net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   18
  44
  45 static const u16 mgmt_commands[] = {
  46         MGMT_OP_READ_INDEX_LIST,
  47         MGMT_OP_READ_INFO,
  48         MGMT_OP_SET_POWERED,
  49         MGMT_OP_SET_DISCOVERABLE,
  50         MGMT_OP_SET_CONNECTABLE,
  51         MGMT_OP_SET_FAST_CONNECTABLE,
  52         MGMT_OP_SET_BONDABLE,
  53         MGMT_OP_SET_LINK_SECURITY,
  54         MGMT_OP_SET_SSP,
  55         MGMT_OP_SET_HS,
  56         MGMT_OP_SET_LE,
  57         MGMT_OP_SET_DEV_CLASS,
  58         MGMT_OP_SET_LOCAL_NAME,
  59         MGMT_OP_ADD_UUID,
  60         MGMT_OP_REMOVE_UUID,
  61         MGMT_OP_LOAD_LINK_KEYS,
  62         MGMT_OP_LOAD_LONG_TERM_KEYS,
  63         MGMT_OP_DISCONNECT,
  64         MGMT_OP_GET_CONNECTIONS,
  65         MGMT_OP_PIN_CODE_REPLY,
  66         MGMT_OP_PIN_CODE_NEG_REPLY,
  67         MGMT_OP_SET_IO_CAPABILITY,
  68         MGMT_OP_PAIR_DEVICE,
  69         MGMT_OP_CANCEL_PAIR_DEVICE,
  70         MGMT_OP_UNPAIR_DEVICE,
  71         MGMT_OP_USER_CONFIRM_REPLY,
  72         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  73         MGMT_OP_USER_PASSKEY_REPLY,
  74         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  75         MGMT_OP_READ_LOCAL_OOB_DATA,
  76         MGMT_OP_ADD_REMOTE_OOB_DATA,
  77         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  78         MGMT_OP_START_DISCOVERY,
  79         MGMT_OP_STOP_DISCOVERY,
  80         MGMT_OP_CONFIRM_NAME,
  81         MGMT_OP_BLOCK_DEVICE,
  82         MGMT_OP_UNBLOCK_DEVICE,
  83         MGMT_OP_SET_DEVICE_ID,
  84         MGMT_OP_SET_ADVERTISING,
  85         MGMT_OP_SET_BREDR,
  86         MGMT_OP_SET_STATIC_ADDRESS,
  87         MGMT_OP_SET_SCAN_PARAMS,
  88         MGMT_OP_SET_SECURE_CONN,
  89         MGMT_OP_SET_DEBUG_KEYS,
  90         MGMT_OP_SET_PRIVACY,
  91         MGMT_OP_LOAD_IRKS,
  92         MGMT_OP_GET_CONN_INFO,
  93         MGMT_OP_GET_CLOCK_INFO,
  94         MGMT_OP_ADD_DEVICE,
  95         MGMT_OP_REMOVE_DEVICE,
  96         MGMT_OP_LOAD_CONN_PARAM,
  97         MGMT_OP_READ_UNCONF_INDEX_LIST,
  98         MGMT_OP_READ_CONFIG_INFO,
  99         MGMT_OP_SET_EXTERNAL_CONFIG,
 100         MGMT_OP_SET_PUBLIC_ADDRESS,
 101         MGMT_OP_START_SERVICE_DISCOVERY,
 102         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 103         MGMT_OP_READ_EXT_INDEX_LIST,
 104         MGMT_OP_READ_ADV_FEATURES,
 105         MGMT_OP_ADD_ADVERTISING,
 106         MGMT_OP_REMOVE_ADVERTISING,
 107         MGMT_OP_GET_ADV_SIZE_INFO,
 108         MGMT_OP_START_LIMITED_DISCOVERY,
 109         MGMT_OP_READ_EXT_INFO,
 110         MGMT_OP_SET_APPEARANCE,
 111         MGMT_OP_SET_BLOCKED_KEYS,
 112         MGMT_OP_SET_WIDEBAND_SPEECH,
 113         MGMT_OP_READ_SECURITY_INFO,
 114         MGMT_OP_READ_EXP_FEATURES_INFO,
 115         MGMT_OP_SET_EXP_FEATURE,
 116         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 117         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 118         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 119         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 120         MGMT_OP_GET_DEVICE_FLAGS,
 121         MGMT_OP_SET_DEVICE_FLAGS,
 122         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 123         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 124         MGMT_OP_REMOVE_ADV_MONITOR,
 125 };
 126
 127 static const u16 mgmt_events[] = {
 128         MGMT_EV_CONTROLLER_ERROR,
 129         MGMT_EV_INDEX_ADDED,
 130         MGMT_EV_INDEX_REMOVED,
 131         MGMT_EV_NEW_SETTINGS,
 132         MGMT_EV_CLASS_OF_DEV_CHANGED,
 133         MGMT_EV_LOCAL_NAME_CHANGED,
 134         MGMT_EV_NEW_LINK_KEY,
 135         MGMT_EV_NEW_LONG_TERM_KEY,
 136         MGMT_EV_DEVICE_CONNECTED,
 137         MGMT_EV_DEVICE_DISCONNECTED,
 138         MGMT_EV_CONNECT_FAILED,
 139         MGMT_EV_PIN_CODE_REQUEST,
 140         MGMT_EV_USER_CONFIRM_REQUEST,
 141         MGMT_EV_USER_PASSKEY_REQUEST,
 142         MGMT_EV_AUTH_FAILED,
 143         MGMT_EV_DEVICE_FOUND,
 144         MGMT_EV_DISCOVERING,
 145         MGMT_EV_DEVICE_BLOCKED,
 146         MGMT_EV_DEVICE_UNBLOCKED,
 147         MGMT_EV_DEVICE_UNPAIRED,
 148         MGMT_EV_PASSKEY_NOTIFY,
 149         MGMT_EV_NEW_IRK,
 150         MGMT_EV_NEW_CSRK,
 151         MGMT_EV_DEVICE_ADDED,
 152         MGMT_EV_DEVICE_REMOVED,
 153         MGMT_EV_NEW_CONN_PARAM,
 154         MGMT_EV_UNCONF_INDEX_ADDED,
 155         MGMT_EV_UNCONF_INDEX_REMOVED,
 156         MGMT_EV_NEW_CONFIG_OPTIONS,
 157         MGMT_EV_EXT_INDEX_ADDED,
 158         MGMT_EV_EXT_INDEX_REMOVED,
 159         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 160         MGMT_EV_ADVERTISING_ADDED,
 161         MGMT_EV_ADVERTISING_REMOVED,
 162         MGMT_EV_EXT_INFO_CHANGED,
 163         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 164         MGMT_EV_EXP_FEATURE_CHANGED,
 165         MGMT_EV_DEVICE_FLAGS_CHANGED,
 166         MGMT_EV_CONTROLLER_SUSPEND,
 167         MGMT_EV_CONTROLLER_RESUME,
 168 };
 169
 170 static const u16 mgmt_untrusted_commands[] = {
 171         MGMT_OP_READ_INDEX_LIST,
 172         MGMT_OP_READ_INFO,
 173         MGMT_OP_READ_UNCONF_INDEX_LIST,
 174         MGMT_OP_READ_CONFIG_INFO,
 175         MGMT_OP_READ_EXT_INDEX_LIST,
 176         MGMT_OP_READ_EXT_INFO,
 177         MGMT_OP_READ_SECURITY_INFO,
 178         MGMT_OP_READ_EXP_FEATURES_INFO,
 179         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 180         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 181 };
 182
 183 static const u16 mgmt_untrusted_events[] = {
 184         MGMT_EV_INDEX_ADDED,
 185         MGMT_EV_INDEX_REMOVED,
 186         MGMT_EV_NEW_SETTINGS,
 187         MGMT_EV_CLASS_OF_DEV_CHANGED,
 188         MGMT_EV_LOCAL_NAME_CHANGED,
 189         MGMT_EV_UNCONF_INDEX_ADDED,
 190         MGMT_EV_UNCONF_INDEX_REMOVED,
 191         MGMT_EV_NEW_CONFIG_OPTIONS,
 192         MGMT_EV_EXT_INDEX_ADDED,
 193         MGMT_EV_EXT_INDEX_REMOVED,
 194         MGMT_EV_EXT_INFO_CHANGED,
 195         MGMT_EV_EXP_FEATURE_CHANGED,
 196         MGMT_EV_ADV_MONITOR_ADDED,
 197         MGMT_EV_ADV_MONITOR_REMOVED,
 198 };
 199
 200 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 201
 202 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 203                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 204
 205 /* HCI to MGMT error code conversion table */
 206 static const u8 mgmt_status_table[] = {
 207         MGMT_STATUS_SUCCESS,
 208         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 209         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 210         MGMT_STATUS_FAILED,             /* Hardware Failure */
 211         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 212         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 213         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 214         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 215         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 216         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 217         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 218         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 219         MGMT_STATUS_BUSY,               /* Command Disallowed */
 220         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 221         MGMT_STATUS_REJECTED,           /* Rejected Security */
 222         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 223         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 225         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 226         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 227         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 228         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 229         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 230         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 231         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 232         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 234         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 235         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 236         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 237         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 238         MGMT_STATUS_FAILED,             /* Unspecified Error */
 239         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 240         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 241         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 242         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 243         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 244         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 245         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 246         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 247         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 249         MGMT_STATUS_FAILED,             /* Transaction Collision */
 250         MGMT_STATUS_FAILED,             /* Reserved for future use */
 251         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 252         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 253         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 254         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 255         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 256         MGMT_STATUS_FAILED,             /* Reserved for future use */
 257         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 258         MGMT_STATUS_FAILED,             /* Reserved for future use */
 259         MGMT_STATUS_FAILED,             /* Slot Violation */
 260         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 261         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 263         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 264         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 265         MGMT_STATUS_BUSY,               /* Controller Busy */
 266         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 267         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 268         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 269         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 270         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 271 };
 272
 273 static u8 mgmt_status(u8 hci_status)
 274 {
 275         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 276                 return mgmt_status_table[hci_status];
 277
 278         return MGMT_STATUS_FAILED;
 279 }
 280
 281 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 282                             u16 len, int flag)
 283 {
 284         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 285                                flag, NULL);
 286 }
 287
 288 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 289                               u16 len, int flag, struct sock *skip_sk)
 290 {
 291         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 292                                flag, skip_sk);
 293 }
 294
 295 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 296                       struct sock *skip_sk)
 297 {
 298         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 299                                HCI_SOCK_TRUSTED, skip_sk);
 300 }
 301
 302 static u8 le_addr_type(u8 mgmt_addr_type)
 303 {
 304         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 305                 return ADDR_LE_DEV_PUBLIC;
 306         else
 307                 return ADDR_LE_DEV_RANDOM;
 308 }
 309
 310 void mgmt_fill_version_info(void *ver)
 311 {
 312         struct mgmt_rp_read_version *rp = ver;
 313
 314         rp->version = MGMT_VERSION;
 315         rp->revision = cpu_to_le16(MGMT_REVISION);
 316 }
 317
 318 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 319                         u16 data_len)
 320 {
 321         struct mgmt_rp_read_version rp;
 322
 323         bt_dev_dbg(hdev, "sock %p", sk);
 324
 325         mgmt_fill_version_info(&rp);
 326
 327         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 328                                  &rp, sizeof(rp));
 329 }
 330
 331 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 332                          u16 data_len)
 333 {
 334         struct mgmt_rp_read_commands *rp;
 335         u16 num_commands, num_events;
 336         size_t rp_size;
 337         int i, err;
 338
 339         bt_dev_dbg(hdev, "sock %p", sk);
 340
 341         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 342                 num_commands = ARRAY_SIZE(mgmt_commands);
 343                 num_events = ARRAY_SIZE(mgmt_events);
 344         } else {
 345                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 346                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 347         }
 348
 349         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 350
 351         rp = kmalloc(rp_size, GFP_KERNEL);
 352         if (!rp)
 353                 return -ENOMEM;
 354
 355         rp->num_commands = cpu_to_le16(num_commands);
 356         rp->num_events = cpu_to_le16(num_events);
 357
 358         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 359                 __le16 *opcode = rp->opcodes;
 360
 361                 for (i = 0; i < num_commands; i++, opcode++)
 362                         put_unaligned_le16(mgmt_commands[i], opcode);
 363
 364                 for (i = 0; i < num_events; i++, opcode++)
 365                         put_unaligned_le16(mgmt_events[i], opcode);
 366         } else {
 367                 __le16 *opcode = rp->opcodes;
 368
 369                 for (i = 0; i < num_commands; i++, opcode++)
 370                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 371
 372                 for (i = 0; i < num_events; i++, opcode++)
 373                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 374         }
 375
 376         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 377                                 rp, rp_size);
 378         kfree(rp);
 379
 380         return err;
 381 }
 382
 383 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 384                            u16 data_len)
 385 {
 386         struct mgmt_rp_read_index_list *rp;
 387         struct hci_dev *d;
 388         size_t rp_len;
 389         u16 count;
 390         int err;
 391
 392         bt_dev_dbg(hdev, "sock %p", sk);
 393
 394         read_lock(&hci_dev_list_lock);
 395
 396         count = 0;
 397         list_for_each_entry(d, &hci_dev_list, list) {
 398                 if (d->dev_type == HCI_PRIMARY &&
 399                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 400                         count++;
 401         }
 402
 403         rp_len = sizeof(*rp) + (2 * count);
 404         rp = kmalloc(rp_len, GFP_ATOMIC);
 405         if (!rp) {
 406                 read_unlock(&hci_dev_list_lock);
 407                 return -ENOMEM;
 408         }
 409
 410         count = 0;
 411         list_for_each_entry(d, &hci_dev_list, list) {
 412                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 413                     hci_dev_test_flag(d, HCI_CONFIG) ||
 414                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 415                         continue;
 416
 417                 /* Devices marked as raw-only are neither configured
 418                  * nor unconfigured controllers.
 419                  */
 420                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 421                         continue;
 422
 423                 if (d->dev_type == HCI_PRIMARY &&
 424                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 425                         rp->index[count++] = cpu_to_le16(d->id);
 426                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 427                 }
 428         }
 429
 430         rp->num_controllers = cpu_to_le16(count);
 431         rp_len = sizeof(*rp) + (2 * count);
 432
 433         read_unlock(&hci_dev_list_lock);
 434
 435         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 436                                 0, rp, rp_len);
 437
 438         kfree(rp);
 439
 440         return err;
 441 }
 442
 443 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 444                                   void *data, u16 data_len)
 445 {
 446         struct mgmt_rp_read_unconf_index_list *rp;
 447         struct hci_dev *d;
 448         size_t rp_len;
 449         u16 count;
 450         int err;
 451
 452         bt_dev_dbg(hdev, "sock %p", sk);
 453
 454         read_lock(&hci_dev_list_lock);
 455
 456         count = 0;
 457         list_for_each_entry(d, &hci_dev_list, list) {
 458                 if (d->dev_type == HCI_PRIMARY &&
 459                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 460                         count++;
 461         }
 462
 463         rp_len = sizeof(*rp) + (2 * count);
 464         rp = kmalloc(rp_len, GFP_ATOMIC);
 465         if (!rp) {
 466                 read_unlock(&hci_dev_list_lock);
 467                 return -ENOMEM;
 468         }
 469
 470         count = 0;
 471         list_for_each_entry(d, &hci_dev_list, list) {
 472                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 473                     hci_dev_test_flag(d, HCI_CONFIG) ||
 474                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 475                         continue;
 476
 477                 /* Devices marked as raw-only are neither configured
 478                  * nor unconfigured controllers.
 479                  */
 480                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 481                         continue;
 482
 483                 if (d->dev_type == HCI_PRIMARY &&
 484                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 485                         rp->index[count++] = cpu_to_le16(d->id);
 486                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 487                 }
 488         }
 489
 490         rp->num_controllers = cpu_to_le16(count);
 491         rp_len = sizeof(*rp) + (2 * count);
 492
 493         read_unlock(&hci_dev_list_lock);
 494
 495         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 496                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 497
 498         kfree(rp);
 499
 500         return err;
 501 }
 502
 503 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 504                                void *data, u16 data_len)
 505 {
 506         struct mgmt_rp_read_ext_index_list *rp;
 507         struct hci_dev *d;
 508         u16 count;
 509         int err;
 510
 511         bt_dev_dbg(hdev, "sock %p", sk);
 512
 513         read_lock(&hci_dev_list_lock);
 514
 515         count = 0;
 516         list_for_each_entry(d, &hci_dev_list, list) {
 517                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 518                         count++;
 519         }
 520
 521         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 522         if (!rp) {
 523                 read_unlock(&hci_dev_list_lock);
 524                 return -ENOMEM;
 525         }
 526
 527         count = 0;
 528         list_for_each_entry(d, &hci_dev_list, list) {
 529                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 530                     hci_dev_test_flag(d, HCI_CONFIG) ||
 531                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 532                         continue;
 533
 534                 /* Devices marked as raw-only are neither configured
 535                  * nor unconfigured controllers.
 536                  */
 537                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 538                         continue;
 539
 540                 if (d->dev_type == HCI_PRIMARY) {
 541                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 542                                 rp->entry[count].type = 0x01;
 543                         else
 544                                 rp->entry[count].type = 0x00;
 545                 } else if (d->dev_type == HCI_AMP) {
 546                         rp->entry[count].type = 0x02;
 547                 } else {
 548                         continue;
 549                 }
 550
 551                 rp->entry[count].bus = d->bus;
 552                 rp->entry[count++].index = cpu_to_le16(d->id);
 553                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 554         }
 555
 556         rp->num_controllers = cpu_to_le16(count);
 557
 558         read_unlock(&hci_dev_list_lock);
 559
 560         /* If this command is called at least once, then all the
 561          * default index and unconfigured index events are disabled
 562          * and from now on only extended index events are used.
 563          */
 564         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 565         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 566         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 567
 568         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 569                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 570                                 struct_size(rp, entry, count));
 571
 572         kfree(rp);
 573
 574         return err;
 575 }
 576
 577 static bool is_configured(struct hci_dev *hdev)
 578 {
 579         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 580             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 581                 return false;
 582
 583         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 584              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 585             !bacmp(&hdev->public_addr, BDADDR_ANY))
 586                 return false;
 587
 588         return true;
 589 }
 590
 591 static __le32 get_missing_options(struct hci_dev *hdev)
 592 {
 593         u32 options = 0;
 594
 595         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 596             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 597                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 598
 599         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 600              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 601             !bacmp(&hdev->public_addr, BDADDR_ANY))
 602                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 603
 604         return cpu_to_le32(options);
 605 }
 606
 607 static int new_options(struct hci_dev *hdev, struct sock *skip)
 608 {
 609         __le32 options = get_missing_options(hdev);
 610
 611         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 612                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 613 }
 614
 615 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 616 {
 617         __le32 options = get_missing_options(hdev);
 618
 619         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 620                                  sizeof(options));
 621 }
 622
 623 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 624                             void *data, u16 data_len)
 625 {
 626         struct mgmt_rp_read_config_info rp;
 627         u32 options = 0;
 628
 629         bt_dev_dbg(hdev, "sock %p", sk);
 630
 631         hci_dev_lock(hdev);
 632
 633         memset(&rp, 0, sizeof(rp));
 634         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 635
 636         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 637                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 638
 639         if (hdev->set_bdaddr)
 640                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 641
 642         rp.supported_options = cpu_to_le32(options);
 643         rp.missing_options = get_missing_options(hdev);
 644
 645         hci_dev_unlock(hdev);
 646
 647         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 648                                  &rp, sizeof(rp));
 649 }
 650
 651 static u32 get_supported_phys(struct hci_dev *hdev)
 652 {
 653         u32 supported_phys = 0;
 654
 655         if (lmp_bredr_capable(hdev)) {
 656                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 657
 658                 if (hdev->features[0][0] & LMP_3SLOT)
 659                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 660
 661                 if (hdev->features[0][0] & LMP_5SLOT)
 662                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 663
 664                 if (lmp_edr_2m_capable(hdev)) {
 665                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 666
 667                         if (lmp_edr_3slot_capable(hdev))
 668                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 669
 670                         if (lmp_edr_5slot_capable(hdev))
 671                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 672
 673                         if (lmp_edr_3m_capable(hdev)) {
 674                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 675
 676                                 if (lmp_edr_3slot_capable(hdev))
 677                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 678
 679                                 if (lmp_edr_5slot_capable(hdev))
 680                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 681                         }
 682                 }
 683         }
 684
 685         if (lmp_le_capable(hdev)) {
 686                 supported_phys |= MGMT_PHY_LE_1M_TX;
 687                 supported_phys |= MGMT_PHY_LE_1M_RX;
 688
 689                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 690                         supported_phys |= MGMT_PHY_LE_2M_TX;
 691                         supported_phys |= MGMT_PHY_LE_2M_RX;
 692                 }
 693
 694                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 695                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 696                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 697                 }
 698         }
 699
 700         return supported_phys;
 701 }
 702
 703 static u32 get_selected_phys(struct hci_dev *hdev)
 704 {
 705         u32 selected_phys = 0;
 706
 707         if (lmp_bredr_capable(hdev)) {
 708                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 709
 710                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 711                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 712
 713                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 714                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 715
 716                 if (lmp_edr_2m_capable(hdev)) {
 717                         if (!(hdev->pkt_type & HCI_2DH1))
 718                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 719
 720                         if (lmp_edr_3slot_capable(hdev) &&
 721                             !(hdev->pkt_type & HCI_2DH3))
 722                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 723
 724                         if (lmp_edr_5slot_capable(hdev) &&
 725                             !(hdev->pkt_type & HCI_2DH5))
 726                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 727
 728                         if (lmp_edr_3m_capable(hdev)) {
 729                                 if (!(hdev->pkt_type & HCI_3DH1))
 730                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 731
 732                                 if (lmp_edr_3slot_capable(hdev) &&
 733                                     !(hdev->pkt_type & HCI_3DH3))
 734                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 735
 736                                 if (lmp_edr_5slot_capable(hdev) &&
 737                                     !(hdev->pkt_type & HCI_3DH5))
 738                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 739                         }
 740                 }
 741         }
 742
 743         if (lmp_le_capable(hdev)) {
 744                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 745                         selected_phys |= MGMT_PHY_LE_1M_TX;
 746
 747                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 748                         selected_phys |= MGMT_PHY_LE_1M_RX;
 749
 750                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 751                         selected_phys |= MGMT_PHY_LE_2M_TX;
 752
 753                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 754                         selected_phys |= MGMT_PHY_LE_2M_RX;
 755
 756                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 757                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 758
 759                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 760                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 761         }
 762
 763         return selected_phys;
 764 }
 765
 766 static u32 get_configurable_phys(struct hci_dev *hdev)
 767 {
 768         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 769                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 770 }
 771
 772 static u32 get_supported_settings(struct hci_dev *hdev)
 773 {
 774         u32 settings = 0;
 775
 776         settings |= MGMT_SETTING_POWERED;
 777         settings |= MGMT_SETTING_BONDABLE;
 778         settings |= MGMT_SETTING_DEBUG_KEYS;
 779         settings |= MGMT_SETTING_CONNECTABLE;
 780         settings |= MGMT_SETTING_DISCOVERABLE;
 781
 782         if (lmp_bredr_capable(hdev)) {
 783                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 784                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 785                 settings |= MGMT_SETTING_BREDR;
 786                 settings |= MGMT_SETTING_LINK_SECURITY;
 787
 788                 if (lmp_ssp_capable(hdev)) {
 789                         settings |= MGMT_SETTING_SSP;
 790                         if (IS_ENABLED(CONFIG_BT_HS))
 791                                 settings |= MGMT_SETTING_HS;
 792                 }
 793
 794                 if (lmp_sc_capable(hdev))
 795                         settings |= MGMT_SETTING_SECURE_CONN;
 796
 797                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 798                              &hdev->quirks))
 799                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 800         }
 801
 802         if (lmp_le_capable(hdev)) {
 803                 settings |= MGMT_SETTING_LE;
 804                 settings |= MGMT_SETTING_SECURE_CONN;
 805                 settings |= MGMT_SETTING_PRIVACY;
 806                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 807
 808                 /* When the experimental feature for LL Privacy support is
 809                  * enabled, then advertising is no longer supported.
 810                  */
 811                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 812                         settings |= MGMT_SETTING_ADVERTISING;
 813         }
 814
 815         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 816             hdev->set_bdaddr)
 817                 settings |= MGMT_SETTING_CONFIGURATION;
 818
 819         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 820
 821         return settings;
 822 }
 823
 824 static u32 get_current_settings(struct hci_dev *hdev)
 825 {
 826         u32 settings = 0;
 827
 828         if (hdev_is_powered(hdev))
 829                 settings |= MGMT_SETTING_POWERED;
 830
 831         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 832                 settings |= MGMT_SETTING_CONNECTABLE;
 833
 834         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 835                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 836
 837         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 838                 settings |= MGMT_SETTING_DISCOVERABLE;
 839
 840         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 841                 settings |= MGMT_SETTING_BONDABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 844                 settings |= MGMT_SETTING_BREDR;
 845
 846         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 847                 settings |= MGMT_SETTING_LE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 850                 settings |= MGMT_SETTING_LINK_SECURITY;
 851
 852         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 853                 settings |= MGMT_SETTING_SSP;
 854
 855         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 856                 settings |= MGMT_SETTING_HS;
 857
 858         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 859                 settings |= MGMT_SETTING_ADVERTISING;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 862                 settings |= MGMT_SETTING_SECURE_CONN;
 863
 864         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 865                 settings |= MGMT_SETTING_DEBUG_KEYS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 868                 settings |= MGMT_SETTING_PRIVACY;
 869
 870         /* The current setting for static address has two purposes. The
 871          * first is to indicate if the static address will be used and
 872          * the second is to indicate if it is actually set.
 873          *
 874          * This means if the static address is not configured, this flag
 875          * will never be set. If the address is configured, then if the
 876          * address is actually used decides if the flag is set or not.
 877          *
 878          * For single mode LE only controllers and dual-mode controllers
 879          * with BR/EDR disabled, the existence of the static address will
 880          * be evaluated.
 881          */
 882         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 883             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 884             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 885                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 886                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 887         }
 888
 889         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 890                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 891
 892         return settings;
 893 }
 894
 895 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 896 {
 897         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 898 }
 899
 900 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 901                                                   struct hci_dev *hdev,
 902                                                   const void *data)
 903 {
 904         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 905 }
 906
 907 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 908 {
 909         struct mgmt_pending_cmd *cmd;
 910
 911         /* If there's a pending mgmt command the flags will not yet have
 912          * their final values, so check for this first.
 913          */
 914         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 915         if (cmd) {
 916                 struct mgmt_mode *cp = cmd->param;
 917                 if (cp->val == 0x01)
 918                         return LE_AD_GENERAL;
 919                 else if (cp->val == 0x02)
 920                         return LE_AD_LIMITED;
 921         } else {
 922                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 923                         return LE_AD_LIMITED;
 924                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 925                         return LE_AD_GENERAL;
 926         }
 927
 928         return 0;
 929 }
 930
 931 bool mgmt_get_connectable(struct hci_dev *hdev)
 932 {
 933         struct mgmt_pending_cmd *cmd;
 934
 935         /* If there's a pending mgmt command the flag will not yet have
 936          * it's final value, so check for this first.
 937          */
 938         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 939         if (cmd) {
 940                 struct mgmt_mode *cp = cmd->param;
 941
 942                 return cp->val;
 943         }
 944
 945         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 946 }
 947
 948 static void service_cache_off(struct work_struct *work)
 949 {
 950         struct hci_dev *hdev = container_of(work, struct hci_dev,
 951                                             service_cache.work);
 952         struct hci_request req;
 953
 954         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 955                 return;
 956
 957         hci_req_init(&req, hdev);
 958
 959         hci_dev_lock(hdev);
 960
 961         __hci_req_update_eir(&req);
 962         __hci_req_update_class(&req);
 963
 964         hci_dev_unlock(hdev);
 965
 966         hci_req_run(&req, NULL);
 967 }
 968
 969 static void rpa_expired(struct work_struct *work)
 970 {
 971         struct hci_dev *hdev = container_of(work, struct hci_dev,
 972                                             rpa_expired.work);
 973         struct hci_request req;
 974
 975         bt_dev_dbg(hdev, "");
 976
 977         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 978
 979         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 980                 return;
 981
 982         /* The generation of a new RPA and programming it into the
 983          * controller happens in the hci_req_enable_advertising()
 984          * function.
 985          */
 986         hci_req_init(&req, hdev);
 987         if (ext_adv_capable(hdev))
 988                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 989         else
 990                 __hci_req_enable_advertising(&req);
 991         hci_req_run(&req, NULL);
 992 }
 993
 994 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 995 {
 996         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 997                 return;
 998
 999         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1000         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1001
1002         /* Non-mgmt controlled devices get this bit set
1003          * implicitly so that pairing works for them, however
1004          * for mgmt we require user-space to explicitly enable
1005          * it
1006          */
1007         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1008 }
1009
1010 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1011                                 void *data, u16 data_len)
1012 {
1013         struct mgmt_rp_read_info rp;
1014
1015         bt_dev_dbg(hdev, "sock %p", sk);
1016
1017         hci_dev_lock(hdev);
1018
1019         memset(&rp, 0, sizeof(rp));
1020
1021         bacpy(&rp.bdaddr, &hdev->bdaddr);
1022
1023         rp.version = hdev->hci_ver;
1024         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1025
1026         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1027         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1028
1029         memcpy(rp.dev_class, hdev->dev_class, 3);
1030
1031         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1032         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1033
1034         hci_dev_unlock(hdev);
1035
1036         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1037                                  sizeof(rp));
1038 }
1039
1040 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1041 {
1042         u16 eir_len = 0;
1043         size_t name_len;
1044
1045         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1046                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1047                                           hdev->dev_class, 3);
1048
1049         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1050                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1051                                           hdev->appearance);
1052
1053         name_len = strlen(hdev->dev_name);
1054         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1055                                   hdev->dev_name, name_len);
1056
1057         name_len = strlen(hdev->short_name);
1058         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1059                                   hdev->short_name, name_len);
1060
1061         return eir_len;
1062 }
1063
1064 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1065                                     void *data, u16 data_len)
1066 {
1067         char buf[512];
1068         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1069         u16 eir_len;
1070
1071         bt_dev_dbg(hdev, "sock %p", sk);
1072
1073         memset(&buf, 0, sizeof(buf));
1074
1075         hci_dev_lock(hdev);
1076
1077         bacpy(&rp->bdaddr, &hdev->bdaddr);
1078
1079         rp->version = hdev->hci_ver;
1080         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1081
1082         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1083         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1084
1085
1086         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1087         rp->eir_len = cpu_to_le16(eir_len);
1088
1089         hci_dev_unlock(hdev);
1090
1091         /* If this command is called at least once, then the events
1092          * for class of device and local name changes are disabled
1093          * and only the new extended controller information event
1094          * is used.
