net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41 #include "eir.h"
  42 #include "aosp.h"
  43
  44 #define MGMT_VERSION    1
  45 #define MGMT_REVISION   22
  46
  47 static const u16 mgmt_commands[] = {
  48         MGMT_OP_READ_INDEX_LIST,
  49         MGMT_OP_READ_INFO,
  50         MGMT_OP_SET_POWERED,
  51         MGMT_OP_SET_DISCOVERABLE,
  52         MGMT_OP_SET_CONNECTABLE,
  53         MGMT_OP_SET_FAST_CONNECTABLE,
  54         MGMT_OP_SET_BONDABLE,
  55         MGMT_OP_SET_LINK_SECURITY,
  56         MGMT_OP_SET_SSP,
  57         MGMT_OP_SET_HS,
  58         MGMT_OP_SET_LE,
  59         MGMT_OP_SET_DEV_CLASS,
  60         MGMT_OP_SET_LOCAL_NAME,
  61         MGMT_OP_ADD_UUID,
  62         MGMT_OP_REMOVE_UUID,
  63         MGMT_OP_LOAD_LINK_KEYS,
  64         MGMT_OP_LOAD_LONG_TERM_KEYS,
  65         MGMT_OP_DISCONNECT,
  66         MGMT_OP_GET_CONNECTIONS,
  67         MGMT_OP_PIN_CODE_REPLY,
  68         MGMT_OP_PIN_CODE_NEG_REPLY,
  69         MGMT_OP_SET_IO_CAPABILITY,
  70         MGMT_OP_PAIR_DEVICE,
  71         MGMT_OP_CANCEL_PAIR_DEVICE,
  72         MGMT_OP_UNPAIR_DEVICE,
  73         MGMT_OP_USER_CONFIRM_REPLY,
  74         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  75         MGMT_OP_USER_PASSKEY_REPLY,
  76         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  77         MGMT_OP_READ_LOCAL_OOB_DATA,
  78         MGMT_OP_ADD_REMOTE_OOB_DATA,
  79         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  80         MGMT_OP_START_DISCOVERY,
  81         MGMT_OP_STOP_DISCOVERY,
  82         MGMT_OP_CONFIRM_NAME,
  83         MGMT_OP_BLOCK_DEVICE,
  84         MGMT_OP_UNBLOCK_DEVICE,
  85         MGMT_OP_SET_DEVICE_ID,
  86         MGMT_OP_SET_ADVERTISING,
  87         MGMT_OP_SET_BREDR,
  88         MGMT_OP_SET_STATIC_ADDRESS,
  89         MGMT_OP_SET_SCAN_PARAMS,
  90         MGMT_OP_SET_SECURE_CONN,
  91         MGMT_OP_SET_DEBUG_KEYS,
  92         MGMT_OP_SET_PRIVACY,
  93         MGMT_OP_LOAD_IRKS,
  94         MGMT_OP_GET_CONN_INFO,
  95         MGMT_OP_GET_CLOCK_INFO,
  96         MGMT_OP_ADD_DEVICE,
  97         MGMT_OP_REMOVE_DEVICE,
  98         MGMT_OP_LOAD_CONN_PARAM,
  99         MGMT_OP_READ_UNCONF_INDEX_LIST,
 100         MGMT_OP_READ_CONFIG_INFO,
 101         MGMT_OP_SET_EXTERNAL_CONFIG,
 102         MGMT_OP_SET_PUBLIC_ADDRESS,
 103         MGMT_OP_START_SERVICE_DISCOVERY,
 104         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 105         MGMT_OP_READ_EXT_INDEX_LIST,
 106         MGMT_OP_READ_ADV_FEATURES,
 107         MGMT_OP_ADD_ADVERTISING,
 108         MGMT_OP_REMOVE_ADVERTISING,
 109         MGMT_OP_GET_ADV_SIZE_INFO,
 110         MGMT_OP_START_LIMITED_DISCOVERY,
 111         MGMT_OP_READ_EXT_INFO,
 112         MGMT_OP_SET_APPEARANCE,
 113         MGMT_OP_GET_PHY_CONFIGURATION,
 114         MGMT_OP_SET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_BLOCKED_KEYS,
 116         MGMT_OP_SET_WIDEBAND_SPEECH,
 117         MGMT_OP_READ_CONTROLLER_CAP,
 118         MGMT_OP_READ_EXP_FEATURES_INFO,
 119         MGMT_OP_SET_EXP_FEATURE,
 120         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_GET_DEVICE_FLAGS,
 125         MGMT_OP_SET_DEVICE_FLAGS,
 126         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 127         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 128         MGMT_OP_REMOVE_ADV_MONITOR,
 129         MGMT_OP_ADD_EXT_ADV_PARAMS,
 130         MGMT_OP_ADD_EXT_ADV_DATA,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 132         MGMT_OP_SET_MESH_RECEIVER,
 133         MGMT_OP_MESH_READ_FEATURES,
 134         MGMT_OP_MESH_SEND,
 135         MGMT_OP_MESH_SEND_CANCEL,
 136 };
 137
 138 static const u16 mgmt_events[] = {
 139         MGMT_EV_CONTROLLER_ERROR,
 140         MGMT_EV_INDEX_ADDED,
 141         MGMT_EV_INDEX_REMOVED,
 142         MGMT_EV_NEW_SETTINGS,
 143         MGMT_EV_CLASS_OF_DEV_CHANGED,
 144         MGMT_EV_LOCAL_NAME_CHANGED,
 145         MGMT_EV_NEW_LINK_KEY,
 146         MGMT_EV_NEW_LONG_TERM_KEY,
 147         MGMT_EV_DEVICE_CONNECTED,
 148         MGMT_EV_DEVICE_DISCONNECTED,
 149         MGMT_EV_CONNECT_FAILED,
 150         MGMT_EV_PIN_CODE_REQUEST,
 151         MGMT_EV_USER_CONFIRM_REQUEST,
 152         MGMT_EV_USER_PASSKEY_REQUEST,
 153         MGMT_EV_AUTH_FAILED,
 154         MGMT_EV_DEVICE_FOUND,
 155         MGMT_EV_DISCOVERING,
 156         MGMT_EV_DEVICE_BLOCKED,
 157         MGMT_EV_DEVICE_UNBLOCKED,
 158         MGMT_EV_DEVICE_UNPAIRED,
 159         MGMT_EV_PASSKEY_NOTIFY,
 160         MGMT_EV_NEW_IRK,
 161         MGMT_EV_NEW_CSRK,
 162         MGMT_EV_DEVICE_ADDED,
 163         MGMT_EV_DEVICE_REMOVED,
 164         MGMT_EV_NEW_CONN_PARAM,
 165         MGMT_EV_UNCONF_INDEX_ADDED,
 166         MGMT_EV_UNCONF_INDEX_REMOVED,
 167         MGMT_EV_NEW_CONFIG_OPTIONS,
 168         MGMT_EV_EXT_INDEX_ADDED,
 169         MGMT_EV_EXT_INDEX_REMOVED,
 170         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 171         MGMT_EV_ADVERTISING_ADDED,
 172         MGMT_EV_ADVERTISING_REMOVED,
 173         MGMT_EV_EXT_INFO_CHANGED,
 174         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 175         MGMT_EV_EXP_FEATURE_CHANGED,
 176         MGMT_EV_DEVICE_FLAGS_CHANGED,
 177         MGMT_EV_ADV_MONITOR_ADDED,
 178         MGMT_EV_ADV_MONITOR_REMOVED,
 179         MGMT_EV_CONTROLLER_SUSPEND,
 180         MGMT_EV_CONTROLLER_RESUME,
 181         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 182         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 183 };
 184
 185 static const u16 mgmt_untrusted_commands[] = {
 186         MGMT_OP_READ_INDEX_LIST,
 187         MGMT_OP_READ_INFO,
 188         MGMT_OP_READ_UNCONF_INDEX_LIST,
 189         MGMT_OP_READ_CONFIG_INFO,
 190         MGMT_OP_READ_EXT_INDEX_LIST,
 191         MGMT_OP_READ_EXT_INFO,
 192         MGMT_OP_READ_CONTROLLER_CAP,
 193         MGMT_OP_READ_EXP_FEATURES_INFO,
 194         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 195         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 196 };
 197
 198 static const u16 mgmt_untrusted_events[] = {
 199         MGMT_EV_INDEX_ADDED,
 200         MGMT_EV_INDEX_REMOVED,
 201         MGMT_EV_NEW_SETTINGS,
 202         MGMT_EV_CLASS_OF_DEV_CHANGED,
 203         MGMT_EV_LOCAL_NAME_CHANGED,
 204         MGMT_EV_UNCONF_INDEX_ADDED,
 205         MGMT_EV_UNCONF_INDEX_REMOVED,
 206         MGMT_EV_NEW_CONFIG_OPTIONS,
 207         MGMT_EV_EXT_INDEX_ADDED,
 208         MGMT_EV_EXT_INDEX_REMOVED,
 209         MGMT_EV_EXT_INFO_CHANGED,
 210         MGMT_EV_EXP_FEATURE_CHANGED,
 211 };
 212
 213 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 214
 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 216                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 217
 218 /* HCI to MGMT error code conversion table */
 219 static const u8 mgmt_status_table[] = {
 220         MGMT_STATUS_SUCCESS,
 221         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 222         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 223         MGMT_STATUS_FAILED,             /* Hardware Failure */
 224         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 225         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 226         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 227         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 228         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 229         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 230         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 231         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 232         MGMT_STATUS_BUSY,               /* Command Disallowed */
 233         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 234         MGMT_STATUS_REJECTED,           /* Rejected Security */
 235         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 236         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 237         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 238         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 239         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 240         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 241         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 242         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 243         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 244         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 245         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 246         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 247         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 248         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 249         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 250         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 251         MGMT_STATUS_FAILED,             /* Unspecified Error */
 252         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 253         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 254         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 255         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 256         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 257         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 258         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 259         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 260         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 262         MGMT_STATUS_FAILED,             /* Transaction Collision */
 263         MGMT_STATUS_FAILED,             /* Reserved for future use */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 265         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 266         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 267         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 269         MGMT_STATUS_FAILED,             /* Reserved for future use */
 270         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 271         MGMT_STATUS_FAILED,             /* Reserved for future use */
 272         MGMT_STATUS_FAILED,             /* Slot Violation */
 273         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 274         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 275         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 276         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 277         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 278         MGMT_STATUS_BUSY,               /* Controller Busy */
 279         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 280         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 281         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 282         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 283         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 284 };
 285
 286 static u8 mgmt_errno_status(int err)
 287 {
 288         switch (err) {
 289         case 0:
 290                 return MGMT_STATUS_SUCCESS;
 291         case -EPERM:
 292                 return MGMT_STATUS_REJECTED;
 293         case -EINVAL:
