, sizeof(*rp) + eir_len);
8296         if (err < 0 || status)
8297                 goto done;
8298
8299         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8300                                  rp, sizeof(*rp) + eir_len,
8301                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8302
8303 done:
8304         kfree(rp);
8305
8306         return err;
8307 }
8308
8309 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8310 {
8311         u32 flags = 0;
8312
8313         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8314         flags |= MGMT_ADV_FLAG_DISCOV;
8315         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8316         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8317         flags |= MGMT_ADV_FLAG_APPEARANCE;
8318         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8319         flags |= MGMT_ADV_PARAM_DURATION;
8320         flags |= MGMT_ADV_PARAM_TIMEOUT;
8321         flags |= MGMT_ADV_PARAM_INTERVALS;
8322         flags |= MGMT_ADV_PARAM_TX_POWER;
8323         flags |= MGMT_ADV_PARAM_SCAN_RSP;
8324
8325         /* In extended adv TX_POWER returned from Set Adv Param
8326          * will be always valid.
8327          */
8328         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8329                 flags |= MGMT_ADV_FLAG_TX_POWER;
8330
8331         if (ext_adv_capable(hdev)) {
8332                 flags |= MGMT_ADV_FLAG_SEC_1M;
8333                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8334                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8335
8336                 if (le_2m_capable(hdev))
8337                         flags |= MGMT_ADV_FLAG_SEC_2M;
8338
8339                 if (le_coded_capable(hdev))
8340                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8341         }
8342
8343         return flags;
8344 }
8345
8346 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8347                              void *data, u16 data_len)
8348 {
8349         struct mgmt_rp_read_adv_features *rp;
8350         size_t rp_len;
8351         int err;
8352         struct adv_info *adv_instance;
8353         u32 supported_flags;
8354         u8 *instance;
8355
8356         bt_dev_dbg(hdev, "sock %p", sk);
8357
8358         if (!lmp_le_capable(hdev))
8359                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8360                                        MGMT_STATUS_REJECTED);
8361
8362         hci_dev_lock(hdev);
8363
8364         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8365         rp = kmalloc(rp_len, GFP_ATOMIC);
8366         if (!rp) {
8367                 hci_dev_unlock(hdev);
8368                 return -ENOMEM;
8369         }
8370
8371         supported_flags = get_supported_adv_flags(hdev);
8372
8373         rp->supported_flags = cpu_to_le32(supported_flags);
8374         rp->max_adv_data_len = max_adv_len(hdev);
8375         rp->max_scan_rsp_len = max_adv_len(hdev);
8376         rp->max_instances = hdev->le_num_of_adv_sets;
8377         rp->num_instances = hdev->adv_instance_cnt;
8378
8379         instance = rp->instance;
8380         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8381                 /* Only instances 1-le_num_of_adv_sets are externally visible */
8382                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8383                         *instance = adv_instance->instance;
8384                         instance++;
8385                 } else {
8386                         rp->num_instances--;
8387                         rp_len--;
8388                 }
8389         }
8390
8391         hci_dev_unlock(hdev);
8392
8393         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8394                                 MGMT_STATUS_SUCCESS, rp, rp_len);
8395
8396         kfree(rp);
8397
8398         return err;
8399 }
8400
8401 static u8 calculate_name_len(struct hci_dev *hdev)
8402 {
8403         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
8404
8405         return eir_append_local_name(hdev, buf, 0);
8406 }
8407
8408 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8409                            bool is_adv_data)
8410 {
8411         u8 max_len = max_adv_len(hdev);
8412
8413         if (is_adv_data) {
8414                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8415                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
8416                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
8417                         max_len -= 3;
8418
8419                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8420                         max_len -= 3;
8421         } else {
8422                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8423                         max_len -= calculate_name_len(hdev);
8424
8425                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8426                         max_len -= 4;
8427         }
8428
8429         return max_len;
8430 }
8431
8432 static bool flags_managed(u32 adv_flags)
8433 {
8434         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8435                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8436                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8437 }
8438
8439 static bool tx_power_managed(u32 adv_flags)
8440 {
8441         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8442 }
8443
8444 static bool name_managed(u32 adv_flags)
8445 {
8446         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8447 }
8448
8449 static bool appearance_managed(u32 adv_flags)
8450 {
8451         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8452 }
8453
8454 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8455                               u8 len, bool is_adv_data)
8456 {
8457         int i, cur_len;
8458         u8 max_len;
8459
8460         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8461
8462         if (len > max_len)
8463                 return false;
8464
8465         /* Make sure that the data is correctly formatted. */
8466         for (i = 0; i < len; i += (cur_len + 1)) {
8467                 cur_len = data[i];
8468
8469                 if (!cur_len)
8470                         continue;
8471
8472                 if (data[i + 1] == EIR_FLAGS &&
8473                     (!is_adv_data || flags_managed(adv_flags)))
8474                         return false;
8475
8476                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8477                         return false;
8478
8479                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8480                         return false;
8481
8482                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8483                         return false;
8484
8485                 if (data[i + 1] == EIR_APPEARANCE &&
8486                     appearance_managed(adv_flags))
8487                         return false;
8488
8489                 /* If the current field length would exceed the total data
8490                  * length, then it's invalid.
8491                  */
8492                 if (i + cur_len >= len)
8493                         return false;
8494         }
8495
8496         return true;
8497 }
8498
8499 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8500 {
8501         u32 supported_flags, phy_flags;
8502
8503         /* The current implementation only supports a subset of the specified
8504          * flags. Also need to check mutual exclusiveness of sec flags.