1095          */
1096         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1097         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1098         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1099
1100         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1101                                  sizeof(*rp) + eir_len);
1102 }
1103
1104 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1105 {
1106         char buf[512];
1107         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1108         u16 eir_len;
1109
1110         memset(buf, 0, sizeof(buf));
1111
1112         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1113         ev->eir_len = cpu_to_le16(eir_len);
1114
1115         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1116                                   sizeof(*ev) + eir_len,
1117                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1118 }
1119
1120 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1121 {
1122         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1123
1124         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1125                                  sizeof(settings));
1126 }
1127
1128 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1129 {
1130         bt_dev_dbg(hdev, "status 0x%02x", status);
1131
1132         if (hci_conn_count(hdev) == 0) {
1133                 cancel_delayed_work(&hdev->power_off);
1134                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1135         }
1136 }
1137
1138 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1139 {
1140         struct mgmt_ev_advertising_added ev;
1141
1142         ev.instance = instance;
1143
1144         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1145 }
1146
1147 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1148                               u8 instance)
1149 {
1150         struct mgmt_ev_advertising_removed ev;
1151
1152         ev.instance = instance;
1153
1154         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1155 }
1156
1157 static void cancel_adv_timeout(struct hci_dev *hdev)
1158 {
1159         if (hdev->adv_instance_timeout) {
1160                 hdev->adv_instance_timeout = 0;
1161                 cancel_delayed_work(&hdev->adv_instance_expire);
1162         }
1163 }
1164
1165 static int clean_up_hci_state(struct hci_dev *hdev)
1166 {
1167         struct hci_request req;
1168         struct hci_conn *conn;
1169         bool discov_stopped;
1170         int err;
1171
1172         hci_req_init(&req, hdev);
1173
1174         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1175             test_bit(HCI_PSCAN, &hdev->flags)) {
1176                 u8 scan = 0x00;
1177                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1178         }
1179
1180         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1181
1182         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1183                 __hci_req_disable_advertising(&req);
1184
1185         discov_stopped = hci_req_stop_discovery(&req);
1186
1187         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1188                 /* 0x15 == Terminated due to Power Off */
1189                 __hci_abort_conn(&req, conn, 0x15);
1190         }
1191
1192         err = hci_req_run(&req, clean_up_hci_complete);
1193         if (!err && discov_stopped)
1194                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1195
1196         return err;
1197 }
1198
1199 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1200                        u16 len)
1201 {
1202         struct mgmt_mode *cp = data;
1203         struct mgmt_pending_cmd *cmd;
1204         int err;
1205
1206         bt_dev_dbg(hdev, "sock %p", sk);
1207
1208         if (cp->val != 0x00 && cp->val != 0x01)
1209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1210                                        MGMT_STATUS_INVALID_PARAMS);
1211
1212         hci_dev_lock(hdev);
1213
1214         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1215                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1216                                       MGMT_STATUS_BUSY);
1217                 goto failed;
1218         }
1219
1220         if (!!cp->val == hdev_is_powered(hdev)) {
1221                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1222                 goto failed;
1223         }
1224
1225         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1226         if (!cmd) {
1227                 err = -ENOMEM;
1228                 goto failed;
1229         }
1230
1231         if (cp->val) {
1232                 queue_work(hdev->req_workqueue, &hdev->power_on);
1233                 err = 0;
1234         } else {
1235                 /* Disconnect connections, stop scans, etc */
1236                 err = clean_up_hci_state(hdev);
1237                 if (!err)
1238                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1239                                            HCI_POWER_OFF_TIMEOUT);
1240
1241                 /* ENODATA means there were no HCI commands queued */
1242                 if (err == -ENODATA) {
1243                         cancel_delayed_work(&hdev->power_off);
1244                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1245                         err = 0;
1246                 }
1247         }
1248
1249 failed:
1250         hci_dev_unlock(hdev);
1251         return err;
1252 }
1253
1254 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1255 {
1256         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1257
1258         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1259                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1260 }
1261
1262 int mgmt_new_settings(struct hci_dev *hdev)
1263 {
1264         return new_settings(hdev, NULL);
1265 }
1266
1267 struct cmd_lookup {
1268         struct sock *sk;
1269         struct hci_dev *hdev;
1270         u8 mgmt_status;
1271 };
1272
1273 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1274 {
1275         struct cmd_lookup *match = data;
1276
1277         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1278
1279         list_del(&cmd->list);
1280
1281         if (match->sk == NULL) {
1282                 match->sk = cmd->sk;
1283                 sock_hold(match->sk);
1284         }
1285
1286         mgmt_pending_free(cmd);
1287 }
1288
1289 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1290 {
1291         u8 *status = data;
1292
1293         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1294         mgmt_pending_remove(cmd);
1295 }
1296
1297 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1298 {
1299         if (cmd->cmd_complete) {
1300                 u8 *status = data;
1301
1302                 cmd->cmd_complete(cmd, *status);
1303                 mgmt_pending_remove(cmd);
1304
1305                 return;
1306         }
1307
1308         cmd_status_rsp(cmd, data);
1309 }
1310
1311 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1312 {
1313         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1314                                  cmd->param, cmd->param_len);
1315 }
1316
1317 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1318 {
1319         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1320                                  cmd->param, sizeof(struct mgmt_addr_info));
1321 }
1322
1323 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1324 {
1325         if (!lmp_bredr_capable(hdev))
1326                 return MGMT_STATUS_NOT_SUPPORTED;
1327         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1328                 return MGMT_STATUS_REJECTED;
1329         else
1330                 return MGMT_STATUS_SUCCESS;
1331 }
1332
1333 static u8 mgmt_le_support(struct hci_dev *hdev)
1334 {
1335         if (!lmp_le_capable(hdev))
1336                 return MGMT_STATUS_NOT_SUPPORTED;
1337         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1338                 return MGMT_STATUS_REJECTED;
1339         else
1340                 return MGMT_STATUS_SUCCESS;
1341 }
1342
1343 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1344 {
1345         struct mgmt_pending_cmd *cmd;
1346
1347         bt_dev_dbg(hdev, "status 0x%02x", status);
1348
1349         hci_dev_lock(hdev);
1350
1351         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1352         if (!cmd)
1353                 goto unlock;
1354
1355         if (status) {
1356                 u8 mgmt_err = mgmt_status(status);
1357                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1358                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1359                 goto remove_cmd;
1360         }
1361
1362         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1363             hdev->discov_timeout > 0) {
1364                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1365                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1366         }
1367
1368         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1369         new_settings(hdev, cmd->sk);
1370
1371 remove_cmd:
1372         mgmt_pending_remove(cmd);
1373
1374 unlock:
1375         hci_dev_unlock(hdev);
1376 }
1377
1378 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1379                             u16 len)
1380 {
1381         struct mgmt_cp_set_discoverable *cp = data;
1382         struct mgmt_pending_cmd *cmd;
1383         u16 timeout;
1384         int err;
1385
1386         bt_dev_dbg(hdev, "sock %p", sk);
1387
1388         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1389             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1391                                        MGMT_STATUS_REJECTED);
1392
1393         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1394                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1395                                        MGMT_STATUS_INVALID_PARAMS);
1396
1397         timeout = __le16_to_cpu(cp->timeout);
1398
1399         /* Disabling discoverable requires that no timeout is set,
1400          * and enabling limited discoverable requires a timeout.
1401          */
1402         if ((cp->val == 0x00 && timeout > 0) ||
1403             (cp->val == 0x02 && timeout == 0))
1404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1405                                        MGMT_STATUS_INVALID_PARAMS);
1406
1407         hci_dev_lock(hdev);
1408
1409         if (!hdev_is_powered(hdev) && timeout > 0) {
1410                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1411                                       MGMT_STATUS_NOT_POWERED);
1412                 goto failed;
1413         }
1414
1415         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1416             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1417                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1418                                       MGMT_STATUS_BUSY);
1419                 goto failed;
1420         }
1421
1422         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1423                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1424                                       MGMT_STATUS_REJECTED);
1425                 goto failed;
1426         }
1427
1428         if (hdev->advertising_paused) {
1429                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1430                                       MGMT_STATUS_BUSY);
1431                 goto failed;
1432         }
1433
1434         if (!hdev_is_powered(hdev)) {
1435                 bool changed = false;
1436
1437                 /* Setting limited discoverable when powered off is
1438                  * not a valid operation since it requires a timeout
1439                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1440                  */
1441                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1442                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1443                         changed = true;
1444                 }
1445
1446                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1447                 if (err < 0)
1448                         goto failed;
1449
1450                 if (changed)
1451                         err = new_settings(hdev, sk);
1452
1453                 goto failed;
1454         }
1455
1456         /* If the current mode is the same, then just update the timeout
1457          * value with the new value. And if only the timeout gets updated,
1458          * then no need for any HCI transactions.
1459          */
1460         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1461             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1462                                                    HCI_LIMITED_DISCOVERABLE)) {
1463                 cancel_delayed_work(&hdev->discov_off);
1464                 hdev->discov_timeout = timeout;
1465
1466                 if (cp->val && hdev->discov_timeout > 0) {
1467                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1468                         queue_delayed_work(hdev->req_workqueue,
1469                                            &hdev->discov_off, to);
1470                 }
1471
1472                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1473                 goto failed;
1474         }
1475
1476         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1477         if (!cmd) {
1478                 err = -ENOMEM;
1479                 goto failed;
1480         }
1481
1482         /* Cancel any potential discoverable timeout that might be
1483          * still active and store new timeout value. The arming of
1484          * the timeout happens in the complete handler.
1485          */
1486         cancel_delayed_work(&hdev->discov_off);
1487         hdev->discov_timeout = timeout;
1488
1489         if (cp->val)
1490                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1491         else
1492                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1493
1494         /* Limited discoverable mode */
1495         if (cp->val == 0x02)
1496                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1497         else
1498                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1499
1500         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1501         err = 0;
1502
1503 failed:
1504         hci_dev_unlock(hdev);
1505         return err;
1506 }
1507
1508 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1509 {
1510         struct mgmt_pending_cmd *cmd;
1511
1512         bt_dev_dbg(hdev, "status 0x%02x", status);
1513
1514         hci_dev_lock(hdev);
1515
1516         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1517         if (!cmd)
1518                 goto unlock;
1519
1520         if (status) {
1521                 u8 mgmt_err = mgmt_status(status);
1522                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1523                 goto remove_cmd;
1524         }
1525
1526         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1527         new_settings(hdev, cmd->sk);
1528
1529 remove_cmd:
1530         mgmt_pending_remove(cmd);
1531
1532 unlock:
1533         hci_dev_unlock(hdev);
1534 }
1535
1536 static int set_connectable_update_settings(struct hci_dev *hdev,
1537                                            struct sock *sk, u8 val)
1538 {
1539         bool changed = false;
1540         int err;
1541
1542         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1543                 changed = true;
1544
1545         if (val) {
1546                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1547         } else {
1548                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1549                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1550         }
1551
1552         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1553         if (err < 0)
1554                 return err;
1555
1556         if (changed) {
1557                 hci_req_update_scan(hdev);
1558                 hci_update_background_scan(hdev);
1559                 return new_settings(hdev, sk);
1560         }
1561
1562         return 0;
1563 }
1564
1565 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1566                            u16 len)
1567 {
1568         struct mgmt_mode *cp = data;
1569         struct mgmt_pending_cmd *cmd;
1570         int err;
1571
1572         bt_dev_dbg(hdev, "sock %p", sk);
1573
1574         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1575             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1577                                        MGMT_STATUS_REJECTED);
1578
1579         if (cp->val != 0x00 && cp->val != 0x01)
1580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1581                                        MGMT_STATUS_INVALID_PARAMS);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (!hdev_is_powered(hdev)) {
1586                 err = set_connectable_update_settings(hdev, sk, cp->val);
1587                 goto failed;
1588         }
1589
1590         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1591             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1592                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1593                                       MGMT_STATUS_BUSY);
1594                 goto failed;
1595         }
1596
1597         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1598         if (!cmd) {
1599                 err = -ENOMEM;
1600                 goto failed;
1601         }
1602
1603         if (cp->val) {
1604                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1605         } else {
1606                 if (hdev->discov_timeout > 0)
1607                         cancel_delayed_work(&hdev->discov_off);
1608
1609                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1610                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1611                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1612         }
1613
1614         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1615         err = 0;
1616
1617 failed:
1618         hci_dev_unlock(hdev);
1619         return err;
1620 }
1621
1622 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1623                         u16 len)
1624 {
1625         struct mgmt_mode *cp = data;
1626         bool changed;
1627         int err;
1628
1629         bt_dev_dbg(hdev, "sock %p", sk);
1630
1631         if (cp->val != 0x00 && cp->val != 0x01)
1632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1633                                        MGMT_STATUS_INVALID_PARAMS);
1634
1635         hci_dev_lock(hdev);
1636
1637         if (cp->val)
1638                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1639         else
1640                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1641
1642         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1643         if (err < 0)
1644                 goto unlock;
1645
1646         if (changed) {
1647                 /* In limited privacy mode the change of bondable mode
1648                  * may affect the local advertising address.
1649                  */
1650                 if (hdev_is_powered(hdev) &&
1651                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1652                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1653                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1654                         queue_work(hdev->req_workqueue,
1655                                    &hdev->discoverable_update);
1656
1657                 err = new_settings(hdev, sk);
1658         }
1659
1660 unlock:
1661         hci_dev_unlock(hdev);
1662         return err;
1663 }
1664
1665 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1666                              u16 len)
1667 {
1668         struct mgmt_mode *cp = data;
1669         struct mgmt_pending_cmd *cmd;
1670         u8 val, status;
1671         int err;
1672
1673         bt_dev_dbg(hdev, "sock %p", sk);
1674
1675         status = mgmt_bredr_support(hdev);
1676         if (status)
1677                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1678                                        status);
1679
1680         if (cp->val != 0x00 && cp->val != 0x01)
1681                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1682                                        MGMT_STATUS_INVALID_PARAMS);
1683
1684         hci_dev_lock(hdev);
1685
1686         if (!hdev_is_powered(hdev)) {
1687                 bool changed = false;
1688
1689                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1690                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1691                         changed = true;
1692                 }
1693
1694                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1695                 if (err < 0)
1696                         goto failed;
1697
1698                 if (changed)
1699                         err = new_settings(hdev, sk);
1700
1701                 goto failed;
1702         }
1703
1704         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1705                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1706                                       MGMT_STATUS_BUSY);
1707                 goto failed;
1708         }
1709
1710         val = !!cp->val;
1711
1712         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1713                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1714                 goto failed;
1715         }
1716
1717         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1718         if (!cmd) {
1719                 err = -ENOMEM;
1720                 goto failed;
1721         }
1722
1723         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1724         if (err < 0) {
1725                 mgmt_pending_remove(cmd);
1726                 goto failed;
1727         }
1728
1729 failed:
1730         hci_dev_unlock(hdev);
1731         return err;
1732 }
1733
1734 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1735 {
1736         struct mgmt_mode *cp = data;
1737         struct mgmt_pending_cmd *cmd;
1738         u8 status;
1739         int err;
1740
1741         bt_dev_dbg(hdev, "sock %p", sk);
1742
1743         status = mgmt_bredr_support(hdev);
1744         if (status)
1745                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1746
1747         if (!lmp_ssp_capable(hdev))
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1749                                        MGMT_STATUS_NOT_SUPPORTED);
1750
1751         if (cp->val != 0x00 && cp->val != 0x01)
1752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1753                                        MGMT_STATUS_INVALID_PARAMS);
1754
1755         hci_dev_lock(hdev);
1756
1757         if (!hdev_is_powered(hdev)) {
1758                 bool changed;
1759
1760                 if (cp->val) {
1761                         changed = !hci_dev_test_and_set_flag(hdev,
1762                                                              HCI_SSP_ENABLED);
1763                 } else {
1764                         changed = hci_dev_test_and_clear_flag(hdev,
1765                                                               HCI_SSP_ENABLED);
1766                         if (!changed)
1767                                 changed = hci_dev_test_and_clear_flag(hdev,
1768                                                                       HCI_HS_ENABLED);
1769                         else
1770                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1771                 }
1772
1773                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1774                 if (err < 0)
1775                         goto failed;
1776
1777                 if (changed)
1778                         err = new_settings(hdev, sk);
1779
1780                 goto failed;
1781         }
1782
1783         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1784                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1785                                       MGMT_STATUS_BUSY);
1786                 goto failed;
1787         }
1788
1789         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1790                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1791                 goto failed;
1792         }
1793
1794         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1795         if (!cmd) {
1796                 err = -ENOMEM;
1797                 goto failed;
1798         }
1799
1800         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1801                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1802                              sizeof(cp->val), &cp->val);
1803
1804         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1805         if (err < 0) {
1806                 mgmt_pending_remove(cmd);
1807                 goto failed;
1808         }
1809
1810 failed:
1811         hci_dev_unlock(hdev);
1812         return err;
1813 }
1814
1815 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1816 {
1817         struct mgmt_mode *cp = data;
1818         bool changed;
1819         u8 status;
1820         int err;
1821
1822         bt_dev_dbg(hdev, "sock %p", sk);
1823
1824         if (!IS_ENABLED(CONFIG_BT_HS))
1825                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1826                                        MGMT_STATUS_NOT_SUPPORTED);
1827
1828         status = mgmt_bredr_support(hdev);
1829         if (status)
1830                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1831
1832         if (!lmp_ssp_capable(hdev))
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1834                                        MGMT_STATUS_NOT_SUPPORTED);
1835
1836         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1837                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1838                                        MGMT_STATUS_REJECTED);
1839
1840         if (cp->val != 0x00 && cp->val != 0x01)
1841                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1842                                        MGMT_STATUS_INVALID_PARAMS);
1843
1844         hci_dev_lock(hdev);
1845
1846         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1847                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1848                                       MGMT_STATUS_BUSY);
1849                 goto unlock;
1850         }
1851
1852         if (cp->val) {
1853                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1854         } else {
1855                 if (hdev_is_powered(hdev)) {
1856                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                               MGMT_STATUS_REJECTED);
1858                         goto unlock;
1859                 }
1860
1861                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1862         }
1863
1864         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1865         if (err < 0)
1866                 goto unlock;
1867
1868         if (changed)
1869                 err = new_settings(hdev, sk);
1870
1871 unlock:
1872         hci_dev_unlock(hdev);
1873         return err;
1874 }
1875
1876 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1877 {
1878         struct cmd_lookup match = { NULL, hdev };
1879
1880         hci_dev_lock(hdev);
1881
1882         if (status) {
1883                 u8 mgmt_err = mgmt_status(status);
1884
1885                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1886                                      &mgmt_err);
1887                 goto unlock;
1888         }
1889
1890         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1891
1892         new_settings(hdev, match.sk);
1893
1894         if (match.sk)
1895                 sock_put(match.sk);
1896
1897         /* Make sure the controller has a good default for
1898          * advertising data. Restrict the update to when LE
1899          * has actually been enabled. During power on, the
1900          * update in powered_update_hci will take care of it.
1901          */
1902         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1903                 struct hci_request req;
1904                 hci_req_init(&req, hdev);
1905                 if (ext_adv_capable(hdev)) {
1906                         int err;
1907
1908                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1909                         if (!err)
1910                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1911                 } else {
1912                         __hci_req_update_adv_data(&req, 0x00);
1913                         __hci_req_update_scan_rsp_data(&req, 0x00);
1914                 }
1915                 hci_req_run(&req, NULL);
1916                 hci_update_background_scan(hdev);
1917         }
1918
1919 unlock:
1920         hci_dev_unlock(hdev);
1921 }
1922
1923 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1924 {
1925         struct mgmt_mode *cp = data;
1926         struct hci_cp_write_le_host_supported hci_cp;
1927         struct mgmt_pending_cmd *cmd;
1928         struct hci_request req;
1929         int err;
1930         u8 val, enabled;
1931
1932         bt_dev_dbg(hdev, "sock %p", sk);
1933
1934         if (!lmp_le_capable(hdev))
1935                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1936                                        MGMT_STATUS_NOT_SUPPORTED);
1937
1938         if (cp->val != 0x00 && cp->val != 0x01)
1939                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1940                                        MGMT_STATUS_INVALID_PARAMS);
1941
1942         /* Bluetooth single mode LE only controllers or dual-mode
1943          * controllers configured as LE only devices, do not allow
1944          * switching LE off. These have either LE enabled explicitly
1945          * or BR/EDR has been previously switched off.
1946          *
1947          * When trying to enable an already enabled LE, then gracefully
1948          * send a positive response. Trying to disable it however will
1949          * result into rejection.
1950          */
1951         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1952                 if (cp->val == 0x01)
1953                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1954
1955                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1956                                        MGMT_STATUS_REJECTED);
1957         }
1958
1959         hci_dev_lock(hdev);
1960
1961         val = !!cp->val;
1962         enabled = lmp_host_le_capable(hdev);
1963
1964         if (!val)
1965                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1966
1967         if (!hdev_is_powered(hdev) || val == enabled) {
1968                 bool changed = false;
1969
1970                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1971                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1972                         changed = true;
1973                 }
1974
1975                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1976                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1977                         changed = true;
1978                 }
1979
1980                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1981                 if (err < 0)
1982                         goto unlock;
1983
1984                 if (changed)
1985                         err = new_settings(hdev, sk);
1986
1987                 goto unlock;
1988         }
1989
1990         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1991             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1992                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1993                                       MGMT_STATUS_BUSY);
1994                 goto unlock;
1995         }
1996
1997         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1998         if (!cmd) {
1999                 err = -ENOMEM;
2000                 goto unlock;
2001         }
2002
2003         hci_req_init(&req, hdev);
2004
2005         memset(&hci_cp, 0, sizeof(hci_cp));
2006
2007         if (val) {
2008                 hci_cp.le = val;
2009                 hci_cp.simul = 0x00;
2010         } else {
2011                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2012                         __hci_req_disable_advertising(&req);
2013
2014                 if (ext_adv_capable(hdev))
2015                         __hci_req_clear_ext_adv_sets(&req);
2016         }
2017
2018         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2019                     &hci_cp);
2020
2021         err = hci_req_run(&req, le_enable_complete);
2022         if (err < 0)
2023                 mgmt_pending_remove(cmd);
2024
2025 unlock:
2026         hci_dev_unlock(hdev);
2027         return err;
2028 }
2029
2030 /* This is a helper function to test for pending mgmt commands that can
2031  * cause CoD or EIR HCI commands. We can only allow one such pending
2032  * mgmt command at a time since otherwise we cannot easily track what
2033  * the current values are, will be, and based on that calculate if a new
2034  * HCI command needs to be sent and if yes with what value.
2035  */
2036 static bool pending_eir_or_class(struct hci_dev *hdev)
2037 {
2038         struct mgmt_pending_cmd *cmd;
2039
2040         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2041                 switch (cmd->opcode) {
2042                 case MGMT_OP_ADD_UUID:
2043                 case MGMT_OP_REMOVE_UUID:
2044                 case MGMT_OP_SET_DEV_CLASS:
2045                 case MGMT_OP_SET_POWERED:
2046                         return true;
2047                 }
2048         }
2049
2050         return false;
2051 }
2052
2053 static const u8 bluetooth_base_uuid[] = {
2054                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2055                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2056 };
2057
2058 static u8 get_uuid_size(const u8 *uuid)
2059 {
2060         u32 val;
2061
2062         if (memcmp(uuid, bluetooth_base_uuid, 12))
2063                 return 128;
2064
2065         val = get_unaligned_le32(&uuid[12]);
2066         if (val > 0xffff)
2067                 return 32;
2068
2069         return 16;
2070 }
2071
2072 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2073 {
2074         struct mgmt_pending_cmd *cmd;
2075
2076         hci_dev_lock(hdev);
2077
2078         cmd = pending_find(mgmt_op, hdev);
2079         if (!cmd)
2080                 goto unlock;
2081
2082         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2083                           mgmt_status(status), hdev->dev_class, 3);
2084
2085         mgmt_pending_remove(cmd);
2086
2087 unlock:
2088         hci_dev_unlock(hdev);
2089 }
2090
2091 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2092 {
2093         bt_dev_dbg(hdev, "status 0x%02x", status);
2094
2095         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2096 }
2097
2098 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2099 {
2100         struct mgmt_cp_add_uuid *cp = data;
2101         struct mgmt_pending_cmd *cmd;
2102         struct hci_request req;
2103         struct bt_uuid *uuid;
2104         int err;
2105
2106         bt_dev_dbg(hdev, "sock %p", sk);
2107
2108         hci_dev_lock(hdev);
2109
2110         if (pending_eir_or_class(hdev)) {
2111                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2112                                       MGMT_STATUS_BUSY);
2113                 goto failed;
2114         }
2115
2116         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2117         if (!uuid) {
2118                 err = -ENOMEM;
2119                 goto failed;
2120         }
2121
2122         memcpy(uuid->uuid, cp->uuid, 16);
2123         uuid->svc_hint = cp->svc_hint;
2124         uuid->size = get_uuid_size(cp->uuid);
2125
2126         list_add_tail(&uuid->list, &hdev->uuids);
2127
2128         hci_req_init(&req, hdev);
2129
2130         __hci_req_update_class(&req);
2131         __hci_req_update_eir(&req);
2132
2133         err = hci_req_run(&req, add_uuid_complete);
2134         if (err < 0) {
2135                 if (err != -ENODATA)
2136                         goto failed;
2137
2138                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2139                                         hdev->dev_class, 3);
2140                 goto failed;
2141         }
2142
2143         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2144         if (!cmd) {
2145                 err = -ENOMEM;
2146                 goto failed;
2147         }
2148
2149         err = 0;
2150
2151 failed:
2152         hci_dev_unlock(hdev);
2153         return err;
2154 }
2155
2156 static bool enable_service_cache(struct hci_dev *hdev)
2157 {
2158         if (!hdev_is_powered(hdev))
2159                 return false;
2160
2161         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2162                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2163                                    CACHE_TIMEOUT);
2164                 return true;
2165         }
2166
2167         return false;
2168 }
2169
2170 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2171 {
2172         bt_dev_dbg(hdev, "status 0x%02x", status);
2173
2174         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2175 }
2176
2177 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2178                        u16 len)
2179 {
2180         struct mgmt_cp_remove_uuid *cp = data;
2181         struct mgmt_pending_cmd *cmd;
2182         struct bt_uuid *match, *tmp;
2183         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2184         struct hci_request req;
2185         int err, found;
2186
2187         bt_dev_dbg(hdev, "sock %p", sk);
2188
2189         hci_dev_lock(hdev);
2190
2191         if (pending_eir_or_class(hdev)) {
2192                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2193                                       MGMT_STATUS_BUSY);
2194                 goto unlock;
2195         }
2196
2197         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2198                 hci_uuids_clear(hdev);
2199
2200                 if (enable_service_cache(hdev)) {
2201                         err = mgmt_cmd_complete(sk, hdev->id,
2202                                                 MGMT_OP_REMOVE_UUID,
2203                                                 0, hdev->dev_class, 3);
2204                         goto unlock;
2205                 }
2206
2207                 goto update_class;
2208         }
2209
2210         found = 0;
2211
2212         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2213                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2214                         continue;
2215
2216                 list_del(&match->list);
2217                 kfree(match);
2218                 found++;
2219         }
2220
2221         if (found == 0) {
2222                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2223                                       MGMT_STATUS_INVALID_PARAMS);
2224                 goto unlock;
2225         }
2226
2227 update_class:
2228         hci_req_init(&req, hdev);
2229
2230         __hci_req_update_class(&req);
2231         __hci_req_update_eir(&req);
2232
2233         err = hci_req_run(&req, remove_uuid_complete);
2234         if (err < 0) {
2235                 if (err != -ENODATA)
2236                         goto unlock;
2237
2238                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2239                                         hdev->dev_class, 3);
2240                 goto unlock;
2241         }
2242
2243         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2244         if (!cmd) {
2245                 err = -ENOMEM;
2246                 goto unlock;
2247         }
2248
2249         err = 0;
2250
2251 unlock:
2252         hci_dev_unlock(hdev);
2253         return err;
2254 }
2255
2256 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2257 {
2258         bt_dev_dbg(hdev, "status 0x%02x", status);
2259
2260         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2261 }
2262
2263 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2264                          u16 len)
2265 {
2266         struct mgmt_cp_set_dev_class *cp = data;
2267         struct mgmt_pending_cmd *cmd;
2268         struct hci_request req;
2269         int err;
2270
2271         bt_dev_dbg(hdev, "sock %p", sk);
2272
2273         if (!lmp_bredr_capable(hdev))
2274                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2275                                        MGMT_STATUS_NOT_SUPPORTED);
2276
2277         hci_dev_lock(hdev);
2278
2279         if (pending_eir_or_class(hdev)) {
2280                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2281                                       MGMT_STATUS_BUSY);
2282                 goto unlock;
2283         }
2284
2285         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2286                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2287                                       MGMT_STATUS_INVALID_PARAMS);
2288                 goto unlock;
2289         }
2290
2291         hdev->major_class = cp->major;
2292         hdev->minor_class = cp->minor;
2293
2294         if (!hdev_is_powered(hdev)) {
2295                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2296                                         hdev->dev_class, 3);
2297                 goto unlock;
2298         }
2299
2300         hci_req_init(&req, hdev);
2301
2302         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2303                 hci_dev_unlock(hdev);
2304                 cancel_delayed_work_sync(&hdev->service_cache);
2305                 hci_dev_lock(hdev);
2306                 __hci_req_update_eir(&req);
2307         }
2308
2309         __hci_req_update_class(&req);
2310
2311         err = hci_req_run(&req, set_class_complete);
2312         if (err < 0) {
2313                 if (err != -ENODATA)
2314                         goto unlock;
2315
2316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2317                                         hdev->dev_class, 3);
2318                 goto unlock;
2319         }
2320
2321         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2322         if (!cmd) {
2323                 err = -ENOMEM;
2324                 goto unlock;
2325         }
2326
2327         err = 0;
2328
2329 unlock:
2330         hci_dev_unlock(hdev);
2331         return err;
2332 }
2333
2334 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2335                           u16 len)
2336 {
2337         struct mgmt_cp_load_link_keys *cp = data;
2338         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2339                                    sizeof(struct mgmt_link_key_info));
2340         u16 key_count, expected_len;
2341         bool changed;
2342         int i;
2343
2344         bt_dev_dbg(hdev, "sock %p", sk);
2345
2346         if (!lmp_bredr_capable(hdev))
2347                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2348                                        MGMT_STATUS_NOT_SUPPORTED);
2349
2350         key_count = __le16_to_cpu(cp->key_count);
2351         if (key_count > max_key_count) {
2352                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2353                            key_count);
2354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2355                                        MGMT_STATUS_INVALID_PARAMS);
2356         }
2357
2358         expected_len = struct_size(cp, keys, key_count);
2359         if (expected_len != len) {
2360                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2361                            expected_len, len);
2362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2363                                        MGMT_STATUS_INVALID_PARAMS);
2364         }
2365
2366         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2367                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2368                                        MGMT_STATUS_INVALID_PARAMS);
2369
2370         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2371                    key_count);
2372
2373         for (i = 0; i < key_count; i++) {
2374                 struct mgmt_link_key_info *key = &cp->keys[i];
2375
2376                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2377                         return mgmt_cmd_status(sk, hdev->id,
2378                                                MGMT_OP_LOAD_LINK_KEYS,
2379                                                MGMT_STATUS_INVALID_PARAMS);
2380         }
2381
2382         hci_dev_lock(hdev);
2383
2384         hci_link_keys_clear(hdev);
2385
2386         if (cp->debug_keys)
2387                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2388         else
2389                 changed = hci_dev_test_and_clear_flag(hdev,
2390                                                       HCI_KEEP_DEBUG_KEYS);
2391
2392         if (changed)
2393                 new_settings(hdev, NULL);
2394
2395         for (i = 0; i < key_count; i++) {
2396                 struct mgmt_link_key_info *key = &cp->keys[i];
2397
2398                 if (hci_is_blocked_key(hdev,
2399                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2400                                        key->val)) {
2401                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2402                                     &key->addr.bdaddr);
2403                         continue;
2404                 }
2405
2406                 /* Always ignore debug keys and require a new pairing if
2407                  * the user wants to use them.