 294                 return MGMT_STATUS_INVALID_PARAMS;
 295         case -EOPNOTSUPP:
 296                 return MGMT_STATUS_NOT_SUPPORTED;
 297         case -EBUSY:
 298                 return MGMT_STATUS_BUSY;
 299         case -ETIMEDOUT:
 300                 return MGMT_STATUS_AUTH_FAILED;
 301         case -ENOMEM:
 302                 return MGMT_STATUS_NO_RESOURCES;
 303         case -EISCONN:
 304                 return MGMT_STATUS_ALREADY_CONNECTED;
 305         case -ENOTCONN:
 306                 return MGMT_STATUS_DISCONNECTED;
 307         }
 308
 309         return MGMT_STATUS_FAILED;
 310 }
 311
 312 static u8 mgmt_status(int err)
 313 {
 314         if (err < 0)
 315                 return mgmt_errno_status(err);
 316
 317         if (err < ARRAY_SIZE(mgmt_status_table))
 318                 return mgmt_status_table[err];
 319
 320         return MGMT_STATUS_FAILED;
 321 }
 322
 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 324                             u16 len, int flag)
 325 {
 326         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 327                                flag, NULL);
 328 }
 329
 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 331                               u16 len, int flag, struct sock *skip_sk)
 332 {
 333         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 334                                flag, skip_sk);
 335 }
 336
 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 338                       struct sock *skip_sk)
 339 {
 340         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 341                                HCI_SOCK_TRUSTED, skip_sk);
 342 }
 343
 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 345 {
 346         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 347                                    skip_sk);
 348 }
 349
 350 static u8 le_addr_type(u8 mgmt_addr_type)
 351 {
 352         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 353                 return ADDR_LE_DEV_PUBLIC;
 354         else
 355                 return ADDR_LE_DEV_RANDOM;
 356 }
 357
 358 void mgmt_fill_version_info(void *ver)
 359 {
 360         struct mgmt_rp_read_version *rp = ver;
 361
 362         rp->version = MGMT_VERSION;
 363         rp->revision = cpu_to_le16(MGMT_REVISION);
 364 }
 365
 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 367                         u16 data_len)
 368 {
 369         struct mgmt_rp_read_version rp;
 370
 371         bt_dev_dbg(hdev, "sock %p", sk);
 372
 373         mgmt_fill_version_info(&rp);
 374
 375         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 376                                  &rp, sizeof(rp));
 377 }
 378
 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 380                          u16 data_len)
 381 {
 382         struct mgmt_rp_read_commands *rp;
 383         u16 num_commands, num_events;
 384         size_t rp_size;
 385         int i, err;
 386
 387         bt_dev_dbg(hdev, "sock %p", sk);
 388
 389         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 390                 num_commands = ARRAY_SIZE(mgmt_commands);
 391                 num_events = ARRAY_SIZE(mgmt_events);
 392         } else {
 393                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 394                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 395         }
 396
 397         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 398
 399         rp = kmalloc(rp_size, GFP_KERNEL);
 400         if (!rp)
 401                 return -ENOMEM;
 402
 403         rp->num_commands = cpu_to_le16(num_commands);
 404         rp->num_events = cpu_to_le16(num_events);
 405
 406         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 407                 __le16 *opcode = rp->opcodes;
 408
 409                 for (i = 0; i < num_commands; i++, opcode++)
 410                         put_unaligned_le16(mgmt_commands[i], opcode);
 411
 412                 for (i = 0; i < num_events; i++, opcode++)
 413                         put_unaligned_le16(mgmt_events[i], opcode);
 414         } else {
 415                 __le16 *opcode = rp->opcodes;
 416
 417                 for (i = 0; i < num_commands; i++, opcode++)
 418                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 419
 420                 for (i = 0; i < num_events; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 422         }
 423
 424         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 425                                 rp, rp_size);
 426         kfree(rp);
 427
 428         return err;
 429 }
 430
 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 432                            u16 data_len)
 433 {
 434         struct mgmt_rp_read_index_list *rp;
 435         struct hci_dev *d;
 436         size_t rp_len;
 437         u16 count;
 438         int err;
 439
 440         bt_dev_dbg(hdev, "sock %p", sk);
 441
 442         read_lock(&hci_dev_list_lock);
 443
 444         count = 0;
 445         list_for_each_entry(d, &hci_dev_list, list) {
 446                 if (d->dev_type == HCI_PRIMARY &&
 447                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 448                         count++;
 449         }
 450
 451         rp_len = sizeof(*rp) + (2 * count);
 452         rp = kmalloc(rp_len, GFP_ATOMIC);
 453         if (!rp) {
 454                 read_unlock(&hci_dev_list_lock);
 455                 return -ENOMEM;
 456         }
 457
 458         count = 0;
 459         list_for_each_entry(d, &hci_dev_list, list) {
 460                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 461                     hci_dev_test_flag(d, HCI_CONFIG) ||
 462                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 463                         continue;
 464
 465                 /* Devices marked as raw-only are neither configured
 466                  * nor unconfigured controllers.
 467                  */
 468                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 469                         continue;
 470
 471                 if (d->dev_type == HCI_PRIMARY &&
 472                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 473                         rp->index[count++] = cpu_to_le16(d->id);
 474                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 475                 }
 476         }
 477
 478         rp->num_controllers = cpu_to_le16(count);
 479         rp_len = sizeof(*rp) + (2 * count);
 480
 481         read_unlock(&hci_dev_list_lock);
 482
 483         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 484                                 0, rp, rp_len);
 485
 486         kfree(rp);
 487
 488         return err;
 489 }
 490
 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 492                                   void *data, u16 data_len)
 493 {
 494         struct mgmt_rp_read_unconf_index_list *rp;
 495         struct hci_dev *d;
 496         size_t rp_len;
 497         u16 count;
 498         int err;
 499
 500         bt_dev_dbg(hdev, "sock %p", sk);
 501
 502         read_lock(&hci_dev_list_lock);
 503
 504         count = 0;
 505         list_for_each_entry(d, &hci_dev_list, list) {
 506                 if (d->dev_type == HCI_PRIMARY &&
 507                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 508                         count++;
 509         }
 510
 511         rp_len = sizeof(*rp) + (2 * count);
 512         rp = kmalloc(rp_len, GFP_ATOMIC);
 513         if (!rp) {
 514                 read_unlock(&hci_dev_list_lock);
 515                 return -ENOMEM;
 516         }
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 521                     hci_dev_test_flag(d, HCI_CONFIG) ||
 522                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 523                         continue;
 524
 525                 /* Devices marked as raw-only are neither configured
 526                  * nor unconfigured controllers.
 527                  */
 528                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 529                         continue;
 530
 531                 if (d->dev_type == HCI_PRIMARY &&
 532                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 533                         rp->index[count++] = cpu_to_le16(d->id);
 534                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 535                 }
 536         }
 537
 538         rp->num_controllers = cpu_to_le16(count);
 539         rp_len = sizeof(*rp) + (2 * count);
 540
 541         read_unlock(&hci_dev_list_lock);
 542
 543         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 544                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 545
 546         kfree(rp);
 547
 548         return err;
 549 }
 550
 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 552                                void *data, u16 data_len)
 553 {
 554         struct mgmt_rp_read_ext_index_list *rp;
 555         struct hci_dev *d;
 556         u16 count;
 557         int err;
 558
 559         bt_dev_dbg(hdev, "sock %p", sk);
 560
 561         read_lock(&hci_dev_list_lock);
 562
 563         count = 0;
 564         list_for_each_entry(d, &hci_dev_list, list) {
 565                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 566                         count++;
 567         }
 568
 569         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 570         if (!rp) {
 571                 read_unlock(&hci_dev_list_lock);
 572                 return -ENOMEM;
 573         }
 574
 575         count = 0;
 576         list_for_each_entry(d, &hci_dev_list, list) {
 577                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 578                     hci_dev_test_flag(d, HCI_CONFIG) ||
 579                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 580                         continue;
 581
 582                 /* Devices marked as raw-only are neither configured
 583                  * nor unconfigured controllers.
 584                  */
 585                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 586                         continue;
 587
 588                 if (d->dev_type == HCI_PRIMARY) {
 589                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 590                                 rp->entry[count].type = 0x01;
 591                         else
 592                                 rp->entry[count].type = 0x00;
 593                 } else if (d->dev_type == HCI_AMP) {
 594                         rp->entry[count].type = 0x02;
 595                 } else {
 596                         continue;
 597                 }
 598
 599                 rp->entry[count].bus = d->bus;
 600                 rp->entry[count++].index = cpu_to_le16(d->id);
 601                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 602         }
 603
 604         rp->num_controllers = cpu_to_le16(count);
 605
 606         read_unlock(&hci_dev_list_lock);
 607
 608         /* If this command is called at least once, then all the
 609          * default index and unconfigured index events are disabled
 610          * and from now on only extended index events are used.