8505          */
8506         supported_flags = get_supported_adv_flags(hdev);
8507         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8508         if (adv_flags & ~supported_flags ||
8509             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8510                 return false;
8511
8512         return true;
8513 }
8514
8515 static bool adv_busy(struct hci_dev *hdev)
8516 {
8517         return pending_find(MGMT_OP_SET_LE, hdev);
8518 }
8519
8520 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8521                              int err)
8522 {
8523         struct adv_info *adv, *n;
8524
8525         bt_dev_dbg(hdev, "err %d", err);
8526
8527         hci_dev_lock(hdev);
8528
8529         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8530                 u8 instance;
8531
8532                 if (!adv->pending)
8533                         continue;
8534
8535                 if (!err) {
8536                         adv->pending = false;
8537                         continue;
8538                 }
8539
8540                 instance = adv->instance;
8541
8542                 if (hdev->cur_adv_instance == instance)
8543                         cancel_adv_timeout(hdev);
8544
8545                 hci_remove_adv_instance(hdev, instance);
8546                 mgmt_advertising_removed(sk, hdev, instance);
8547         }
8548
8549         hci_dev_unlock(hdev);
8550 }
8551
8552 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8553 {
8554         struct mgmt_pending_cmd *cmd = data;
8555         struct mgmt_cp_add_advertising *cp = cmd->param;
8556         struct mgmt_rp_add_advertising rp;
8557
8558         memset(&rp, 0, sizeof(rp));
8559
8560         rp.instance = cp->instance;
8561
8562         if (err)
8563                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8564                                 mgmt_status(err));
8565         else
8566                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8567                                   mgmt_status(err), &rp, sizeof(rp));
8568
8569         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8570
8571         mgmt_pending_free(cmd);
8572 }
8573
8574 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8575 {
8576         struct mgmt_pending_cmd *cmd = data;
8577         struct mgmt_cp_add_advertising *cp = cmd->param;
8578
8579         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8580 }
8581
8582 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8583                            void *data, u16 data_len)
8584 {
8585         struct mgmt_cp_add_advertising *cp = data;
8586         struct mgmt_rp_add_advertising rp;
8587         u32 flags;
8588         u8 status;
8589         u16 timeout, duration;
8590         unsigned int prev_instance_cnt;
8591         u8 schedule_instance = 0;
8592         struct adv_info *adv, *next_instance;
8593         int err;
8594         struct mgmt_pending_cmd *cmd;
8595
8596         bt_dev_dbg(hdev, "sock %p", sk);
8597
8598         status = mgmt_le_support(hdev);
8599         if (status)
8600                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8601                                        status);
8602
8603         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8604                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8605                                        MGMT_STATUS_INVALID_PARAMS);
8606
8607         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8608                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8609                                        MGMT_STATUS_INVALID_PARAMS);
8610
8611         flags = __le32_to_cpu(cp->flags);
8612         timeout = __le16_to_cpu(cp->timeout);
8613         duration = __le16_to_cpu(cp->duration);
8614
8615         if (!requested_adv_flags_are_valid(hdev, flags))
8616                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8617                                        MGMT_STATUS_INVALID_PARAMS);
8618
8619         hci_dev_lock(hdev);
8620
8621         if (timeout && !hdev_is_powered(hdev)) {
8622                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8623                                       MGMT_STATUS_REJECTED);
8624                 goto unlock;
8625         }
8626
8627         if (adv_busy(hdev)) {
8628                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8629                                       MGMT_STATUS_BUSY);
8630                 goto unlock;
8631         }
8632
8633         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8634             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8635                                cp->scan_rsp_len, false)) {
8636                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8637                                       MGMT_STATUS_INVALID_PARAMS);
8638                 goto unlock;
8639         }
8640
8641         prev_instance_cnt = hdev->adv_instance_cnt;
8642
8643         adv = hci_add_adv_instance(hdev, cp->instance, flags,
8644                                    cp->adv_data_len, cp->data,
8645                                    cp->scan_rsp_len,
8646                                    cp->data + cp->adv_data_len,
8647                                    timeout, duration,
8648                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8649                                    hdev->le_adv_min_interval,
8650                                    hdev->le_adv_max_interval, 0);
8651         if (IS_ERR(adv)) {
8652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8653                                       MGMT_STATUS_FAILED);
8654                 goto unlock;
8655         }
8656
8657         /* Only trigger an advertising added event if a new instance was
8658          * actually added.
8659          */
8660         if (hdev->adv_instance_cnt > prev_instance_cnt)
8661                 mgmt_advertising_added(sk, hdev, cp->instance);
8662
8663         if (hdev->cur_adv_instance == cp->instance) {
8664                 /* If the currently advertised instance is being changed then
8665                  * cancel the current advertising and schedule the next
8666                  * instance. If there is only one instance then the overridden
8667                  * advertising data will be visible right away.
8668                  */
8669                 cancel_adv_timeout(hdev);
8670
8671                 next_instance = hci_get_next_instance(hdev, cp->instance);
8672                 if (next_instance)
8673                         schedule_instance = next_instance->instance;
8674         } else if (!hdev->adv_instance_timeout) {
8675                 /* Immediately advertise the new instance if no other
8676                  * instance is currently being advertised.
8677                  */
8678                 schedule_instance = cp->instance;
8679         }
8680
8681         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8682          * there is no instance to be advertised then we have no HCI
8683          * communication to make. Simply return.
8684          */
8685         if (!hdev_is_powered(hdev) ||
8686             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8687             !schedule_instance) {
8688                 rp.instance = cp->instance;
8689                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8690                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8691                 goto unlock;
8692         }
8693
8694         /* We're good to go, update advertising data, parameters, and start
8695          * advertising.
8696          */
8697         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8698                                data_len);
8699         if (!cmd) {
8700                 err = -ENOMEM;
8701                 goto unlock;
8702         }
8703
8704         cp->instance = schedule_instance;
8705
8706         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8707                                  add_advertising_complete);
8708         if (err < 0)
8709                 mgmt_pending_free(cmd);
8710
8711 unlock:
8712         hci_dev_unlock(hdev);
8713
8714         return err;
8715 }
8716
8717 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8718                                         int err)
8719 {
8720         struct mgmt_pending_cmd *cmd = data;
8721         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8722         struct mgmt_rp_add_ext_adv_params rp;
8723         struct adv_info *adv;
8724         u32 flags;
8725
8726         BT_DBG("%s", hdev->name);
8727
8728         hci_dev_lock(hdev);
8729
8730         adv = hci_find_adv_instance(hdev, cp->instance);
8731         if (!adv)
8732                 goto unlock;
8733
8734         rp.instance = cp->instance;
8735         rp.tx_power = adv->tx_power;
8736
8737         /* While we're at it, inform userspace of the available space for this
8738          * advertisement, given the flags that will be used.
8739          */
8740         flags = __le32_to_cpu(cp->flags);
8741         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8742         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8743
8744         if (err) {
8745                 /* If this advertisement was previously advertising and we
8746                  * failed to update it, we signal that it has been removed and
8747                  * delete its structure
8748                  */
8749                 if (!adv->pending)
8750                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8751
8752                 hci_remove_adv_instance(hdev, cp->instance);
8753
8754                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8755                                 mgmt_status(err));
8756         } else {
8757                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8758                                   mgmt_status(err), &rp, sizeof(rp));
8759         }
8760
8761 unlock:
8762         if (cmd)
8763                 mgmt_pending_free(cmd);
8764
8765         hci_dev_unlock(hdev);
8766 }
8767
8768 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8769 {
8770         struct mgmt_pending_cmd *cmd = data;
8771         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8772
8773         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8774 }
8775
8776 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8777                               void *data, u16 data_len)
8778 {
8779         struct mgmt_cp_add_ext_adv_params *cp = data;
8780         struct mgmt_rp_add_ext_adv_params rp;
8781         struct mgmt_pending_cmd *cmd = NULL;
8782         struct adv_info *adv;
8783         u32 flags, min_interval, max_interval;
8784         u16 timeout, duration;
8785         u8 status;
8786         s8 tx_power;
8787         int err;
8788
8789         BT_DBG("%s", hdev->name);
8790
8791         status = mgmt_le_support(hdev);
8792         if (status)
8793                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8794                                        status);
8795
8796         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8797                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8798                                        MGMT_STATUS_INVALID_PARAMS);
8799
8800         /* The purpose of breaking add_advertising into two separate MGMT calls
8801          * for params and data is to allow more parameters to be added to this
8802          * structure in the future. For this reason, we verify that we have the
8803          * bare minimum structure we know of when the interface was defined. Any
8804          * extra parameters we don't know about will be ignored in this request.