2408                  */
2409                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2410                         continue;
2411
2412                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2413                                  key->type, key->pin_len, NULL);
2414         }
2415
2416         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2417
2418         hci_dev_unlock(hdev);
2419
2420         return 0;
2421 }
2422
2423 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2424                            u8 addr_type, struct sock *skip_sk)
2425 {
2426         struct mgmt_ev_device_unpaired ev;
2427
2428         bacpy(&ev.addr.bdaddr, bdaddr);
2429         ev.addr.type = addr_type;
2430
2431         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2432                           skip_sk);
2433 }
2434
2435 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2436                          u16 len)
2437 {
2438         struct mgmt_cp_unpair_device *cp = data;
2439         struct mgmt_rp_unpair_device rp;
2440         struct hci_conn_params *params;
2441         struct mgmt_pending_cmd *cmd;
2442         struct hci_conn *conn;
2443         u8 addr_type;
2444         int err;
2445
2446         memset(&rp, 0, sizeof(rp));
2447         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2448         rp.addr.type = cp->addr.type;
2449
2450         if (!bdaddr_type_is_valid(cp->addr.type))
2451                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2452                                          MGMT_STATUS_INVALID_PARAMS,
2453                                          &rp, sizeof(rp));
2454
2455         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2456                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2457                                          MGMT_STATUS_INVALID_PARAMS,
2458                                          &rp, sizeof(rp));
2459
2460         hci_dev_lock(hdev);
2461
2462         if (!hdev_is_powered(hdev)) {
2463                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2464                                         MGMT_STATUS_NOT_POWERED, &rp,
2465                                         sizeof(rp));
2466                 goto unlock;
2467         }
2468
2469         if (cp->addr.type == BDADDR_BREDR) {
2470                 /* If disconnection is requested, then look up the
2471                  * connection. If the remote device is connected, it
2472                  * will be later used to terminate the link.
2473                  *
2474                  * Setting it to NULL explicitly will cause no
2475                  * termination of the link.
2476                  */
2477                 if (cp->disconnect)
2478                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2479                                                        &cp->addr.bdaddr);
2480                 else
2481                         conn = NULL;
2482
2483                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2484                 if (err < 0) {
2485                         err = mgmt_cmd_complete(sk, hdev->id,
2486                                                 MGMT_OP_UNPAIR_DEVICE,
2487                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2488                                                 sizeof(rp));
2489                         goto unlock;
2490                 }
2491
2492                 goto done;
2493         }
2494
2495         /* LE address type */
2496         addr_type = le_addr_type(cp->addr.type);
2497
2498         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2499         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2500         if (err < 0) {
2501                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2502                                         MGMT_STATUS_NOT_PAIRED, &rp,
2503                                         sizeof(rp));
2504                 goto unlock;
2505         }
2506
2507         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2508         if (!conn) {
2509                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2510                 goto done;
2511         }
2512
2513
2514         /* Defer clearing up the connection parameters until closing to
2515          * give a chance of keeping them if a repairing happens.
2516          */
2517         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2518
2519         /* Disable auto-connection parameters if present */
2520         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2521         if (params) {
2522                 if (params->explicit_connect)
2523                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2524                 else
2525                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2526         }
2527
2528         /* If disconnection is not requested, then clear the connection
2529          * variable so that the link is not terminated.
2530          */
2531         if (!cp->disconnect)
2532                 conn = NULL;
2533
2534 done:
2535         /* If the connection variable is set, then termination of the
2536          * link is requested.
2537          */
2538         if (!conn) {
2539                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2540                                         &rp, sizeof(rp));
2541                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2542                 goto unlock;
2543         }
2544
2545         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2546                                sizeof(*cp));
2547         if (!cmd) {
2548                 err = -ENOMEM;
2549                 goto unlock;
2550         }
2551
2552         cmd->cmd_complete = addr_cmd_complete;
2553
2554         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2555         if (err < 0)
2556                 mgmt_pending_remove(cmd);
2557
2558 unlock:
2559         hci_dev_unlock(hdev);
2560         return err;
2561 }
2562
2563 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2564                       u16 len)
2565 {
2566         struct mgmt_cp_disconnect *cp = data;
2567         struct mgmt_rp_disconnect rp;
2568         struct mgmt_pending_cmd *cmd;
2569         struct hci_conn *conn;
2570         int err;
2571
2572         bt_dev_dbg(hdev, "sock %p", sk);
2573
2574         memset(&rp, 0, sizeof(rp));
2575         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2576         rp.addr.type = cp->addr.type;
2577
2578         if (!bdaddr_type_is_valid(cp->addr.type))
2579                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2580                                          MGMT_STATUS_INVALID_PARAMS,
2581                                          &rp, sizeof(rp));
2582
2583         hci_dev_lock(hdev);
2584
2585         if (!test_bit(HCI_UP, &hdev->flags)) {
2586                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2587                                         MGMT_STATUS_NOT_POWERED, &rp,
2588                                         sizeof(rp));
2589                 goto failed;
2590         }
2591
2592         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2593                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2594                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2595                 goto failed;
2596         }
2597
2598         if (cp->addr.type == BDADDR_BREDR)
2599                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2600                                                &cp->addr.bdaddr);
2601         else
2602                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2603                                                le_addr_type(cp->addr.type));
2604
2605         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2606                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2607                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2608                                         sizeof(rp));
2609                 goto failed;
2610         }
2611
2612         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2613         if (!cmd) {
2614                 err = -ENOMEM;
2615                 goto failed;
2616         }
2617
2618         cmd->cmd_complete = generic_cmd_complete;
2619
2620         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2621         if (err < 0)
2622                 mgmt_pending_remove(cmd);
2623
2624 failed:
2625         hci_dev_unlock(hdev);
2626         return err;
2627 }
2628
2629 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2630 {
2631         switch (link_type) {
2632         case LE_LINK:
2633                 switch (addr_type) {
2634                 case ADDR_LE_DEV_PUBLIC:
2635                         return BDADDR_LE_PUBLIC;
2636
2637                 default:
2638                         /* Fallback to LE Random address type */
2639                         return BDADDR_LE_RANDOM;
2640                 }
2641
2642         default:
2643                 /* Fallback to BR/EDR type */
2644                 return BDADDR_BREDR;
2645         }
2646 }
2647
2648 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2649                            u16 data_len)
2650 {
2651         struct mgmt_rp_get_connections *rp;
2652         struct hci_conn *c;
2653         int err;
2654         u16 i;
2655
2656         bt_dev_dbg(hdev, "sock %p", sk);
2657
2658         hci_dev_lock(hdev);
2659
2660         if (!hdev_is_powered(hdev)) {
2661                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2662                                       MGMT_STATUS_NOT_POWERED);
2663                 goto unlock;
2664         }
2665
2666         i = 0;
2667         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2668                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2669                         i++;
2670         }
2671
2672         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2673         if (!rp) {
2674                 err = -ENOMEM;
2675                 goto unlock;
2676         }
2677
2678         i = 0;
2679         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2680                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2681                         continue;
2682                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2683                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2684                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2685                         continue;
2686                 i++;
2687         }
2688
2689         rp->conn_count = cpu_to_le16(i);
2690
2691         /* Recalculate length in case of filtered SCO connections, etc */
2692         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2693                                 struct_size(rp, addr, i));
2694
2695         kfree(rp);
2696
2697 unlock:
2698         hci_dev_unlock(hdev);
2699         return err;
2700 }
2701
2702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2703                                    struct mgmt_cp_pin_code_neg_reply *cp)
2704 {
2705         struct mgmt_pending_cmd *cmd;
2706         int err;
2707
2708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2709                                sizeof(*cp));
2710         if (!cmd)
2711                 return -ENOMEM;
2712
2713         cmd->cmd_complete = addr_cmd_complete;
2714
2715         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2716                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2717         if (err < 0)
2718                 mgmt_pending_remove(cmd);
2719
2720         return err;
2721 }
2722
2723 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2724                           u16 len)
2725 {
2726         struct hci_conn *conn;
2727         struct mgmt_cp_pin_code_reply *cp = data;
2728         struct hci_cp_pin_code_reply reply;
2729         struct mgmt_pending_cmd *cmd;
2730         int err;
2731
2732         bt_dev_dbg(hdev, "sock %p", sk);
2733
2734         hci_dev_lock(hdev);
2735
2736         if (!hdev_is_powered(hdev)) {
2737                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2738                                       MGMT_STATUS_NOT_POWERED);
2739                 goto failed;
2740         }
2741
2742         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2743         if (!conn) {
2744                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2745                                       MGMT_STATUS_NOT_CONNECTED);
2746                 goto failed;
2747         }
2748
2749         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2750                 struct mgmt_cp_pin_code_neg_reply ncp;
2751
2752                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2753
2754                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2755
2756                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2757                 if (err >= 0)
2758                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2759                                               MGMT_STATUS_INVALID_PARAMS);
2760
2761                 goto failed;
2762         }
2763
2764         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2765         if (!cmd) {
2766                 err = -ENOMEM;
2767                 goto failed;
2768         }
2769
2770         cmd->cmd_complete = addr_cmd_complete;
2771
2772         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2773         reply.pin_len = cp->pin_len;
2774         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2775
2776         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2777         if (err < 0)
2778                 mgmt_pending_remove(cmd);
2779
2780 failed:
2781         hci_dev_unlock(hdev);
2782         return err;
2783 }
2784
2785 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2786                              u16 len)
2787 {
2788         struct mgmt_cp_set_io_capability *cp = data;
2789
2790         bt_dev_dbg(hdev, "sock %p", sk);
2791
2792         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2793                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2794                                        MGMT_STATUS_INVALID_PARAMS);
2795
2796         hci_dev_lock(hdev);
2797
2798         hdev->io_capability = cp->io_capability;
2799
2800         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2801
2802         hci_dev_unlock(hdev);
2803
2804         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2805                                  NULL, 0);
2806 }
2807
2808 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2809 {
2810         struct hci_dev *hdev = conn->hdev;
2811         struct mgmt_pending_cmd *cmd;
2812
2813         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2814                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2815                         continue;
2816
2817                 if (cmd->user_data != conn)
2818                         continue;
2819
2820                 return cmd;
2821         }
2822
2823         return NULL;
2824 }
2825
2826 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2827 {
2828         struct mgmt_rp_pair_device rp;
2829         struct hci_conn *conn = cmd->user_data;
2830         int err;
2831
2832         bacpy(&rp.addr.bdaddr, &conn->dst);
2833         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2834
2835         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2836                                 status, &rp, sizeof(rp));
2837
2838         /* So we don't get further callbacks for this connection */
2839         conn->connect_cfm_cb = NULL;
2840         conn->security_cfm_cb = NULL;
2841         conn->disconn_cfm_cb = NULL;
2842
2843         hci_conn_drop(conn);
2844
2845         /* The device is paired so there is no need to remove
2846          * its connection parameters anymore.
2847          */
2848         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2849
2850         hci_conn_put(conn);
2851
2852         return err;
2853 }
2854
2855 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2856 {
2857         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2858         struct mgmt_pending_cmd *cmd;
2859
2860         cmd = find_pairing(conn);
2861         if (cmd) {
2862                 cmd->cmd_complete(cmd, status);
2863                 mgmt_pending_remove(cmd);
2864         }
2865 }
2866
2867 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2868 {
2869         struct mgmt_pending_cmd *cmd;
2870
2871         BT_DBG("status %u", status);
2872
2873         cmd = find_pairing(conn);
2874         if (!cmd) {
2875                 BT_DBG("Unable to find a pending command");
2876                 return;
2877         }
2878
2879         cmd->cmd_complete(cmd, mgmt_status(status));
2880         mgmt_pending_remove(cmd);
2881 }
2882
2883 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2884 {
2885         struct mgmt_pending_cmd *cmd;
2886
2887         BT_DBG("status %u", status);
2888
2889         if (!status)
2890                 return;
2891
2892         cmd = find_pairing(conn);
2893         if (!cmd) {
2894                 BT_DBG("Unable to find a pending command");
2895                 return;
2896         }
2897
2898         cmd->cmd_complete(cmd, mgmt_status(status));
2899         mgmt_pending_remove(cmd);
2900 }
2901
2902 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2903                        u16 len)
2904 {
2905         struct mgmt_cp_pair_device *cp = data;
2906         struct mgmt_rp_pair_device rp;
2907         struct mgmt_pending_cmd *cmd;
2908         u8 sec_level, auth_type;
2909         struct hci_conn *conn;
2910         int err;
2911
2912         bt_dev_dbg(hdev, "sock %p", sk);
2913
2914         memset(&rp, 0, sizeof(rp));
2915         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2916         rp.addr.type = cp->addr.type;
2917
2918         if (!bdaddr_type_is_valid(cp->addr.type))
2919                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2920                                          MGMT_STATUS_INVALID_PARAMS,
2921                                          &rp, sizeof(rp));
2922
2923         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2924                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2925                                          MGMT_STATUS_INVALID_PARAMS,
2926                                          &rp, sizeof(rp));
2927
2928         hci_dev_lock(hdev);
2929
2930         if (!hdev_is_powered(hdev)) {
2931                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2932                                         MGMT_STATUS_NOT_POWERED, &rp,
2933                                         sizeof(rp));
2934                 goto unlock;
2935         }
2936
2937         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2938                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2939                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2940                                         sizeof(rp));
2941                 goto unlock;
2942         }
2943
2944         sec_level = BT_SECURITY_MEDIUM;
2945         auth_type = HCI_AT_DEDICATED_BONDING;
2946
2947         if (cp->addr.type == BDADDR_BREDR) {
2948                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2949                                        auth_type, CONN_REASON_PAIR_DEVICE);
2950         } else {
2951                 u8 addr_type = le_addr_type(cp->addr.type);
2952                 struct hci_conn_params *p;
2953
2954                 /* When pairing a new device, it is expected to remember
2955                  * this device for future connections. Adding the connection
2956                  * parameter information ahead of time allows tracking
2957                  * of the slave preferred values and will speed up any
2958                  * further connection establishment.
2959                  *
2960                  * If connection parameters already exist, then they
2961                  * will be kept and this function does nothing.
2962                  */
2963                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2964
2965                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2966                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2967
2968                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2969                                            sec_level, HCI_LE_CONN_TIMEOUT,
2970                                            CONN_REASON_PAIR_DEVICE);
2971         }
2972
2973         if (IS_ERR(conn)) {
2974                 int status;
2975
2976                 if (PTR_ERR(conn) == -EBUSY)
2977                         status = MGMT_STATUS_BUSY;
2978                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2979                         status = MGMT_STATUS_NOT_SUPPORTED;
2980                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2981                         status = MGMT_STATUS_REJECTED;
2982                 else
2983                         status = MGMT_STATUS_CONNECT_FAILED;
2984
2985                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2986                                         status, &rp, sizeof(rp));
2987                 goto unlock;
2988         }
2989
2990         if (conn->connect_cfm_cb) {
2991                 hci_conn_drop(conn);
2992                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2993                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2994                 goto unlock;
2995         }
2996
2997         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2998         if (!cmd) {
2999                 err = -ENOMEM;
3000                 hci_conn_drop(conn);
3001                 goto unlock;
3002         }
3003
3004         cmd->cmd_complete = pairing_complete;
3005
3006         /* For LE, just connecting isn't a proof that the pairing finished */
3007         if (cp->addr.type == BDADDR_BREDR) {
3008                 conn->connect_cfm_cb = pairing_complete_cb;
3009                 conn->security_cfm_cb = pairing_complete_cb;
3010                 conn->disconn_cfm_cb = pairing_complete_cb;
3011         } else {
3012                 conn->connect_cfm_cb = le_pairing_complete_cb;
3013                 conn->security_cfm_cb = le_pairing_complete_cb;
3014                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3015         }
3016
3017         conn->io_capability = cp->io_cap;
3018         cmd->user_data = hci_conn_get(conn);
3019
3020         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3021             hci_conn_security(conn, sec_level, auth_type, true)) {
3022                 cmd->cmd_complete(cmd, 0);
3023                 mgmt_pending_remove(cmd);
3024         }
3025
3026         err = 0;
3027
3028 unlock:
3029         hci_dev_unlock(hdev);
3030         return err;
3031 }
3032
3033 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3034                               u16 len)
3035 {
3036         struct mgmt_addr_info *addr = data;
3037         struct mgmt_pending_cmd *cmd;
3038         struct hci_conn *conn;
3039         int err;
3040
3041         bt_dev_dbg(hdev, "sock %p", sk);
3042
3043         hci_dev_lock(hdev);
3044
3045         if (!hdev_is_powered(hdev)) {
3046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3047                                       MGMT_STATUS_NOT_POWERED);
3048                 goto unlock;
3049         }
3050
3051         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3052         if (!cmd) {
3053                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3054                                       MGMT_STATUS_INVALID_PARAMS);
3055                 goto unlock;
3056         }
3057
3058         conn = cmd->user_data;
3059
3060         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3061                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3062                                       MGMT_STATUS_INVALID_PARAMS);
3063                 goto unlock;
3064         }
3065
3066         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3067         mgmt_pending_remove(cmd);
3068
3069         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3070                                 addr, sizeof(*addr));
3071
3072         /* Since user doesn't want to proceed with the connection, abort any
3073          * ongoing pairing and then terminate the link if it was created
3074          * because of the pair device action.
3075          */
3076         if (addr->type == BDADDR_BREDR)
3077                 hci_remove_link_key(hdev, &addr->bdaddr);
3078         else
3079                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3080                                               le_addr_type(addr->type));
3081
3082         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3083                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3084
3085 unlock:
3086         hci_dev_unlock(hdev);
3087         return err;
3088 }
3089
3090 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3091                              struct mgmt_addr_info *addr, u16 mgmt_op,
3092                              u16 hci_op, __le32 passkey)
3093 {
3094         struct mgmt_pending_cmd *cmd;
3095         struct hci_conn *conn;
3096         int err;
3097
3098         hci_dev_lock(hdev);
3099
3100         if (!hdev_is_powered(hdev)) {
3101                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3102                                         MGMT_STATUS_NOT_POWERED, addr,
3103                                         sizeof(*addr));
3104                 goto done;
3105         }
3106
3107         if (addr->type == BDADDR_BREDR)
3108                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3109         else
3110                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3111                                                le_addr_type(addr->type));
3112
3113         if (!conn) {
3114                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3115                                         MGMT_STATUS_NOT_CONNECTED, addr,
3116                                         sizeof(*addr));
3117                 goto done;
3118         }
3119
3120         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3121                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3122                 if (!err)
3123                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                                 MGMT_STATUS_SUCCESS, addr,
3125                                                 sizeof(*addr));
3126                 else
3127                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3128                                                 MGMT_STATUS_FAILED, addr,
3129                                                 sizeof(*addr));
3130
3131                 goto done;
3132         }
3133
3134         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3135         if (!cmd) {
3136                 err = -ENOMEM;
3137                 goto done;
3138         }
3139
3140         cmd->cmd_complete = addr_cmd_complete;
3141
3142         /* Continue with pairing via HCI */
3143         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3144                 struct hci_cp_user_passkey_reply cp;
3145
3146                 bacpy(&cp.bdaddr, &addr->bdaddr);
3147                 cp.passkey = passkey;
3148                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3149         } else
3150                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3151                                    &addr->bdaddr);
3152
3153         if (err < 0)
3154                 mgmt_pending_remove(cmd);
3155
3156 done:
3157         hci_dev_unlock(hdev);
3158         return err;
3159 }
3160
3161 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3162                               void *data, u16 len)
3163 {
3164         struct mgmt_cp_pin_code_neg_reply *cp = data;
3165
3166         bt_dev_dbg(hdev, "sock %p", sk);
3167
3168         return user_pairing_resp(sk, hdev, &cp->addr,
3169                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3170                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3171 }
3172
3173 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3174                               u16 len)
3175 {
3176         struct mgmt_cp_user_confirm_reply *cp = data;
3177
3178         bt_dev_dbg(hdev, "sock %p", sk);
3179
3180         if (len != sizeof(*cp))
3181                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3182                                        MGMT_STATUS_INVALID_PARAMS);
3183
3184         return user_pairing_resp(sk, hdev, &cp->addr,
3185                                  MGMT_OP_USER_CONFIRM_REPLY,
3186                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3187 }
3188
3189 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3190                                   void *data, u16 len)
3191 {
3192         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3193
3194         bt_dev_dbg(hdev, "sock %p", sk);
3195
3196         return user_pairing_resp(sk, hdev, &cp->addr,
3197                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3198                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3199 }
3200
3201 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3202                               u16 len)
3203 {
3204         struct mgmt_cp_user_passkey_reply *cp = data;
3205
3206         bt_dev_dbg(hdev, "sock %p", sk);
3207
3208         return user_pairing_resp(sk, hdev, &cp->addr,
3209                                  MGMT_OP_USER_PASSKEY_REPLY,
3210                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3211 }
3212
3213 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3214                                   void *data, u16 len)
3215 {
3216         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3217
3218         bt_dev_dbg(hdev, "sock %p", sk);
3219
3220         return user_pairing_resp(sk, hdev, &cp->addr,
3221                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3222                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3223 }
3224
3225 static void adv_expire(struct hci_dev *hdev, u32 flags)
3226 {
3227         struct adv_info *adv_instance;
3228         struct hci_request req;
3229         int err;
3230
3231         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3232         if (!adv_instance)
3233                 return;
3234
3235         /* stop if current instance doesn't need to be changed */
3236         if (!(adv_instance->flags & flags))
3237                 return;
3238
3239         cancel_adv_timeout(hdev);
3240
3241         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3242         if (!adv_instance)
3243                 return;
3244
3245         hci_req_init(&req, hdev);
3246         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3247                                               true);
3248         if (err)
3249                 return;
3250
3251         hci_req_run(&req, NULL);
3252 }
3253
3254 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3255 {
3256         struct mgmt_cp_set_local_name *cp;
3257         struct mgmt_pending_cmd *cmd;
3258
3259         bt_dev_dbg(hdev, "status 0x%02x", status);
3260
3261         hci_dev_lock(hdev);
3262
3263         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3264         if (!cmd)
3265                 goto unlock;
3266
3267         cp = cmd->param;
3268
3269         if (status) {
3270                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3271                                 mgmt_status(status));
3272         } else {
3273                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3274                                   cp, sizeof(*cp));
3275
3276                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3277                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3278         }
3279
3280         mgmt_pending_remove(cmd);
3281
3282 unlock:
3283         hci_dev_unlock(hdev);
3284 }
3285
3286 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3287                           u16 len)
3288 {
3289         struct mgmt_cp_set_local_name *cp = data;
3290         struct mgmt_pending_cmd *cmd;
3291         struct hci_request req;
3292         int err;
3293
3294         bt_dev_dbg(hdev, "sock %p", sk);
3295
3296         hci_dev_lock(hdev);
3297
3298         /* If the old values are the same as the new ones just return a
3299          * direct command complete event.
3300          */
3301         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3302             !memcmp(hdev->short_name, cp->short_name,
3303                     sizeof(hdev->short_name))) {
3304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3305                                         data, len);
3306                 goto failed;
3307         }
3308
3309         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3310
3311         if (!hdev_is_powered(hdev)) {
3312                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3313
3314                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3315                                         data, len);
3316                 if (err < 0)
3317                         goto failed;
3318
3319                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3320                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3321                 ext_info_changed(hdev, sk);
3322
3323                 goto failed;
3324         }
3325
3326         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3327         if (!cmd) {
3328                 err = -ENOMEM;
3329                 goto failed;
3330         }
3331
3332         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3333
3334         hci_req_init(&req, hdev);
3335
3336         if (lmp_bredr_capable(hdev)) {
3337                 __hci_req_update_name(&req);
3338                 __hci_req_update_eir(&req);
3339         }
3340
3341         /* The name is stored in the scan response data and so
3342          * no need to udpate the advertising data here.