 611          */
 612         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 613         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 614         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 615
 616         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 617                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 618                                 struct_size(rp, entry, count));
 619
 620         kfree(rp);
 621
 622         return err;
 623 }
 624
 625 static bool is_configured(struct hci_dev *hdev)
 626 {
 627         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 628             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 629                 return false;
 630
 631         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 632              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 633             !bacmp(&hdev->public_addr, BDADDR_ANY))
 634                 return false;
 635
 636         return true;
 637 }
 638
 639 static __le32 get_missing_options(struct hci_dev *hdev)
 640 {
 641         u32 options = 0;
 642
 643         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 644             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 648              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 649             !bacmp(&hdev->public_addr, BDADDR_ANY))
 650                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 651
 652         return cpu_to_le32(options);
 653 }
 654
 655 static int new_options(struct hci_dev *hdev, struct sock *skip)
 656 {
 657         __le32 options = get_missing_options(hdev);
 658
 659         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 660                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 661 }
 662
 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 664 {
 665         __le32 options = get_missing_options(hdev);
 666
 667         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 668                                  sizeof(options));
 669 }
 670
 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 672                             void *data, u16 data_len)
 673 {
 674         struct mgmt_rp_read_config_info rp;
 675         u32 options = 0;
 676
 677         bt_dev_dbg(hdev, "sock %p", sk);
 678
 679         hci_dev_lock(hdev);
 680
 681         memset(&rp, 0, sizeof(rp));
 682         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 683
 684         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 685                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 686
 687         if (hdev->set_bdaddr)
 688                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 689
 690         rp.supported_options = cpu_to_le32(options);
 691         rp.missing_options = get_missing_options(hdev);
 692
 693         hci_dev_unlock(hdev);
 694
 695         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 696                                  &rp, sizeof(rp));
 697 }
 698
 699 static u32 get_supported_phys(struct hci_dev *hdev)
 700 {
 701         u32 supported_phys = 0;
 702
 703         if (lmp_bredr_capable(hdev)) {
 704                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 705
 706                 if (hdev->features[0][0] & LMP_3SLOT)
 707                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_5SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 711
 712                 if (lmp_edr_2m_capable(hdev)) {
 713                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 714
 715                         if (lmp_edr_3slot_capable(hdev))
 716                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 717
 718                         if (lmp_edr_5slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 720
 721                         if (lmp_edr_3m_capable(hdev)) {
 722                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 723
 724                                 if (lmp_edr_3slot_capable(hdev))
 725                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 726
 727                                 if (lmp_edr_5slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 729                         }
 730                 }
 731         }
 732
 733         if (lmp_le_capable(hdev)) {
 734                 supported_phys |= MGMT_PHY_LE_1M_TX;
 735                 supported_phys |= MGMT_PHY_LE_1M_RX;
 736
 737                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 738                         supported_phys |= MGMT_PHY_LE_2M_TX;
 739                         supported_phys |= MGMT_PHY_LE_2M_RX;
 740                 }
 741
 742                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 743                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 744                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 745                 }
 746         }
 747
 748         return supported_phys;
 749 }
 750
 751 static u32 get_selected_phys(struct hci_dev *hdev)
 752 {
 753         u32 selected_phys = 0;
 754
 755         if (lmp_bredr_capable(hdev)) {
 756                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 757
 758                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 759                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 762                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 763
 764                 if (lmp_edr_2m_capable(hdev)) {
 765                         if (!(hdev->pkt_type & HCI_2DH1))
 766                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 767
 768                         if (lmp_edr_3slot_capable(hdev) &&
 769                             !(hdev->pkt_type & HCI_2DH3))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 771
 772                         if (lmp_edr_5slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH5))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 775
 776                         if (lmp_edr_3m_capable(hdev)) {
 777                                 if (!(hdev->pkt_type & HCI_3DH1))
 778                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 779
 780                                 if (lmp_edr_3slot_capable(hdev) &&
 781                                     !(hdev->pkt_type & HCI_3DH3))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 783
 784                                 if (lmp_edr_5slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH5))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 787                         }
 788                 }
 789         }
 790
 791         if (lmp_le_capable(hdev)) {
 792                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 793                         selected_phys |= MGMT_PHY_LE_1M_TX;
 794
 795                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_RX;
 797
 798                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 799                         selected_phys |= MGMT_PHY_LE_2M_TX;
 800
 801                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_RX;
 803
 804                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 805                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 806
 807                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 809         }
 810
 811         return selected_phys;
 812 }
 813
 814 static u32 get_configurable_phys(struct hci_dev *hdev)
 815 {
 816         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 817                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 818 }
 819
 820 static u32 get_supported_settings(struct hci_dev *hdev)
 821 {
 822         u32 settings = 0;
 823
 824         settings |= MGMT_SETTING_POWERED;
 825         settings |= MGMT_SETTING_BONDABLE;
 826         settings |= MGMT_SETTING_DEBUG_KEYS;
 827         settings |= MGMT_SETTING_CONNECTABLE;
 828         settings |= MGMT_SETTING_DISCOVERABLE;
 829
 830         if (lmp_bredr_capable(hdev)) {
 831                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 832                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 833                 settings |= MGMT_SETTING_BREDR;
 834                 settings |= MGMT_SETTING_LINK_SECURITY;
 835
 836                 if (lmp_ssp_capable(hdev)) {
 837                         settings |= MGMT_SETTING_SSP;
 838                 }
 839
 840                 if (lmp_sc_capable(hdev))
 841                         settings |= MGMT_SETTING_SECURE_CONN;
 842
 843                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 844                              &hdev->quirks))
 845                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 846         }
 847
 848         if (lmp_le_capable(hdev)) {
 849                 settings |= MGMT_SETTING_LE;
 850                 settings |= MGMT_SETTING_SECURE_CONN;
 851                 settings |= MGMT_SETTING_PRIVACY;
 852                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 853                 settings |= MGMT_SETTING_ADVERTISING;
 854         }
 855
 856         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 857             hdev->set_bdaddr)
 858                 settings |= MGMT_SETTING_CONFIGURATION;
 859
 860         if (cis_central_capable(hdev))
 861                 settings |= MGMT_SETTING_CIS_CENTRAL;
 862
 863         if (cis_peripheral_capable(hdev))
 864                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 865
 866         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 867
 868         return settings;
 869 }
 870
 871 static u32 get_current_settings(struct hci_dev *hdev)
 872 {
 873         u32 settings = 0;
 874
 875         if (hdev_is_powered(hdev))
 876                 settings |= MGMT_SETTING_POWERED;
 877
 878         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 879                 settings |= MGMT_SETTING_CONNECTABLE;
 880
 881         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 882                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 883
 884         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 885                 settings |= MGMT_SETTING_DISCOVERABLE;
 886
 887         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 888                 settings |= MGMT_SETTING_BONDABLE;
 889
 890         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 891                 settings |= MGMT_SETTING_BREDR;
 892
 893         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 894                 settings |= MGMT_SETTING_LE;
 895
 896         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 897                 settings |= MGMT_SETTING_LINK_SECURITY;
 898
 899         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 900                 settings |= MGMT_SETTING_SSP;
 901
 902         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 903                 settings |= MGMT_SETTING_ADVERTISING;
 904
 905         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 906                 settings |= MGMT_SETTING_SECURE_CONN;
 907
 908         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 909                 settings |= MGMT_SETTING_DEBUG_KEYS;
 910
 911         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 912                 settings |= MGMT_SETTING_PRIVACY;
 913
 914         /* The current setting for static address has two purposes. The
 915          * first is to indicate if the static address will be used and
 916          * the second is to indicate if it is actually set.
 917          *
 918          * This means if the static address is not configured, this flag
 919          * will never be set. If the address is configured, then if the
 920          * address is actually used decides if the flag is set or not.
 921          *
 922          * For single mode LE only controllers and dual-mode controllers
 923          * with BR/EDR disabled, the existence of the static address will
 924          * be evaluated.
 925          */
 926         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 927             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 928             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 929                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 930                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 931         }
 932
 933         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 934                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 935
 936         if (cis_central_capable(hdev))
 937                 settings |= MGMT_SETTING_CIS_CENTRAL;
 938
 939         if (cis_peripheral_capable(hdev))
 940                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 941
 942         if (bis_capable(hdev))
 943                 settings |= MGMT_SETTING_ISO_BROADCASTER;
 944
 945         if (sync_recv_capable(hdev))
 946                 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
 947
 948         return settings;
 949 }
 950
 951 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 952 {
 953         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 954 }
 955
 956 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 957 {
 958         struct mgmt_pending_cmd *cmd;
 959
 960         /* If there's a pending mgmt command the flags will not yet have
 961          * their final values, so check for this first.
 962          */
 963         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 964         if (cmd) {
 965                 struct mgmt_mode *cp = cmd->param;
 966                 if (cp->val == 0x01)
 967                         return LE_AD_GENERAL;
 968                 else if (cp->val == 0x02)
 969                         return LE_AD_LIMITED;
 970         } else {
 971                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 972                         return LE_AD_LIMITED;
 973                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 974                         return LE_AD_GENERAL;
 975         }
 976
 977         return 0;
 978 }
 979
 980 bool mgmt_get_connectable(struct hci_dev *hdev)
 981 {
 982         struct mgmt_pending_cmd *cmd;
 983
 984         /* If there's a pending mgmt command the flag will not yet have
 985          * it's final value, so check for this first.
 986          */
 987         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 988         if (cmd) {
 989                 struct mgmt_mode *cp = cmd->param;
 990
 991                 return cp->val;
 992         }
 993
 994         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 995 }
 996
 997 static int service_cache_sync(struct hci_dev *hdev, void *data)
 998 {
 999         hci_update_eir_sync(hdev);
1000         hci_update_class_sync(hdev);
1001
1002         return 0;
1003 }
1004
1005 static void service_cache_off(struct work_struct *work)
1006 {
1007         struct hci_dev *hdev = container_of(work, struct hci_dev,
1008                                             service_cache.work);
1009
1010         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1011                 return;
1012
1013         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1014 }
1015
1016 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1017 {
1018         /* The generation of a new RPA and programming it into the
1019          * controller happens in the hci_req_enable_advertising()
1020          * function.