8805          */
8806         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8808                                        MGMT_STATUS_INVALID_PARAMS);
8809
8810         flags = __le32_to_cpu(cp->flags);
8811
8812         if (!requested_adv_flags_are_valid(hdev, flags))
8813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8814                                        MGMT_STATUS_INVALID_PARAMS);
8815
8816         hci_dev_lock(hdev);
8817
8818         /* In new interface, we require that we are powered to register */
8819         if (!hdev_is_powered(hdev)) {
8820                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8821                                       MGMT_STATUS_REJECTED);
8822                 goto unlock;
8823         }
8824
8825         if (adv_busy(hdev)) {
8826                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8827                                       MGMT_STATUS_BUSY);
8828                 goto unlock;
8829         }
8830
8831         /* Parse defined parameters from request, use defaults otherwise */
8832         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8833                   __le16_to_cpu(cp->timeout) : 0;
8834
8835         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8836                    __le16_to_cpu(cp->duration) :
8837                    hdev->def_multi_adv_rotation_duration;
8838
8839         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8840                        __le32_to_cpu(cp->min_interval) :
8841                        hdev->le_adv_min_interval;
8842
8843         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8844                        __le32_to_cpu(cp->max_interval) :
8845                        hdev->le_adv_max_interval;
8846
8847         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8848                    cp->tx_power :
8849                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8850
8851         /* Create advertising instance with no advertising or response data */
8852         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8853                                    timeout, duration, tx_power, min_interval,
8854                                    max_interval, 0);
8855
8856         if (IS_ERR(adv)) {
8857                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8858                                       MGMT_STATUS_FAILED);
8859                 goto unlock;
8860         }
8861
8862         /* Submit request for advertising params if ext adv available */
8863         if (ext_adv_capable(hdev)) {
8864                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8865                                        data, data_len);
8866                 if (!cmd) {
8867                         err = -ENOMEM;
8868                         hci_remove_adv_instance(hdev, cp->instance);
8869                         goto unlock;
8870                 }
8871
8872                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8873                                          add_ext_adv_params_complete);
8874                 if (err < 0)
8875                         mgmt_pending_free(cmd);
8876         } else {
8877                 rp.instance = cp->instance;
8878                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8879                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8880                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8881                 err = mgmt_cmd_complete(sk, hdev->id,
8882                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8883                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8884         }
8885
8886 unlock:
8887         hci_dev_unlock(hdev);
8888
8889         return err;
8890 }
8891
8892 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8893 {
8894         struct mgmt_pending_cmd *cmd = data;
8895         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8896         struct mgmt_rp_add_advertising rp;
8897
8898         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8899
8900         memset(&rp, 0, sizeof(rp));
8901
8902         rp.instance = cp->instance;
8903
8904         if (err)
8905                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8906                                 mgmt_status(err));
8907         else
8908                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8909                                   mgmt_status(err), &rp, sizeof(rp));
8910
8911         mgmt_pending_free(cmd);
8912 }
8913
8914 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8915 {
8916         struct mgmt_pending_cmd *cmd = data;
8917         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8918         int err;
8919
8920         if (ext_adv_capable(hdev)) {
8921                 err = hci_update_adv_data_sync(hdev, cp->instance);
8922                 if (err)
8923                         return err;
8924
8925                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8926                 if (err)
8927                         return err;
8928
8929                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8930         }
8931
8932         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8933 }
8934
8935 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8936                             u16 data_len)
8937 {
8938         struct mgmt_cp_add_ext_adv_data *cp = data;
8939         struct mgmt_rp_add_ext_adv_data rp;
8940         u8 schedule_instance = 0;
8941         struct adv_info *next_instance;
8942         struct adv_info *adv_instance;
8943         int err = 0;
8944         struct mgmt_pending_cmd *cmd;
8945
8946         BT_DBG("%s", hdev->name);
8947
8948         hci_dev_lock(hdev);
8949
8950         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8951
8952         if (!adv_instance) {
8953                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8954                                       MGMT_STATUS_INVALID_PARAMS);
8955                 goto unlock;
8956         }
8957
8958         /* In new interface, we require that we are powered to register */
8959         if (!hdev_is_powered(hdev)) {
8960                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8961                                       MGMT_STATUS_REJECTED);
8962                 goto clear_new_instance;
8963         }
8964
8965         if (adv_busy(hdev)) {
8966                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8967                                       MGMT_STATUS_BUSY);
8968                 goto clear_new_instance;
8969         }
8970
8971         /* Validate new data */
8972         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8973                                cp->adv_data_len, true) ||
8974             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8975                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8976                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8977                                       MGMT_STATUS_INVALID_PARAMS);
8978                 goto clear_new_instance;
8979         }
8980
8981         /* Set the data in the advertising instance */
8982         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8983                                   cp->data, cp->scan_rsp_len,
8984                                   cp->data + cp->adv_data_len);
8985
8986         /* If using software rotation, determine next instance to use */
8987         if (hdev->cur_adv_instance == cp->instance) {
8988                 /* If the currently advertised instance is being changed
8989                  * then cancel the current advertising and schedule the
8990                  * next instance. If there is only one instance then the
8991                  * overridden advertising data will be visible right
8992                  * away
8993                  */
8994                 cancel_adv_timeout(hdev);
8995
8996                 next_instance = hci_get_next_instance(hdev, cp->instance);
8997                 if (next_instance)
8998                         schedule_instance = next_instance->instance;
8999         } else if (!hdev->adv_instance_timeout) {
9000                 /* Immediately advertise the new instance if no other
9001                  * instance is currently being advertised.
9002                  */
9003                 schedule_instance = cp->instance;
9004         }
9005
9006         /* If the HCI_ADVERTISING flag is set or there is no instance to
9007          * be advertised then we have no HCI communication to make.
9008          * Simply return.
9009          */
9010         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9011                 if (adv_instance->pending) {
9012                         mgmt_advertising_added(sk, hdev, cp->instance);
9013                         adv_instance->pending = false;
9014                 }
9015                 rp.instance = cp->instance;
9016                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9017                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9018                 goto unlock;
9019         }
9020
9021         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9022                                data_len);
9023         if (!cmd) {
9024                 err = -ENOMEM;
9025                 goto clear_new_instance;
9026         }
9027
9028         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9029                                  add_ext_adv_data_complete);
9030         if (err < 0) {
9031                 mgmt_pending_free(cmd);
9032                 goto clear_new_instance;
9033         }
9034
9035         /* We were successful in updating data, so trigger advertising_added
9036          * event if this is an instance that wasn't previously advertising. If
9037          * a failure occurs in the requests we initiated, we will remove the
9038          * instance again in add_advertising_complete
9039          */
9040         if (adv_instance->pending)
9041                 mgmt_advertising_added(sk, hdev, cp->instance);
9042
9043         goto unlock;
9044
9045 clear_new_instance:
9046         hci_remove_adv_instance(hdev, cp->instance);
9047
9048 unlock:
9049         hci_dev_unlock(hdev);
9050
9051         return err;
9052 }
9053
9054 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9055                                         int err)
9056 {
9057         struct mgmt_pending_cmd *cmd = data;
9058         struct mgmt_cp_remove_advertising *cp = cmd->param;
9059         struct mgmt_rp_remove_advertising rp;
9060
9061         bt_dev_dbg(hdev, "err %d", err);
9062
9063         memset(&rp, 0, sizeof(rp));
9064         rp.instance = cp->instance;
9065
9066         if (err)
9067                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9068                                 mgmt_status(err));
9069         else
9070                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9071                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9072
9073         mgmt_pending_free(cmd);
9074 }
9075
9076 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9077 {
9078         struct mgmt_pending_cmd *cmd = data;
9079         struct mgmt_cp_remove_advertising *cp = cmd->param;
9080         int err;
9081
9082         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9083         if (err)
9084                 return err;
9085
9086         if (list_empty(&hdev->adv_instances))
9087                 err = hci_disable_advertising_sync(hdev);
9088
9089         return err;
9090 }
9091
9092 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9093                               void *data, u16 data_len)
9094 {
9095         struct mgmt_cp_remove_advertising *cp = data;
9096         struct mgmt_pending_cmd *cmd;
9097         int err;
9098
9099         bt_dev_dbg(hdev, "sock %p", sk);
9100
9101         hci_dev_lock(hdev);
9102
9103         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9104                 err = mgmt_cmd_status(sk, hdev->id,
9105                                       MGMT_OP_REMOVE_ADVERTISING,
9106                                       MGMT_STATUS_INVALID_PARAMS);
9107                 goto unlock;
9108         }
9109
9110         if (pending_find(MGMT_OP_SET_LE, hdev)) {
9111                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9112                                       MGMT_STATUS_BUSY);
9113                 goto unlock;
9114         }
9115
9116         if (list_empty(&hdev->adv_instances)) {
9117                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9118                                       MGMT_STATUS_INVALID_PARAMS);
9119                 goto unlock;
9120         }
9121
9122         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9123                                data_len);
9124         if (!cmd) {
9125                 err = -ENOMEM;
9126                 goto unlock;
9127         }
9128
9129         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9130                                  remove_advertising_complete);
9131         if (err < 0)
9132                 mgmt_pending_free(cmd);
9133
9134 unlock:
9135         hci_dev_unlock(hdev);
9136
9137         return err;
9138 }
9139
9140 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9141                              void *data, u16 data_len)
9142 {
9143         struct mgmt_cp_get_adv_size_info *cp = data;
9144         struct mgmt_rp_get_adv_size_info rp;
9145         u32 flags, supported_flags;
9146
9147         bt_dev_dbg(hdev, "sock %p", sk);
9148
9149         if (!lmp_le_capable(hdev))
9150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9151                                        MGMT_STATUS_REJECTED);
9152
9153         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9154                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9155                                        MGMT_STATUS_INVALID_PARAMS);
9156
9157         flags = __le32_to_cpu(cp->flags);
9158
9159         /* The current implementation only supports a subset of the specified
9160          * flags.