3343          */
3344         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3345                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3346
3347         err = hci_req_run(&req, set_name_complete);
3348         if (err < 0)
3349                 mgmt_pending_remove(cmd);
3350
3351 failed:
3352         hci_dev_unlock(hdev);
3353         return err;
3354 }
3355
3356 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3357                           u16 len)
3358 {
3359         struct mgmt_cp_set_appearance *cp = data;
3360         u16 appearance;
3361         int err;
3362
3363         bt_dev_dbg(hdev, "sock %p", sk);
3364
3365         if (!lmp_le_capable(hdev))
3366                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3367                                        MGMT_STATUS_NOT_SUPPORTED);
3368
3369         appearance = le16_to_cpu(cp->appearance);
3370
3371         hci_dev_lock(hdev);
3372
3373         if (hdev->appearance != appearance) {
3374                 hdev->appearance = appearance;
3375
3376                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3377                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3378
3379                 ext_info_changed(hdev, sk);
3380         }
3381
3382         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3383                                 0);
3384
3385         hci_dev_unlock(hdev);
3386
3387         return err;
3388 }
3389
3390 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3391                                  void *data, u16 len)
3392 {
3393         struct mgmt_rp_get_phy_confguration rp;
3394
3395         bt_dev_dbg(hdev, "sock %p", sk);
3396
3397         hci_dev_lock(hdev);
3398
3399         memset(&rp, 0, sizeof(rp));
3400
3401         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3402         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3403         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3404
3405         hci_dev_unlock(hdev);
3406
3407         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3408                                  &rp, sizeof(rp));
3409 }
3410
3411 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3412 {
3413         struct mgmt_ev_phy_configuration_changed ev;
3414
3415         memset(&ev, 0, sizeof(ev));
3416
3417         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3418
3419         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3420                           sizeof(ev), skip);
3421 }
3422
3423 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3424                                      u16 opcode, struct sk_buff *skb)
3425 {
3426         struct mgmt_pending_cmd *cmd;
3427
3428         bt_dev_dbg(hdev, "status 0x%02x", status);
3429
3430         hci_dev_lock(hdev);
3431
3432         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3433         if (!cmd)
3434                 goto unlock;
3435
3436         if (status) {
3437                 mgmt_cmd_status(cmd->sk, hdev->id,
3438                                 MGMT_OP_SET_PHY_CONFIGURATION,
3439                                 mgmt_status(status));
3440         } else {
3441                 mgmt_cmd_complete(cmd->sk, hdev->id,
3442                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3443                                   NULL, 0);
3444
3445                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3446         }
3447
3448         mgmt_pending_remove(cmd);
3449
3450 unlock:
3451         hci_dev_unlock(hdev);
3452 }
3453
3454 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3455                                  void *data, u16 len)
3456 {
3457         struct mgmt_cp_set_phy_confguration *cp = data;
3458         struct hci_cp_le_set_default_phy cp_phy;
3459         struct mgmt_pending_cmd *cmd;
3460         struct hci_request req;
3461         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3462         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3463         bool changed = false;
3464         int err;
3465
3466         bt_dev_dbg(hdev, "sock %p", sk);
3467
3468         configurable_phys = get_configurable_phys(hdev);
3469         supported_phys = get_supported_phys(hdev);
3470         selected_phys = __le32_to_cpu(cp->selected_phys);
3471
3472         if (selected_phys & ~supported_phys)
3473                 return mgmt_cmd_status(sk, hdev->id,
3474                                        MGMT_OP_SET_PHY_CONFIGURATION,
3475                                        MGMT_STATUS_INVALID_PARAMS);
3476
3477         unconfigure_phys = supported_phys & ~configurable_phys;
3478
3479         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3480                 return mgmt_cmd_status(sk, hdev->id,
3481                                        MGMT_OP_SET_PHY_CONFIGURATION,
3482                                        MGMT_STATUS_INVALID_PARAMS);
3483
3484         if (selected_phys == get_selected_phys(hdev))
3485                 return mgmt_cmd_complete(sk, hdev->id,
3486                                          MGMT_OP_SET_PHY_CONFIGURATION,
3487                                          0, NULL, 0);
3488
3489         hci_dev_lock(hdev);
3490
3491         if (!hdev_is_powered(hdev)) {
3492                 err = mgmt_cmd_status(sk, hdev->id,
3493                                       MGMT_OP_SET_PHY_CONFIGURATION,
3494                                       MGMT_STATUS_REJECTED);
3495                 goto unlock;
3496         }
3497
3498         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3499                 err = mgmt_cmd_status(sk, hdev->id,
3500                                       MGMT_OP_SET_PHY_CONFIGURATION,
3501                                       MGMT_STATUS_BUSY);
3502                 goto unlock;
3503         }
3504
3505         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3506                 pkt_type |= (HCI_DH3 | HCI_DM3);
3507         else
3508                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3509
3510         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3511                 pkt_type |= (HCI_DH5 | HCI_DM5);
3512         else
3513                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3514
3515         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3516                 pkt_type &= ~HCI_2DH1;
3517         else
3518                 pkt_type |= HCI_2DH1;
3519
3520         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3521                 pkt_type &= ~HCI_2DH3;
3522         else
3523                 pkt_type |= HCI_2DH3;
3524
3525         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3526                 pkt_type &= ~HCI_2DH5;
3527         else
3528                 pkt_type |= HCI_2DH5;
3529
3530         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3531                 pkt_type &= ~HCI_3DH1;
3532         else
3533                 pkt_type |= HCI_3DH1;
3534
3535         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3536                 pkt_type &= ~HCI_3DH3;
3537         else
3538                 pkt_type |= HCI_3DH3;
3539
3540         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3541                 pkt_type &= ~HCI_3DH5;
3542         else
3543                 pkt_type |= HCI_3DH5;
3544
3545         if (pkt_type != hdev->pkt_type) {
3546                 hdev->pkt_type = pkt_type;
3547                 changed = true;
3548         }
3549
3550         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3551             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3552                 if (changed)
3553                         mgmt_phy_configuration_changed(hdev, sk);
3554
3555                 err = mgmt_cmd_complete(sk, hdev->id,
3556                                         MGMT_OP_SET_PHY_CONFIGURATION,
3557                                         0, NULL, 0);
3558
3559                 goto unlock;
3560         }
3561
3562         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3563                                len);
3564         if (!cmd) {
3565                 err = -ENOMEM;
3566                 goto unlock;
3567         }
3568
3569         hci_req_init(&req, hdev);
3570
3571         memset(&cp_phy, 0, sizeof(cp_phy));
3572
3573         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3574                 cp_phy.all_phys |= 0x01;
3575
3576         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3577                 cp_phy.all_phys |= 0x02;
3578
3579         if (selected_phys & MGMT_PHY_LE_1M_TX)
3580                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3581
3582         if (selected_phys & MGMT_PHY_LE_2M_TX)
3583                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3584
3585         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3586                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_RX)
3589                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_RX)
3592                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3595                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3598
3599         err = hci_req_run_skb(&req, set_default_phy_complete);
3600         if (err < 0)
3601                 mgmt_pending_remove(cmd);
3602
3603 unlock:
3604         hci_dev_unlock(hdev);
3605
3606         return err;
3607 }
3608
3609 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3610                             u16 len)
3611 {
3612         int err = MGMT_STATUS_SUCCESS;
3613         struct mgmt_cp_set_blocked_keys *keys = data;
3614         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3615                                    sizeof(struct mgmt_blocked_key_info));
3616         u16 key_count, expected_len;
3617         int i;
3618
3619         bt_dev_dbg(hdev, "sock %p", sk);
3620
3621         key_count = __le16_to_cpu(keys->key_count);
3622         if (key_count > max_key_count) {
3623                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3624                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3625                                        MGMT_STATUS_INVALID_PARAMS);
3626         }
3627
3628         expected_len = struct_size(keys, keys, key_count);
3629         if (expected_len != len) {
3630                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3631                            expected_len, len);
3632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3633                                        MGMT_STATUS_INVALID_PARAMS);
3634         }
3635
3636         hci_dev_lock(hdev);
3637
3638         hci_blocked_keys_clear(hdev);
3639
3640         for (i = 0; i < keys->key_count; ++i) {
3641                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3642
3643                 if (!b) {
3644                         err = MGMT_STATUS_NO_RESOURCES;
3645                         break;
3646                 }
3647
3648                 b->type = keys->keys[i].type;
3649                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3650                 list_add_rcu(&b->list, &hdev->blocked_keys);
3651         }
3652         hci_dev_unlock(hdev);
3653
3654         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3655                                 err, NULL, 0);
3656 }
3657
3658 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3659                                void *data, u16 len)
3660 {
3661         struct mgmt_mode *cp = data;
3662         int err;
3663         bool changed = false;
3664
3665         bt_dev_dbg(hdev, "sock %p", sk);
3666
3667         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3668                 return mgmt_cmd_status(sk, hdev->id,
3669                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3670                                        MGMT_STATUS_NOT_SUPPORTED);
3671
3672         if (cp->val != 0x00 && cp->val != 0x01)
3673                 return mgmt_cmd_status(sk, hdev->id,
3674                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3675                                        MGMT_STATUS_INVALID_PARAMS);
3676
3677         hci_dev_lock(hdev);
3678
3679         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3680                 err = mgmt_cmd_status(sk, hdev->id,
3681                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3682                                       MGMT_STATUS_BUSY);
3683                 goto unlock;
3684         }
3685
3686         if (hdev_is_powered(hdev) &&
3687             !!cp->val != hci_dev_test_flag(hdev,
3688                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_REJECTED);
3692                 goto unlock;
3693         }
3694
3695         if (cp->val)
3696                 changed = !hci_dev_test_and_set_flag(hdev,
3697                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3698         else
3699                 changed = hci_dev_test_and_clear_flag(hdev,
3700                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3701
3702         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3703         if (err < 0)
3704                 goto unlock;
3705
3706         if (changed)
3707                 err = new_settings(hdev, sk);
3708
3709 unlock:
3710         hci_dev_unlock(hdev);
3711         return err;
3712 }
3713
3714 static int read_security_info(struct sock *sk, struct hci_dev *hdev,
3715                               void *data, u16 data_len)
3716 {
3717         char buf[16];
3718         struct mgmt_rp_read_security_info *rp = (void *)buf;
3719         u16 sec_len = 0;
3720         u8 flags = 0;
3721
3722         bt_dev_dbg(hdev, "sock %p", sk);
3723
3724         memset(&buf, 0, sizeof(buf));
3725
3726         hci_dev_lock(hdev);
3727
3728         /* When the Read Simple Pairing Options command is supported, then
3729          * the remote public key validation is supported.
3730          */
3731         if (hdev->commands[41] & 0x08)
3732                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3733
3734         flags |= 0x02;          /* Remote public key validation (LE) */
3735
3736         /* When the Read Encryption Key Size command is supported, then the
3737          * encryption key size is enforced.
3738          */
3739         if (hdev->commands[20] & 0x10)
3740                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3741
3742         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3743
3744         sec_len = eir_append_data(rp->sec, sec_len, 0x01, &flags, 1);
3745
3746         /* When the Read Simple Pairing Options command is supported, then
3747          * also max encryption key size information is provided.
3748          */
3749         if (hdev->commands[41] & 0x08)
3750                 sec_len = eir_append_le16(rp->sec, sec_len, 0x02,
3751                                           hdev->max_enc_key_size);
3752
3753         sec_len = eir_append_le16(rp->sec, sec_len, 0x03, SMP_MAX_ENC_KEY_SIZE);
3754
3755         rp->sec_len = cpu_to_le16(sec_len);
3756
3757         hci_dev_unlock(hdev);
3758
3759         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_SECURITY_INFO, 0,
3760                                  rp, sizeof(*rp) + sec_len);
3761 }
3762
3763 #ifdef CONFIG_BT_FEATURE_DEBUG
3764 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3765 static const u8 debug_uuid[16] = {
3766         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3767         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3768 };
3769 #endif
3770
3771 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3772 static const u8 simult_central_periph_uuid[16] = {
3773         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3774         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3775 };
3776
3777 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3778 static const u8 rpa_resolution_uuid[16] = {
3779         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3780         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3781 };
3782
3783 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3784                                   void *data, u16 data_len)
3785 {
3786         char buf[62];   /* Enough space for 3 features */
3787         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3788         u16 idx = 0;
3789         u32 flags;
3790
3791         bt_dev_dbg(hdev, "sock %p", sk);
3792
3793         memset(&buf, 0, sizeof(buf));
3794
3795 #ifdef CONFIG_BT_FEATURE_DEBUG
3796         if (!hdev) {
3797                 flags = bt_dbg_get() ? BIT(0) : 0;
3798
3799                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3800                 rp->features[idx].flags = cpu_to_le32(flags);
3801                 idx++;
3802         }
3803 #endif
3804
3805         if (hdev) {
3806                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3807                     (hdev->le_states[4] & 0x08) &&      /* Central */
3808                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3809                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3810                         flags = BIT(0);
3811                 else
3812                         flags = 0;
3813
3814                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3815                 rp->features[idx].flags = cpu_to_le32(flags);
3816                 idx++;
3817         }
3818
3819         if (hdev && use_ll_privacy(hdev)) {
3820                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3821                         flags = BIT(0) | BIT(1);
3822                 else
3823                         flags = BIT(1);
3824
3825                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3826                 rp->features[idx].flags = cpu_to_le32(flags);
3827                 idx++;
3828         }
3829
3830         rp->feature_count = cpu_to_le16(idx);
3831
3832         /* After reading the experimental features information, enable
3833          * the events to update client on any future change.
3834          */
3835         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3836
3837         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3838                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3839                                  0, rp, sizeof(*rp) + (20 * idx));
3840 }
3841
3842 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3843                                           struct sock *skip)
3844 {
3845         struct mgmt_ev_exp_feature_changed ev;
3846
3847         memset(&ev, 0, sizeof(ev));
3848         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3849         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3850
3851         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3852                                   &ev, sizeof(ev),
3853                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3854
3855 }
3856
3857 #ifdef CONFIG_BT_FEATURE_DEBUG
3858 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3859 {
3860         struct mgmt_ev_exp_feature_changed ev;
3861
3862         memset(&ev, 0, sizeof(ev));
3863         memcpy(ev.uuid, debug_uuid, 16);
3864         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3865
3866         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3867                                   &ev, sizeof(ev),
3868                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3869 }
3870 #endif
3871
3872 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3873                            void *data, u16 data_len)
3874 {
3875         struct mgmt_cp_set_exp_feature *cp = data;
3876         struct mgmt_rp_set_exp_feature rp;
3877
3878         bt_dev_dbg(hdev, "sock %p", sk);
3879
3880         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3881                 memset(rp.uuid, 0, 16);
3882                 rp.flags = cpu_to_le32(0);
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885                 if (!hdev) {
3886                         bool changed = bt_dbg_get();
3887
3888                         bt_dbg_set(false);
3889
3890                         if (changed)
3891                                 exp_debug_feature_changed(false, sk);
3892                 }
3893 #endif
3894
3895                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3896                         bool changed = hci_dev_test_flag(hdev,
3897                                                          HCI_ENABLE_LL_PRIVACY);
3898
3899                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3900
3901                         if (changed)
3902                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3903                 }
3904
3905                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3906
3907                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3908                                          MGMT_OP_SET_EXP_FEATURE, 0,
3909                                          &rp, sizeof(rp));
3910         }
3911
3912 #ifdef CONFIG_BT_FEATURE_DEBUG
3913         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3914                 bool val, changed;
3915                 int err;
3916
3917                 /* Command requires to use the non-controller index */
3918                 if (hdev)
3919                         return mgmt_cmd_status(sk, hdev->id,
3920                                                MGMT_OP_SET_EXP_FEATURE,
3921                                                MGMT_STATUS_INVALID_INDEX);
3922
3923                 /* Parameters are limited to a single octet */
3924                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3925                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3926                                                MGMT_OP_SET_EXP_FEATURE,
3927                                                MGMT_STATUS_INVALID_PARAMS);
3928
3929                 /* Only boolean on/off is supported */
3930                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3931                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3932                                                MGMT_OP_SET_EXP_FEATURE,
3933                                                MGMT_STATUS_INVALID_PARAMS);
3934
3935                 val = !!cp->param[0];
3936                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3937                 bt_dbg_set(val);
3938
3939                 memcpy(rp.uuid, debug_uuid, 16);
3940                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3941
3942                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3943
3944                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3945                                         MGMT_OP_SET_EXP_FEATURE, 0,
3946                                         &rp, sizeof(rp));
3947
3948                 if (changed)
3949                         exp_debug_feature_changed(val, sk);
3950
3951                 return err;
3952         }
3953 #endif
3954
3955         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3956                 bool val, changed;
3957                 int err;
3958                 u32 flags;
3959
3960                 /* Command requires to use the controller index */
3961                 if (!hdev)
3962                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3963                                                MGMT_OP_SET_EXP_FEATURE,
3964                                                MGMT_STATUS_INVALID_INDEX);
3965
3966                 /* Changes can only be made when controller is powered down */
3967                 if (hdev_is_powered(hdev))
3968                         return mgmt_cmd_status(sk, hdev->id,
3969                                                MGMT_OP_SET_EXP_FEATURE,
3970                                                MGMT_STATUS_NOT_POWERED);
3971
3972                 /* Parameters are limited to a single octet */
3973                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3974                         return mgmt_cmd_status(sk, hdev->id,
3975                                                MGMT_OP_SET_EXP_FEATURE,
3976                                                MGMT_STATUS_INVALID_PARAMS);
3977
3978                 /* Only boolean on/off is supported */
3979                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3980                         return mgmt_cmd_status(sk, hdev->id,
3981                                                MGMT_OP_SET_EXP_FEATURE,
3982                                                MGMT_STATUS_INVALID_PARAMS);
3983
3984                 val = !!cp->param[0];
3985
3986                 if (val) {
3987                         changed = !hci_dev_test_flag(hdev,
3988                                                      HCI_ENABLE_LL_PRIVACY);
3989                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3990                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3991
3992                         /* Enable LL privacy + supported settings changed */
3993                         flags = BIT(0) | BIT(1);
3994                 } else {
3995                         changed = hci_dev_test_flag(hdev,
3996                                                     HCI_ENABLE_LL_PRIVACY);
3997                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3998
3999                         /* Disable LL privacy + supported settings changed */
4000                         flags = BIT(1);
4001                 }
4002
4003                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4004                 rp.flags = cpu_to_le32(flags);
4005
4006                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4007
4008                 err = mgmt_cmd_complete(sk, hdev->id,
4009                                         MGMT_OP_SET_EXP_FEATURE, 0,
4010                                         &rp, sizeof(rp));
4011
4012                 if (changed)
4013                         exp_ll_privacy_feature_changed(val, hdev, sk);
4014
4015                 return err;
4016         }
4017
4018         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4019                                MGMT_OP_SET_EXP_FEATURE,
4020                                MGMT_STATUS_NOT_SUPPORTED);
4021 }
4022
4023 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4024
4025 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4026                             u16 data_len)
4027 {
4028         struct mgmt_cp_get_device_flags *cp = data;
4029         struct mgmt_rp_get_device_flags rp;
4030         struct bdaddr_list_with_flags *br_params;
4031         struct hci_conn_params *params;
4032         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4033         u32 current_flags = 0;
4034         u8 status = MGMT_STATUS_INVALID_PARAMS;
4035
4036         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4037                    &cp->addr.bdaddr, cp->addr.type);
4038
4039         hci_dev_lock(hdev);
4040
4041         memset(&rp, 0, sizeof(rp));
4042
4043         if (cp->addr.type == BDADDR_BREDR) {
4044                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4045                                                               &cp->addr.bdaddr,
4046                                                               cp->addr.type);
4047                 if (!br_params)
4048                         goto done;
4049
4050                 current_flags = br_params->current_flags;
4051         } else {
4052                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4053                                                 le_addr_type(cp->addr.type));
4054
4055                 if (!params)
4056                         goto done;
4057
4058                 current_flags = params->current_flags;
4059         }
4060
4061         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4062         rp.addr.type = cp->addr.type;
4063         rp.supported_flags = cpu_to_le32(supported_flags);
4064         rp.current_flags = cpu_to_le32(current_flags);
4065
4066         status = MGMT_STATUS_SUCCESS;
4067
4068 done:
4069         hci_dev_unlock(hdev);
4070
4071         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4072                                 &rp, sizeof(rp));
4073 }
4074
4075 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4076                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4077                                  u32 supported_flags, u32 current_flags)
4078 {
4079         struct mgmt_ev_device_flags_changed ev;
4080
4081         bacpy(&ev.addr.bdaddr, bdaddr);
4082         ev.addr.type = bdaddr_type;
4083         ev.supported_flags = cpu_to_le32(supported_flags);
4084         ev.current_flags = cpu_to_le32(current_flags);
4085
4086         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4087 }
4088
4089 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4090                             u16 len)
4091 {
4092         struct mgmt_cp_set_device_flags *cp = data;
4093         struct bdaddr_list_with_flags *br_params;
4094         struct hci_conn_params *params;
4095         u8 status = MGMT_STATUS_INVALID_PARAMS;
4096         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4097         u32 current_flags = __le32_to_cpu(cp->current_flags);
4098
4099         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4100                    &cp->addr.bdaddr, cp->addr.type,
4101                    __le32_to_cpu(current_flags));
4102
4103         if ((supported_flags | current_flags) != supported_flags) {
4104                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4105                             current_flags, supported_flags);
4106                 goto done;
4107         }
4108
4109         hci_dev_lock(hdev);
4110
4111         if (cp->addr.type == BDADDR_BREDR) {
4112                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4113                                                               &cp->addr.bdaddr,
4114                                                               cp->addr.type);
4115
4116                 if (br_params) {
4117                         br_params->current_flags = current_flags;
4118                         status = MGMT_STATUS_SUCCESS;
4119                 } else {
4120                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4121                                     &cp->addr.bdaddr, cp->addr.type);
4122                 }
4123         } else {
4124                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4125                                                 le_addr_type(cp->addr.type));
4126                 if (params) {
4127                         params->current_flags = current_flags;
4128                         status = MGMT_STATUS_SUCCESS;
4129                 } else {
4130                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4131                                     &cp->addr.bdaddr,
4132                                     le_addr_type(cp->addr.type));
4133                 }
4134         }
4135
4136 done:
4137         hci_dev_unlock(hdev);
4138
4139         if (status == MGMT_STATUS_SUCCESS)
4140                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4141                                      supported_flags, current_flags);
4142
4143         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4144                                  &cp->addr, sizeof(cp->addr));
4145 }
4146
4147 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4148                                    u16 handle)
4149 {
4150         struct mgmt_ev_adv_monitor_added ev;
4151
4152         ev.monitor_handle = cpu_to_le16(handle);
4153
4154         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4155 }
4156
4157 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
4158                                      u16 handle)
4159 {
4160         struct mgmt_ev_adv_monitor_added ev;
4161
4162         ev.monitor_handle = cpu_to_le16(handle);
4163
4164         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
4165 }
4166
4167 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4168                                  void *data, u16 len)
4169 {
4170         struct adv_monitor *monitor = NULL;
4171         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4172         int handle, err;
4173         size_t rp_size = 0;
4174         __u32 supported = 0;
4175         __u16 num_handles = 0;
4176         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4177
4178         BT_DBG("request for %s", hdev->name);
4179
4180         hci_dev_lock(hdev);
4181
4182         if (msft_get_features(hdev) & MSFT_FEATURE_MASK_LE_ADV_MONITOR)
4183                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4184
4185         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) {
4186                 handles[num_handles++] = monitor->handle;
4187         }
4188
4189         hci_dev_unlock(hdev);
4190
4191         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4192         rp = kmalloc(rp_size, GFP_KERNEL);
4193         if (!rp)
4194                 return -ENOMEM;
4195
4196         /* Once controller-based monitoring is in place, the enabled_features
4197          * should reflect the use.
4198          */
4199         rp->supported_features = cpu_to_le32(supported);
4200         rp->enabled_features = 0;
4201         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4202         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4203         rp->num_handles = cpu_to_le16(num_handles);
4204         if (num_handles)
4205                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4206
4207         err = mgmt_cmd_complete(sk, hdev->id,
4208                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4209                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4210
4211         kfree(rp);
4212
4213         return err;
4214 }
4215
4216 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4217                                     void *data, u16 len)
4218 {
4219         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4220         struct mgmt_rp_add_adv_patterns_monitor rp;
4221         struct adv_monitor *m = NULL;
4222         struct adv_pattern *p = NULL;
4223         unsigned int mp_cnt = 0, prev_adv_monitors_cnt;
4224         __u8 cp_ofst = 0, cp_len = 0;
4225         int err, i;
4226
4227         BT_DBG("request for %s", hdev->name);
4228
4229         if (len <= sizeof(*cp) || cp->pattern_count == 0) {
4230                 err = mgmt_cmd_status(sk, hdev->id,
4231                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4232                                       MGMT_STATUS_INVALID_PARAMS);
4233                 goto failed;
4234         }
4235
4236         m = kmalloc(sizeof(*m), GFP_KERNEL);
4237         if (!m) {
4238                 err = -ENOMEM;
4239                 goto failed;
4240         }
4241
4242         INIT_LIST_HEAD(&m->patterns);
4243         m->active = false;
4244
4245         for (i = 0; i < cp->pattern_count; i++) {
4246                 if (++mp_cnt > HCI_MAX_ADV_MONITOR_NUM_PATTERNS) {
4247                         err = mgmt_cmd_status(sk, hdev->id,
4248                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4249                                               MGMT_STATUS_INVALID_PARAMS);
4250                         goto failed;
4251                 }
4252
4253                 cp_ofst = cp->patterns[i].offset;
4254                 cp_len = cp->patterns[i].length;
4255                 if (cp_ofst >= HCI_MAX_AD_LENGTH ||
4256                     cp_len > HCI_MAX_AD_LENGTH ||
4257                     (cp_ofst + cp_len) > HCI_MAX_AD_LENGTH) {
4258                         err = mgmt_cmd_status(sk, hdev->id,
4259                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4260                                               MGMT_STATUS_INVALID_PARAMS);
4261                         goto failed;
4262                 }
4263
4264                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4265                 if (!p) {
4266                         err = -ENOMEM;
4267                         goto failed;
4268                 }
4269
4270                 p->ad_type = cp->patterns[i].ad_type;
4271                 p->offset = cp->patterns[i].offset;
4272                 p->length = cp->patterns[i].length;
4273                 memcpy(p->value, cp->patterns[i].value, p->length);
4274
4275                 INIT_LIST_HEAD(&p->list);
4276                 list_add(&p->list, &m->patterns);
4277         }
4278
4279         if (mp_cnt != cp->pattern_count) {
4280                 err = mgmt_cmd_status(sk, hdev->id,
4281                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4282                                       MGMT_STATUS_INVALID_PARAMS);
4283                 goto failed;
4284         }
4285
4286         hci_dev_lock(hdev);
4287
4288         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4289
4290         err = hci_add_adv_monitor(hdev, m);
4291         if (err) {
4292                 if (err == -ENOSPC) {
4293                         mgmt_cmd_status(sk, hdev->id,
4294                                         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4295                                         MGMT_STATUS_NO_RESOURCES);
4296                 }
4297                 goto unlock;
4298         }
4299
4300         if (hdev->adv_monitors_cnt > prev_adv_monitors_cnt)
4301                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4302
4303         hci_dev_unlock(hdev);
4304
4305         rp.monitor_handle = cpu_to_le16(m->handle);
4306
4307         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4308                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4309
4310 unlock:
4311         hci_dev_unlock(hdev);
4312
4313 failed:
4314         hci_free_adv_monitor(m);
4315         return err;
4316 }
4317
4318 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4319                               void *data, u16 len)
4320 {
4321         struct mgmt_cp_remove_adv_monitor *cp = data;
4322         struct mgmt_rp_remove_adv_monitor rp;
4323         unsigned int prev_adv_monitors_cnt;
4324         u16 handle;
4325         int err;
4326
4327         BT_DBG("request for %s", hdev->name);
4328
4329         hci_dev_lock(hdev);
4330
4331         handle = __le16_to_cpu(cp->monitor_handle);
4332         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4333
4334         err = hci_remove_adv_monitor(hdev, handle);
4335         if (err == -ENOENT) {
4336                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4337                                       MGMT_STATUS_INVALID_INDEX);
4338                 goto unlock;
4339         }
4340
4341         if (hdev->adv_monitors_cnt < prev_adv_monitors_cnt)
4342                 mgmt_adv_monitor_removed(sk, hdev, handle);
4343
4344         hci_dev_unlock(hdev);
4345
4346         rp.monitor_handle = cp->monitor_handle;
4347
4348         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4349                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4350
4351 unlock:
4352         hci_dev_unlock(hdev);
4353         return err;
4354 }
4355
4356 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4357                                          u16 opcode, struct sk_buff *skb)
4358 {
4359         struct mgmt_rp_read_local_oob_data mgmt_rp;
4360         size_t rp_size = sizeof(mgmt_rp);
4361         struct mgmt_pending_cmd *cmd;
4362
4363         bt_dev_dbg(hdev, "status %u", status);
4364
4365         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4366         if (!cmd)
4367                 return;
4368
4369         if (status || !skb) {
4370                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4371                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4372                 goto remove;
4373         }
4374
4375         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4376
4377         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4378                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4379
4380                 if (skb->len < sizeof(*rp)) {
4381                         mgmt_cmd_status(cmd->sk, hdev->id,
4382                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4383                                         MGMT_STATUS_FAILED);
4384                         goto remove;
4385                 }
4386
4387                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4388                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4389
4390                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4391         } else {
4392                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4393
4394                 if (skb->len < sizeof(*rp)) {
4395                         mgmt_cmd_status(cmd->sk, hdev->id,
4396                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4397                                         MGMT_STATUS_FAILED);
4398                         goto remove;
4399                 }
4400
4401                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4402                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4403
4404                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4405                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4406         }
4407
4408         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4409                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4410
4411 remove:
4412         mgmt_pending_remove(cmd);
4413 }
4414
4415 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4416                                void *data, u16 data_len)
4417 {
4418         struct mgmt_pending_cmd *cmd;
4419         struct hci_request req;
4420         int err;
4421
4422         bt_dev_dbg(hdev, "sock %p", sk);
4423
4424         hci_dev_lock(hdev);
4425
4426         if (!hdev_is_powered(hdev)) {
4427                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4428                                       MGMT_STATUS_NOT_POWERED);
4429                 goto unlock;
4430         }
4431
4432         if (!lmp_ssp_capable(hdev)) {
4433                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4434                                       MGMT_STATUS_NOT_SUPPORTED);
4435                 goto unlock;
4436         }
4437
4438         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4439                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4440                                       MGMT_STATUS_BUSY);
4441                 goto unlock;
4442         }
4443
4444         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4445         if (!cmd) {
4446                 err = -ENOMEM;
4447                 goto unlock;
4448         }
4449
4450         hci_req_init(&req, hdev);
4451
4452         if (bredr_sc_enabled(hdev))
4453                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4454         else
4455                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4456
4457         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4458         if (err < 0)
4459                 mgmt_pending_remove(cmd);
4460
4461 unlock:
4462         hci_dev_unlock(hdev);
4463         return err;
4464 }
4465
4466 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4467                                void *data, u16 len)
4468 {
4469         struct mgmt_addr_info *addr = data;
4470         int err;
4471
4472         bt_dev_dbg(hdev, "sock %p", sk);
4473
4474         if (!bdaddr_type_is_valid(addr->type))
4475                 return mgmt_cmd_complete(sk, hdev->id,
4476                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4477                                          MGMT_STATUS_INVALID_PARAMS,
4478                                          addr, sizeof(*addr));
4479
4480         hci_dev_lock(hdev);
4481
4482         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4483                 struct mgmt_cp_add_remote_oob_data *cp = data;
4484                 u8 status;
4485
4486                 if (cp->addr.type != BDADDR_BREDR) {
4487                         err = mgmt_cmd_complete(sk, hdev->id,
4488                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4489                                                 MGMT_STATUS_INVALID_PARAMS,
4490                                                 &cp->addr, sizeof(cp->addr));
4491                         goto unlock;
4492                 }
4493
4494                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4495                                               cp->addr.type, cp->hash,
4496                                               cp->rand, NULL, NULL);
4497                 if (err < 0)
4498                         status = MGMT_STATUS_FAILED;
4499                 else
4500                         status = MGMT_STATUS_SUCCESS;
4501
4502                 err = mgmt_cmd_complete(sk, hdev->id,
4503                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4504                                         &cp->addr, sizeof(cp->addr));
4505         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4506                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4507                 u8 *rand192, *hash192, *rand256, *hash256;
4508                 u8 status;
4509
4510                 if (bdaddr_type_is_le(cp->addr.type)) {
4511                         /* Enforce zero-valued 192-bit parameters as
4512                          * long as legacy SMP OOB isn't implemented.
4513                          */
4514                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4515                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4516                                 err = mgmt_cmd_complete(sk, hdev->id,
4517                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4518                                                         MGMT_STATUS_INVALID_PARAMS,
4519                                                         addr, sizeof(*addr));
4520                                 goto unlock;
4521                         }
4522
4523                         rand192 = NULL;
4524                         hash192 = NULL;
4525                 } else {
4526                         /* In case one of the P-192 values is set to zero,
4527                          * then just disable OOB data for P-192.
4528                          */
4529                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4530                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4531                                 rand192 = NULL;
4532                                 hash192 = NULL;
4533                         } else {
4534                                 rand192 = cp->rand192;
4535                                 hash192 = cp->hash192;
4536                         }
4537                 }
4538
4539                 /* In case one of the P-256 values is set to zero, then just
4540                  * disable OOB data for P-256.