1021          */
1022         if (ext_adv_capable(hdev))
1023                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1024         else
1025                 return hci_enable_advertising_sync(hdev);
1026 }
1027
1028 static void rpa_expired(struct work_struct *work)
1029 {
1030         struct hci_dev *hdev = container_of(work, struct hci_dev,
1031                                             rpa_expired.work);
1032
1033         bt_dev_dbg(hdev, "");
1034
1035         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1036
1037         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1038                 return;
1039
1040         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1041 }
1042
1043 static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1044
1045 static void discov_off(struct work_struct *work)
1046 {
1047         struct hci_dev *hdev = container_of(work, struct hci_dev,
1048                                             discov_off.work);
1049
1050         bt_dev_dbg(hdev, "");
1051
1052         hci_dev_lock(hdev);
1053
1054         /* When discoverable timeout triggers, then just make sure
1055          * the limited discoverable flag is cleared. Even in the case
1056          * of a timeout triggered from general discoverable, it is
1057          * safe to unconditionally clear the flag.
1058          */
1059         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1060         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1061         hdev->discov_timeout = 0;
1062
1063         hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
1064
1065         mgmt_new_settings(hdev);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1071
1072 static void mesh_send_complete(struct hci_dev *hdev,
1073                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1074 {
1075         u8 handle = mesh_tx->handle;
1076
1077         if (!silent)
1078                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1079                            sizeof(handle), NULL);
1080
1081         mgmt_mesh_remove(mesh_tx);
1082 }
1083
1084 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1085 {
1086         struct mgmt_mesh_tx *mesh_tx;
1087
1088         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1089         hci_disable_advertising_sync(hdev);
1090         mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092         if (mesh_tx)
1093                 mesh_send_complete(hdev, mesh_tx, false);
1094
1095         return 0;
1096 }
1097
1098 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1099 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1100 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1101 {
1102         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1103
1104         if (!mesh_tx)
1105                 return;
1106
1107         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1108                                  mesh_send_start_complete);
1109
1110         if (err < 0)
1111                 mesh_send_complete(hdev, mesh_tx, false);
1112         else
1113                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1114 }
1115
1116 static void mesh_send_done(struct work_struct *work)
1117 {
1118         struct hci_dev *hdev = container_of(work, struct hci_dev,
1119                                             mesh_send_done.work);
1120
1121         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1122                 return;
1123
1124         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1125 }
1126
1127 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1128 {
1129         if (hci_dev_test_flag(hdev, HCI_MGMT))
1130                 return;
1131
1132         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1133
1134         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1135         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1136         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1137         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1138
1139         /* Non-mgmt controlled devices get this bit set
1140          * implicitly so that pairing works for them, however
1141          * for mgmt we require user-space to explicitly enable
1142          * it
1143          */
1144         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1145
1146         hci_dev_set_flag(hdev, HCI_MGMT);
1147 }
1148
1149 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1150                                 void *data, u16 data_len)
1151 {
1152         struct mgmt_rp_read_info rp;
1153
1154         bt_dev_dbg(hdev, "sock %p", sk);
1155
1156         hci_dev_lock(hdev);
1157
1158         memset(&rp, 0, sizeof(rp));
1159
1160         bacpy(&rp.bdaddr, &hdev->bdaddr);
1161
1162         rp.version = hdev->hci_ver;
1163         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1164
1165         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1166         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1167
1168         memcpy(rp.dev_class, hdev->dev_class, 3);
1169
1170         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1171         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1172
1173         hci_dev_unlock(hdev);
1174
1175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1176                                  sizeof(rp));
1177 }
1178
1179 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1180 {
1181         u16 eir_len = 0;
1182         size_t name_len;
1183
1184         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1185                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1186                                           hdev->dev_class, 3);
1187
1188         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1189                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1190                                           hdev->appearance);
1191
1192         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1193         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1194                                   hdev->dev_name, name_len);
1195
1196         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1197         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1198                                   hdev->short_name, name_len);
1199
1200         return eir_len;
1201 }
1202
1203 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1204                                     void *data, u16 data_len)
1205 {
1206         char buf[512];
1207         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1208         u16 eir_len;
1209
1210         bt_dev_dbg(hdev, "sock %p", sk);
1211
1212         memset(&buf, 0, sizeof(buf));
1213
1214         hci_dev_lock(hdev);
1215
1216         bacpy(&rp->bdaddr, &hdev->bdaddr);
1217
1218         rp->version = hdev->hci_ver;
1219         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1220
1221         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1222         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1223
1224
1225         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1226         rp->eir_len = cpu_to_le16(eir_len);
1227
1228         hci_dev_unlock(hdev);
1229
1230         /* If this command is called at least once, then the events
1231          * for class of device and local name changes are disabled
1232          * and only the new extended controller information event
1233          * is used.
1234          */
1235         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1236         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1238
1239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1240                                  sizeof(*rp) + eir_len);
1241 }
1242
1243 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1244 {
1245         char buf[512];
1246         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1247         u16 eir_len;
1248
1249         memset(buf, 0, sizeof(buf));
1250
1251         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1252         ev->eir_len = cpu_to_le16(eir_len);
1253
1254         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1255                                   sizeof(*ev) + eir_len,
1256                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1257 }
1258
1259 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1260 {
1261         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1262
1263         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1264                                  sizeof(settings));
1265 }
1266
1267 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1268 {
1269         struct mgmt_ev_advertising_added ev;
1270
1271         ev.instance = instance;
1272
1273         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1274 }
1275
1276 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1277                               u8 instance)
1278 {
1279         struct mgmt_ev_advertising_removed ev;
1280
1281         ev.instance = instance;
1282
1283         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1284 }
1285
1286 static void cancel_adv_timeout(struct hci_dev *hdev)
1287 {
1288         if (hdev->adv_instance_timeout) {
1289                 hdev->adv_instance_timeout = 0;
1290                 cancel_delayed_work(&hdev->adv_instance_expire);
1291         }
1292 }
1293
1294 /* This function requires the caller holds hdev->lock */
1295 static void restart_le_actions(struct hci_dev *hdev)
1296 {
1297         struct hci_conn_params *p;
1298
1299         list_for_each_entry(p, &hdev->le_conn_params, list) {
1300                 /* Needed for AUTO_OFF case where might not "really"
1301                  * have been powered off.
1302                  */
1303                 hci_pend_le_list_del_init(p);
1304
1305                 switch (p->auto_connect) {
1306                 case HCI_AUTO_CONN_DIRECT:
1307                 case HCI_AUTO_CONN_ALWAYS:
1308                         hci_pend_le_list_add(p, &hdev->pend_le_conns);
1309                         break;
1310                 case HCI_AUTO_CONN_REPORT:
1311                         hci_pend_le_list_add(p, &hdev->pend_le_reports);
1312                         break;
1313                 default:
1314                         break;
1315                 }
1316         }
1317 }
1318
1319 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1320 {
1321         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1322
1323         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1324                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1325 }
1326
1327 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1328 {
1329         struct mgmt_pending_cmd *cmd = data;
1330         struct mgmt_mode *cp;
1331
1332         /* Make sure cmd still outstanding. */
1333         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1334                 return;
1335
1336         cp = cmd->param;
1337
1338         bt_dev_dbg(hdev, "err %d", err);
1339
1340         if (!err) {
1341                 if (cp->val) {
1342                         hci_dev_lock(hdev);
1343                         restart_le_actions(hdev);
1344                         hci_update_passive_scan(hdev);
1345                         hci_dev_unlock(hdev);
1346                 }
1347
1348                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1349
1350                 /* Only call new_setting for power on as power off is deferred
1351                  * to hdev->power_off work which does call hci_dev_do_close.