9161          */
9162         supported_flags = get_supported_adv_flags(hdev);
9163         if (flags & ~supported_flags)
9164                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9165                                        MGMT_STATUS_INVALID_PARAMS);
9166
9167         rp.instance = cp->instance;
9168         rp.flags = cp->flags;
9169         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9170         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9171
9172         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9173                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9174 }
9175
9176 static const struct hci_mgmt_handler mgmt_handlers[] = {
9177         { NULL }, /* 0x0000 (no command) */
9178         { read_version,            MGMT_READ_VERSION_SIZE,
9179                                                 HCI_MGMT_NO_HDEV |
9180                                                 HCI_MGMT_UNTRUSTED },
9181         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9182                                                 HCI_MGMT_NO_HDEV |
9183                                                 HCI_MGMT_UNTRUSTED },
9184         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9185                                                 HCI_MGMT_NO_HDEV |
9186                                                 HCI_MGMT_UNTRUSTED },
9187         { read_controller_info,    MGMT_READ_INFO_SIZE,
9188                                                 HCI_MGMT_UNTRUSTED },
9189         { set_powered,             MGMT_SETTING_SIZE },
9190         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9191         { set_connectable,         MGMT_SETTING_SIZE },
9192         { set_fast_connectable,    MGMT_SETTING_SIZE },
9193         { set_bondable,            MGMT_SETTING_SIZE },
9194         { set_link_security,       MGMT_SETTING_SIZE },
9195         { set_ssp,                 MGMT_SETTING_SIZE },
9196         { set_hs,                  MGMT_SETTING_SIZE },
9197         { set_le,                  MGMT_SETTING_SIZE },
9198         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9199         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9200         { add_uuid,                MGMT_ADD_UUID_SIZE },
9201         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9202         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9203                                                 HCI_MGMT_VAR_LEN },
9204         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9205                                                 HCI_MGMT_VAR_LEN },
9206         { disconnect,              MGMT_DISCONNECT_SIZE },
9207         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9208         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9209         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9210         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9211         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9212         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9213         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9214         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9215         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9216         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9217         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9218         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9219         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9220                                                 HCI_MGMT_VAR_LEN },
9221         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9222         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9223         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9224         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9225         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9226         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9227         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9228         { set_advertising,         MGMT_SETTING_SIZE },
9229         { set_bredr,               MGMT_SETTING_SIZE },
9230         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9231         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9232         { set_secure_conn,         MGMT_SETTING_SIZE },
9233         { set_debug_keys,          MGMT_SETTING_SIZE },
9234         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9235         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9236                                                 HCI_MGMT_VAR_LEN },
9237         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9238         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9239         { add_device,              MGMT_ADD_DEVICE_SIZE },
9240         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9241         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9242                                                 HCI_MGMT_VAR_LEN },
9243         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9244                                                 HCI_MGMT_NO_HDEV |
9245                                                 HCI_MGMT_UNTRUSTED },
9246         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9247                                                 HCI_MGMT_UNCONFIGURED |
9248                                                 HCI_MGMT_UNTRUSTED },
9249         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9250                                                 HCI_MGMT_UNCONFIGURED },
9251         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9252                                                 HCI_MGMT_UNCONFIGURED },
9253         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9254                                                 HCI_MGMT_VAR_LEN },
9255         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9256         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9257                                                 HCI_MGMT_NO_HDEV |
9258                                                 HCI_MGMT_UNTRUSTED },
9259         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9260         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9261                                                 HCI_MGMT_VAR_LEN },
9262         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9263         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9264         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9265         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9266                                                 HCI_MGMT_UNTRUSTED },
9267         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9268         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9269         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9270         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9271                                                 HCI_MGMT_VAR_LEN },
9272         { set_wideband_speech,     MGMT_SETTING_SIZE },
9273         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
9274                                                 HCI_MGMT_UNTRUSTED },
9275         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9276                                                 HCI_MGMT_UNTRUSTED |
9277                                                 HCI_MGMT_HDEV_OPTIONAL },
9278         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9279                                                 HCI_MGMT_VAR_LEN |
9280                                                 HCI_MGMT_HDEV_OPTIONAL },
9281         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9282                                                 HCI_MGMT_UNTRUSTED },
9283         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9284                                                 HCI_MGMT_VAR_LEN },
9285         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9286                                                 HCI_MGMT_UNTRUSTED },
9287         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9288                                                 HCI_MGMT_VAR_LEN },
9289         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9290         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9291         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9292         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9293                                                 HCI_MGMT_VAR_LEN },
9294         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9295         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9296                                                 HCI_MGMT_VAR_LEN },
9297         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
9298                                                 HCI_MGMT_VAR_LEN },
9299         { add_adv_patterns_monitor_rssi,
9300                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9301                                                 HCI_MGMT_VAR_LEN },
9302         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
9303                                                 HCI_MGMT_VAR_LEN },
9304         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
9305         { mesh_send,               MGMT_MESH_SEND_SIZE,
9306                                                 HCI_MGMT_VAR_LEN },
9307         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
9308 };
9309
9310 void mgmt_index_added(struct hci_dev *hdev)
9311 {
9312         struct mgmt_ev_ext_index ev;
9313
9314         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9315                 return;
9316
9317         switch (hdev->dev_type) {
9318         case HCI_PRIMARY:
9319                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9320                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9321                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9322                         ev.type = 0x01;
9323                 } else {
9324                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9325                                          HCI_MGMT_INDEX_EVENTS);
9326                         ev.type = 0x00;
9327                 }
9328                 break;
9329         case HCI_AMP:
9330                 ev.type = 0x02;
9331                 break;
9332         default:
9333                 return;
9334         }
9335
9336         ev.bus = hdev->bus;
9337
9338         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9339                          HCI_MGMT_EXT_INDEX_EVENTS);
9340 }
9341
9342 void mgmt_index_removed(struct hci_dev *hdev)
9343 {
9344         struct mgmt_ev_ext_index ev;
9345         u8 status = MGMT_STATUS_INVALID_INDEX;
9346
9347         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9348                 return;
9349
9350         switch (hdev->dev_type) {
9351         case HCI_PRIMARY:
9352                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9353
9354                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9355                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9356                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9357                         ev.type = 0x01;
9358                 } else {
9359                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9360                                          HCI_MGMT_INDEX_EVENTS);
9361                         ev.type = 0x00;
9362                 }
9363                 break;
9364         case HCI_AMP:
9365                 ev.type = 0x02;
9366                 break;
9367         default:
9368                 return;
9369         }
9370
9371         ev.bus = hdev->bus;
9372
9373         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9374                          HCI_MGMT_EXT_INDEX_EVENTS);
9375
9376         /* Cancel any remaining timed work */
9377         if (!hci_dev_test_flag(hdev, HCI_MGMT))
9378                 return;
9379         cancel_delayed_work_sync(&hdev->discov_off);
9380         cancel_delayed_work_sync(&hdev->service_cache);
9381         cancel_delayed_work_sync(&hdev->rpa_expired);
9382 }
9383
9384 void mgmt_power_on(struct hci_dev *hdev, int err)
9385 {
9386         struct cmd_lookup match = { NULL, hdev };
9387
9388         bt_dev_dbg(hdev, "err %d", err);
9389
9390         hci_dev_lock(hdev);
9391
9392         if (!err) {
9393                 restart_le_actions(hdev);
9394                 hci_update_passive_scan(hdev);
9395         }
9396
9397         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9398
9399         new_settings(hdev, match.sk);
9400
9401         if (match.sk)
9402                 sock_put(match.sk);
9403
9404         hci_dev_unlock(hdev);
9405 }
9406
9407 void __mgmt_power_off(struct hci_dev *hdev)
9408 {
9409         struct cmd_lookup match = { NULL, hdev };
9410         u8 status, zero_cod[] = { 0, 0, 0 };
9411
9412         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9413
9414         /* If the power off is because of hdev unregistration let
9415          * use the appropriate INVALID_INDEX status. Otherwise use
9416          * NOT_POWERED. We cover both scenarios here since later in
9417          * mgmt_index_removed() any hci_conn callbacks will have already
9418          * been triggered, potentially causing misleading DISCONNECTED
9419          * status responses.