4541                  */
4542                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4543                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4544                         rand256 = NULL;
4545                         hash256 = NULL;
4546                 } else {
4547                         rand256 = cp->rand256;
4548                         hash256 = cp->hash256;
4549                 }
4550
4551                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4552                                               cp->addr.type, hash192, rand192,
4553                                               hash256, rand256);
4554                 if (err < 0)
4555                         status = MGMT_STATUS_FAILED;
4556                 else
4557                         status = MGMT_STATUS_SUCCESS;
4558
4559                 err = mgmt_cmd_complete(sk, hdev->id,
4560                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4561                                         status, &cp->addr, sizeof(cp->addr));
4562         } else {
4563                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4564                            len);
4565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4566                                       MGMT_STATUS_INVALID_PARAMS);
4567         }
4568
4569 unlock:
4570         hci_dev_unlock(hdev);
4571         return err;
4572 }
4573
4574 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4575                                   void *data, u16 len)
4576 {
4577         struct mgmt_cp_remove_remote_oob_data *cp = data;
4578         u8 status;
4579         int err;
4580
4581         bt_dev_dbg(hdev, "sock %p", sk);
4582
4583         if (cp->addr.type != BDADDR_BREDR)
4584                 return mgmt_cmd_complete(sk, hdev->id,
4585                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4586                                          MGMT_STATUS_INVALID_PARAMS,
4587                                          &cp->addr, sizeof(cp->addr));
4588
4589         hci_dev_lock(hdev);
4590
4591         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4592                 hci_remote_oob_data_clear(hdev);
4593                 status = MGMT_STATUS_SUCCESS;
4594                 goto done;
4595         }
4596
4597         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4598         if (err < 0)
4599                 status = MGMT_STATUS_INVALID_PARAMS;
4600         else
4601                 status = MGMT_STATUS_SUCCESS;
4602
4603 done:
4604         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4605                                 status, &cp->addr, sizeof(cp->addr));
4606
4607         hci_dev_unlock(hdev);
4608         return err;
4609 }
4610
4611 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4612 {
4613         struct mgmt_pending_cmd *cmd;
4614
4615         bt_dev_dbg(hdev, "status %d", status);
4616
4617         hci_dev_lock(hdev);
4618
4619         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4620         if (!cmd)
4621                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4622
4623         if (!cmd)
4624                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4625
4626         if (cmd) {
4627                 cmd->cmd_complete(cmd, mgmt_status(status));
4628                 mgmt_pending_remove(cmd);
4629         }
4630
4631         hci_dev_unlock(hdev);
4632
4633         /* Handle suspend notifier */
4634         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4635                                hdev->suspend_tasks)) {
4636                 bt_dev_dbg(hdev, "Unpaused discovery");
4637                 wake_up(&hdev->suspend_wait_q);
4638         }
4639 }
4640
4641 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4642                                     uint8_t *mgmt_status)
4643 {
4644         switch (type) {
4645         case DISCOV_TYPE_LE:
4646                 *mgmt_status = mgmt_le_support(hdev);
4647                 if (*mgmt_status)
4648                         return false;
4649                 break;
4650         case DISCOV_TYPE_INTERLEAVED:
4651                 *mgmt_status = mgmt_le_support(hdev);
4652                 if (*mgmt_status)
4653                         return false;
4654                 fallthrough;
4655         case DISCOV_TYPE_BREDR:
4656                 *mgmt_status = mgmt_bredr_support(hdev);
4657                 if (*mgmt_status)
4658                         return false;
4659                 break;
4660         default:
4661                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4662                 return false;
4663         }
4664
4665         return true;
4666 }
4667
4668 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4669                                     u16 op, void *data, u16 len)
4670 {
4671         struct mgmt_cp_start_discovery *cp = data;
4672         struct mgmt_pending_cmd *cmd;
4673         u8 status;
4674         int err;
4675
4676         bt_dev_dbg(hdev, "sock %p", sk);
4677
4678         hci_dev_lock(hdev);
4679
4680         if (!hdev_is_powered(hdev)) {
4681                 err = mgmt_cmd_complete(sk, hdev->id, op,
4682                                         MGMT_STATUS_NOT_POWERED,
4683                                         &cp->type, sizeof(cp->type));
4684                 goto failed;
4685         }
4686
4687         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4688             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4689                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4690                                         &cp->type, sizeof(cp->type));
4691                 goto failed;
4692         }
4693
4694         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4695                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4696                                         &cp->type, sizeof(cp->type));
4697                 goto failed;
4698         }
4699
4700         /* Can't start discovery when it is paused */
4701         if (hdev->discovery_paused) {
4702                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4703                                         &cp->type, sizeof(cp->type));
4704                 goto failed;
4705         }
4706
4707         /* Clear the discovery filter first to free any previously
4708          * allocated memory for the UUID list.
4709          */
4710         hci_discovery_filter_clear(hdev);
4711
4712         hdev->discovery.type = cp->type;
4713         hdev->discovery.report_invalid_rssi = false;
4714         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4715                 hdev->discovery.limited = true;
4716         else
4717                 hdev->discovery.limited = false;
4718
4719         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4720         if (!cmd) {
4721                 err = -ENOMEM;
4722                 goto failed;
4723         }
4724
4725         cmd->cmd_complete = generic_cmd_complete;
4726
4727         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4728         queue_work(hdev->req_workqueue, &hdev->discov_update);
4729         err = 0;
4730
4731 failed:
4732         hci_dev_unlock(hdev);
4733         return err;
4734 }
4735
4736 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4737                            void *data, u16 len)
4738 {
4739         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4740                                         data, len);
4741 }
4742
4743 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4744                                    void *data, u16 len)
4745 {
4746         return start_discovery_internal(sk, hdev,
4747                                         MGMT_OP_START_LIMITED_DISCOVERY,
4748                                         data, len);
4749 }
4750
4751 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4752                                           u8 status)
4753 {
4754         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4755                                  cmd->param, 1);
4756 }
4757
4758 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4759                                    void *data, u16 len)
4760 {
4761         struct mgmt_cp_start_service_discovery *cp = data;
4762         struct mgmt_pending_cmd *cmd;
4763         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4764         u16 uuid_count, expected_len;
4765         u8 status;
4766         int err;
4767
4768         bt_dev_dbg(hdev, "sock %p", sk);
4769
4770         hci_dev_lock(hdev);
4771
4772         if (!hdev_is_powered(hdev)) {
4773                 err = mgmt_cmd_complete(sk, hdev->id,
4774                                         MGMT_OP_START_SERVICE_DISCOVERY,
4775                                         MGMT_STATUS_NOT_POWERED,
4776                                         &cp->type, sizeof(cp->type));
4777                 goto failed;
4778         }
4779
4780         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4781             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4782                 err = mgmt_cmd_complete(sk, hdev->id,
4783                                         MGMT_OP_START_SERVICE_DISCOVERY,
4784                                         MGMT_STATUS_BUSY, &cp->type,
4785                                         sizeof(cp->type));
4786                 goto failed;
4787         }
4788
4789         uuid_count = __le16_to_cpu(cp->uuid_count);
4790         if (uuid_count > max_uuid_count) {
4791                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
4792                            uuid_count);
4793                 err = mgmt_cmd_complete(sk, hdev->id,
4794                                         MGMT_OP_START_SERVICE_DISCOVERY,
4795                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4796                                         sizeof(cp->type));
4797                 goto failed;
4798         }
4799
4800         expected_len = sizeof(*cp) + uuid_count * 16;
4801         if (expected_len != len) {
4802                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
4803                            expected_len, len);
4804                 err = mgmt_cmd_complete(sk, hdev->id,
4805                                         MGMT_OP_START_SERVICE_DISCOVERY,
4806                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4807                                         sizeof(cp->type));
4808                 goto failed;
4809         }
4810
4811         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4812                 err = mgmt_cmd_complete(sk, hdev->id,
4813                                         MGMT_OP_START_SERVICE_DISCOVERY,
4814                                         status, &cp->type, sizeof(cp->type));
4815                 goto failed;
4816         }
4817
4818         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4819                                hdev, data, len);
4820         if (!cmd) {
4821                 err = -ENOMEM;
4822                 goto failed;
4823         }
4824
4825         cmd->cmd_complete = service_discovery_cmd_complete;
4826
4827         /* Clear the discovery filter first to free any previously
4828          * allocated memory for the UUID list.
4829          */
4830         hci_discovery_filter_clear(hdev);
4831
4832         hdev->discovery.result_filtering = true;
4833         hdev->discovery.type = cp->type;
4834         hdev->discovery.rssi = cp->rssi;
4835         hdev->discovery.uuid_count = uuid_count;
4836
4837         if (uuid_count > 0) {
4838                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4839                                                 GFP_KERNEL);
4840                 if (!hdev->discovery.uuids) {
4841                         err = mgmt_cmd_complete(sk, hdev->id,
4842                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4843                                                 MGMT_STATUS_FAILED,
4844                                                 &cp->type, sizeof(cp->type));
4845                         mgmt_pending_remove(cmd);
4846                         goto failed;
4847                 }
4848         }
4849
4850         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4851         queue_work(hdev->req_workqueue, &hdev->discov_update);
4852         err = 0;
4853
4854 failed:
4855         hci_dev_unlock(hdev);
4856         return err;
4857 }
4858
4859 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4860 {
4861         struct mgmt_pending_cmd *cmd;
4862
4863         bt_dev_dbg(hdev, "status %d", status);
4864
4865         hci_dev_lock(hdev);
4866
4867         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4868         if (cmd) {
4869                 cmd->cmd_complete(cmd, mgmt_status(status));
4870                 mgmt_pending_remove(cmd);
4871         }
4872
4873         hci_dev_unlock(hdev);
4874
4875         /* Handle suspend notifier */
4876         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
4877                 bt_dev_dbg(hdev, "Paused discovery");
4878                 wake_up(&hdev->suspend_wait_q);
4879         }
4880 }
4881
4882 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4883                           u16 len)
4884 {
4885         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4886         struct mgmt_pending_cmd *cmd;
4887         int err;
4888
4889         bt_dev_dbg(hdev, "sock %p", sk);
4890
4891         hci_dev_lock(hdev);
4892
4893         if (!hci_discovery_active(hdev)) {
4894                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4895                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4896                                         sizeof(mgmt_cp->type));
4897                 goto unlock;
4898         }
4899
4900         if (hdev->discovery.type != mgmt_cp->type) {
4901                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4902                                         MGMT_STATUS_INVALID_PARAMS,
4903                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4904                 goto unlock;
4905         }
4906
4907         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4908         if (!cmd) {
4909                 err = -ENOMEM;
4910                 goto unlock;
4911         }
4912
4913         cmd->cmd_complete = generic_cmd_complete;
4914
4915         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4916         queue_work(hdev->req_workqueue, &hdev->discov_update);
4917         err = 0;
4918
4919 unlock:
4920         hci_dev_unlock(hdev);
4921         return err;
4922 }
4923
4924 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4925                         u16 len)
4926 {
4927         struct mgmt_cp_confirm_name *cp = data;
4928         struct inquiry_entry *e;
4929         int err;
4930
4931         bt_dev_dbg(hdev, "sock %p", sk);
4932
4933         hci_dev_lock(hdev);
4934
4935         if (!hci_discovery_active(hdev)) {
4936                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4937                                         MGMT_STATUS_FAILED, &cp->addr,
4938                                         sizeof(cp->addr));
4939                 goto failed;
4940         }
4941
4942         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4943         if (!e) {
4944                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4945                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4946                                         sizeof(cp->addr));
4947                 goto failed;
4948         }
4949
4950         if (cp->name_known) {
4951                 e->name_state = NAME_KNOWN;
4952                 list_del(&e->list);
4953         } else {
4954                 e->name_state = NAME_NEEDED;
4955                 hci_inquiry_cache_update_resolve(hdev, e);
4956         }
4957
4958         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4959                                 &cp->addr, sizeof(cp->addr));
4960
4961 failed:
4962         hci_dev_unlock(hdev);
4963         return err;
4964 }
4965
4966 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4967                         u16 len)
4968 {
4969         struct mgmt_cp_block_device *cp = data;
4970         u8 status;
4971         int err;
4972
4973         bt_dev_dbg(hdev, "sock %p", sk);
4974
4975         if (!bdaddr_type_is_valid(cp->addr.type))
4976                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4977                                          MGMT_STATUS_INVALID_PARAMS,
4978                                          &cp->addr, sizeof(cp->addr));
4979
4980         hci_dev_lock(hdev);
4981
4982         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
4983                                   cp->addr.type);
4984         if (err < 0) {
4985                 status = MGMT_STATUS_FAILED;
4986                 goto done;
4987         }
4988
4989         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4990                    sk);
4991         status = MGMT_STATUS_SUCCESS;
4992
4993 done:
4994         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4995                                 &cp->addr, sizeof(cp->addr));
4996
4997         hci_dev_unlock(hdev);
4998
4999         return err;
5000 }
5001
5002 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5003                           u16 len)
5004 {
5005         struct mgmt_cp_unblock_device *cp = data;
5006         u8 status;
5007         int err;
5008
5009         bt_dev_dbg(hdev, "sock %p", sk);
5010
5011         if (!bdaddr_type_is_valid(cp->addr.type))
5012                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5013                                          MGMT_STATUS_INVALID_PARAMS,
5014                                          &cp->addr, sizeof(cp->addr));
5015
5016         hci_dev_lock(hdev);
5017
5018         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5019                                   cp->addr.type);
5020         if (err < 0) {
5021                 status = MGMT_STATUS_INVALID_PARAMS;
5022                 goto done;
5023         }
5024
5025         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5026                    sk);
5027         status = MGMT_STATUS_SUCCESS;
5028
5029 done:
5030         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5031                                 &cp->addr, sizeof(cp->addr));
5032
5033         hci_dev_unlock(hdev);
5034
5035         return err;
5036 }
5037
5038 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5039                          u16 len)
5040 {
5041         struct mgmt_cp_set_device_id *cp = data;
5042         struct hci_request req;
5043         int err;
5044         __u16 source;
5045
5046         bt_dev_dbg(hdev, "sock %p", sk);
5047
5048         source = __le16_to_cpu(cp->source);
5049
5050         if (source > 0x0002)
5051                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5052                                        MGMT_STATUS_INVALID_PARAMS);
5053
5054         hci_dev_lock(hdev);
5055
5056         hdev->devid_source = source;
5057         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5058         hdev->devid_product = __le16_to_cpu(cp->product);
5059         hdev->devid_version = __le16_to_cpu(cp->version);
5060
5061         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5062                                 NULL, 0);
5063
5064         hci_req_init(&req, hdev);
5065         __hci_req_update_eir(&req);
5066         hci_req_run(&req, NULL);
5067
5068         hci_dev_unlock(hdev);
5069
5070         return err;
5071 }
5072
5073 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5074                                         u16 opcode)
5075 {
5076         bt_dev_dbg(hdev, "status %d", status);
5077 }
5078
5079 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5080                                      u16 opcode)
5081 {
5082         struct cmd_lookup match = { NULL, hdev };
5083         struct hci_request req;
5084         u8 instance;
5085         struct adv_info *adv_instance;
5086         int err;
5087
5088         hci_dev_lock(hdev);
5089
5090         if (status) {
5091                 u8 mgmt_err = mgmt_status(status);
5092
5093                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5094                                      cmd_status_rsp, &mgmt_err);
5095                 goto unlock;
5096         }
5097
5098         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5099                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5100         else
5101                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5102
5103         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5104                              &match);
5105
5106         new_settings(hdev, match.sk);
5107
5108         if (match.sk)
5109                 sock_put(match.sk);
5110
5111         /* Handle suspend notifier */
5112         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5113                                hdev->suspend_tasks)) {
5114                 bt_dev_dbg(hdev, "Paused advertising");
5115                 wake_up(&hdev->suspend_wait_q);
5116         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5117                                       hdev->suspend_tasks)) {
5118                 bt_dev_dbg(hdev, "Unpaused advertising");
5119                 wake_up(&hdev->suspend_wait_q);
5120         }
5121
5122         /* If "Set Advertising" was just disabled and instance advertising was
5123          * set up earlier, then re-enable multi-instance advertising.
5124          */
5125         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5126             list_empty(&hdev->adv_instances))
5127                 goto unlock;
5128
5129         instance = hdev->cur_adv_instance;
5130         if (!instance) {
5131                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5132                                                         struct adv_info, list);
5133                 if (!adv_instance)
5134                         goto unlock;
5135
5136                 instance = adv_instance->instance;
5137         }
5138
5139         hci_req_init(&req, hdev);
5140
5141         err = __hci_req_schedule_adv_instance(&req, instance, true);
5142
5143         if (!err)
5144                 err = hci_req_run(&req, enable_advertising_instance);
5145
5146         if (err)
5147                 bt_dev_err(hdev, "failed to re-configure advertising");
5148
5149 unlock:
5150         hci_dev_unlock(hdev);
5151 }
5152
5153 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5154                            u16 len)
5155 {
5156         struct mgmt_mode *cp = data;
5157         struct mgmt_pending_cmd *cmd;
5158         struct hci_request req;
5159         u8 val, status;
5160         int err;
5161
5162         bt_dev_dbg(hdev, "sock %p", sk);
5163
5164         status = mgmt_le_support(hdev);
5165         if (status)
5166                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5167                                        status);
5168
5169         /* Enabling the experimental LL Privay support disables support for
5170          * advertising.
5171          */
5172         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5174                                        MGMT_STATUS_NOT_SUPPORTED);
5175
5176         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5177                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5178                                        MGMT_STATUS_INVALID_PARAMS);
5179
5180         if (hdev->advertising_paused)
5181                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5182                                        MGMT_STATUS_BUSY);
5183
5184         hci_dev_lock(hdev);
5185
5186         val = !!cp->val;
5187
5188         /* The following conditions are ones which mean that we should
5189          * not do any HCI communication but directly send a mgmt
5190          * response to user space (after toggling the flag if
5191          * necessary).
5192          */
5193         if (!hdev_is_powered(hdev) ||
5194             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5195              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5196             hci_conn_num(hdev, LE_LINK) > 0 ||
5197             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5198              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5199                 bool changed;
5200
5201                 if (cp->val) {
5202                         hdev->cur_adv_instance = 0x00;
5203                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5204                         if (cp->val == 0x02)
5205                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5206                         else
5207                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5208                 } else {
5209                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5210                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5211                 }
5212
5213                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5214                 if (err < 0)
5215                         goto unlock;
5216
5217                 if (changed)
5218                         err = new_settings(hdev, sk);
5219
5220                 goto unlock;
5221         }
5222
5223         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5224             pending_find(MGMT_OP_SET_LE, hdev)) {
5225                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5226                                       MGMT_STATUS_BUSY);
5227                 goto unlock;
5228         }
5229
5230         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5231         if (!cmd) {
5232                 err = -ENOMEM;
5233                 goto unlock;
5234         }
5235
5236         hci_req_init(&req, hdev);
5237
5238         if (cp->val == 0x02)
5239                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5240         else
5241                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5242
5243         cancel_adv_timeout(hdev);
5244
5245         if (val) {
5246                 /* Switch to instance "0" for the Set Advertising setting.
5247                  * We cannot use update_[adv|scan_rsp]_data() here as the
5248                  * HCI_ADVERTISING flag is not yet set.
5249                  */
5250                 hdev->cur_adv_instance = 0x00;
5251
5252                 if (ext_adv_capable(hdev)) {
5253                         __hci_req_start_ext_adv(&req, 0x00);
5254                 } else {
5255                         __hci_req_update_adv_data(&req, 0x00);
5256                         __hci_req_update_scan_rsp_data(&req, 0x00);
5257                         __hci_req_enable_advertising(&req);
5258                 }
5259         } else {
5260                 __hci_req_disable_advertising(&req);
5261         }
5262
5263         err = hci_req_run(&req, set_advertising_complete);
5264         if (err < 0)
5265                 mgmt_pending_remove(cmd);
5266
5267 unlock:
5268         hci_dev_unlock(hdev);
5269         return err;
5270 }
5271
5272 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5273                               void *data, u16 len)
5274 {
5275         struct mgmt_cp_set_static_address *cp = data;
5276         int err;
5277
5278         bt_dev_dbg(hdev, "sock %p", sk);
5279
5280         if (!lmp_le_capable(hdev))
5281                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5282                                        MGMT_STATUS_NOT_SUPPORTED);
5283
5284         if (hdev_is_powered(hdev))
5285                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5286                                        MGMT_STATUS_REJECTED);
5287
5288         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5289                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5290                         return mgmt_cmd_status(sk, hdev->id,
5291                                                MGMT_OP_SET_STATIC_ADDRESS,
5292                                                MGMT_STATUS_INVALID_PARAMS);
5293
5294                 /* Two most significant bits shall be set */
5295                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5296                         return mgmt_cmd_status(sk, hdev->id,
5297                                                MGMT_OP_SET_STATIC_ADDRESS,
5298                                                MGMT_STATUS_INVALID_PARAMS);
5299         }
5300
5301         hci_dev_lock(hdev);
5302
5303         bacpy(&hdev->static_addr, &cp->bdaddr);
5304
5305         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5306         if (err < 0)
5307                 goto unlock;
5308
5309         err = new_settings(hdev, sk);
5310
5311 unlock:
5312         hci_dev_unlock(hdev);
5313         return err;
5314 }
5315
5316 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5317                            void *data, u16 len)
5318 {
5319         struct mgmt_cp_set_scan_params *cp = data;
5320         __u16 interval, window;
5321         int err;
5322
5323         bt_dev_dbg(hdev, "sock %p", sk);
5324
5325         if (!lmp_le_capable(hdev))
5326                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5327                                        MGMT_STATUS_NOT_SUPPORTED);
5328
5329         interval = __le16_to_cpu(cp->interval);
5330
5331         if (interval < 0x0004 || interval > 0x4000)
5332                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5333                                        MGMT_STATUS_INVALID_PARAMS);
5334
5335         window = __le16_to_cpu(cp->window);
5336
5337         if (window < 0x0004 || window > 0x4000)
5338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5339                                        MGMT_STATUS_INVALID_PARAMS);
5340
5341         if (window > interval)
5342                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5343                                        MGMT_STATUS_INVALID_PARAMS);
5344
5345         hci_dev_lock(hdev);
5346
5347         hdev->le_scan_interval = interval;
5348         hdev->le_scan_window = window;
5349
5350         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5351                                 NULL, 0);
5352
5353         /* If background scan is running, restart it so new parameters are
5354          * loaded.
5355          */
5356         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5357             hdev->discovery.state == DISCOVERY_STOPPED) {
5358                 struct hci_request req;
5359
5360                 hci_req_init(&req, hdev);
5361
5362                 hci_req_add_le_scan_disable(&req, false);
5363                 hci_req_add_le_passive_scan(&req);
5364
5365                 hci_req_run(&req, NULL);
5366         }
5367
5368         hci_dev_unlock(hdev);
5369
5370         return err;
5371 }
5372
5373 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5374                                       u16 opcode)
5375 {
5376         struct mgmt_pending_cmd *cmd;
5377
5378         bt_dev_dbg(hdev, "status 0x%02x", status);
5379
5380         hci_dev_lock(hdev);
5381
5382         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5383         if (!cmd)
5384                 goto unlock;
5385
5386         if (status) {
5387                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5388                                 mgmt_status(status));
5389         } else {
5390                 struct mgmt_mode *cp = cmd->param;
5391
5392                 if (cp->val)
5393                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5394                 else
5395                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5396
5397                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5398                 new_settings(hdev, cmd->sk);
5399         }
5400
5401         mgmt_pending_remove(cmd);
5402
5403 unlock:
5404         hci_dev_unlock(hdev);
5405 }
5406
5407 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5408                                 void *data, u16 len)
5409 {
5410         struct mgmt_mode *cp = data;
5411         struct mgmt_pending_cmd *cmd;
5412         struct hci_request req;
5413         int err;
5414
5415         bt_dev_dbg(hdev, "sock %p", sk);
5416
5417         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5418             hdev->hci_ver < BLUETOOTH_VER_1_2)
5419                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5420                                        MGMT_STATUS_NOT_SUPPORTED);
5421
5422         if (cp->val != 0x00 && cp->val != 0x01)
5423                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5424                                        MGMT_STATUS_INVALID_PARAMS);
5425
5426         hci_dev_lock(hdev);
5427
5428         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5429                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5430                                       MGMT_STATUS_BUSY);
5431                 goto unlock;
5432         }
5433
5434         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5435                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5436                                         hdev);
5437                 goto unlock;
5438         }
5439
5440         if (!hdev_is_powered(hdev)) {
5441                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5442                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5443                                         hdev);
5444                 new_settings(hdev, sk);
5445                 goto unlock;
5446         }
5447
5448         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5449                                data, len);
5450         if (!cmd) {
5451                 err = -ENOMEM;
5452                 goto unlock;
5453         }
5454
5455         hci_req_init(&req, hdev);
5456
5457         __hci_req_write_fast_connectable(&req, cp->val);
5458
5459         err = hci_req_run(&req, fast_connectable_complete);
5460         if (err < 0) {
5461                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5462                                       MGMT_STATUS_FAILED);
5463                 mgmt_pending_remove(cmd);
5464         }
5465
5466 unlock:
5467         hci_dev_unlock(hdev);
5468
5469         return err;
5470 }
5471
5472 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5473 {
5474         struct mgmt_pending_cmd *cmd;
5475
5476         bt_dev_dbg(hdev, "status 0x%02x", status);
5477
5478         hci_dev_lock(hdev);
5479
5480         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5481         if (!cmd)
5482                 goto unlock;
5483
5484         if (status) {
5485                 u8 mgmt_err = mgmt_status(status);
5486
5487                 /* We need to restore the flag if related HCI commands
5488                  * failed.
5489                  */
5490                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5491
5492                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5493         } else {
5494                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5495                 new_settings(hdev, cmd->sk);
5496         }
5497
5498         mgmt_pending_remove(cmd);
5499
5500 unlock:
5501         hci_dev_unlock(hdev);
5502 }
5503
5504 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5505 {
5506         struct mgmt_mode *cp = data;
5507         struct mgmt_pending_cmd *cmd;
5508         struct hci_request req;
5509         int err;
5510
5511         bt_dev_dbg(hdev, "sock %p", sk);
5512
5513         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5514                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5515                                        MGMT_STATUS_NOT_SUPPORTED);
5516
5517         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5518                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5519                                        MGMT_STATUS_REJECTED);
5520
5521         if (cp->val != 0x00 && cp->val != 0x01)
5522                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5523                                        MGMT_STATUS_INVALID_PARAMS);
5524
5525         hci_dev_lock(hdev);
5526
5527         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5528                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5529                 goto unlock;
5530         }
5531
5532         if (!hdev_is_powered(hdev)) {
5533                 if (!cp->val) {
5534                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5535                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5536                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5537                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5538                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5539                 }
5540
5541                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5542
5543                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5544                 if (err < 0)
5545                         goto unlock;
5546
5547                 err = new_settings(hdev, sk);
5548                 goto unlock;
5549         }
5550
5551         /* Reject disabling when powered on */
5552         if (!cp->val) {
5553                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5554                                       MGMT_STATUS_REJECTED);
5555                 goto unlock;
5556         } else {
5557                 /* When configuring a dual-mode controller to operate
5558                  * with LE only and using a static address, then switching
5559                  * BR/EDR back on is not allowed.
5560                  *
5561                  * Dual-mode controllers shall operate with the public
5562                  * address as its identity address for BR/EDR and LE. So
5563                  * reject the attempt to create an invalid configuration.
5564                  *
5565                  * The same restrictions applies when secure connections
5566                  * has been enabled. For BR/EDR this is a controller feature
5567                  * while for LE it is a host stack feature. This means that
5568                  * switching BR/EDR back on when secure connections has been
5569                  * enabled is not a supported transaction.
5570                  */
5571                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5572                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5573                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5574                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5575                                               MGMT_STATUS_REJECTED);
5576                         goto unlock;
5577                 }
5578         }
5579
5580         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5581                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5582                                       MGMT_STATUS_BUSY);
5583                 goto unlock;
5584         }
5585
5586         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5587         if (!cmd) {
5588                 err = -ENOMEM;
5589                 goto unlock;
5590         }
5591
5592         /* We need to flip the bit already here so that
5593          * hci_req_update_adv_data generates the correct flags.
5594          */
5595         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5596
5597         hci_req_init(&req, hdev);
5598
5599         __hci_req_write_fast_connectable(&req, false);
5600         __hci_req_update_scan(&req);
5601
5602         /* Since only the advertising data flags will change, there
5603          * is no need to update the scan response data.