1352                  */
1353                 if (cp->val)
1354                         new_settings(hdev, cmd->sk);
1355         } else {
1356                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1357                                 mgmt_status(err));
1358         }
1359
1360         mgmt_pending_remove(cmd);
1361 }
1362
1363 static int set_powered_sync(struct hci_dev *hdev, void *data)
1364 {
1365         struct mgmt_pending_cmd *cmd = data;
1366         struct mgmt_mode *cp = cmd->param;
1367
1368         BT_DBG("%s", hdev->name);
1369
1370         return hci_set_powered_sync(hdev, cp->val);
1371 }
1372
1373 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1374                        u16 len)
1375 {
1376         struct mgmt_mode *cp = data;
1377         struct mgmt_pending_cmd *cmd;
1378         int err;
1379
1380         bt_dev_dbg(hdev, "sock %p", sk);
1381
1382         if (cp->val != 0x00 && cp->val != 0x01)
1383                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1384                                        MGMT_STATUS_INVALID_PARAMS);
1385
1386         hci_dev_lock(hdev);
1387
1388         if (!cp->val) {
1389                 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
1390                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1391                                               MGMT_STATUS_BUSY);
1392                         goto failed;
1393                 }
1394         }
1395
1396         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1397                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1398                                       MGMT_STATUS_BUSY);
1399                 goto failed;
1400         }
1401
1402         if (!!cp->val == hdev_is_powered(hdev)) {
1403                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1404                 goto failed;
1405         }
1406
1407         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1408         if (!cmd) {
1409                 err = -ENOMEM;
1410                 goto failed;
1411         }
1412
1413         /* Cancel potentially blocking sync operation before power off */
1414         if (cp->val == 0x00) {
1415                 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
1416                 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1417                                          mgmt_set_powered_complete);
1418         } else {
1419                 /* Use hci_cmd_sync_submit since hdev might not be running */
1420                 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1421                                           mgmt_set_powered_complete);
1422         }
1423
1424         if (err < 0)
1425                 mgmt_pending_remove(cmd);
1426
1427 failed:
1428         hci_dev_unlock(hdev);
1429         return err;
1430 }
1431
1432 int mgmt_new_settings(struct hci_dev *hdev)
1433 {
1434         return new_settings(hdev, NULL);
1435 }
1436
1437 struct cmd_lookup {
1438         struct sock *sk;
1439         struct hci_dev *hdev;
1440         u8 mgmt_status;
1441 };
1442
1443 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1444 {
1445         struct cmd_lookup *match = data;
1446
1447         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1448
1449         list_del(&cmd->list);
1450
1451         if (match->sk == NULL) {
1452                 match->sk = cmd->sk;
1453                 sock_hold(match->sk);
1454         }
1455
1456         mgmt_pending_free(cmd);
1457 }
1458
1459 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1460 {
1461         u8 *status = data;
1462
1463         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1464         mgmt_pending_remove(cmd);
1465 }
1466
1467 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1468 {
1469         if (cmd->cmd_complete) {
1470                 u8 *status = data;
1471
1472                 cmd->cmd_complete(cmd, *status);
1473                 mgmt_pending_remove(cmd);
1474
1475                 return;
1476         }
1477
1478         cmd_status_rsp(cmd, data);
1479 }
1480
1481 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1482 {
1483         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1484                                  cmd->param, cmd->param_len);
1485 }
1486
1487 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1488 {
1489         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1490                                  cmd->param, sizeof(struct mgmt_addr_info));
1491 }
1492
1493 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1494 {
1495         if (!lmp_bredr_capable(hdev))
1496                 return MGMT_STATUS_NOT_SUPPORTED;
1497         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1498                 return MGMT_STATUS_REJECTED;
1499         else
1500                 return MGMT_STATUS_SUCCESS;
1501 }
1502
1503 static u8 mgmt_le_support(struct hci_dev *hdev)
1504 {
1505         if (!lmp_le_capable(hdev))
1506                 return MGMT_STATUS_NOT_SUPPORTED;
1507         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1508                 return MGMT_STATUS_REJECTED;
1509         else
1510                 return MGMT_STATUS_SUCCESS;
1511 }
1512
1513 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1514                                            int err)
1515 {
1516         struct mgmt_pending_cmd *cmd = data;
1517
1518         bt_dev_dbg(hdev, "err %d", err);
1519
1520         /* Make sure cmd still outstanding. */
1521         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1522                 return;
1523
1524         hci_dev_lock(hdev);
1525
1526         if (err) {
1527                 u8 mgmt_err = mgmt_status(err);
1528                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1529                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1530                 goto done;
1531         }
1532
1533         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1534             hdev->discov_timeout > 0) {
1535                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1536                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1537         }
1538
1539         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1540         new_settings(hdev, cmd->sk);
1541
1542 done:
1543         mgmt_pending_remove(cmd);
1544         hci_dev_unlock(hdev);
1545 }
1546
1547 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1548 {
1549         BT_DBG("%s", hdev->name);
1550
1551         return hci_update_discoverable_sync(hdev);
1552 }
1553
1554 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1555                             u16 len)
1556 {
1557         struct mgmt_cp_set_discoverable *cp = data;
1558         struct mgmt_pending_cmd *cmd;
1559         u16 timeout;
1560         int err;
1561
1562         bt_dev_dbg(hdev, "sock %p", sk);
1563
1564         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1565             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1567                                        MGMT_STATUS_REJECTED);
1568
1569         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1571                                        MGMT_STATUS_INVALID_PARAMS);
1572
1573         timeout = __le16_to_cpu(cp->timeout);
1574
1575         /* Disabling discoverable requires that no timeout is set,
1576          * and enabling limited discoverable requires a timeout.
1577          */
1578         if ((cp->val == 0x00 && timeout > 0) ||
1579             (cp->val == 0x02 && timeout == 0))
1580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1581                                        MGMT_STATUS_INVALID_PARAMS);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (!hdev_is_powered(hdev) && timeout > 0) {
1586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1587                                       MGMT_STATUS_NOT_POWERED);
1588                 goto failed;
1589         }
1590
1591         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1592             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1593                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594                                       MGMT_STATUS_BUSY);
1595                 goto failed;
1596         }
1597
1598         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1599                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1600                                       MGMT_STATUS_REJECTED);
1601                 goto failed;
1602         }
1603
1604         if (hdev->advertising_paused) {
1605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1606                                       MGMT_STATUS_BUSY);
1607                 goto failed;
1608         }
1609
1610         if (!hdev_is_powered(hdev)) {
1611                 bool changed = false;
1612
1613                 /* Setting limited discoverable when powered off is
1614                  * not a valid operation since it requires a timeout
1615                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1616                  */
1617                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1618                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1619                         changed = true;
1620                 }
1621
1622                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1623                 if (err < 0)
1624                         goto failed;
1625
1626                 if (changed)
1627                         err = new_settings(hdev, sk);
1628
1629                 goto failed;
1630         }
1631
1632         /* If the current mode is the same, then just update the timeout
1633          * value with the new value. And if only the timeout gets updated,
1634          * then no need for any HCI transactions.
1635          */
1636         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1637             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1638                                                    HCI_LIMITED_DISCOVERABLE)) {
1639                 cancel_delayed_work(&hdev->discov_off);
1640                 hdev->discov_timeout = timeout;
1641
1642                 if (cp->val && hdev->discov_timeout > 0) {
1643                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1644                         queue_delayed_work(hdev->req_workqueue,
1645                                            &hdev->discov_off, to);
1646                 }
1647
1648                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1649                 goto failed;
1650         }
1651
1652         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1653         if (!cmd) {
1654                 err = -ENOMEM;
1655                 goto failed;
1656         }
1657
1658         /* Cancel any potential discoverable timeout that might be
1659          * still active and store new timeout value. The arming of
1660          * the timeout happens in the complete handler.
1661          */
1662         cancel_delayed_work(&hdev->discov_off);
1663         hdev->discov_timeout = timeout;
1664
1665         if (cp->val)
1666                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1667         else
1668                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1669
1670         /* Limited discoverable mode */
1671         if (cp->val == 0x02)
1672                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1673         else
1674                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1675
1676         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1677                                  mgmt_set_discoverable_complete);
1678
1679         if (err < 0)
1680                 mgmt_pending_remove(cmd);
1681
1682 failed:
1683         hci_dev_unlock(hdev);
1684         return err;
1685 }
1686
1687 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1688                                           int err)
1689 {
1690         struct mgmt_pending_cmd *cmd = data;
1691
1692         bt_dev_dbg(hdev, "err %d", err);
1693
1694         /* Make sure cmd still outstanding. */
1695         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1696                 return;
1697
1698         hci_dev_lock(hdev);
1699
1700         if (err) {
1701                 u8 mgmt_err = mgmt_status(err);
1702                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1703                 goto done;
1704         }
1705
1706         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1707         new_settings(hdev, cmd->sk);
1708
1709 done:
1710         mgmt_pending_remove(cmd);
1711
1712         hci_dev_unlock(hdev);
1713 }
1714
1715 static int set_connectable_update_settings(struct hci_dev *hdev,
1716                                            struct sock *sk, u8 val)
1717 {
1718         bool changed = false;
1719         int err;
1720
1721         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1722                 changed = true;
1723
1724         if (val) {
1725                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1726         } else {
1727                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1728                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1729         }
1730
1731         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1732         if (err < 0)
1733                 return err;
1734
1735         if (changed) {
1736                 hci_update_scan(hdev);
1737                 hci_update_passive_scan(hdev);
1738                 return new_settings(hdev, sk);
1739         }
1740
1741         return 0;
1742 }
1743
1744 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1745 {
1746         BT_DBG("%s", hdev->name);
1747
1748         return hci_update_connectable_sync(hdev);
1749 }
1750
1751 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1752                            u16 len)
1753 {
1754         struct mgmt_mode *cp = data;
1755         struct mgmt_pending_cmd *cmd;
1756         int err;
1757
1758         bt_dev_dbg(hdev, "sock %p", sk);
1759
1760         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1761             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1763                                        MGMT_STATUS_REJECTED);
1764
1765         if (cp->val != 0x00 && cp->val != 0x01)
1766                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1767                                        MGMT_STATUS_INVALID_PARAMS);
1768
1769         hci_dev_lock(hdev);
1770
1771         if (!hdev_is_powered(hdev)) {
1772                 err = set_connectable_update_settings(hdev, sk, cp->val);
1773                 goto failed;
1774         }
1775
1776         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1777             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1778                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1779                                       MGMT_STATUS_BUSY);
1780                 goto failed;
1781         }
1782
1783         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1784         if (!cmd) {
1785                 err = -ENOMEM;
1786                 goto failed;
1787         }
1788
1789         if (cp->val) {
1790                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1791         } else {
1792                 if (hdev->discov_timeout > 0)
1793                         cancel_delayed_work(&hdev->discov_off);
1794
1795                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1796                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1797                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1798         }
1799
1800         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1801                                  mgmt_set_connectable_complete);
1802
1803         if (err < 0)
1804                 mgmt_pending_remove(cmd);
1805
1806 failed:
1807         hci_dev_unlock(hdev);
1808         return err;
1809 }
1810
1811 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1812                         u16 len)
1813 {
1814         struct mgmt_mode *cp = data;
1815         bool changed;
1816         int err;
1817
1818         bt_dev_dbg(hdev, "sock %p", sk);
1819
1820         if (cp->val != 0x00 && cp->val != 0x01)
1821                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1822                                        MGMT_STATUS_INVALID_PARAMS);
1823
1824         hci_dev_lock(hdev);
1825
1826         if (cp->val)
1827                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1828         else
1829                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1830
1831         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1832         if (err < 0)
1833                 goto unlock;
1834
1835         if (changed) {
1836                 /* In limited privacy mode the change of bondable mode
1837                  * may affect the local advertising address.