9420          */
9421         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9422                 status = MGMT_STATUS_INVALID_INDEX;
9423         else
9424                 status = MGMT_STATUS_NOT_POWERED;
9425
9426         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9427
9428         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9429                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9430                                    zero_cod, sizeof(zero_cod),
9431                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9432                 ext_info_changed(hdev, NULL);
9433         }
9434
9435         new_settings(hdev, match.sk);
9436
9437         if (match.sk)
9438                 sock_put(match.sk);
9439 }
9440
9441 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9442 {
9443         struct mgmt_pending_cmd *cmd;
9444         u8 status;
9445
9446         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9447         if (!cmd)
9448                 return;
9449
9450         if (err == -ERFKILL)
9451                 status = MGMT_STATUS_RFKILLED;
9452         else
9453                 status = MGMT_STATUS_FAILED;
9454
9455         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9456
9457         mgmt_pending_remove(cmd);
9458 }
9459
9460 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9461                        bool persistent)
9462 {
9463         struct mgmt_ev_new_link_key ev;
9464
9465         memset(&ev, 0, sizeof(ev));
9466
9467         ev.store_hint = persistent;
9468         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9469         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
9470         ev.key.type = key->type;
9471         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9472         ev.key.pin_len = key->pin_len;
9473
9474         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9475 }
9476
9477 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9478 {
9479         switch (ltk->type) {
9480         case SMP_LTK:
9481         case SMP_LTK_RESPONDER:
9482                 if (ltk->authenticated)
9483                         return MGMT_LTK_AUTHENTICATED;
9484                 return MGMT_LTK_UNAUTHENTICATED;
9485         case SMP_LTK_P256:
9486                 if (ltk->authenticated)
9487                         return MGMT_LTK_P256_AUTH;
9488                 return MGMT_LTK_P256_UNAUTH;
9489         case SMP_LTK_P256_DEBUG:
9490                 return MGMT_LTK_P256_DEBUG;
9491         }
9492
9493         return MGMT_LTK_UNAUTHENTICATED;
9494 }
9495
9496 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9497 {
9498         struct mgmt_ev_new_long_term_key ev;
9499
9500         memset(&ev, 0, sizeof(ev));
9501
9502         /* Devices using resolvable or non-resolvable random addresses
9503          * without providing an identity resolving key don't require
9504          * to store long term keys. Their addresses will change the
9505          * next time around.
9506          *
9507          * Only when a remote device provides an identity address
9508          * make sure the long term key is stored. If the remote
9509          * identity is known, the long term keys are internally
9510          * mapped to the identity address. So allow static random
9511          * and public addresses here.
9512          */
9513         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9514             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9515                 ev.store_hint = 0x00;
9516         else
9517                 ev.store_hint = persistent;
9518
9519         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9520         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
9521         ev.key.type = mgmt_ltk_type(key);
9522         ev.key.enc_size = key->enc_size;
9523         ev.key.ediv = key->ediv;
9524         ev.key.rand = key->rand;
9525
9526         if (key->type == SMP_LTK)
9527                 ev.key.initiator = 1;
9528
9529         /* Make sure we copy only the significant bytes based on the
9530          * encryption key size, and set the rest of the value to zeroes.
9531          */
9532         memcpy(ev.key.val, key->val, key->enc_size);
9533         memset(ev.key.val + key->enc_size, 0,
9534                sizeof(ev.key.val) - key->enc_size);
9535
9536         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9537 }
9538
9539 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9540 {
9541         struct mgmt_ev_new_irk ev;
9542
9543         memset(&ev, 0, sizeof(ev));
9544
9545         ev.store_hint = persistent;
9546
9547         bacpy(&ev.rpa, &irk->rpa);
9548         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9549         ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
9550         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9551
9552         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9553 }
9554
9555 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9556                    bool persistent)
9557 {
9558         struct mgmt_ev_new_csrk ev;
9559
9560         memset(&ev, 0, sizeof(ev));
9561
9562         /* Devices using resolvable or non-resolvable random addresses
9563          * without providing an identity resolving key don't require
9564          * to store signature resolving keys. Their addresses will change
9565          * the next time around.
9566          *
9567          * Only when a remote device provides an identity address
9568          * make sure the signature resolving key is stored. So allow
9569          * static random and public addresses here.
9570          */
9571         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9572             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9573                 ev.store_hint = 0x00;
9574         else
9575                 ev.store_hint = persistent;
9576
9577         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9578         ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
9579         ev.key.type = csrk->type;
9580         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9581
9582         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9583 }
9584
9585 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9586                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9587                          u16 max_interval, u16 latency, u16 timeout)
9588 {
9589         struct mgmt_ev_new_conn_param ev;
9590
9591         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9592                 return;
9593
9594         memset(&ev, 0, sizeof(ev));
9595         bacpy(&ev.addr.bdaddr, bdaddr);
9596         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9597         ev.store_hint = store_hint;
9598         ev.min_interval = cpu_to_le16(min_interval);
9599         ev.max_interval = cpu_to_le16(max_interval);
9600         ev.latency = cpu_to_le16(latency);
9601         ev.timeout = cpu_to_le16(timeout);
9602
9603         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9604 }
9605
9606 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9607                            u8 *name, u8 name_len)
9608 {
9609         struct sk_buff *skb;
9610         struct mgmt_ev_device_connected *ev;
9611         u16 eir_len = 0;
9612         u32 flags = 0;
9613
9614         if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
9615                 return;
9616
9617         /* allocate buff for LE or BR/EDR adv */
9618         if (conn->le_adv_data_len > 0)
9619                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9620                                      sizeof(*ev) + conn->le_adv_data_len);
9621         else
9622                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9623                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9624                                      eir_precalc_len(sizeof(conn->dev_class)));
9625
9626         ev = skb_put(skb, sizeof(*ev));
9627         bacpy(&ev->addr.bdaddr, &conn->dst);
9628         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9629
9630         if (conn->out)
9631                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9632
9633         ev->flags = __cpu_to_le32(flags);
9634
9635         /* We must ensure that the EIR Data fields are ordered and
9636          * unique. Keep it simple for now and avoid the problem by not
9637          * adding any BR/EDR data to the LE adv.