5604          */
5605         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5606
5607         err = hci_req_run(&req, set_bredr_complete);
5608         if (err < 0)
5609                 mgmt_pending_remove(cmd);
5610
5611 unlock:
5612         hci_dev_unlock(hdev);
5613         return err;
5614 }
5615
5616 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5617 {
5618         struct mgmt_pending_cmd *cmd;
5619         struct mgmt_mode *cp;
5620
5621         bt_dev_dbg(hdev, "status %u", status);
5622
5623         hci_dev_lock(hdev);
5624
5625         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5626         if (!cmd)
5627                 goto unlock;
5628
5629         if (status) {
5630                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5631                                 mgmt_status(status));
5632                 goto remove;
5633         }
5634
5635         cp = cmd->param;
5636
5637         switch (cp->val) {
5638         case 0x00:
5639                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5640                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5641                 break;
5642         case 0x01:
5643                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5644                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5645                 break;
5646         case 0x02:
5647                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5648                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5649                 break;
5650         }
5651
5652         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5653         new_settings(hdev, cmd->sk);
5654
5655 remove:
5656         mgmt_pending_remove(cmd);
5657 unlock:
5658         hci_dev_unlock(hdev);
5659 }
5660
5661 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5662                            void *data, u16 len)
5663 {
5664         struct mgmt_mode *cp = data;
5665         struct mgmt_pending_cmd *cmd;
5666         struct hci_request req;
5667         u8 val;
5668         int err;
5669
5670         bt_dev_dbg(hdev, "sock %p", sk);
5671
5672         if (!lmp_sc_capable(hdev) &&
5673             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5674                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5675                                        MGMT_STATUS_NOT_SUPPORTED);
5676
5677         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5678             lmp_sc_capable(hdev) &&
5679             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5680                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5681                                        MGMT_STATUS_REJECTED);
5682
5683         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5684                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5685                                   MGMT_STATUS_INVALID_PARAMS);
5686
5687         hci_dev_lock(hdev);
5688
5689         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5690             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5691                 bool changed;
5692
5693                 if (cp->val) {
5694                         changed = !hci_dev_test_and_set_flag(hdev,
5695                                                              HCI_SC_ENABLED);
5696                         if (cp->val == 0x02)
5697                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5698                         else
5699                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5700                 } else {
5701                         changed = hci_dev_test_and_clear_flag(hdev,
5702                                                               HCI_SC_ENABLED);
5703                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5704                 }
5705
5706                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5707                 if (err < 0)
5708                         goto failed;
5709
5710                 if (changed)
5711                         err = new_settings(hdev, sk);
5712
5713                 goto failed;
5714         }
5715
5716         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5717                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5718                                       MGMT_STATUS_BUSY);
5719                 goto failed;
5720         }
5721
5722         val = !!cp->val;
5723
5724         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5725             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5726                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5727                 goto failed;
5728         }
5729
5730         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5731         if (!cmd) {
5732                 err = -ENOMEM;
5733                 goto failed;
5734         }
5735
5736         hci_req_init(&req, hdev);
5737         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5738         err = hci_req_run(&req, sc_enable_complete);
5739         if (err < 0) {
5740                 mgmt_pending_remove(cmd);
5741                 goto failed;
5742         }
5743
5744 failed:
5745         hci_dev_unlock(hdev);
5746         return err;
5747 }
5748
5749 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5750                           void *data, u16 len)
5751 {
5752         struct mgmt_mode *cp = data;
5753         bool changed, use_changed;
5754         int err;
5755
5756         bt_dev_dbg(hdev, "sock %p", sk);
5757
5758         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5759                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5760                                        MGMT_STATUS_INVALID_PARAMS);
5761
5762         hci_dev_lock(hdev);
5763
5764         if (cp->val)
5765                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5766         else
5767                 changed = hci_dev_test_and_clear_flag(hdev,
5768                                                       HCI_KEEP_DEBUG_KEYS);
5769
5770         if (cp->val == 0x02)
5771                 use_changed = !hci_dev_test_and_set_flag(hdev,
5772                                                          HCI_USE_DEBUG_KEYS);
5773         else
5774                 use_changed = hci_dev_test_and_clear_flag(hdev,
5775                                                           HCI_USE_DEBUG_KEYS);
5776
5777         if (hdev_is_powered(hdev) && use_changed &&
5778             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5779                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5780                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5781                              sizeof(mode), &mode);
5782         }
5783
5784         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5785         if (err < 0)
5786                 goto unlock;
5787
5788         if (changed)
5789                 err = new_settings(hdev, sk);
5790
5791 unlock:
5792         hci_dev_unlock(hdev);
5793         return err;
5794 }
5795
5796 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5797                        u16 len)
5798 {
5799         struct mgmt_cp_set_privacy *cp = cp_data;
5800         bool changed;
5801         int err;
5802
5803         bt_dev_dbg(hdev, "sock %p", sk);
5804
5805         if (!lmp_le_capable(hdev))
5806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5807                                        MGMT_STATUS_NOT_SUPPORTED);
5808
5809         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
5810                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5811                                        MGMT_STATUS_INVALID_PARAMS);
5812
5813         if (hdev_is_powered(hdev))
5814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5815                                        MGMT_STATUS_REJECTED);
5816
5817         hci_dev_lock(hdev);
5818
5819         /* If user space supports this command it is also expected to
5820          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5821          */
5822         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5823
5824         if (cp->privacy) {
5825                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5826                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5827                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5828                 hci_adv_instances_set_rpa_expired(hdev, true);
5829                 if (cp->privacy == 0x02)
5830                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
5831                 else
5832                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5833         } else {
5834                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5835                 memset(hdev->irk, 0, sizeof(hdev->irk));
5836                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5837                 hci_adv_instances_set_rpa_expired(hdev, false);
5838                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5839         }
5840
5841         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5842         if (err < 0)
5843                 goto unlock;
5844
5845         if (changed)
5846                 err = new_settings(hdev, sk);
5847
5848 unlock:
5849         hci_dev_unlock(hdev);
5850         return err;
5851 }
5852
5853 static bool irk_is_valid(struct mgmt_irk_info *irk)
5854 {
5855         switch (irk->addr.type) {
5856         case BDADDR_LE_PUBLIC:
5857                 return true;
5858
5859         case BDADDR_LE_RANDOM:
5860                 /* Two most significant bits shall be set */
5861                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5862                         return false;
5863                 return true;
5864         }
5865
5866         return false;
5867 }
5868
5869 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5870                      u16 len)
5871 {
5872         struct mgmt_cp_load_irks *cp = cp_data;
5873         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5874                                    sizeof(struct mgmt_irk_info));
5875         u16 irk_count, expected_len;
5876         int i, err;
5877
5878         bt_dev_dbg(hdev, "sock %p", sk);
5879
5880         if (!lmp_le_capable(hdev))
5881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5882                                        MGMT_STATUS_NOT_SUPPORTED);
5883
5884         irk_count = __le16_to_cpu(cp->irk_count);
5885         if (irk_count > max_irk_count) {
5886                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5887                            irk_count);
5888                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5889                                        MGMT_STATUS_INVALID_PARAMS);
5890         }
5891
5892         expected_len = struct_size(cp, irks, irk_count);
5893         if (expected_len != len) {
5894                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5895                            expected_len, len);
5896                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5897                                        MGMT_STATUS_INVALID_PARAMS);
5898         }
5899
5900         bt_dev_dbg(hdev, "irk_count %u", irk_count);
5901
5902         for (i = 0; i < irk_count; i++) {
5903                 struct mgmt_irk_info *key = &cp->irks[i];
5904
5905                 if (!irk_is_valid(key))
5906                         return mgmt_cmd_status(sk, hdev->id,
5907                                                MGMT_OP_LOAD_IRKS,
5908                                                MGMT_STATUS_INVALID_PARAMS);
5909         }
5910
5911         hci_dev_lock(hdev);
5912
5913         hci_smp_irks_clear(hdev);
5914
5915         for (i = 0; i < irk_count; i++) {
5916                 struct mgmt_irk_info *irk = &cp->irks[i];
5917
5918                 if (hci_is_blocked_key(hdev,
5919                                        HCI_BLOCKED_KEY_TYPE_IRK,
5920                                        irk->val)) {
5921                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
5922                                     &irk->addr.bdaddr);
5923                         continue;
5924                 }
5925
5926                 hci_add_irk(hdev, &irk->addr.bdaddr,
5927                             le_addr_type(irk->addr.type), irk->val,
5928                             BDADDR_ANY);
5929         }
5930
5931         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5932
5933         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5934
5935         hci_dev_unlock(hdev);
5936
5937         return err;
5938 }
5939
5940 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5941 {
5942         if (key->master != 0x00 && key->master != 0x01)
5943                 return false;
5944
5945         switch (key->addr.type) {
5946         case BDADDR_LE_PUBLIC:
5947                 return true;
5948
5949         case BDADDR_LE_RANDOM:
5950                 /* Two most significant bits shall be set */
5951                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5952                         return false;
5953                 return true;
5954         }
5955
5956         return false;
5957 }
5958
5959 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5960                                void *cp_data, u16 len)
5961 {
5962         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5963         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5964                                    sizeof(struct mgmt_ltk_info));
5965         u16 key_count, expected_len;
5966         int i, err;
5967
5968         bt_dev_dbg(hdev, "sock %p", sk);
5969
5970         if (!lmp_le_capable(hdev))
5971                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5972                                        MGMT_STATUS_NOT_SUPPORTED);
5973
5974         key_count = __le16_to_cpu(cp->key_count);
5975         if (key_count > max_key_count) {
5976                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5977                            key_count);
5978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5979                                        MGMT_STATUS_INVALID_PARAMS);
5980         }
5981
5982         expected_len = struct_size(cp, keys, key_count);
5983         if (expected_len != len) {
5984                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5985                            expected_len, len);
5986                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5987                                        MGMT_STATUS_INVALID_PARAMS);
5988         }
5989
5990         bt_dev_dbg(hdev, "key_count %u", key_count);
5991
5992         for (i = 0; i < key_count; i++) {
5993                 struct mgmt_ltk_info *key = &cp->keys[i];
5994
5995                 if (!ltk_is_valid(key))
5996                         return mgmt_cmd_status(sk, hdev->id,
5997                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
5998                                                MGMT_STATUS_INVALID_PARAMS);
5999         }
6000
6001         hci_dev_lock(hdev);
6002
6003         hci_smp_ltks_clear(hdev);
6004
6005         for (i = 0; i < key_count; i++) {
6006                 struct mgmt_ltk_info *key = &cp->keys[i];
6007                 u8 type, authenticated;
6008
6009                 if (hci_is_blocked_key(hdev,
6010                                        HCI_BLOCKED_KEY_TYPE_LTK,
6011                                        key->val)) {
6012                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6013                                     &key->addr.bdaddr);
6014                         continue;
6015                 }
6016
6017                 switch (key->type) {
6018                 case MGMT_LTK_UNAUTHENTICATED:
6019                         authenticated = 0x00;
6020                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6021                         break;
6022                 case MGMT_LTK_AUTHENTICATED:
6023                         authenticated = 0x01;
6024                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6025                         break;
6026                 case MGMT_LTK_P256_UNAUTH:
6027                         authenticated = 0x00;
6028                         type = SMP_LTK_P256;
6029                         break;
6030                 case MGMT_LTK_P256_AUTH:
6031                         authenticated = 0x01;
6032                         type = SMP_LTK_P256;
6033                         break;
6034                 case MGMT_LTK_P256_DEBUG:
6035                         authenticated = 0x00;
6036                         type = SMP_LTK_P256_DEBUG;
6037                         fallthrough;
6038                 default:
6039                         continue;
6040                 }
6041
6042                 hci_add_ltk(hdev, &key->addr.bdaddr,
6043                             le_addr_type(key->addr.type), type, authenticated,
6044                             key->val, key->enc_size, key->ediv, key->rand);
6045         }
6046
6047         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6048                            NULL, 0);
6049
6050         hci_dev_unlock(hdev);
6051
6052         return err;
6053 }
6054
6055 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6056 {
6057         struct hci_conn *conn = cmd->user_data;
6058         struct mgmt_rp_get_conn_info rp;
6059         int err;
6060
6061         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6062
6063         if (status == MGMT_STATUS_SUCCESS) {
6064                 rp.rssi = conn->rssi;
6065                 rp.tx_power = conn->tx_power;
6066                 rp.max_tx_power = conn->max_tx_power;
6067         } else {
6068                 rp.rssi = HCI_RSSI_INVALID;
6069                 rp.tx_power = HCI_TX_POWER_INVALID;
6070                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6071         }
6072
6073         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6074                                 status, &rp, sizeof(rp));
6075
6076         hci_conn_drop(conn);
6077         hci_conn_put(conn);
6078
6079         return err;
6080 }
6081
6082 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6083                                        u16 opcode)
6084 {
6085         struct hci_cp_read_rssi *cp;
6086         struct mgmt_pending_cmd *cmd;
6087         struct hci_conn *conn;
6088         u16 handle;
6089         u8 status;
6090
6091         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6092
6093         hci_dev_lock(hdev);
6094
6095         /* Commands sent in request are either Read RSSI or Read Transmit Power
6096          * Level so we check which one was last sent to retrieve connection
6097          * handle.  Both commands have handle as first parameter so it's safe to
6098          * cast data on the same command struct.
6099          *
6100          * First command sent is always Read RSSI and we fail only if it fails.
6101          * In other case we simply override error to indicate success as we
6102          * already remembered if TX power value is actually valid.
6103          */
6104         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6105         if (!cp) {
6106                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6107                 status = MGMT_STATUS_SUCCESS;
6108         } else {
6109                 status = mgmt_status(hci_status);
6110         }
6111
6112         if (!cp) {
6113                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6114                 goto unlock;
6115         }
6116
6117         handle = __le16_to_cpu(cp->handle);
6118         conn = hci_conn_hash_lookup_handle(hdev, handle);
6119         if (!conn) {
6120                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6121                            handle);
6122                 goto unlock;
6123         }
6124
6125         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6126         if (!cmd)
6127                 goto unlock;
6128
6129         cmd->cmd_complete(cmd, status);
6130         mgmt_pending_remove(cmd);
6131
6132 unlock:
6133         hci_dev_unlock(hdev);
6134 }
6135
6136 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6137                          u16 len)
6138 {
6139         struct mgmt_cp_get_conn_info *cp = data;
6140         struct mgmt_rp_get_conn_info rp;
6141         struct hci_conn *conn;
6142         unsigned long conn_info_age;
6143         int err = 0;
6144
6145         bt_dev_dbg(hdev, "sock %p", sk);
6146
6147         memset(&rp, 0, sizeof(rp));
6148         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6149         rp.addr.type = cp->addr.type;
6150
6151         if (!bdaddr_type_is_valid(cp->addr.type))
6152                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6153                                          MGMT_STATUS_INVALID_PARAMS,
6154                                          &rp, sizeof(rp));
6155
6156         hci_dev_lock(hdev);
6157
6158         if (!hdev_is_powered(hdev)) {
6159                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6160                                         MGMT_STATUS_NOT_POWERED, &rp,
6161                                         sizeof(rp));
6162                 goto unlock;
6163         }
6164
6165         if (cp->addr.type == BDADDR_BREDR)
6166                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6167                                                &cp->addr.bdaddr);
6168         else
6169                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6170
6171         if (!conn || conn->state != BT_CONNECTED) {
6172                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6173                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6174                                         sizeof(rp));
6175                 goto unlock;
6176         }
6177
6178         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6179                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6180                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6181                 goto unlock;
6182         }
6183
6184         /* To avoid client trying to guess when to poll again for information we
6185          * calculate conn info age as random value between min/max set in hdev.
6186          */
6187         conn_info_age = hdev->conn_info_min_age +
6188                         prandom_u32_max(hdev->conn_info_max_age -
6189                                         hdev->conn_info_min_age);
6190
6191         /* Query controller to refresh cached values if they are too old or were
6192          * never read.
6193          */
6194         if (time_after(jiffies, conn->conn_info_timestamp +
6195                        msecs_to_jiffies(conn_info_age)) ||
6196             !conn->conn_info_timestamp) {
6197                 struct hci_request req;
6198                 struct hci_cp_read_tx_power req_txp_cp;
6199                 struct hci_cp_read_rssi req_rssi_cp;
6200                 struct mgmt_pending_cmd *cmd;
6201
6202                 hci_req_init(&req, hdev);
6203                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6204                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6205                             &req_rssi_cp);
6206
6207                 /* For LE links TX power does not change thus we don't need to
6208                  * query for it once value is known.
6209                  */
6210                 if (!bdaddr_type_is_le(cp->addr.type) ||
6211                     conn->tx_power == HCI_TX_POWER_INVALID) {
6212                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6213                         req_txp_cp.type = 0x00;
6214                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6215                                     sizeof(req_txp_cp), &req_txp_cp);
6216                 }
6217
6218                 /* Max TX power needs to be read only once per connection */
6219                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6220                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6221                         req_txp_cp.type = 0x01;
6222                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6223                                     sizeof(req_txp_cp), &req_txp_cp);
6224                 }
6225
6226                 err = hci_req_run(&req, conn_info_refresh_complete);
6227                 if (err < 0)
6228                         goto unlock;
6229
6230                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6231                                        data, len);
6232                 if (!cmd) {
6233                         err = -ENOMEM;
6234                         goto unlock;
6235                 }
6236
6237                 hci_conn_hold(conn);
6238                 cmd->user_data = hci_conn_get(conn);
6239                 cmd->cmd_complete = conn_info_cmd_complete;
6240
6241                 conn->conn_info_timestamp = jiffies;
6242         } else {
6243                 /* Cache is valid, just reply with values cached in hci_conn */
6244                 rp.rssi = conn->rssi;
6245                 rp.tx_power = conn->tx_power;
6246                 rp.max_tx_power = conn->max_tx_power;
6247
6248                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6249                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6250         }
6251
6252 unlock:
6253         hci_dev_unlock(hdev);
6254         return err;
6255 }
6256
6257 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6258 {
6259         struct hci_conn *conn = cmd->user_data;
6260         struct mgmt_rp_get_clock_info rp;
6261         struct hci_dev *hdev;
6262         int err;
6263
6264         memset(&rp, 0, sizeof(rp));
6265         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6266
6267         if (status)
6268                 goto complete;
6269
6270         hdev = hci_dev_get(cmd->index);
6271         if (hdev) {
6272                 rp.local_clock = cpu_to_le32(hdev->clock);
6273                 hci_dev_put(hdev);
6274         }
6275
6276         if (conn) {
6277                 rp.piconet_clock = cpu_to_le32(conn->clock);
6278                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6279         }
6280
6281 complete:
6282         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6283                                 sizeof(rp));
6284
6285         if (conn) {
6286                 hci_conn_drop(conn);
6287                 hci_conn_put(conn);
6288         }
6289
6290         return err;
6291 }
6292
6293 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6294 {
6295         struct hci_cp_read_clock *hci_cp;
6296         struct mgmt_pending_cmd *cmd;
6297         struct hci_conn *conn;
6298
6299         bt_dev_dbg(hdev, "status %u", status);
6300
6301         hci_dev_lock(hdev);
6302
6303         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6304         if (!hci_cp)
6305                 goto unlock;
6306
6307         if (hci_cp->which) {
6308                 u16 handle = __le16_to_cpu(hci_cp->handle);
6309                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6310         } else {
6311                 conn = NULL;
6312         }
6313
6314         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6315         if (!cmd)
6316                 goto unlock;
6317
6318         cmd->cmd_complete(cmd, mgmt_status(status));
6319         mgmt_pending_remove(cmd);
6320
6321 unlock:
6322         hci_dev_unlock(hdev);
6323 }
6324
6325 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6326                          u16 len)
6327 {
6328         struct mgmt_cp_get_clock_info *cp = data;
6329         struct mgmt_rp_get_clock_info rp;
6330         struct hci_cp_read_clock hci_cp;
6331         struct mgmt_pending_cmd *cmd;
6332         struct hci_request req;
6333         struct hci_conn *conn;
6334         int err;
6335
6336         bt_dev_dbg(hdev, "sock %p", sk);
6337
6338         memset(&rp, 0, sizeof(rp));
6339         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6340         rp.addr.type = cp->addr.type;
6341
6342         if (cp->addr.type != BDADDR_BREDR)
6343                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6344                                          MGMT_STATUS_INVALID_PARAMS,
6345                                          &rp, sizeof(rp));
6346
6347         hci_dev_lock(hdev);
6348
6349         if (!hdev_is_powered(hdev)) {
6350                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6351                                         MGMT_STATUS_NOT_POWERED, &rp,
6352                                         sizeof(rp));
6353                 goto unlock;
6354         }
6355
6356         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6357                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6358                                                &cp->addr.bdaddr);
6359                 if (!conn || conn->state != BT_CONNECTED) {
6360                         err = mgmt_cmd_complete(sk, hdev->id,
6361                                                 MGMT_OP_GET_CLOCK_INFO,
6362                                                 MGMT_STATUS_NOT_CONNECTED,
6363                                                 &rp, sizeof(rp));
6364                         goto unlock;
6365                 }
6366         } else {
6367                 conn = NULL;
6368         }
6369
6370         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6371         if (!cmd) {
6372                 err = -ENOMEM;
6373                 goto unlock;
6374         }
6375
6376         cmd->cmd_complete = clock_info_cmd_complete;
6377
6378         hci_req_init(&req, hdev);
6379
6380         memset(&hci_cp, 0, sizeof(hci_cp));
6381         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6382
6383         if (conn) {
6384                 hci_conn_hold(conn);
6385                 cmd->user_data = hci_conn_get(conn);
6386
6387                 hci_cp.handle = cpu_to_le16(conn->handle);
6388                 hci_cp.which = 0x01; /* Piconet clock */
6389                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6390         }
6391
6392         err = hci_req_run(&req, get_clock_info_complete);
6393         if (err < 0)
6394                 mgmt_pending_remove(cmd);
6395
6396 unlock:
6397         hci_dev_unlock(hdev);
6398         return err;
6399 }
6400
6401 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6402 {
6403         struct hci_conn *conn;
6404
6405         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6406         if (!conn)
6407                 return false;
6408
6409         if (conn->dst_type != type)
6410                 return false;
6411
6412         if (conn->state != BT_CONNECTED)
6413                 return false;
6414
6415         return true;
6416 }
6417
6418 /* This function requires the caller holds hdev->lock */
6419 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6420                                u8 addr_type, u8 auto_connect)
6421 {
6422         struct hci_conn_params *params;
6423
6424         params = hci_conn_params_add(hdev, addr, addr_type);
6425         if (!params)
6426                 return -EIO;
6427
6428         if (params->auto_connect == auto_connect)
6429                 return 0;
6430
6431         list_del_init(&params->action);
6432
6433         switch (auto_connect) {
6434         case HCI_AUTO_CONN_DISABLED:
6435         case HCI_AUTO_CONN_LINK_LOSS:
6436                 /* If auto connect is being disabled when we're trying to
6437                  * connect to device, keep connecting.
6438                  */
6439                 if (params->explicit_connect)
6440                         list_add(&params->action, &hdev->pend_le_conns);
6441                 break;
6442         case HCI_AUTO_CONN_REPORT:
6443                 if (params->explicit_connect)
6444                         list_add(&params->action, &hdev->pend_le_conns);
6445                 else
6446                         list_add(&params->action, &hdev->pend_le_reports);
6447                 break;
6448         case HCI_AUTO_CONN_DIRECT:
6449         case HCI_AUTO_CONN_ALWAYS:
6450                 if (!is_connected(hdev, addr, addr_type))
6451                         list_add(&params->action, &hdev->pend_le_conns);
6452                 break;
6453         }
6454
6455         params->auto_connect = auto_connect;
6456
6457         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6458                    addr, addr_type, auto_connect);
6459
6460         return 0;
6461 }
6462
6463 static void device_added(struct sock *sk, struct hci_dev *hdev,
6464                          bdaddr_t *bdaddr, u8 type, u8 action)
6465 {
6466         struct mgmt_ev_device_added ev;
6467
6468         bacpy(&ev.addr.bdaddr, bdaddr);
6469         ev.addr.type = type;
6470         ev.action = action;
6471
6472         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6473 }
6474
6475 static int add_device(struct sock *sk, struct hci_dev *hdev,
6476                       void *data, u16 len)
6477 {
6478         struct mgmt_cp_add_device *cp = data;
6479         u8 auto_conn, addr_type;
6480         struct hci_conn_params *params;
6481         int err;
6482         u32 current_flags = 0;
6483
6484         bt_dev_dbg(hdev, "sock %p", sk);
6485
6486         if (!bdaddr_type_is_valid(cp->addr.type) ||
6487             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6488                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6489                                          MGMT_STATUS_INVALID_PARAMS,
6490                                          &cp->addr, sizeof(cp->addr));
6491
6492         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6493                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6494                                          MGMT_STATUS_INVALID_PARAMS,
6495                                          &cp->addr, sizeof(cp->addr));
6496
6497         hci_dev_lock(hdev);
6498
6499         if (cp->addr.type == BDADDR_BREDR) {
6500                 /* Only incoming connections action is supported for now */
6501                 if (cp->action != 0x01) {
6502                         err = mgmt_cmd_complete(sk, hdev->id,
6503                                                 MGMT_OP_ADD_DEVICE,
6504                                                 MGMT_STATUS_INVALID_PARAMS,
6505                                                 &cp->addr, sizeof(cp->addr));
6506                         goto unlock;
6507                 }
6508
6509                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
6510                                                      &cp->addr.bdaddr,
6511                                                      cp->addr.type, 0);
6512                 if (err)
6513                         goto unlock;
6514
6515                 hci_req_update_scan(hdev);
6516
6517                 goto added;
6518         }
6519
6520         addr_type = le_addr_type(cp->addr.type);
6521
6522         if (cp->action == 0x02)
6523                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6524         else if (cp->action == 0x01)
6525                 auto_conn = HCI_AUTO_CONN_DIRECT;
6526         else
6527                 auto_conn = HCI_AUTO_CONN_REPORT;
6528
6529         /* Kernel internally uses conn_params with resolvable private
6530          * address, but Add Device allows only identity addresses.
6531          * Make sure it is enforced before calling
6532          * hci_conn_params_lookup.
6533          */
6534         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6535                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6536                                         MGMT_STATUS_INVALID_PARAMS,
6537                                         &cp->addr, sizeof(cp->addr));
6538                 goto unlock;
6539         }
6540
6541         /* If the connection parameters don't exist for this device,
6542          * they will be created and configured with defaults.
6543          */
6544         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6545                                 auto_conn) < 0) {
6546                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6547                                         MGMT_STATUS_FAILED, &cp->addr,
6548                                         sizeof(cp->addr));
6549                 goto unlock;
6550         } else {
6551                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6552                                                 addr_type);
6553                 if (params)
6554                         current_flags = params->current_flags;
6555         }
6556
6557         hci_update_background_scan(hdev);
6558
6559 added:
6560         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6561         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6562                              SUPPORTED_DEVICE_FLAGS(), current_flags);
6563
6564         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6565                                 MGMT_STATUS_SUCCESS, &cp->addr,
6566                                 sizeof(cp->addr));
6567
6568 unlock:
6569         hci_dev_unlock(hdev);
6570         return err;
6571 }
6572
6573 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6574                            bdaddr_t *bdaddr, u8 type)
6575 {
6576         struct mgmt_ev_device_removed ev;
6577
6578         bacpy(&ev.addr.bdaddr, bdaddr);
6579         ev.addr.type = type;
6580
6581         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6582 }
6583
6584 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6585                          void *data, u16 len)
6586 {
6587         struct mgmt_cp_remove_device *cp = data;
6588         int err;
6589
6590         bt_dev_dbg(hdev, "sock %p", sk);
6591
6592         hci_dev_lock(hdev);
6593
6594         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6595                 struct hci_conn_params *params;
6596                 u8 addr_type;
6597
6598                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6599                         err = mgmt_cmd_complete(sk, hdev->id,
6600                                                 MGMT_OP_REMOVE_DEVICE,
6601                                                 MGMT_STATUS_INVALID_PARAMS,
6602                                                 &cp->addr, sizeof(cp->addr));
6603                         goto unlock;
6604                 }
6605
6606                 if (cp->addr.type == BDADDR_BREDR) {
6607                         err = hci_bdaddr_list_del(&hdev->accept_list,
6608                                                   &cp->addr.bdaddr,
6609                                                   cp->addr.type);
6610                         if (err) {
6611                                 err = mgmt_cmd_complete(sk, hdev->id,
6612                                                         MGMT_OP_REMOVE_DEVICE,
6613                                                         MGMT_STATUS_INVALID_PARAMS,
6614                                                         &cp->addr,
6615                                                         sizeof(cp->addr));
6616                                 goto unlock;
6617                         }
6618
6619                         hci_req_update_scan(hdev);
6620
6621                         device_removed(sk, hdev, &cp->addr.bdaddr,
6622                                        cp->addr.type);
6623                         goto complete;
6624                 }
6625
6626                 addr_type = le_addr_type(cp->addr.type);
6627
6628                 /* Kernel internally uses conn_params with resolvable private
6629                  * address, but Remove Device allows only identity addresses.
6630                  * Make sure it is enforced before calling
6631                  * hci_conn_params_lookup.