1838                  */
1839                 hci_update_discoverable(hdev);
1840
1841                 err = new_settings(hdev, sk);
1842         }
1843
1844 unlock:
1845         hci_dev_unlock(hdev);
1846         return err;
1847 }
1848
1849 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1850                              u16 len)
1851 {
1852         struct mgmt_mode *cp = data;
1853         struct mgmt_pending_cmd *cmd;
1854         u8 val, status;
1855         int err;
1856
1857         bt_dev_dbg(hdev, "sock %p", sk);
1858
1859         status = mgmt_bredr_support(hdev);
1860         if (status)
1861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1862                                        status);
1863
1864         if (cp->val != 0x00 && cp->val != 0x01)
1865                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1866                                        MGMT_STATUS_INVALID_PARAMS);
1867
1868         hci_dev_lock(hdev);
1869
1870         if (!hdev_is_powered(hdev)) {
1871                 bool changed = false;
1872
1873                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1874                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1875                         changed = true;
1876                 }
1877
1878                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1879                 if (err < 0)
1880                         goto failed;
1881
1882                 if (changed)
1883                         err = new_settings(hdev, sk);
1884
1885                 goto failed;
1886         }
1887
1888         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1889                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1890                                       MGMT_STATUS_BUSY);
1891                 goto failed;
1892         }
1893
1894         val = !!cp->val;
1895
1896         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1897                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1898                 goto failed;
1899         }
1900
1901         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1902         if (!cmd) {
1903                 err = -ENOMEM;
1904                 goto failed;
1905         }
1906
1907         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1908         if (err < 0) {
1909                 mgmt_pending_remove(cmd);
1910                 goto failed;
1911         }
1912
1913 failed:
1914         hci_dev_unlock(hdev);
1915         return err;
1916 }
1917
1918 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1919 {
1920         struct cmd_lookup match = { NULL, hdev };
1921         struct mgmt_pending_cmd *cmd = data;
1922         struct mgmt_mode *cp = cmd->param;
1923         u8 enable = cp->val;
1924         bool changed;
1925
1926         /* Make sure cmd still outstanding. */
1927         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1928                 return;
1929
1930         if (err) {
1931                 u8 mgmt_err = mgmt_status(err);
1932
1933                 if (enable && hci_dev_test_and_clear_flag(hdev,
1934                                                           HCI_SSP_ENABLED)) {
1935                         new_settings(hdev, NULL);
1936                 }
1937
1938                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1939                                      &mgmt_err);
1940                 return;
1941         }
1942
1943         if (enable) {
1944                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1945         } else {
1946                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1947         }
1948
1949         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1950
1951         if (changed)
1952                 new_settings(hdev, match.sk);
1953
1954         if (match.sk)
1955                 sock_put(match.sk);
1956
1957         hci_update_eir_sync(hdev);
1958 }
1959
1960 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1961 {
1962         struct mgmt_pending_cmd *cmd = data;
1963         struct mgmt_mode *cp = cmd->param;
1964         bool changed = false;
1965         int err;
1966
1967         if (cp->val)
1968                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1969
1970         err = hci_write_ssp_mode_sync(hdev, cp->val);
1971
1972         if (!err && changed)
1973                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1974
1975         return err;
1976 }
1977
1978 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1979 {
1980         struct mgmt_mode *cp = data;
1981         struct mgmt_pending_cmd *cmd;
1982         u8 status;
1983         int err;
1984
1985         bt_dev_dbg(hdev, "sock %p", sk);
1986
1987         status = mgmt_bredr_support(hdev);
1988         if (status)
1989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1990
1991         if (!lmp_ssp_capable(hdev))
1992                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1993                                        MGMT_STATUS_NOT_SUPPORTED);
1994
1995         if (cp->val != 0x00 && cp->val != 0x01)
1996                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1997                                        MGMT_STATUS_INVALID_PARAMS);
1998
1999         hci_dev_lock(hdev);
2000
2001         if (!hdev_is_powered(hdev)) {
2002                 bool changed;
2003
2004                 if (cp->val) {
2005                         changed = !hci_dev_test_and_set_flag(hdev,
2006                                                              HCI_SSP_ENABLED);
2007                 } else {
2008                         changed = hci_dev_test_and_clear_flag(hdev,
2009                                                               HCI_SSP_ENABLED);
2010                 }
2011
2012                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2013                 if (err < 0)
2014                         goto failed;
2015
2016                 if (changed)
2017                         err = new_settings(hdev, sk);
2018
2019                 goto failed;
2020         }
2021
2022         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2024                                       MGMT_STATUS_BUSY);
2025                 goto failed;
2026         }
2027
2028         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2029                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2030                 goto failed;
2031         }
2032
2033         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2034         if (!cmd)
2035                 err = -ENOMEM;
2036         else
2037                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2038                                          set_ssp_complete);
2039
2040         if (err < 0) {
2041                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2042                                       MGMT_STATUS_FAILED);
2043
2044                 if (cmd)
2045                         mgmt_pending_remove(cmd);
2046         }
2047
2048 failed:
2049         hci_dev_unlock(hdev);
2050         return err;
2051 }
2052
2053 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2054 {
2055         bt_dev_dbg(hdev, "sock %p", sk);
2056
2057         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2058                                        MGMT_STATUS_NOT_SUPPORTED);
2059 }
2060
2061 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2062 {
2063         struct cmd_lookup match = { NULL, hdev };
2064         u8 status = mgmt_status(err);
2065
2066         bt_dev_dbg(hdev, "err %d", err);
2067
2068         if (status) {
2069                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2070                                                         &status);
2071                 return;
2072         }
2073
2074         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2075
2076         new_settings(hdev, match.sk);
2077
2078         if (match.sk)
2079                 sock_put(match.sk);
2080 }
2081
2082 static int set_le_sync(struct hci_dev *hdev, void *data)
2083 {
2084         struct mgmt_pending_cmd *cmd = data;
2085         struct mgmt_mode *cp = cmd->param;
2086         u8 val = !!cp->val;
2087         int err;
2088
2089         if (!val) {
2090                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2091
2092                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2093                         hci_disable_advertising_sync(hdev);
2094
2095                 if (ext_adv_capable(hdev))
2096                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2097         } else {
2098                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2099         }
2100
2101         err = hci_write_le_host_supported_sync(hdev, val, 0);
2102
2103         /* Make sure the controller has a good default for
2104          * advertising data. Restrict the update to when LE
2105          * has actually been enabled. During power on, the
2106          * update in powered_update_hci will take care of it.
2107          */
2108         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2109                 if (ext_adv_capable(hdev)) {
2110                         int status;
2111
2112                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2113                         if (!status)
2114                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2115                 } else {
2116                         hci_update_adv_data_sync(hdev, 0x00);
2117                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2118                 }
2119
2120                 hci_update_passive_scan(hdev);
2121         }
2122
2123         return err;
2124 }
2125
2126 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2127 {
2128         struct mgmt_pending_cmd *cmd = data;
2129         u8 status = mgmt_status(err);
2130         struct sock *sk = cmd->sk;
2131
2132         if (status) {
2133                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2134                                      cmd_status_rsp, &status);
2135                 return;
2136         }
2137
2138         mgmt_pending_remove(cmd);
2139         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2140 }
2141
2142 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2143 {
2144         struct mgmt_pending_cmd *cmd = data;
2145         struct mgmt_cp_set_mesh *cp = cmd->param;
2146         size_t len = cmd->param_len;
2147
2148         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2149
2150         if (cp->enable)
2151                 hci_dev_set_flag(hdev, HCI_MESH);
2152         else
2153                 hci_dev_clear_flag(hdev, HCI_MESH);
2154
2155         len -= sizeof(*cp);
2156
2157         /* If filters don't fit, forward all adv pkts */
2158         if (len <= sizeof(hdev->mesh_ad_types))
2159                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2160
2161         hci_update_passive_scan_sync(hdev);
2162         return 0;
2163 }
2164
2165 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2166 {
2167         struct mgmt_cp_set_mesh *cp = data;
2168         struct mgmt_pending_cmd *cmd;
2169         int err = 0;
2170
2171         bt_dev_dbg(hdev, "sock %p", sk);
2172
2173         if (!lmp_le_capable(hdev) ||
2174             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2175                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2176                                        MGMT_STATUS_NOT_SUPPORTED);
2177
2178         if (cp->enable != 0x00 && cp->enable != 0x01)
2179                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2180                                        MGMT_STATUS_INVALID_PARAMS);
2181
2182         hci_dev_lock(hdev);
2183
2184         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2185         if (!cmd)
2186                 err = -ENOMEM;
2187         else
2188                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2189                                          set_mesh_complete);
2190
2191         if (err < 0) {
2192                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2193                                       MGMT_STATUS_FAILED);
2194
2195                 if (cmd)
2196                         mgmt_pending_remove(cmd);
2197         }
2198
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2204 {
2205         struct mgmt_mesh_tx *mesh_tx = data;
2206         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2207         unsigned long mesh_send_interval;
2208         u8 mgmt_err = mgmt_status(err);
2209
2210         /* Report any errors here, but don't report completion */
2211
2212         if (mgmt_err) {
2213                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2214                 /* Send Complete Error Code for handle */
2215                 mesh_send_complete(hdev, mesh_tx, false);
2216                 return;
2217         }
2218
2219         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2220         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2221                            mesh_send_interval);
2222 }
2223
2224 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2225 {
2226         struct mgmt_mesh_tx *mesh_tx = data;
2227         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2228         struct adv_info *adv, *next_instance;
2229         u8 instance = hdev->le_num_of_adv_sets + 1;
2230         u16 timeout, duration;
2231         int err = 0;
2232
2233         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2234                 return MGMT_STATUS_BUSY;
2235
2236         timeout = 1000;
2237         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2238         adv = hci_add_adv_instance(hdev, instance, 0,
2239                                    send->adv_data_len, send->adv_data,
2240                                    0, NULL,
2241                                    timeout, duration,
2242                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2243                                    hdev->le_adv_min_interval,
2244                                    hdev->le_adv_max_interval,
2245                                    mesh_tx->handle);
2246
2247         if (!IS_ERR(adv))
2248                 mesh_tx->instance = instance;
2249         else
2250                 err = PTR_ERR(adv);
2251
2252         if (hdev->cur_adv_instance == instance) {
2253                 /* If the currently advertised instance is being changed then
2254                  * cancel the current advertising and schedule the next
2255                  * instance. If there is only one instance then the overridden
2256                  * advertising data will be visible right away.