9638          */
9639         if (conn->le_adv_data_len > 0) {
9640                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9641                 eir_len = conn->le_adv_data_len;
9642         } else {
9643                 if (name)
9644                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9645
9646                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9647                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9648                                                     conn->dev_class, sizeof(conn->dev_class));
9649         }
9650
9651         ev->eir_len = cpu_to_le16(eir_len);
9652
9653         mgmt_event_skb(skb, NULL);
9654 }
9655
9656 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9657 {
9658         struct sock **sk = data;
9659
9660         cmd->cmd_complete(cmd, 0);
9661
9662         *sk = cmd->sk;
9663         sock_hold(*sk);
9664
9665         mgmt_pending_remove(cmd);
9666 }
9667
9668 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9669 {
9670         struct hci_dev *hdev = data;
9671         struct mgmt_cp_unpair_device *cp = cmd->param;
9672
9673         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9674
9675         cmd->cmd_complete(cmd, 0);
9676         mgmt_pending_remove(cmd);
9677 }
9678
9679 bool mgmt_powering_down(struct hci_dev *hdev)
9680 {
9681         struct mgmt_pending_cmd *cmd;
9682         struct mgmt_mode *cp;
9683
9684         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9685         if (!cmd)
9686                 return false;
9687
9688         cp = cmd->param;
9689         if (!cp->val)
9690                 return true;
9691
9692         return false;
9693 }
9694
9695 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9696                               u8 link_type, u8 addr_type, u8 reason,
9697                               bool mgmt_connected)
9698 {
9699         struct mgmt_ev_device_disconnected ev;
9700         struct sock *sk = NULL;
9701
9702         if (!mgmt_connected)
9703                 return;
9704
9705         if (link_type != ACL_LINK && link_type != LE_LINK)
9706                 return;
9707
9708         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9709
9710         bacpy(&ev.addr.bdaddr, bdaddr);
9711         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9712         ev.reason = reason;
9713
9714         /* Report disconnects due to suspend */
9715         if (hdev->suspended)
9716                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9717
9718         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9719
9720         if (sk)
9721                 sock_put(sk);
9722
9723         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9724                              hdev);
9725 }
9726
9727 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9728                             u8 link_type, u8 addr_type, u8 status)
9729 {
9730         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9731         struct mgmt_cp_disconnect *cp;
9732         struct mgmt_pending_cmd *cmd;
9733
9734         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9735                              hdev);
9736
9737         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9738         if (!cmd)
9739                 return;
9740
9741         cp = cmd->param;
9742
9743         if (bacmp(bdaddr, &cp->addr.bdaddr))
9744                 return;
9745
9746         if (cp->addr.type != bdaddr_type)
9747                 return;
9748
9749         cmd->cmd_complete(cmd, mgmt_status(status));
9750         mgmt_pending_remove(cmd);
9751 }
9752
9753 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9754                          u8 addr_type, u8 status)
9755 {
9756         struct mgmt_ev_connect_failed ev;
9757
9758         bacpy(&ev.addr.bdaddr, bdaddr);
9759         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9760         ev.status = mgmt_status(status);
9761
9762         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9763 }
9764
9765 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9766 {
9767         struct mgmt_ev_pin_code_request ev;
9768
9769         bacpy(&ev.addr.bdaddr, bdaddr);
9770         ev.addr.type = BDADDR_BREDR;
9771         ev.secure = secure;
9772
9773         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9774 }
9775
9776 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9777                                   u8 status)
9778 {
9779         struct mgmt_pending_cmd *cmd;
9780
9781         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9782         if (!cmd)
9783                 return;
9784
9785         cmd->cmd_complete(cmd, mgmt_status(status));
9786         mgmt_pending_remove(cmd);
9787 }
9788
9789 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9790                                       u8 status)
9791 {
9792         struct mgmt_pending_cmd *cmd;
9793
9794         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9795         if (!cmd)
9796                 return;
9797
9798         cmd->cmd_complete(cmd, mgmt_status(status));
9799         mgmt_pending_remove(cmd);
9800 }
9801
9802 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9803                               u8 link_type, u8 addr_type, u32 value,
9804                               u8 confirm_hint)
9805 {
9806         struct mgmt_ev_user_confirm_request ev;
9807
9808         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9809
9810         bacpy(&ev.addr.bdaddr, bdaddr);
9811         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9812         ev.confirm_hint = confirm_hint;
9813         ev.value = cpu_to_le32(value);
9814
9815         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9816                           NULL);
9817 }
9818
9819 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9820                               u8 link_type, u8 addr_type)
9821 {
9822         struct mgmt_ev_user_passkey_request ev;
9823
9824         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9825
9826         bacpy(&ev.addr.bdaddr, bdaddr);
9827         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9828
9829         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9830                           NULL);
9831 }
9832
9833 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9834                                       u8 link_type, u8 addr_type, u8 status,
9835                                       u8 opcode)
9836 {
9837         struct mgmt_pending_cmd *cmd;
9838
9839         cmd = pending_find(opcode, hdev);
9840         if (!cmd)
9841                 return -ENOENT;
9842
9843         cmd->cmd_complete(cmd, mgmt_status(status));
9844         mgmt_pending_remove(cmd);
9845
9846         return 0;
9847 }
9848
9849 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9850                                      u8 link_type, u8 addr_type, u8 status)
9851 {
9852         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9853                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9854 }
9855
9856 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9857                                          u8 link_type, u8 addr_type, u8 status)
9858 {
9859         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9860                                           status,
9861                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9862 }
9863
9864 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9865                                      u8 link_type, u8 addr_type, u8 status)
9866 {
9867         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9868                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9869 }
9870
9871 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9872                                          u8 link_type, u8 addr_type, u8 status)
9873 {
9874         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9875                                           status,
9876                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9877 }
9878
9879 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9880                              u8 link_type, u8 addr_type, u32 passkey,
9881                              u8 entered)
9882 {
9883         struct mgmt_ev_passkey_notify ev;
9884
9885         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9886
9887         bacpy(&ev.addr.bdaddr, bdaddr);
9888         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9889         ev.passkey = __cpu_to_le32(passkey);
9890         ev.entered = entered;
9891
9892         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9893 }
9894
9895 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9896 {
9897         struct mgmt_ev_auth_failed ev;
9898         struct mgmt_pending_cmd *cmd;
9899         u8 status = mgmt_status(hci_status);
9900
9901         bacpy(&ev.addr.bdaddr, &conn->dst);
9902         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9903         ev.status = status;
9904
9905         cmd = find_pairing(conn);
9906
9907         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9908                     cmd ? cmd->sk : NULL);
9909
9910         if (cmd) {
9911                 cmd->cmd_complete(cmd, status);
9912                 mgmt_pending_remove(cmd);
9913         }
9914 }
9915
9916 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9917 {
9918         struct cmd_lookup match = { NULL, hdev };
9919         bool changed;
9920
9921         if (status) {
9922                 u8 mgmt_err = mgmt_status(status);
9923                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9924                                      cmd_status_rsp, &mgmt_err);
9925                 return;
9926         }
9927
9928         if (test_bit(HCI_AUTH, &hdev->flags))
9929                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9930         else
9931                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9932
9933         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9934                              &match);
9935
9936         if (changed)
9937                 new_settings(hdev, match.sk);
9938
9939         if (match.sk)
9940                 sock_put(match.sk);
9941 }
9942
9943 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9944 {
9945         struct cmd_lookup *match = data;
9946
9947         if (match->sk == NULL) {
9948                 match->sk = cmd->sk;
9949                 sock_hold(match->sk);
9950         }
9951 }
9952
9953 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9954                                     u8 status)
9955 {
9956         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9957
9958         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9959         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9960         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9961
9962         if (!status) {
9963                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9964                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9965                 ext_info_changed(hdev, NULL);
9966         }
9967
9968         if (match.sk)
9969                 sock_put(match.sk);
9970 }
9971
9972 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9973 {
9974         struct mgmt_cp_set_local_name ev;
9975         struct mgmt_pending_cmd *cmd;
9976
9977         if (status)
9978                 return;
9979
9980         memset(&ev, 0, sizeof(ev));
9981         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9982         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9983
9984         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9985         if (!cmd) {
9986                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9987
9988                 /* If this is a HCI command related to powering on the
9989                  * HCI dev don't send any mgmt signals.