6632                  */
6633                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6634                         err = mgmt_cmd_complete(sk, hdev->id,
6635                                                 MGMT_OP_REMOVE_DEVICE,
6636                                                 MGMT_STATUS_INVALID_PARAMS,
6637                                                 &cp->addr, sizeof(cp->addr));
6638                         goto unlock;
6639                 }
6640
6641                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6642                                                 addr_type);
6643                 if (!params) {
6644                         err = mgmt_cmd_complete(sk, hdev->id,
6645                                                 MGMT_OP_REMOVE_DEVICE,
6646                                                 MGMT_STATUS_INVALID_PARAMS,
6647                                                 &cp->addr, sizeof(cp->addr));
6648                         goto unlock;
6649                 }
6650
6651                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6652                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6653                         err = mgmt_cmd_complete(sk, hdev->id,
6654                                                 MGMT_OP_REMOVE_DEVICE,
6655                                                 MGMT_STATUS_INVALID_PARAMS,
6656                                                 &cp->addr, sizeof(cp->addr));
6657                         goto unlock;
6658                 }
6659
6660                 list_del(&params->action);
6661                 list_del(&params->list);
6662                 kfree(params);
6663                 hci_update_background_scan(hdev);
6664
6665                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6666         } else {
6667                 struct hci_conn_params *p, *tmp;
6668                 struct bdaddr_list *b, *btmp;
6669
6670                 if (cp->addr.type) {
6671                         err = mgmt_cmd_complete(sk, hdev->id,
6672                                                 MGMT_OP_REMOVE_DEVICE,
6673                                                 MGMT_STATUS_INVALID_PARAMS,
6674                                                 &cp->addr, sizeof(cp->addr));
6675                         goto unlock;
6676                 }
6677
6678                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
6679                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6680                         list_del(&b->list);
6681                         kfree(b);
6682                 }
6683
6684                 hci_req_update_scan(hdev);
6685
6686                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6687                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6688                                 continue;
6689                         device_removed(sk, hdev, &p->addr, p->addr_type);
6690                         if (p->explicit_connect) {
6691                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6692                                 continue;
6693                         }
6694                         list_del(&p->action);
6695                         list_del(&p->list);
6696                         kfree(p);
6697                 }
6698
6699                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6700
6701                 hci_update_background_scan(hdev);
6702         }
6703
6704 complete:
6705         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6706                                 MGMT_STATUS_SUCCESS, &cp->addr,
6707                                 sizeof(cp->addr));
6708 unlock:
6709         hci_dev_unlock(hdev);
6710         return err;
6711 }
6712
6713 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6714                            u16 len)
6715 {
6716         struct mgmt_cp_load_conn_param *cp = data;
6717         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6718                                      sizeof(struct mgmt_conn_param));
6719         u16 param_count, expected_len;
6720         int i;
6721
6722         if (!lmp_le_capable(hdev))
6723                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6724                                        MGMT_STATUS_NOT_SUPPORTED);
6725
6726         param_count = __le16_to_cpu(cp->param_count);
6727         if (param_count > max_param_count) {
6728                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6729                            param_count);
6730                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6731                                        MGMT_STATUS_INVALID_PARAMS);
6732         }
6733
6734         expected_len = struct_size(cp, params, param_count);
6735         if (expected_len != len) {
6736                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6737                            expected_len, len);
6738                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6739                                        MGMT_STATUS_INVALID_PARAMS);
6740         }
6741
6742         bt_dev_dbg(hdev, "param_count %u", param_count);
6743
6744         hci_dev_lock(hdev);
6745
6746         hci_conn_params_clear_disabled(hdev);
6747
6748         for (i = 0; i < param_count; i++) {
6749                 struct mgmt_conn_param *param = &cp->params[i];
6750                 struct hci_conn_params *hci_param;
6751                 u16 min, max, latency, timeout;
6752                 u8 addr_type;
6753
6754                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
6755                            param->addr.type);
6756
6757                 if (param->addr.type == BDADDR_LE_PUBLIC) {
6758                         addr_type = ADDR_LE_DEV_PUBLIC;
6759                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6760                         addr_type = ADDR_LE_DEV_RANDOM;
6761                 } else {
6762                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6763                         continue;
6764                 }
6765
6766                 min = le16_to_cpu(param->min_interval);
6767                 max = le16_to_cpu(param->max_interval);
6768                 latency = le16_to_cpu(param->latency);
6769                 timeout = le16_to_cpu(param->timeout);
6770
6771                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6772                            min, max, latency, timeout);
6773
6774                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6775                         bt_dev_err(hdev, "ignoring invalid connection parameters");
6776                         continue;
6777                 }
6778
6779                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6780                                                 addr_type);
6781                 if (!hci_param) {
6782                         bt_dev_err(hdev, "failed to add connection parameters");
6783                         continue;
6784                 }
6785
6786                 hci_param->conn_min_interval = min;
6787                 hci_param->conn_max_interval = max;
6788                 hci_param->conn_latency = latency;
6789                 hci_param->supervision_timeout = timeout;
6790         }
6791
6792         hci_dev_unlock(hdev);
6793
6794         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6795                                  NULL, 0);
6796 }
6797
6798 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6799                                void *data, u16 len)
6800 {
6801         struct mgmt_cp_set_external_config *cp = data;
6802         bool changed;
6803         int err;
6804
6805         bt_dev_dbg(hdev, "sock %p", sk);
6806
6807         if (hdev_is_powered(hdev))
6808                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6809                                        MGMT_STATUS_REJECTED);
6810
6811         if (cp->config != 0x00 && cp->config != 0x01)
6812                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6813                                          MGMT_STATUS_INVALID_PARAMS);
6814
6815         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6816                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6817                                        MGMT_STATUS_NOT_SUPPORTED);
6818
6819         hci_dev_lock(hdev);
6820
6821         if (cp->config)
6822                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6823         else
6824                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6825
6826         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6827         if (err < 0)
6828                 goto unlock;
6829
6830         if (!changed)
6831                 goto unlock;
6832
6833         err = new_options(hdev, sk);
6834
6835         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6836                 mgmt_index_removed(hdev);
6837
6838                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6839                         hci_dev_set_flag(hdev, HCI_CONFIG);
6840                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6841
6842                         queue_work(hdev->req_workqueue, &hdev->power_on);
6843                 } else {
6844                         set_bit(HCI_RAW, &hdev->flags);
6845                         mgmt_index_added(hdev);
6846                 }
6847         }
6848
6849 unlock:
6850         hci_dev_unlock(hdev);
6851         return err;
6852 }
6853
6854 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6855                               void *data, u16 len)
6856 {
6857         struct mgmt_cp_set_public_address *cp = data;
6858         bool changed;
6859         int err;
6860
6861         bt_dev_dbg(hdev, "sock %p", sk);
6862
6863         if (hdev_is_powered(hdev))
6864                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6865                                        MGMT_STATUS_REJECTED);
6866
6867         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6869                                        MGMT_STATUS_INVALID_PARAMS);
6870
6871         if (!hdev->set_bdaddr)
6872                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6873                                        MGMT_STATUS_NOT_SUPPORTED);
6874
6875         hci_dev_lock(hdev);
6876
6877         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6878         bacpy(&hdev->public_addr, &cp->bdaddr);
6879
6880         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6881         if (err < 0)
6882                 goto unlock;
6883
6884         if (!changed)
6885                 goto unlock;
6886
6887         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6888                 err = new_options(hdev, sk);
6889
6890         if (is_configured(hdev)) {
6891                 mgmt_index_removed(hdev);
6892
6893                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6894
6895                 hci_dev_set_flag(hdev, HCI_CONFIG);
6896                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6897
6898                 queue_work(hdev->req_workqueue, &hdev->power_on);
6899         }
6900
6901 unlock:
6902         hci_dev_unlock(hdev);
6903         return err;
6904 }
6905
6906 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6907                                              u16 opcode, struct sk_buff *skb)
6908 {
6909         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6910         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6911         u8 *h192, *r192, *h256, *r256;
6912         struct mgmt_pending_cmd *cmd;
6913         u16 eir_len;
6914         int err;
6915
6916         bt_dev_dbg(hdev, "status %u", status);
6917
6918         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6919         if (!cmd)
6920                 return;
6921
6922         mgmt_cp = cmd->param;
6923
6924         if (status) {
6925                 status = mgmt_status(status);
6926                 eir_len = 0;
6927
6928                 h192 = NULL;
6929                 r192 = NULL;
6930                 h256 = NULL;
6931                 r256 = NULL;
6932         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6933                 struct hci_rp_read_local_oob_data *rp;
6934
6935                 if (skb->len != sizeof(*rp)) {
6936                         status = MGMT_STATUS_FAILED;
6937                         eir_len = 0;
6938                 } else {
6939                         status = MGMT_STATUS_SUCCESS;
6940                         rp = (void *)skb->data;
6941
6942                         eir_len = 5 + 18 + 18;
6943                         h192 = rp->hash;
6944                         r192 = rp->rand;
6945                         h256 = NULL;
6946                         r256 = NULL;
6947                 }
6948         } else {
6949                 struct hci_rp_read_local_oob_ext_data *rp;
6950
6951                 if (skb->len != sizeof(*rp)) {
6952                         status = MGMT_STATUS_FAILED;
6953                         eir_len = 0;
6954                 } else {
6955                         status = MGMT_STATUS_SUCCESS;
6956                         rp = (void *)skb->data;
6957
6958                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6959                                 eir_len = 5 + 18 + 18;
6960                                 h192 = NULL;
6961                                 r192 = NULL;
6962                         } else {
6963                                 eir_len = 5 + 18 + 18 + 18 + 18;
6964                                 h192 = rp->hash192;
6965                                 r192 = rp->rand192;
6966                         }
6967
6968                         h256 = rp->hash256;
6969                         r256 = rp->rand256;
6970                 }
6971         }
6972
6973         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6974         if (!mgmt_rp)
6975                 goto done;
6976
6977         if (status)
6978                 goto send_rsp;
6979
6980         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6981                                   hdev->dev_class, 3);
6982
6983         if (h192 && r192) {
6984                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6985                                           EIR_SSP_HASH_C192, h192, 16);
6986                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6987                                           EIR_SSP_RAND_R192, r192, 16);
6988         }
6989
6990         if (h256 && r256) {
6991                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6992                                           EIR_SSP_HASH_C256, h256, 16);
6993                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6994                                           EIR_SSP_RAND_R256, r256, 16);
6995         }
6996
6997 send_rsp:
6998         mgmt_rp->type = mgmt_cp->type;
6999         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7000
7001         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7002                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7003                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7004         if (err < 0 || status)
7005                 goto done;
7006
7007         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7008
7009         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7010                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7011                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7012 done:
7013         kfree(mgmt_rp);
7014         mgmt_pending_remove(cmd);
7015 }
7016
7017 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7018                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7019 {
7020         struct mgmt_pending_cmd *cmd;
7021         struct hci_request req;
7022         int err;
7023
7024         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7025                                cp, sizeof(*cp));
7026         if (!cmd)
7027                 return -ENOMEM;
7028
7029         hci_req_init(&req, hdev);
7030
7031         if (bredr_sc_enabled(hdev))
7032                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7033         else
7034                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7035
7036         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7037         if (err < 0) {
7038                 mgmt_pending_remove(cmd);
7039                 return err;
7040         }
7041
7042         return 0;
7043 }
7044
7045 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7046                                    void *data, u16 data_len)
7047 {
7048         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7049         struct mgmt_rp_read_local_oob_ext_data *rp;
7050         size_t rp_len;
7051         u16 eir_len;
7052         u8 status, flags, role, addr[7], hash[16], rand[16];
7053         int err;
7054
7055         bt_dev_dbg(hdev, "sock %p", sk);
7056
7057         if (hdev_is_powered(hdev)) {
7058                 switch (cp->type) {
7059                 case BIT(BDADDR_BREDR):
7060                         status = mgmt_bredr_support(hdev);
7061                         if (status)
7062                                 eir_len = 0;
7063                         else
7064                                 eir_len = 5;
7065                         break;
7066                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7067                         status = mgmt_le_support(hdev);
7068                         if (status)
7069                                 eir_len = 0;
7070                         else
7071                                 eir_len = 9 + 3 + 18 + 18 + 3;
7072                         break;
7073                 default:
7074                         status = MGMT_STATUS_INVALID_PARAMS;
7075                         eir_len = 0;
7076                         break;
7077                 }
7078         } else {
7079                 status = MGMT_STATUS_NOT_POWERED;
7080                 eir_len = 0;
7081         }
7082
7083         rp_len = sizeof(*rp) + eir_len;
7084         rp = kmalloc(rp_len, GFP_ATOMIC);
7085         if (!rp)
7086                 return -ENOMEM;
7087
7088         if (status)
7089                 goto complete;
7090
7091         hci_dev_lock(hdev);
7092
7093         eir_len = 0;
7094         switch (cp->type) {
7095         case BIT(BDADDR_BREDR):
7096                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7097                         err = read_local_ssp_oob_req(hdev, sk, cp);
7098                         hci_dev_unlock(hdev);
7099                         if (!err)
7100                                 goto done;
7101
7102                         status = MGMT_STATUS_FAILED;
7103                         goto complete;
7104                 } else {
7105                         eir_len = eir_append_data(rp->eir, eir_len,
7106                                                   EIR_CLASS_OF_DEV,
7107                                                   hdev->dev_class, 3);
7108                 }
7109                 break;
7110         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7111                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7112                     smp_generate_oob(hdev, hash, rand) < 0) {
7113                         hci_dev_unlock(hdev);
7114                         status = MGMT_STATUS_FAILED;
7115                         goto complete;
7116                 }
7117
7118                 /* This should return the active RPA, but since the RPA
7119                  * is only programmed on demand, it is really hard to fill
7120                  * this in at the moment. For now disallow retrieving
7121                  * local out-of-band data when privacy is in use.
7122                  *
7123                  * Returning the identity address will not help here since
7124                  * pairing happens before the identity resolving key is
7125                  * known and thus the connection establishment happens
7126                  * based on the RPA and not the identity address.
7127                  */
7128                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7129                         hci_dev_unlock(hdev);
7130                         status = MGMT_STATUS_REJECTED;
7131                         goto complete;
7132                 }
7133
7134                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7135                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7136                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7137                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7138                         memcpy(addr, &hdev->static_addr, 6);
7139                         addr[6] = 0x01;
7140                 } else {
7141                         memcpy(addr, &hdev->bdaddr, 6);
7142                         addr[6] = 0x00;
7143                 }
7144
7145                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7146                                           addr, sizeof(addr));
7147
7148                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7149                         role = 0x02;
7150                 else
7151                         role = 0x01;
7152
7153                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7154                                           &role, sizeof(role));
7155
7156                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7157                         eir_len = eir_append_data(rp->eir, eir_len,
7158                                                   EIR_LE_SC_CONFIRM,
7159                                                   hash, sizeof(hash));
7160
7161                         eir_len = eir_append_data(rp->eir, eir_len,
7162                                                   EIR_LE_SC_RANDOM,
7163                                                   rand, sizeof(rand));
7164                 }
7165
7166                 flags = mgmt_get_adv_discov_flags(hdev);
7167
7168                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7169                         flags |= LE_AD_NO_BREDR;
7170
7171                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7172                                           &flags, sizeof(flags));
7173                 break;
7174         }
7175
7176         hci_dev_unlock(hdev);
7177
7178         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7179
7180         status = MGMT_STATUS_SUCCESS;
7181
7182 complete:
7183         rp->type = cp->type;
7184         rp->eir_len = cpu_to_le16(eir_len);
7185
7186         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7187                                 status, rp, sizeof(*rp) + eir_len);
7188         if (err < 0 || status)
7189                 goto done;
7190
7191         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7192                                  rp, sizeof(*rp) + eir_len,
7193                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7194
7195 done:
7196         kfree(rp);
7197
7198         return err;
7199 }
7200
7201 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7202 {
7203         u32 flags = 0;
7204
7205         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7206         flags |= MGMT_ADV_FLAG_DISCOV;
7207         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7208         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7209         flags |= MGMT_ADV_FLAG_APPEARANCE;
7210         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7211
7212         /* In extended adv TX_POWER returned from Set Adv Param
7213          * will be always valid.
7214          */
7215         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7216             ext_adv_capable(hdev))
7217                 flags |= MGMT_ADV_FLAG_TX_POWER;
7218
7219         if (ext_adv_capable(hdev)) {
7220                 flags |= MGMT_ADV_FLAG_SEC_1M;
7221                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7222                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7223
7224                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7225                         flags |= MGMT_ADV_FLAG_SEC_2M;
7226
7227                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7228                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7229         }
7230
7231         return flags;
7232 }
7233
7234 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7235                              void *data, u16 data_len)
7236 {
7237         struct mgmt_rp_read_adv_features *rp;
7238         size_t rp_len;
7239         int err;
7240         struct adv_info *adv_instance;
7241         u32 supported_flags;
7242         u8 *instance;
7243
7244         bt_dev_dbg(hdev, "sock %p", sk);
7245
7246         if (!lmp_le_capable(hdev))
7247                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7248                                        MGMT_STATUS_REJECTED);
7249
7250         /* Enabling the experimental LL Privay support disables support for
7251          * advertising.
7252          */
7253         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7254                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7255                                        MGMT_STATUS_NOT_SUPPORTED);
7256
7257         hci_dev_lock(hdev);
7258
7259         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7260         rp = kmalloc(rp_len, GFP_ATOMIC);
7261         if (!rp) {
7262                 hci_dev_unlock(hdev);
7263                 return -ENOMEM;
7264         }
7265
7266         supported_flags = get_supported_adv_flags(hdev);
7267
7268         rp->supported_flags = cpu_to_le32(supported_flags);
7269         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7270         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7271         rp->max_instances = hdev->le_num_of_adv_sets;
7272         rp->num_instances = hdev->adv_instance_cnt;
7273
7274         instance = rp->instance;
7275         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7276                 *instance = adv_instance->instance;
7277                 instance++;
7278         }
7279
7280         hci_dev_unlock(hdev);
7281
7282         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7283                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7284
7285         kfree(rp);
7286
7287         return err;
7288 }
7289
7290 static u8 calculate_name_len(struct hci_dev *hdev)
7291 {
7292         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7293
7294         return append_local_name(hdev, buf, 0);
7295 }
7296
7297 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7298                            bool is_adv_data)
7299 {
7300         u8 max_len = HCI_MAX_AD_LENGTH;
7301
7302         if (is_adv_data) {
7303                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7304                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7305                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7306                         max_len -= 3;
7307
7308                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7309                         max_len -= 3;
7310         } else {
7311                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7312                         max_len -= calculate_name_len(hdev);
7313
7314                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7315                         max_len -= 4;
7316         }
7317
7318         return max_len;
7319 }
7320
7321 static bool flags_managed(u32 adv_flags)
7322 {
7323         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7324                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7325                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7326 }
7327
7328 static bool tx_power_managed(u32 adv_flags)
7329 {
7330         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7331 }
7332
7333 static bool name_managed(u32 adv_flags)
7334 {
7335         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7336 }
7337
7338 static bool appearance_managed(u32 adv_flags)
7339 {
7340         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7341 }
7342
7343 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7344                               u8 len, bool is_adv_data)
7345 {
7346         int i, cur_len;
7347         u8 max_len;
7348
7349         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7350
7351         if (len > max_len)
7352                 return false;
7353
7354         /* Make sure that the data is correctly formatted. */
7355         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7356                 cur_len = data[i];
7357
7358                 if (!cur_len)
7359                         continue;
7360
7361                 if (data[i + 1] == EIR_FLAGS &&
7362                     (!is_adv_data || flags_managed(adv_flags)))
7363                         return false;
7364
7365                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7366                         return false;
7367
7368                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7369                         return false;
7370
7371                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7372                         return false;
7373
7374                 if (data[i + 1] == EIR_APPEARANCE &&
7375                     appearance_managed(adv_flags))
7376                         return false;
7377
7378                 /* If the current field length would exceed the total data
7379                  * length, then it's invalid.
7380                  */
7381                 if (i + cur_len >= len)
7382                         return false;
7383         }
7384
7385         return true;
7386 }
7387
7388 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7389                                      u16 opcode)
7390 {
7391         struct mgmt_pending_cmd *cmd;
7392         struct mgmt_cp_add_advertising *cp;
7393         struct mgmt_rp_add_advertising rp;
7394         struct adv_info *adv_instance, *n;
7395         u8 instance;
7396
7397         bt_dev_dbg(hdev, "status %d", status);
7398
7399         hci_dev_lock(hdev);
7400
7401         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7402
7403         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7404                 if (!adv_instance->pending)
7405                         continue;
7406
7407                 if (!status) {
7408                         adv_instance->pending = false;
7409                         continue;
7410                 }
7411
7412                 instance = adv_instance->instance;
7413
7414                 if (hdev->cur_adv_instance == instance)
7415                         cancel_adv_timeout(hdev);
7416
7417                 hci_remove_adv_instance(hdev, instance);
7418                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7419         }
7420
7421         if (!cmd)
7422                 goto unlock;
7423
7424         cp = cmd->param;
7425         rp.instance = cp->instance;
7426
7427         if (status)
7428                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7429                                 mgmt_status(status));
7430         else
7431                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7432                                   mgmt_status(status), &rp, sizeof(rp));
7433
7434         mgmt_pending_remove(cmd);
7435
7436 unlock:
7437         hci_dev_unlock(hdev);
7438 }
7439
7440 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7441                            void *data, u16 data_len)
7442 {
7443         struct mgmt_cp_add_advertising *cp = data;
7444         struct mgmt_rp_add_advertising rp;
7445         u32 flags;
7446         u32 supported_flags, phy_flags;
7447         u8 status;
7448         u16 timeout, duration;
7449         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7450         u8 schedule_instance = 0;
7451         struct adv_info *next_instance;
7452         int err;
7453         struct mgmt_pending_cmd *cmd;
7454         struct hci_request req;
7455
7456         bt_dev_dbg(hdev, "sock %p", sk);
7457
7458         status = mgmt_le_support(hdev);
7459         if (status)
7460                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7461                                        status);
7462
7463         /* Enabling the experimental LL Privay support disables support for
7464          * advertising.
7465          */
7466         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7468                                        MGMT_STATUS_NOT_SUPPORTED);
7469
7470         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7472                                        MGMT_STATUS_INVALID_PARAMS);
7473
7474         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7475                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7476                                        MGMT_STATUS_INVALID_PARAMS);
7477
7478         flags = __le32_to_cpu(cp->flags);
7479         timeout = __le16_to_cpu(cp->timeout);
7480         duration = __le16_to_cpu(cp->duration);
7481
7482         /* The current implementation only supports a subset of the specified
7483          * flags. Also need to check mutual exclusiveness of sec flags.
7484          */
7485         supported_flags = get_supported_adv_flags(hdev);
7486         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
7487         if (flags & ~supported_flags ||
7488             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7489                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7490                                        MGMT_STATUS_INVALID_PARAMS);
7491
7492         hci_dev_lock(hdev);
7493
7494         if (timeout && !hdev_is_powered(hdev)) {
7495                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7496                                       MGMT_STATUS_REJECTED);
7497                 goto unlock;
7498         }
7499
7500         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7501             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7502             pending_find(MGMT_OP_SET_LE, hdev)) {
7503                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7504                                       MGMT_STATUS_BUSY);
7505                 goto unlock;
7506         }
7507
7508         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7509             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7510                                cp->scan_rsp_len, false)) {
7511                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7512                                       MGMT_STATUS_INVALID_PARAMS);
7513                 goto unlock;
7514         }
7515
7516         err = hci_add_adv_instance(hdev, cp->instance, flags,
7517                                    cp->adv_data_len, cp->data,
7518                                    cp->scan_rsp_len,
7519                                    cp->data + cp->adv_data_len,
7520                                    timeout, duration);
7521         if (err < 0) {
7522                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7523                                       MGMT_STATUS_FAILED);
7524                 goto unlock;
7525         }
7526
7527         /* Only trigger an advertising added event if a new instance was
7528          * actually added.
7529          */
7530         if (hdev->adv_instance_cnt > prev_instance_cnt)
7531                 mgmt_advertising_added(sk, hdev, cp->instance);
7532
7533         if (hdev->cur_adv_instance == cp->instance) {
7534                 /* If the currently advertised instance is being changed then
7535                  * cancel the current advertising and schedule the next
7536                  * instance. If there is only one instance then the overridden
7537                  * advertising data will be visible right away.
7538                  */
7539                 cancel_adv_timeout(hdev);
7540
7541                 next_instance = hci_get_next_instance(hdev, cp->instance);
7542                 if (next_instance)
7543                         schedule_instance = next_instance->instance;
7544         } else if (!hdev->adv_instance_timeout) {
7545                 /* Immediately advertise the new instance if no other
7546                  * instance is currently being advertised.
7547                  */
7548                 schedule_instance = cp->instance;
7549         }
7550
7551         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7552          * there is no instance to be advertised then we have no HCI
7553          * communication to make. Simply return.
7554          */
7555         if (!hdev_is_powered(hdev) ||
7556             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7557             !schedule_instance) {
7558                 rp.instance = cp->instance;
7559                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7560                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7561                 goto unlock;
7562         }
7563
7564         /* We're good to go, update advertising data, parameters, and start
7565          * advertising.
7566          */
7567         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7568                                data_len);
7569         if (!cmd) {
7570                 err = -ENOMEM;
7571                 goto unlock;
7572         }
7573
7574         hci_req_init(&req, hdev);
7575
7576         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7577
7578         if (!err)
7579                 err = hci_req_run(&req, add_advertising_complete);
7580
7581         if (err < 0) {
7582                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7583                                       MGMT_STATUS_FAILED);
7584                 mgmt_pending_remove(cmd);
7585         }
7586
7587 unlock:
7588         hci_dev_unlock(hdev);
7589
7590         return err;
7591 }
7592
7593 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7594                                         u16 opcode)
7595 {
7596         struct mgmt_pending_cmd *cmd;
7597         struct mgmt_cp_remove_advertising *cp;
7598         struct mgmt_rp_remove_advertising rp;
7599
7600         bt_dev_dbg(hdev, "status %d", status);
7601
7602         hci_dev_lock(hdev);
7603
7604         /* A failure status here only means that we failed to disable
7605          * advertising. Otherwise, the advertising instance has been removed,
7606          * so report success.
7607          */
7608         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7609         if (!cmd)
7610                 goto unlock;
7611
7612         cp = cmd->param;
7613         rp.instance = cp->instance;
7614
7615         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7616                           &rp, sizeof(rp));
7617         mgmt_pending_remove(cmd);
7618
7619 unlock:
7620         hci_dev_unlock(hdev);
7621 }
7622
7623 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7624                               void *data, u16 data_len)
7625 {
7626         struct mgmt_cp_remove_advertising *cp = data;
7627         struct mgmt_rp_remove_advertising rp;
7628         struct mgmt_pending_cmd *cmd;
7629         struct hci_request req;
7630         int err;
7631
7632         bt_dev_dbg(hdev, "sock %p", sk);
7633
7634         /* Enabling the experimental LL Privay support disables support for
7635          * advertising.
7636          */
7637         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7638                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7639                                        MGMT_STATUS_NOT_SUPPORTED);
7640
7641         hci_dev_lock(hdev);
7642
7643         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
7644                 err = mgmt_cmd_status(sk, hdev->id,
7645                                       MGMT_OP_REMOVE_ADVERTISING,
7646                                       MGMT_STATUS_INVALID_PARAMS);
7647                 goto unlock;
7648         }
7649
7650         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7651             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7652             pending_find(MGMT_OP_SET_LE, hdev)) {
7653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7654                                       MGMT_STATUS_BUSY);
7655                 goto unlock;
7656         }
7657
7658         if (list_empty(&hdev->adv_instances)) {
7659                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7660                                       MGMT_STATUS_INVALID_PARAMS);
7661                 goto unlock;
7662         }
7663
7664         hci_req_init(&req, hdev);
7665
7666         /* If we use extended advertising, instance is disabled and removed */
7667         if (ext_adv_capable(hdev)) {
7668                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
7669                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
7670         }
7671
7672         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
7673
7674         if (list_empty(&hdev->adv_instances))
7675                 __hci_req_disable_advertising(&req);
7676
7677         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7678          * flag is set or the device isn't powered then we have no HCI
7679          * communication to make. Simply return.
7680          */
7681         if (skb_queue_empty(&req.cmd_q) ||
7682             !hdev_is_powered(hdev) ||
7683             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7684                 hci_req_purge(&req);
7685                 rp.instance = cp->instance;
7686                 err = mgmt_cmd_complete(sk, hdev->id,
7687                                         MGMT_OP_REMOVE_ADVERTISING,
7688                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7689                 goto unlock;
7690         }
7691
7692         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7693                                data_len);
7694         if (!cmd) {
7695                 err = -ENOMEM;
7696                 goto unlock;
7697         }
7698
7699         err = hci_req_run(&req, remove_advertising_complete);
7700         if (err < 0)
7701                 mgmt_pending_remove(cmd);
7702
7703 unlock:
7704         hci_dev_unlock(hdev);
7705
7706         return err;
7707 }
7708
7709 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
7710                              void *data, u16 data_len)
7711 {
7712         struct mgmt_cp_get_adv_size_info *cp = data;
7713         struct mgmt_rp_get_adv_size_info rp;
7714         u32 flags, supported_flags;
7715         int err;
7716
7717         bt_dev_dbg(hdev, "sock %p", sk);
7718
7719         if (!lmp_le_capable(hdev))
7720                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
7721                                        MGMT_STATUS_REJECTED);
7722
7723         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
7725                                        MGMT_STATUS_INVALID_PARAMS);
7726
7727         flags = __le32_to_cpu(cp->flags);
7728
7729         /* The current implementation only supports a subset of the specified
7730          * flags.