2257                  */
2258                 cancel_adv_timeout(hdev);
2259
2260                 next_instance = hci_get_next_instance(hdev, instance);
2261                 if (next_instance)
2262                         instance = next_instance->instance;
2263                 else
2264                         instance = 0;
2265         } else if (hdev->adv_instance_timeout) {
2266                 /* Immediately advertise the new instance if no other, or
2267                  * let it go naturally from queue if ADV is already happening
2268                  */
2269                 instance = 0;
2270         }
2271
2272         if (instance)
2273                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2274
2275         return err;
2276 }
2277
2278 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2279 {
2280         struct mgmt_rp_mesh_read_features *rp = data;
2281
2282         if (rp->used_handles >= rp->max_handles)
2283                 return;
2284
2285         rp->handles[rp->used_handles++] = mesh_tx->handle;
2286 }
2287
2288 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2289                          void *data, u16 len)
2290 {
2291         struct mgmt_rp_mesh_read_features rp;
2292
2293         if (!lmp_le_capable(hdev) ||
2294             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2295                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2296                                        MGMT_STATUS_NOT_SUPPORTED);
2297
2298         memset(&rp, 0, sizeof(rp));
2299         rp.index = cpu_to_le16(hdev->id);
2300         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2301                 rp.max_handles = MESH_HANDLES_MAX;
2302
2303         hci_dev_lock(hdev);
2304
2305         if (rp.max_handles)
2306                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2307
2308         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2309                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2310
2311         hci_dev_unlock(hdev);
2312         return 0;
2313 }
2314
2315 static int send_cancel(struct hci_dev *hdev, void *data)
2316 {
2317         struct mgmt_pending_cmd *cmd = data;
2318         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2319         struct mgmt_mesh_tx *mesh_tx;
2320
2321         if (!cancel->handle) {
2322                 do {
2323                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2324
2325                         if (mesh_tx)
2326                                 mesh_send_complete(hdev, mesh_tx, false);
2327                 } while (mesh_tx);
2328         } else {
2329                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2330
2331                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2332                         mesh_send_complete(hdev, mesh_tx, false);
2333         }
2334
2335         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2336                           0, NULL, 0);
2337         mgmt_pending_free(cmd);
2338
2339         return 0;
2340 }
2341
2342 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2343                             void *data, u16 len)
2344 {
2345         struct mgmt_pending_cmd *cmd;
2346         int err;
2347
2348         if (!lmp_le_capable(hdev) ||
2349             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2351                                        MGMT_STATUS_NOT_SUPPORTED);
2352
2353         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2355                                        MGMT_STATUS_REJECTED);
2356
2357         hci_dev_lock(hdev);
2358         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2359         if (!cmd)
2360                 err = -ENOMEM;
2361         else
2362                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2363
2364         if (err < 0) {
2365                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2366                                       MGMT_STATUS_FAILED);
2367
2368                 if (cmd)
2369                         mgmt_pending_free(cmd);
2370         }
2371
2372         hci_dev_unlock(hdev);
2373         return err;
2374 }
2375
2376 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2377 {
2378         struct mgmt_mesh_tx *mesh_tx;
2379         struct mgmt_cp_mesh_send *send = data;
2380         struct mgmt_rp_mesh_read_features rp;
2381         bool sending;
2382         int err = 0;
2383
2384         if (!lmp_le_capable(hdev) ||
2385             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2386                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2387                                        MGMT_STATUS_NOT_SUPPORTED);
2388         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2389             len <= MGMT_MESH_SEND_SIZE ||
2390             len > (MGMT_MESH_SEND_SIZE + 31))
2391                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2392                                        MGMT_STATUS_REJECTED);
2393
2394         hci_dev_lock(hdev);
2395
2396         memset(&rp, 0, sizeof(rp));
2397         rp.max_handles = MESH_HANDLES_MAX;
2398
2399         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2400
2401         if (rp.max_handles <= rp.used_handles) {
2402                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2403                                       MGMT_STATUS_BUSY);
2404                 goto done;
2405         }
2406
2407         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2408         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2409
2410         if (!mesh_tx)
2411                 err = -ENOMEM;
2412         else if (!sending)
2413                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2414                                          mesh_send_start_complete);
2415
2416         if (err < 0) {
2417                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2419                                       MGMT_STATUS_FAILED);
2420
2421                 if (mesh_tx) {
2422                         if (sending)
2423                                 mgmt_mesh_remove(mesh_tx);
2424                 }
2425         } else {
2426                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2427
2428                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2429                                   &mesh_tx->handle, 1);
2430         }
2431
2432 done:
2433         hci_dev_unlock(hdev);
2434         return err;
2435 }
2436
2437 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2438 {
2439         struct mgmt_mode *cp = data;
2440         struct mgmt_pending_cmd *cmd;
2441         int err;
2442         u8 val, enabled;
2443
2444         bt_dev_dbg(hdev, "sock %p", sk);
2445
2446         if (!lmp_le_capable(hdev))
2447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2448                                        MGMT_STATUS_NOT_SUPPORTED);
2449
2450         if (cp->val != 0x00 && cp->val != 0x01)
2451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2452                                        MGMT_STATUS_INVALID_PARAMS);
2453
2454         /* Bluetooth single mode LE only controllers or dual-mode
2455          * controllers configured as LE only devices, do not allow
2456          * switching LE off. These have either LE enabled explicitly
2457          * or BR/EDR has been previously switched off.
2458          *
2459          * When trying to enable an already enabled LE, then gracefully
2460          * send a positive response. Trying to disable it however will
2461          * result into rejection.
2462          */
2463         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2464                 if (cp->val == 0x01)
2465                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2466
2467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2468                                        MGMT_STATUS_REJECTED);
2469         }
2470
2471         hci_dev_lock(hdev);
2472
2473         val = !!cp->val;
2474         enabled = lmp_host_le_capable(hdev);
2475
2476         if (!hdev_is_powered(hdev) || val == enabled) {
2477                 bool changed = false;
2478
2479                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2480                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2481                         changed = true;
2482                 }
2483
2484                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2485                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2486                         changed = true;
2487                 }
2488
2489                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2490                 if (err < 0)
2491                         goto unlock;
2492
2493                 if (changed)
2494                         err = new_settings(hdev, sk);
2495
2496                 goto unlock;
2497         }
2498
2499         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2500             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2501                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2502                                       MGMT_STATUS_BUSY);
2503                 goto unlock;
2504         }
2505
2506         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2507         if (!cmd)
2508                 err = -ENOMEM;
2509         else
2510                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2511                                          set_le_complete);
2512
2513         if (err < 0) {
2514                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2515                                       MGMT_STATUS_FAILED);
2516
2517                 if (cmd)
2518                         mgmt_pending_remove(cmd);
2519         }
2520
2521 unlock:
2522         hci_dev_unlock(hdev);
2523         return err;
2524 }
2525
2526 /* This is a helper function to test for pending mgmt commands that can
2527  * cause CoD or EIR HCI commands. We can only allow one such pending
2528  * mgmt command at a time since otherwise we cannot easily track what
2529  * the current values are, will be, and based on that calculate if a new
2530  * HCI command needs to be sent and if yes with what value.