9990                  */
9991                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9992                         return;
9993         }
9994
9995         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9996                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9997         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9998 }
9999
10000 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10001 {
10002         int i;
10003
10004         for (i = 0; i < uuid_count; i++) {
10005                 if (!memcmp(uuid, uuids[i], 16))
10006                         return true;
10007         }
10008
10009         return false;
10010 }
10011
10012 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10013 {
10014         u16 parsed = 0;
10015
10016         while (parsed < eir_len) {
10017                 u8 field_len = eir[0];
10018                 u8 uuid[16];
10019                 int i;
10020
10021                 if (field_len == 0)
10022                         break;
10023
10024                 if (eir_len - parsed < field_len + 1)
10025                         break;
10026
10027                 switch (eir[1]) {
10028                 case EIR_UUID16_ALL:
10029                 case EIR_UUID16_SOME:
10030                         for (i = 0; i + 3 <= field_len; i += 2) {
10031                                 memcpy(uuid, bluetooth_base_uuid, 16);
10032                                 uuid[13] = eir[i + 3];
10033                                 uuid[12] = eir[i + 2];
10034                                 if (has_uuid(uuid, uuid_count, uuids))
10035                                         return true;
10036                         }
10037                         break;
10038                 case EIR_UUID32_ALL:
10039                 case EIR_UUID32_SOME:
10040                         for (i = 0; i + 5 <= field_len; i += 4) {
10041                                 memcpy(uuid, bluetooth_base_uuid, 16);
10042                                 uuid[15] = eir[i + 5];
10043                                 uuid[14] = eir[i + 4];
10044                                 uuid[13] = eir[i + 3];
10045                                 uuid[12] = eir[i + 2];
10046                                 if (has_uuid(uuid, uuid_count, uuids))
10047                                         return true;
10048                         }
10049                         break;
10050                 case EIR_UUID128_ALL:
10051                 case EIR_UUID128_SOME:
10052                         for (i = 0; i + 17 <= field_len; i += 16) {
10053                                 memcpy(uuid, eir + i + 2, 16);
10054                                 if (has_uuid(uuid, uuid_count, uuids))
10055                                         return true;
10056                         }
10057                         break;
10058                 }
10059
10060                 parsed += field_len + 1;
10061                 eir += field_len + 1;
10062         }
10063
10064         return false;
10065 }
10066
10067 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10068                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10069 {
10070         /* If a RSSI threshold has been specified, and
10071          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10072          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10073          * is set, let it through for further processing, as we might need to
10074          * restart the scan.
10075          *
10076          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10077          * the results are also dropped.
10078          */
10079         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10080             (rssi == HCI_RSSI_INVALID ||
10081             (rssi < hdev->discovery.rssi &&
10082              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10083                 return  false;
10084
10085         if (hdev->discovery.uuid_count != 0) {
10086                 /* If a list of UUIDs is provided in filter, results with no
10087                  * matching UUID should be dropped.
10088                  */
10089                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10090                                    hdev->discovery.uuids) &&
10091                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10092                                    hdev->discovery.uuid_count,
10093                                    hdev->discovery.uuids))
10094                         return false;
10095         }
10096
10097         /* If duplicate filtering does not report RSSI changes, then restart
10098          * scanning to ensure updated result with updated RSSI values.
10099          */
10100         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10101                 /* Validate RSSI value against the RSSI threshold once more. */
10102                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10103                     rssi < hdev->discovery.rssi)
10104                         return false;
10105         }
10106
10107         return true;
10108 }
10109
10110 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10111                                   bdaddr_t *bdaddr, u8 addr_type)
10112 {
10113         struct mgmt_ev_adv_monitor_device_lost ev;
10114
10115         ev.monitor_handle = cpu_to_le16(handle);
10116         bacpy(&ev.addr.bdaddr, bdaddr);
10117         ev.addr.type = addr_type;
10118
10119         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10120                    NULL);
10121 }
10122
10123 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10124                                                struct sk_buff *skb,
10125                                                struct sock *skip_sk,
10126                                                u16 handle)
10127 {
10128         struct sk_buff *advmon_skb;
10129         size_t advmon_skb_len;
10130         __le16 *monitor_handle;
10131
10132         if (!skb)
10133                 return;
10134
10135         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10136                           sizeof(struct mgmt_ev_device_found)) + skb->len;
10137         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10138                                     advmon_skb_len);
10139         if (!advmon_skb)
10140                 return;
10141
10142         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10143          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10144          * store monitor_handle of the matched monitor.
10145          */
10146         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10147         *monitor_handle = cpu_to_le16(handle);
10148         skb_put_data(advmon_skb, skb->data, skb->len);
10149
10150         mgmt_event_skb(advmon_skb, skip_sk);
10151 }
10152
10153 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10154                                           bdaddr_t *bdaddr, bool report_device,
10155                                           struct sk_buff *skb,
10156                                           struct sock *skip_sk)
10157 {
10158         struct monitored_device *dev, *tmp;
10159         bool matched = false;
10160         bool notified = false;
10161
10162         /* We have received the Advertisement Report because:
10163          * 1. the kernel has initiated active discovery
10164          * 2. if not, we have pend_le_reports > 0 in which case we are doing
10165          *    passive scanning
10166          * 3. if none of the above is true, we have one or more active
10167          *    Advertisement Monitor
10168          *
10169          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10170          * and report ONLY one advertisement per device for the matched Monitor
10171          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10172          *
10173          * For case 3, since we are not active scanning and all advertisements
10174          * received are due to a matched Advertisement Monitor, report all
10175          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10176          */
10177         if (report_device && !hdev->advmon_pend_notify) {
10178                 mgmt_event_skb(skb, skip_sk);
10179                 return;
10180         }
10181
10182         hdev->advmon_pend_notify = false;
10183
10184         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10185                 if (!bacmp(&dev->bdaddr, bdaddr)) {
10186                         matched = true;
10187
10188                         if (!dev->notified) {
10189                                 mgmt_send_adv_monitor_device_found(hdev, skb,
10190                                                                    skip_sk,
10191                                                                    dev->handle);
10192                                 notified = true;
10193                                 dev->notified = true;
10194                         }
10195                 }
10196
10197                 if (!dev->notified)
10198                         hdev->advmon_pend_notify = true;
10199         }
10200
10201         if (!report_device &&
10202             ((matched && !notified) || !msft_monitor_supported(hdev))) {
10203                 /* Handle 0 indicates that we are not active scanning and this
10204                  * is a subsequent advertisement report for an already matched
10205                  * Advertisement Monitor or the controller offloading support
10206                  * is not available.