7731          */
7732         supported_flags = get_supported_adv_flags(hdev);
7733         if (flags & ~supported_flags)
7734                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
7735                                        MGMT_STATUS_INVALID_PARAMS);
7736
7737         rp.instance = cp->instance;
7738         rp.flags = cp->flags;
7739         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7740         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7741
7742         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
7743                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7744
7745         return err;
7746 }
7747
7748 static const struct hci_mgmt_handler mgmt_handlers[] = {
7749         { NULL }, /* 0x0000 (no command) */
7750         { read_version,            MGMT_READ_VERSION_SIZE,
7751                                                 HCI_MGMT_NO_HDEV |
7752                                                 HCI_MGMT_UNTRUSTED },
7753         { read_commands,           MGMT_READ_COMMANDS_SIZE,
7754                                                 HCI_MGMT_NO_HDEV |
7755                                                 HCI_MGMT_UNTRUSTED },
7756         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
7757                                                 HCI_MGMT_NO_HDEV |
7758                                                 HCI_MGMT_UNTRUSTED },
7759         { read_controller_info,    MGMT_READ_INFO_SIZE,
7760                                                 HCI_MGMT_UNTRUSTED },
7761         { set_powered,             MGMT_SETTING_SIZE },
7762         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
7763         { set_connectable,         MGMT_SETTING_SIZE },
7764         { set_fast_connectable,    MGMT_SETTING_SIZE },
7765         { set_bondable,            MGMT_SETTING_SIZE },
7766         { set_link_security,       MGMT_SETTING_SIZE },
7767         { set_ssp,                 MGMT_SETTING_SIZE },
7768         { set_hs,                  MGMT_SETTING_SIZE },
7769         { set_le,                  MGMT_SETTING_SIZE },
7770         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
7771         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
7772         { add_uuid,                MGMT_ADD_UUID_SIZE },
7773         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
7774         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
7775                                                 HCI_MGMT_VAR_LEN },
7776         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7777                                                 HCI_MGMT_VAR_LEN },
7778         { disconnect,              MGMT_DISCONNECT_SIZE },
7779         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
7780         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
7781         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
7782         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
7783         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
7784         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
7785         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
7786         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
7787         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7788         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
7789         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7790         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
7791         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7792                                                 HCI_MGMT_VAR_LEN },
7793         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7794         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
7795         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
7796         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
7797         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
7798         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
7799         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
7800         { set_advertising,         MGMT_SETTING_SIZE },
7801         { set_bredr,               MGMT_SETTING_SIZE },
7802         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
7803         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
7804         { set_secure_conn,         MGMT_SETTING_SIZE },
7805         { set_debug_keys,          MGMT_SETTING_SIZE },
7806         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
7807         { load_irks,               MGMT_LOAD_IRKS_SIZE,
7808                                                 HCI_MGMT_VAR_LEN },
7809         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
7810         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
7811         { add_device,              MGMT_ADD_DEVICE_SIZE },
7812         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
7813         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
7814                                                 HCI_MGMT_VAR_LEN },
7815         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7816                                                 HCI_MGMT_NO_HDEV |
7817                                                 HCI_MGMT_UNTRUSTED },
7818         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
7819                                                 HCI_MGMT_UNCONFIGURED |
7820                                                 HCI_MGMT_UNTRUSTED },
7821         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
7822                                                 HCI_MGMT_UNCONFIGURED },
7823         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
7824                                                 HCI_MGMT_UNCONFIGURED },
7825         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7826                                                 HCI_MGMT_VAR_LEN },
7827         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7828         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
7829                                                 HCI_MGMT_NO_HDEV |
7830                                                 HCI_MGMT_UNTRUSTED },
7831         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
7832         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
7833                                                 HCI_MGMT_VAR_LEN },
7834         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
7835         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
7836         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
7837         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
7838                                                 HCI_MGMT_UNTRUSTED },
7839         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
7840         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
7841         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
7842         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
7843                                                 HCI_MGMT_VAR_LEN },
7844         { set_wideband_speech,     MGMT_SETTING_SIZE },
7845         { read_security_info,      MGMT_READ_SECURITY_INFO_SIZE,
7846                                                 HCI_MGMT_UNTRUSTED },
7847         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
7848                                                 HCI_MGMT_UNTRUSTED |
7849                                                 HCI_MGMT_HDEV_OPTIONAL },
7850         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
7851                                                 HCI_MGMT_VAR_LEN |
7852                                                 HCI_MGMT_HDEV_OPTIONAL },
7853         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
7854                                                 HCI_MGMT_UNTRUSTED },
7855         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
7856                                                 HCI_MGMT_VAR_LEN },
7857         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
7858                                                 HCI_MGMT_UNTRUSTED },
7859         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
7860                                                 HCI_MGMT_VAR_LEN },
7861         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
7862         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
7863         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
7864         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
7865                                                 HCI_MGMT_VAR_LEN },
7866         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
7867 };
7868
7869 void mgmt_index_added(struct hci_dev *hdev)
7870 {
7871         struct mgmt_ev_ext_index ev;
7872
7873         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7874                 return;
7875
7876         switch (hdev->dev_type) {
7877         case HCI_PRIMARY:
7878                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7879                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7880                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7881                         ev.type = 0x01;
7882                 } else {
7883                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7884                                          HCI_MGMT_INDEX_EVENTS);
7885                         ev.type = 0x00;
7886                 }
7887                 break;
7888         case HCI_AMP:
7889                 ev.type = 0x02;
7890                 break;
7891         default:
7892                 return;
7893         }
7894
7895         ev.bus = hdev->bus;
7896
7897         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7898                          HCI_MGMT_EXT_INDEX_EVENTS);
7899 }
7900
7901 void mgmt_index_removed(struct hci_dev *hdev)
7902 {
7903         struct mgmt_ev_ext_index ev;
7904         u8 status = MGMT_STATUS_INVALID_INDEX;
7905
7906         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7907                 return;
7908
7909         switch (hdev->dev_type) {
7910         case HCI_PRIMARY:
7911                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7912
7913                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7914                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7915                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7916                         ev.type = 0x01;
7917                 } else {
7918                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7919                                          HCI_MGMT_INDEX_EVENTS);
7920                         ev.type = 0x00;
7921                 }
7922                 break;
7923         case HCI_AMP:
7924                 ev.type = 0x02;
7925                 break;
7926         default:
7927                 return;
7928         }
7929
7930         ev.bus = hdev->bus;
7931
7932         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7933                          HCI_MGMT_EXT_INDEX_EVENTS);
7934 }
7935
7936 /* This function requires the caller holds hdev->lock */
7937 static void restart_le_actions(struct hci_dev *hdev)
7938 {
7939         struct hci_conn_params *p;
7940
7941         list_for_each_entry(p, &hdev->le_conn_params, list) {
7942                 /* Needed for AUTO_OFF case where might not "really"
7943                  * have been powered off.
7944                  */
7945                 list_del_init(&p->action);
7946
7947                 switch (p->auto_connect) {
7948                 case HCI_AUTO_CONN_DIRECT:
7949                 case HCI_AUTO_CONN_ALWAYS:
7950                         list_add(&p->action, &hdev->pend_le_conns);
7951                         break;
7952                 case HCI_AUTO_CONN_REPORT:
7953                         list_add(&p->action, &hdev->pend_le_reports);
7954                         break;
7955                 default:
7956                         break;
7957                 }
7958         }
7959 }
7960
7961 void mgmt_power_on(struct hci_dev *hdev, int err)
7962 {
7963         struct cmd_lookup match = { NULL, hdev };
7964
7965         bt_dev_dbg(hdev, "err %d", err);
7966
7967         hci_dev_lock(hdev);
7968
7969         if (!err) {
7970                 restart_le_actions(hdev);
7971                 hci_update_background_scan(hdev);
7972         }
7973
7974         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7975
7976         new_settings(hdev, match.sk);
7977
7978         if (match.sk)
7979                 sock_put(match.sk);
7980
7981         hci_dev_unlock(hdev);
7982 }
7983
7984 void __mgmt_power_off(struct hci_dev *hdev)
7985 {
7986         struct cmd_lookup match = { NULL, hdev };
7987         u8 status, zero_cod[] = { 0, 0, 0 };
7988
7989         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7990
7991         /* If the power off is because of hdev unregistration let
7992          * use the appropriate INVALID_INDEX status. Otherwise use
7993          * NOT_POWERED. We cover both scenarios here since later in
7994          * mgmt_index_removed() any hci_conn callbacks will have already
7995          * been triggered, potentially causing misleading DISCONNECTED
7996          * status responses.
7997          */
7998         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7999                 status = MGMT_STATUS_INVALID_INDEX;
8000         else
8001                 status = MGMT_STATUS_NOT_POWERED;
8002
8003         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8004
8005         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8006                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8007                                    zero_cod, sizeof(zero_cod),
8008                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8009                 ext_info_changed(hdev, NULL);
8010         }
8011
8012         new_settings(hdev, match.sk);
8013
8014         if (match.sk)
8015                 sock_put(match.sk);
8016 }
8017
8018 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8019 {
8020         struct mgmt_pending_cmd *cmd;
8021         u8 status;
8022
8023         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8024         if (!cmd)
8025                 return;
8026
8027         if (err == -ERFKILL)
8028                 status = MGMT_STATUS_RFKILLED;
8029         else
8030                 status = MGMT_STATUS_FAILED;
8031
8032         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8033
8034         mgmt_pending_remove(cmd);
8035 }
8036
8037 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8038                        bool persistent)
8039 {
8040         struct mgmt_ev_new_link_key ev;
8041
8042         memset(&ev, 0, sizeof(ev));
8043
8044         ev.store_hint = persistent;
8045         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8046         ev.key.addr.type = BDADDR_BREDR;
8047         ev.key.type = key->type;
8048         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8049         ev.key.pin_len = key->pin_len;
8050
8051         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8052 }
8053
8054 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8055 {
8056         switch (ltk->type) {
8057         case SMP_LTK:
8058         case SMP_LTK_SLAVE:
8059                 if (ltk->authenticated)
8060                         return MGMT_LTK_AUTHENTICATED;
8061                 return MGMT_LTK_UNAUTHENTICATED;
8062         case SMP_LTK_P256:
8063                 if (ltk->authenticated)
8064                         return MGMT_LTK_P256_AUTH;
8065                 return MGMT_LTK_P256_UNAUTH;
8066         case SMP_LTK_P256_DEBUG:
8067                 return MGMT_LTK_P256_DEBUG;
8068         }
8069
8070         return MGMT_LTK_UNAUTHENTICATED;
8071 }
8072
8073 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8074 {
8075         struct mgmt_ev_new_long_term_key ev;
8076
8077         memset(&ev, 0, sizeof(ev));
8078
8079         /* Devices using resolvable or non-resolvable random addresses
8080          * without providing an identity resolving key don't require
8081          * to store long term keys. Their addresses will change the
8082          * next time around.
8083          *
8084          * Only when a remote device provides an identity address
8085          * make sure the long term key is stored. If the remote
8086          * identity is known, the long term keys are internally
8087          * mapped to the identity address. So allow static random
8088          * and public addresses here.
8089          */
8090         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8091             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8092                 ev.store_hint = 0x00;
8093         else
8094                 ev.store_hint = persistent;
8095
8096         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8097         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8098         ev.key.type = mgmt_ltk_type(key);
8099         ev.key.enc_size = key->enc_size;
8100         ev.key.ediv = key->ediv;
8101         ev.key.rand = key->rand;
8102
8103         if (key->type == SMP_LTK)
8104                 ev.key.master = 1;
8105
8106         /* Make sure we copy only the significant bytes based on the
8107          * encryption key size, and set the rest of the value to zeroes.
8108          */
8109         memcpy(ev.key.val, key->val, key->enc_size);
8110         memset(ev.key.val + key->enc_size, 0,
8111                sizeof(ev.key.val) - key->enc_size);
8112
8113         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8114 }
8115
8116 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8117 {
8118         struct mgmt_ev_new_irk ev;
8119
8120         memset(&ev, 0, sizeof(ev));
8121
8122         ev.store_hint = persistent;
8123
8124         bacpy(&ev.rpa, &irk->rpa);
8125         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8126         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8127         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8128
8129         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8130 }
8131
8132 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8133                    bool persistent)
8134 {
8135         struct mgmt_ev_new_csrk ev;
8136
8137         memset(&ev, 0, sizeof(ev));
8138
8139         /* Devices using resolvable or non-resolvable random addresses
8140          * without providing an identity resolving key don't require
8141          * to store signature resolving keys. Their addresses will change
8142          * the next time around.
8143          *
8144          * Only when a remote device provides an identity address
8145          * make sure the signature resolving key is stored. So allow
8146          * static random and public addresses here.
8147          */
8148         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8149             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8150                 ev.store_hint = 0x00;
8151         else
8152                 ev.store_hint = persistent;
8153
8154         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8155         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8156         ev.key.type = csrk->type;
8157         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8158
8159         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8160 }
8161
8162 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8163                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8164                          u16 max_interval, u16 latency, u16 timeout)
8165 {
8166         struct mgmt_ev_new_conn_param ev;
8167
8168         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8169                 return;
8170
8171         memset(&ev, 0, sizeof(ev));
8172         bacpy(&ev.addr.bdaddr, bdaddr);
8173         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8174         ev.store_hint = store_hint;
8175         ev.min_interval = cpu_to_le16(min_interval);
8176         ev.max_interval = cpu_to_le16(max_interval);
8177         ev.latency = cpu_to_le16(latency);
8178         ev.timeout = cpu_to_le16(timeout);
8179
8180         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8181 }
8182
8183 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8184                            u32 flags, u8 *name, u8 name_len)
8185 {
8186         char buf[512];
8187         struct mgmt_ev_device_connected *ev = (void *) buf;
8188         u16 eir_len = 0;
8189
8190         bacpy(&ev->addr.bdaddr, &conn->dst);
8191         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8192
8193         ev->flags = __cpu_to_le32(flags);
8194
8195         /* We must ensure that the EIR Data fields are ordered and
8196          * unique. Keep it simple for now and avoid the problem by not
8197          * adding any BR/EDR data to the LE adv.
8198          */
8199         if (conn->le_adv_data_len > 0) {
8200                 memcpy(&ev->eir[eir_len],
8201                        conn->le_adv_data, conn->le_adv_data_len);
8202                 eir_len = conn->le_adv_data_len;
8203         } else {
8204                 if (name_len > 0)
8205                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8206                                                   name, name_len);
8207
8208                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8209                         eir_len = eir_append_data(ev->eir, eir_len,
8210                                                   EIR_CLASS_OF_DEV,
8211                                                   conn->dev_class, 3);
8212         }
8213
8214         ev->eir_len = cpu_to_le16(eir_len);
8215
8216         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8217                     sizeof(*ev) + eir_len, NULL);
8218 }
8219
8220 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8221 {
8222         struct sock **sk = data;
8223
8224         cmd->cmd_complete(cmd, 0);
8225
8226         *sk = cmd->sk;
8227         sock_hold(*sk);
8228
8229         mgmt_pending_remove(cmd);
8230 }
8231
8232 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8233 {
8234         struct hci_dev *hdev = data;
8235         struct mgmt_cp_unpair_device *cp = cmd->param;
8236
8237         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8238
8239         cmd->cmd_complete(cmd, 0);
8240         mgmt_pending_remove(cmd);
8241 }
8242
8243 bool mgmt_powering_down(struct hci_dev *hdev)
8244 {
8245         struct mgmt_pending_cmd *cmd;
8246         struct mgmt_mode *cp;
8247
8248         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8249         if (!cmd)
8250                 return false;
8251
8252         cp = cmd->param;
8253         if (!cp->val)
8254                 return true;
8255
8256         return false;
8257 }
8258
8259 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8260                               u8 link_type, u8 addr_type, u8 reason,
8261                               bool mgmt_connected)
8262 {
8263         struct mgmt_ev_device_disconnected ev;
8264         struct sock *sk = NULL;
8265
8266         /* The connection is still in hci_conn_hash so test for 1
8267          * instead of 0 to know if this is the last one.
8268          */
8269         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8270                 cancel_delayed_work(&hdev->power_off);
8271                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8272         }
8273
8274         if (!mgmt_connected)
8275                 return;
8276
8277         if (link_type != ACL_LINK && link_type != LE_LINK)
8278                 return;
8279
8280         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8281
8282         bacpy(&ev.addr.bdaddr, bdaddr);
8283         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8284         ev.reason = reason;
8285
8286         /* Report disconnects due to suspend */
8287         if (hdev->suspended)
8288                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8289
8290         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8291
8292         if (sk)
8293                 sock_put(sk);
8294
8295         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8296                              hdev);
8297 }
8298
8299 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8300                             u8 link_type, u8 addr_type, u8 status)
8301 {
8302         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8303         struct mgmt_cp_disconnect *cp;
8304         struct mgmt_pending_cmd *cmd;
8305
8306         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8307                              hdev);
8308
8309         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8310         if (!cmd)
8311                 return;
8312
8313         cp = cmd->param;
8314
8315         if (bacmp(bdaddr, &cp->addr.bdaddr))
8316                 return;
8317
8318         if (cp->addr.type != bdaddr_type)
8319                 return;
8320
8321         cmd->cmd_complete(cmd, mgmt_status(status));
8322         mgmt_pending_remove(cmd);
8323 }
8324
8325 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8326                          u8 addr_type, u8 status)
8327 {
8328         struct mgmt_ev_connect_failed ev;
8329
8330         /* The connection is still in hci_conn_hash so test for 1
8331          * instead of 0 to know if this is the last one.
8332          */
8333         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8334                 cancel_delayed_work(&hdev->power_off);
8335                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8336         }
8337
8338         bacpy(&ev.addr.bdaddr, bdaddr);
8339         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8340         ev.status = mgmt_status(status);
8341
8342         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8343 }
8344
8345 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8346 {
8347         struct mgmt_ev_pin_code_request ev;
8348
8349         bacpy(&ev.addr.bdaddr, bdaddr);
8350         ev.addr.type = BDADDR_BREDR;
8351         ev.secure = secure;
8352
8353         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8354 }
8355
8356 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8357                                   u8 status)
8358 {
8359         struct mgmt_pending_cmd *cmd;
8360
8361         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8362         if (!cmd)
8363                 return;
8364
8365         cmd->cmd_complete(cmd, mgmt_status(status));
8366         mgmt_pending_remove(cmd);
8367 }
8368
8369 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8370                                       u8 status)
8371 {
8372         struct mgmt_pending_cmd *cmd;
8373
8374         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8375         if (!cmd)
8376                 return;
8377
8378         cmd->cmd_complete(cmd, mgmt_status(status));
8379         mgmt_pending_remove(cmd);
8380 }
8381
8382 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8383                               u8 link_type, u8 addr_type, u32 value,
8384                               u8 confirm_hint)
8385 {
8386         struct mgmt_ev_user_confirm_request ev;
8387
8388         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8389
8390         bacpy(&ev.addr.bdaddr, bdaddr);
8391         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8392         ev.confirm_hint = confirm_hint;
8393         ev.value = cpu_to_le32(value);
8394
8395         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8396                           NULL);
8397 }
8398
8399 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8400                               u8 link_type, u8 addr_type)
8401 {
8402         struct mgmt_ev_user_passkey_request ev;
8403
8404         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8405
8406         bacpy(&ev.addr.bdaddr, bdaddr);
8407         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8408
8409         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8410                           NULL);
8411 }
8412
8413 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8414                                       u8 link_type, u8 addr_type, u8 status,
8415                                       u8 opcode)
8416 {
8417         struct mgmt_pending_cmd *cmd;
8418
8419         cmd = pending_find(opcode, hdev);
8420         if (!cmd)
8421                 return -ENOENT;
8422
8423         cmd->cmd_complete(cmd, mgmt_status(status));
8424         mgmt_pending_remove(cmd);
8425
8426         return 0;
8427 }
8428
8429 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8430                                      u8 link_type, u8 addr_type, u8 status)
8431 {
8432         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8433                                           status, MGMT_OP_USER_CONFIRM_REPLY);
8434 }
8435
8436 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8437                                          u8 link_type, u8 addr_type, u8 status)
8438 {
8439         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8440                                           status,
8441                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
8442 }
8443
8444 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8445                                      u8 link_type, u8 addr_type, u8 status)
8446 {
8447         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8448                                           status, MGMT_OP_USER_PASSKEY_REPLY);
8449 }
8450
8451 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8452                                          u8 link_type, u8 addr_type, u8 status)
8453 {
8454         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8455                                           status,
8456                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
8457 }
8458
8459 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8460                              u8 link_type, u8 addr_type, u32 passkey,
8461                              u8 entered)
8462 {
8463         struct mgmt_ev_passkey_notify ev;
8464
8465         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8466
8467         bacpy(&ev.addr.bdaddr, bdaddr);
8468         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8469         ev.passkey = __cpu_to_le32(passkey);
8470         ev.entered = entered;
8471
8472         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8473 }
8474
8475 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8476 {
8477         struct mgmt_ev_auth_failed ev;
8478         struct mgmt_pending_cmd *cmd;
8479         u8 status = mgmt_status(hci_status);
8480
8481         bacpy(&ev.addr.bdaddr, &conn->dst);
8482         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8483         ev.status = status;
8484
8485         cmd = find_pairing(conn);
8486
8487         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8488                     cmd ? cmd->sk : NULL);
8489
8490         if (cmd) {
8491                 cmd->cmd_complete(cmd, status);
8492                 mgmt_pending_remove(cmd);
8493         }
8494 }
8495
8496 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
8497 {
8498         struct cmd_lookup match = { NULL, hdev };
8499         bool changed;
8500
8501         if (status) {
8502                 u8 mgmt_err = mgmt_status(status);
8503                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8504                                      cmd_status_rsp, &mgmt_err);
8505                 return;
8506         }
8507
8508         if (test_bit(HCI_AUTH, &hdev->flags))
8509                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
8510         else
8511                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
8512
8513         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8514                              &match);
8515
8516         if (changed)
8517                 new_settings(hdev, match.sk);
8518
8519         if (match.sk)
8520                 sock_put(match.sk);
8521 }
8522
8523 static void clear_eir(struct hci_request *req)
8524 {
8525         struct hci_dev *hdev = req->hdev;
8526         struct hci_cp_write_eir cp;
8527
8528         if (!lmp_ext_inq_capable(hdev))
8529                 return;
8530
8531         memset(hdev->eir, 0, sizeof(hdev->eir));
8532
8533         memset(&cp, 0, sizeof(cp));
8534
8535         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8536 }
8537
8538 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8539 {
8540         struct cmd_lookup match = { NULL, hdev };
8541         struct hci_request req;
8542         bool changed = false;
8543
8544         if (status) {
8545                 u8 mgmt_err = mgmt_status(status);
8546
8547                 if (enable && hci_dev_test_and_clear_flag(hdev,
8548                                                           HCI_SSP_ENABLED)) {
8549                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8550                         new_settings(hdev, NULL);
8551                 }
8552
8553                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8554                                      &mgmt_err);
8555                 return;
8556         }
8557
8558         if (enable) {
8559                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
8560         } else {
8561                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
8562                 if (!changed)
8563                         changed = hci_dev_test_and_clear_flag(hdev,
8564                                                               HCI_HS_ENABLED);
8565                 else
8566                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8567         }
8568
8569         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8570
8571         if (changed)
8572                 new_settings(hdev, match.sk);
8573
8574         if (match.sk)
8575                 sock_put(match.sk);
8576
8577         hci_req_init(&req, hdev);
8578
8579         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8580                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
8581                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8582                                     sizeof(enable), &enable);
8583                 __hci_req_update_eir(&req);
8584         } else {
8585                 clear_eir(&req);
8586         }
8587
8588         hci_req_run(&req, NULL);
8589 }
8590
8591 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
8592 {
8593         struct cmd_lookup *match = data;
8594
8595         if (match->sk == NULL) {
8596                 match->sk = cmd->sk;
8597                 sock_hold(match->sk);
8598         }
8599 }
8600
8601 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8602                                     u8 status)
8603 {
8604         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8605
8606         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8607         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8608         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8609
8610         if (!status) {
8611                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
8612                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8613                 ext_info_changed(hdev, NULL);
8614         }
8615
8616         if (match.sk)
8617                 sock_put(match.sk);
8618 }
8619
8620 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8621 {
8622         struct mgmt_cp_set_local_name ev;
8623         struct mgmt_pending_cmd *cmd;
8624
8625         if (status)
8626                 return;
8627
8628         memset(&ev, 0, sizeof(ev));
8629         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
8630         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
8631
8632         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
8633         if (!cmd) {
8634                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
8635
8636                 /* If this is a HCI command related to powering on the
8637                  * HCI dev don't send any mgmt signals.
8638                  */
8639                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
8640                         return;
8641         }
8642
8643         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8644                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
8645         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
8646 }
8647
8648 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8649 {
8650         int i;
8651
8652         for (i = 0; i < uuid_count; i++) {
8653                 if (!memcmp(uuid, uuids[i], 16))
8654                         return true;
8655         }
8656
8657         return false;
8658 }
8659
8660 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8661 {
8662         u16 parsed = 0;
8663
8664         while (parsed < eir_len) {
8665                 u8 field_len = eir[0];
8666                 u8 uuid[16];
8667                 int i;
8668
8669                 if (field_len == 0)
8670                         break;
8671
8672                 if (eir_len - parsed < field_len + 1)
8673                         break;
8674
8675                 switch (eir[1]) {
8676                 case EIR_UUID16_ALL:
8677                 case EIR_UUID16_SOME:
8678                         for (i = 0; i + 3 <= field_len; i += 2) {
8679                                 memcpy(uuid, bluetooth_base_uuid, 16);
8680                                 uuid[13] = eir[i + 3];
8681                                 uuid[12] = eir[i + 2];
8682                                 if (has_uuid(uuid, uuid_count, uuids))
8683                                         return true;
8684                         }
8685                         break;
8686                 case EIR_UUID32_ALL:
8687                 case EIR_UUID32_SOME:
8688                         for (i = 0; i + 5 <= field_len; i += 4) {
8689                                 memcpy(uuid, bluetooth_base_uuid, 16);
8690                                 uuid[15] = eir[i + 5];
8691                                 uuid[14] = eir[i + 4];
8692                                 uuid[13] = eir[i + 3];
8693                                 uuid[12] = eir[i + 2];
8694                                 if (has_uuid(uuid, uuid_count, uuids))
8695                                         return true;
8696                         }
8697                         break;
8698                 case EIR_UUID128_ALL:
8699                 case EIR_UUID128_SOME:
8700                         for (i = 0; i + 17 <= field_len; i += 16) {
8701                                 memcpy(uuid, eir + i + 2, 16);
8702                                 if (has_uuid(uuid, uuid_count, uuids))
8703                                         return true;
8704                         }
8705                         break;
8706                 }
8707
8708                 parsed += field_len + 1;
8709                 eir += field_len + 1;
8710         }
8711
8712         return false;
8713 }
8714
8715 static void restart_le_scan(struct hci_dev *hdev)
8716 {
8717         /* If controller is not scanning we are done. */
8718         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
8719                 return;
8720
8721         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8722                        hdev->discovery.scan_start +
8723                        hdev->discovery.scan_duration))
8724                 return;
8725
8726         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
8727                            DISCOV_LE_RESTART_DELAY);
8728 }
8729
8730 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8731                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8732 {
8733         /* If a RSSI threshold has been specified, and
8734          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8735          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8736          * is set, let it through for further processing, as we might need to
8737          * restart the scan.
8738          *
8739          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8740          * the results are also dropped.
8741          */
8742         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8743             (rssi == HCI_RSSI_INVALID ||
8744             (rssi < hdev->discovery.rssi &&
8745              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
8746                 return  false;
8747
8748         if (hdev->discovery.uuid_count != 0) {
8749                 /* If a list of UUIDs is provided in filter, results with no
8750                  * matching UUID should be dropped.
8751                  */
8752                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8753                                    hdev->discovery.uuids) &&
8754                     !eir_has_uuids(scan_rsp, scan_rsp_len,
8755                                    hdev->discovery.uuid_count,
8756                                    hdev->discovery.uuids))
8757                         return false;
8758         }
8759
8760         /* If duplicate filtering does not report RSSI changes, then restart
8761          * scanning to ensure updated result with updated RSSI values.
8762          */
8763         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8764                 restart_le_scan(hdev);
8765
8766                 /* Validate RSSI value against the RSSI threshold once more. */
8767                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8768                     rssi < hdev->discovery.rssi)
8769                         return false;
8770         }
8771
8772         return true;
8773 }
8774
8775 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8776                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8777                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8778 {
8779         char buf[512];
8780         struct mgmt_ev_device_found *ev = (void *)buf;
8781         size_t ev_size;
8782
8783         /* Don't send events for a non-kernel initiated discovery. With
8784          * LE one exception is if we have pend_le_reports > 0 in which
8785          * case we're doing passive scanning and want these events.
8786          */
8787         if (!hci_discovery_active(hdev)) {
8788                 if (link_type == ACL_LINK)
8789                         return;
8790                 if (link_type == LE_LINK &&
8791                     list_empty(&hdev->pend_le_reports) &&
8792                     !hci_is_adv_monitoring(hdev)) {
8793                         return;
8794                 }
8795         }
8796
8797         if (hdev->discovery.result_filtering) {
8798                 /* We are using service discovery */
8799                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8800                                      scan_rsp_len))
8801                         return;
8802         }
8803
8804         if (hdev->discovery.limited) {
8805                 /* Check for limited discoverable bit */
8806                 if (dev_class) {
8807                         if (!(dev_class[1] & 0x20))
8808                                 return;
8809                 } else {
8810                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
8811                         if (!flags || !(flags[0] & LE_AD_LIMITED))
8812                                 return;
8813                 }
8814         }
8815
8816         /* Make sure that the buffer is big enough. The 5 extra bytes
8817          * are for the potential CoD field.
8818          */
8819         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8820                 return;
8821
8822         memset(buf, 0, sizeof(buf));
8823
8824         /* In case of device discovery with BR/EDR devices (pre 1.2), the
8825          * RSSI value was reported as 0 when not available. This behavior
8826          * is kept when using device discovery. This is required for full
8827          * backwards compatibility with the API.
8828          *
8829          * However when using service discovery, the value 127 will be
8830          * returned when the RSSI is not available.
8831          */
8832         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8833             link_type == ACL_LINK)
8834                 rssi = 0;
8835
8836         bacpy(&ev->addr.bdaddr, bdaddr);
8837         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8838         ev->rssi = rssi;
8839         ev->flags = cpu_to_le32(flags);
8840
8841         if (eir_len > 0)
8842                 /* Copy EIR or advertising data into event */
8843                 memcpy(ev->eir, eir, eir_len);
8844
8845         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8846                                        NULL))
8847                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8848                                           dev_class, 3);
8849
8850         if (scan_rsp_len > 0)
8851                 /* Append scan response data to event */
8852                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8853
8854         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8855         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8856
8857         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8858 }
8859
8860 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8861                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8862 {
8863         struct mgmt_ev_device_found *ev;
8864         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8865         u16 eir_len;
8866
8867         ev = (struct mgmt_ev_device_found *) buf;
8868
8869         memset(buf, 0, sizeof(buf));
8870
8871         bacpy(&ev->addr.bdaddr, bdaddr);
8872         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8873         ev->rssi = rssi;
8874
8875         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8876                                   name_len);
8877
8878         ev->eir_len = cpu_to_le16(eir_len);
8879
8880         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8881 }
8882
8883 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8884 {
8885         struct mgmt_ev_discovering ev;
8886
8887         bt_dev_dbg(hdev, "discovering %u", discovering);
8888
8889         memset(&ev, 0, sizeof(ev));
8890         ev.type = hdev->discovery.type;
8891         ev.discovering = discovering;
8892
8893         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8894 }
8895
8896 void mgmt_suspending(struct hci_dev *hdev, u8 state)
8897 {
8898         struct mgmt_ev_controller_suspend ev;
8899
8900         ev.suspend_state = state;
8901         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
8902 }
8903
8904 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
8905                    u8 addr_type)
8906 {
8907         struct mgmt_ev_controller_resume ev;
8908
8909         ev.wake_reason = reason;
8910         if (bdaddr) {
8911                 bacpy(&ev.addr.bdaddr, bdaddr);
8912                 ev.addr.type = addr_type;
8913         } else {
8914                 memset(&ev.addr, 0, sizeof(ev.addr));
8915         }
8916
8917         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
8918 }
8919
8920 static struct hci_mgmt_chan chan = {
8921         .channel        = HCI_CHANNEL_CONTROL,
8922         .handler_count  = ARRAY_SIZE(mgmt_handlers),
8923         .handlers       = mgmt_handlers,
8924         .hdev_init      = mgmt_init_hdev,
8925 };
8926
8927 int mgmt_init(void)
8928 {
8929         return hci_mgmt_chan_register(&chan);
8930 }
8931
8932 void mgmt_exit(void)
8933 {
8934         hci_mgmt_chan_unregister(&chan);
8935 }