10207                  */
10208                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10209         }
10210
10211         if (report_device)
10212                 mgmt_event_skb(skb, skip_sk);
10213         else
10214                 kfree_skb(skb);
10215 }
10216
10217 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10218                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10219                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10220                               u64 instant)
10221 {
10222         struct sk_buff *skb;
10223         struct mgmt_ev_mesh_device_found *ev;
10224         int i, j;
10225
10226         if (!hdev->mesh_ad_types[0])
10227                 goto accepted;
10228
10229         /* Scan for requested AD types */
10230         if (eir_len > 0) {
10231                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10232                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10233                                 if (!hdev->mesh_ad_types[j])
10234                                         break;
10235
10236                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
10237                                         goto accepted;
10238                         }
10239                 }
10240         }
10241
10242         if (scan_rsp_len > 0) {
10243                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10244                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10245                                 if (!hdev->mesh_ad_types[j])
10246                                         break;
10247
10248                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10249                                         goto accepted;
10250                         }
10251                 }
10252         }
10253
10254         return;
10255
10256 accepted:
10257         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10258                              sizeof(*ev) + eir_len + scan_rsp_len);
10259         if (!skb)
10260                 return;
10261
10262         ev = skb_put(skb, sizeof(*ev));
10263
10264         bacpy(&ev->addr.bdaddr, bdaddr);
10265         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10266         ev->rssi = rssi;
10267         ev->flags = cpu_to_le32(flags);
10268         ev->instant = cpu_to_le64(instant);
10269
10270         if (eir_len > 0)
10271                 /* Copy EIR or advertising data into event */
10272                 skb_put_data(skb, eir, eir_len);
10273
10274         if (scan_rsp_len > 0)
10275                 /* Append scan response data to event */
10276                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10277
10278         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10279
10280         mgmt_event_skb(skb, NULL);
10281 }
10282
10283 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10284                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10285                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10286                        u64 instant)
10287 {
10288         struct sk_buff *skb;
10289         struct mgmt_ev_device_found *ev;
10290         bool report_device = hci_discovery_active(hdev);
10291
10292         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10293                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10294                                   eir, eir_len, scan_rsp, scan_rsp_len,
10295                                   instant);
10296
10297         /* Don't send events for a non-kernel initiated discovery. With
10298          * LE one exception is if we have pend_le_reports > 0 in which
10299          * case we're doing passive scanning and want these events.
10300          */
10301         if (!hci_discovery_active(hdev)) {
10302                 if (link_type == ACL_LINK)
10303                         return;
10304                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10305                         report_device = true;
10306                 else if (!hci_is_adv_monitoring(hdev))
10307                         return;
10308         }
10309
10310         if (hdev->discovery.result_filtering) {
10311                 /* We are using service discovery */
10312                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10313                                      scan_rsp_len))
10314                         return;
10315         }
10316
10317         if (hdev->discovery.limited) {
10318                 /* Check for limited discoverable bit */
10319                 if (dev_class) {
10320                         if (!(dev_class[1] & 0x20))
10321                                 return;
10322                 } else {
10323                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10324                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10325                                 return;
10326                 }
10327         }
10328
10329         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10330         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10331                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
10332         if (!skb)
10333                 return;
10334
10335         ev = skb_put(skb, sizeof(*ev));
10336
10337         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10338          * RSSI value was reported as 0 when not available. This behavior
10339          * is kept when using device discovery. This is required for full
10340          * backwards compatibility with the API.
10341          *
10342          * However when using service discovery, the value 127 will be
10343          * returned when the RSSI is not available.
10344          */
10345         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10346             link_type == ACL_LINK)
10347                 rssi = 0;
10348
10349         bacpy(&ev->addr.bdaddr, bdaddr);
10350         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10351         ev->rssi = rssi;
10352         ev->flags = cpu_to_le32(flags);
10353
10354         if (eir_len > 0)
10355                 /* Copy EIR or advertising data into event */
10356                 skb_put_data(skb, eir, eir_len);
10357
10358         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10359                 u8 eir_cod[5];
10360
10361                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10362                                            dev_class, 3);
10363                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10364         }
10365
10366         if (scan_rsp_len > 0)
10367                 /* Append scan response data to event */
10368                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10369
10370         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10371
10372         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10373 }
10374
10375 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10376                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10377 {
10378         struct sk_buff *skb;
10379         struct mgmt_ev_device_found *ev;
10380         u16 eir_len = 0;
10381         u32 flags = 0;
10382
10383         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10384                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10385
10386         ev = skb_put(skb, sizeof(*ev));
10387         bacpy(&ev->addr.bdaddr, bdaddr);
10388         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10389         ev->rssi = rssi;
10390
10391         if (name)
10392                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10393         else
10394                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10395
10396         ev->eir_len = cpu_to_le16(eir_len);
10397         ev->flags = cpu_to_le32(flags);
10398
10399         mgmt_event_skb(skb, NULL);
10400 }
10401
10402 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10403 {
10404         struct mgmt_ev_discovering ev;
10405
10406         bt_dev_dbg(hdev, "discovering %u", discovering);
10407
10408         memset(&ev, 0, sizeof(ev));
10409         ev.type = hdev->discovery.type;
10410         ev.discovering = discovering;
10411
10412         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10413 }
10414
10415 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10416 {
10417         struct mgmt_ev_controller_suspend ev;
10418
10419         ev.suspend_state = state;
10420         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10421 }
10422
10423 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10424                    u8 addr_type)
10425 {
10426         struct mgmt_ev_controller_resume ev;
10427
10428         ev.wake_reason = reason;
10429         if (bdaddr) {
10430                 bacpy(&ev.addr.bdaddr, bdaddr);
10431                 ev.addr.type = addr_type;
10432         } else {
10433                 memset(&ev.addr, 0, sizeof(ev.addr));
10434         }
10435
10436         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10437 }
10438
10439 static struct hci_mgmt_chan chan = {
10440         .channel        = HCI_CHANNEL_CONTROL,
10441         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10442         .handlers       = mgmt_handlers,
10443         .hdev_init      = mgmt_init_hdev,
10444 };
10445
10446 int mgmt_init(void)
10447 {
10448         return hci_mgmt_chan_register(&chan);
10449 }
10450
10451 void mgmt_exit(void)
10452 {
10453         hci_mgmt_chan_unregister(&chan);
10454 }
10455
10456 void mgmt_cleanup(struct sock *sk)
10457 {
10458         struct mgmt_mesh_tx *mesh_tx;
10459         struct hci_dev *hdev;
10460
10461         read_lock(&hci_dev_list_lock);
10462
10463         list_for_each_entry(hdev, &hci_dev_list, list) {
10464                 do {
10465                         mesh_tx = mgmt_mesh_next(hdev, sk);
10466
10467                         if (mesh_tx)
10468                                 mesh_send_complete(hdev, mesh_tx, true);
10469                 } while (mesh_tx);
10470         }
10471
10472         read_unlock(&hci_dev_list_lock);
10473 }