2531  */
2532 static bool pending_eir_or_class(struct hci_dev *hdev)
2533 {
2534         struct mgmt_pending_cmd *cmd;
2535
2536         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2537                 switch (cmd->opcode) {
2538                 case MGMT_OP_ADD_UUID:
2539                 case MGMT_OP_REMOVE_UUID:
2540                 case MGMT_OP_SET_DEV_CLASS:
2541                 case MGMT_OP_SET_POWERED:
2542                         return true;
2543                 }
2544         }
2545
2546         return false;
2547 }
2548
2549 static const u8 bluetooth_base_uuid[] = {
2550                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2551                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2552 };
2553
2554 static u8 get_uuid_size(const u8 *uuid)
2555 {
2556         u32 val;
2557
2558         if (memcmp(uuid, bluetooth_base_uuid, 12))
2559                 return 128;
2560
2561         val = get_unaligned_le32(&uuid[12]);
2562         if (val > 0xffff)
2563                 return 32;
2564
2565         return 16;
2566 }
2567
2568 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2569 {
2570         struct mgmt_pending_cmd *cmd = data;
2571
2572         bt_dev_dbg(hdev, "err %d", err);
2573
2574         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2575                           mgmt_status(err), hdev->dev_class, 3);
2576
2577         mgmt_pending_free(cmd);
2578 }
2579
2580 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2581 {
2582         int err;
2583
2584         err = hci_update_class_sync(hdev);
2585         if (err)
2586                 return err;
2587
2588         return hci_update_eir_sync(hdev);
2589 }
2590
2591 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2592 {
2593         struct mgmt_cp_add_uuid *cp = data;
2594         struct mgmt_pending_cmd *cmd;
2595         struct bt_uuid *uuid;
2596         int err;
2597
2598         bt_dev_dbg(hdev, "sock %p", sk);
2599
2600         hci_dev_lock(hdev);
2601
2602         if (pending_eir_or_class(hdev)) {
2603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2604                                       MGMT_STATUS_BUSY);
2605                 goto failed;
2606         }
2607
2608         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2609         if (!uuid) {
2610                 err = -ENOMEM;
2611                 goto failed;
2612         }
2613
2614         memcpy(uuid->uuid, cp->uuid, 16);
2615         uuid->svc_hint = cp->svc_hint;
2616         uuid->size = get_uuid_size(cp->uuid);
2617
2618         list_add_tail(&uuid->list, &hdev->uuids);
2619
2620         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2621         if (!cmd) {
2622                 err = -ENOMEM;
2623                 goto failed;
2624         }
2625
2626         /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
2627          * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2628          */
2629         err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
2630                                   mgmt_class_complete);
2631         if (err < 0) {
2632                 mgmt_pending_free(cmd);
2633                 goto failed;
2634         }
2635
2636 failed:
2637         hci_dev_unlock(hdev);
2638         return err;
2639 }
2640
2641 static bool enable_service_cache(struct hci_dev *hdev)
2642 {
2643         if (!hdev_is_powered(hdev))
2644                 return false;
2645
2646         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2647                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2648                                    CACHE_TIMEOUT);
2649                 return true;
2650         }
2651
2652         return false;
2653 }
2654
2655 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2656 {
2657         int err;
2658
2659         err = hci_update_class_sync(hdev);
2660         if (err)
2661                 return err;
2662
2663         return hci_update_eir_sync(hdev);
2664 }
2665
2666 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2667                        u16 len)
2668 {
2669         struct mgmt_cp_remove_uuid *cp = data;
2670         struct mgmt_pending_cmd *cmd;
2671         struct bt_uuid *match, *tmp;
2672         static const u8 bt_uuid_any[] = {
2673                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2674         };
2675         int err, found;
2676
2677         bt_dev_dbg(hdev, "sock %p", sk);
2678
2679         hci_dev_lock(hdev);
2680
2681         if (pending_eir_or_class(hdev)) {
2682                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2683                                       MGMT_STATUS_BUSY);
2684                 goto unlock;
2685         }
2686
2687         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2688                 hci_uuids_clear(hdev);
2689
2690                 if (enable_service_cache(hdev)) {
2691                         err = mgmt_cmd_complete(sk, hdev->id,
2692                                                 MGMT_OP_REMOVE_UUID,
2693                                                 0, hdev->dev_class, 3);
2694                         goto unlock;
2695                 }
2696
2697                 goto update_class;
2698         }
2699
2700         found = 0;
2701
2702         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2703                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2704                         continue;
2705
2706                 list_del(&match->list);
2707                 kfree(match);
2708                 found++;
2709         }
2710
2711         if (found == 0) {
2712                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2713                                       MGMT_STATUS_INVALID_PARAMS);
2714                 goto unlock;
2715         }
2716
2717 update_class:
2718         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2719         if (!cmd) {
2720                 err = -ENOMEM;
2721                 goto unlock;
2722         }
2723
2724         /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
2725          * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2726          */
2727         err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
2728                                   mgmt_class_complete);
2729         if (err < 0)
2730                 mgmt_pending_free(cmd);
2731
2732 unlock:
2733         hci_dev_unlock(hdev);
2734         return err;
2735 }
2736
2737 static int set_class_sync(struct hci_dev *hdev, void *data)
2738 {
2739         int err = 0;
2740
2741         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2742                 cancel_delayed_work_sync(&hdev->service_cache);
2743                 err = hci_update_eir_sync(hdev);
2744         }
2745
2746         if (err)
2747                 return err;
2748
2749         return hci_update_class_sync(hdev);
2750 }
2751
2752 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2753                          u16 len)
2754 {
2755         struct mgmt_cp_set_dev_class *cp = data;
2756         struct mgmt_pending_cmd *cmd;
2757         int err;
2758
2759         bt_dev_dbg(hdev, "sock %p", sk);
2760
2761         if (!lmp_bredr_capable(hdev))
2762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2763                                        MGMT_STATUS_NOT_SUPPORTED);
2764
2765         hci_dev_lock(hdev);
2766
2767         if (pending_eir_or_class(hdev)) {
2768                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2769                                       MGMT_STATUS_BUSY);
2770                 goto unlock;
2771         }
2772
2773         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2774                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2775                                       MGMT_STATUS_INVALID_PARAMS);
2776                 goto unlock;
2777         }
2778
2779         hdev->major_class = cp->major;
2780         hdev->minor_class = cp->minor;
2781
2782         if (!hdev_is_powered(hdev)) {
2783                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2784                                         hdev->dev_class, 3);
2785                 goto unlock;
2786         }
2787
2788         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2789         if (!cmd) {
2790                 err = -ENOMEM;
2791                 goto unlock;
2792         }
2793
2794         /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
2795          * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2796          */
2797         err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
2798                                   mgmt_class_complete);
2799         if (err < 0)
2800                 mgmt_pending_free(cmd);
2801
2802 unlock:
2803         hci_dev_unlock(hdev);
2804         return err;
2805 }
2806
2807 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2808                           u16 len)
2809 {
2810         struct mgmt_cp_load_link_keys *cp = data;
2811         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2812                                    sizeof(struct mgmt_link_key_info));
2813         u16 key_count, expected_len;
2814         bool changed;
2815         int i;
2816
2817         bt_dev_dbg(hdev, "sock %p", sk);
2818
2819         if (!lmp_bredr_capable(hdev))
2820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2821                                        MGMT_STATUS_NOT_SUPPORTED);
2822
2823         key_count = __le16_to_cpu(cp->key_count);
2824         if (key_count > max_key_count) {
2825                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2826                            key_count);
2827                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2828                                        MGMT_STATUS_INVALID_PARAMS);
2829         }
2830
2831         expected_len = struct_size(cp, keys, key_count);
2832         if (expected_len != len) {
2833                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2834                            expected_len, len);
2835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2836                                        MGMT_STATUS_INVALID_PARAMS);
2837         }
2838
2839         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2840                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2841                                        MGMT_STATUS_INVALID_PARAMS);
2842
2843         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2844                    key_count);
2845
2846         for (i = 0; i < key_count; i++) {
2847                 struct mgmt_link_key_info *key = &cp->keys[i];
2848
2849                 /* Considering SMP over BREDR/LE, there is no need to check addr_type */
2850                 if (key->type > 0x08)
2851                         return mgmt_cmd_status(sk, hdev->id,
2852                                                MGMT_OP_LOAD_LINK_KEYS,
2853                                                MGMT_STATUS_INVALID_PARAMS);
2854         }
2855
2856         hci_dev_lock(hdev);
2857
2858         hci_link_keys_clear(hdev);
2859
2860         if (cp->debug_keys)
2861                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2862         else
2863                 changed = hci_dev_test_and_clear_flag(hdev,
2864                                                       HCI_KEEP_DEBUG_KEYS);
2865
2866         if (changed)
2867                 new_settings(hdev, NULL);
2868
2869         for (i = 0; i < key_count; i++) {
2870                 struct mgmt_link_key_info *key = &cp->keys[i];
2871
2872                 if (hci_is_blocked_key(hdev,
2873                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2874                                        key->val)) {
2875                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2876                                     &key->addr.bdaddr);
2877                         continue;
2878                 }
2879
2880                 /* Always ignore debug keys and require a new pairing if
2881                  * the user wants to use them.
2882                  */
2883                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2884                         continue;
2885
2886                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2887                                  key->type, key->pin_len, NULL);
2888         }
2889
2890         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2891
2892         hci_dev_unlock(hdev);
2893
2894         return 0;
2895 }
2896
2897 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2898                            u8 addr_type, struct sock *skip_sk)
2899 {
2900         struct mgmt_ev_device_unpaired ev;
2901
2902         bacpy(&ev.addr.bdaddr, bdaddr);
2903         ev.addr.type = addr_type;
2904
2905         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2906                           skip_sk);
2907 }
2908
2909 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2910 {
2911         struct mgmt_pending_cmd *cmd = data;
2912         struct mgmt_cp_unpair_device *cp = cmd->param;
2913
2914         if (!err)
2915                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2916
2917         cmd->cmd_complete(cmd, err);
2918         mgmt_pending_free(cmd);
2919 }
2920
2921 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2922 {
2923         struct mgmt_pending_cmd *cmd = data;
2924         struct mgmt_cp_unpair_device *cp = cmd->param;
2925         struct hci_conn *conn;
2926
2927         if (cp->addr.type == BDADDR_BREDR)
2928                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2929                                                &cp->addr.bdaddr);
2930         else
2931                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2932                                                le_addr_type(cp->addr.type));
2933
2934         if (!conn)
2935                 return 0;
2936
2937         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2938 }
2939
2940 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2941                          u16 len)
2942 {
2943         struct mgmt_cp_unpair_device *cp = data;
2944         struct mgmt_rp_unpair_device rp;
2945         struct hci_conn_params *params;
2946         struct mgmt_pending_cmd *cmd;
2947         struct hci_conn *conn;
2948         u8 addr_type;
2949         int err;
2950
2951         memset(&rp, 0, sizeof(rp));
2952         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2953         rp.addr.type = cp->addr.type;
2954
2955         if (!bdaddr_type_is_valid(cp->addr.type))
2956                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2957                                          MGMT_STATUS_INVALID_PARAMS,
2958                                          &rp, sizeof(rp));
2959
2960         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2961                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2962                                          MGMT_STATUS_INVALID_PARAMS,
2963                                          &rp, sizeof(rp));
2964
2965         hci_dev_lock(hdev);
2966
2967         if (!hdev_is_powered(hdev)) {
2968                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2969                                         MGMT_STATUS_NOT_POWERED, &rp,
2970                                         sizeof(rp));
2971                 goto unlock;
2972         }
2973
2974         if (cp->addr.type == BDADDR_BREDR) {
2975                 /* If disconnection is requested, then look up the
2976                  * connection. If the remote device is connected, it
2977                  * will be later used to terminate the link.
2978                  *
2979                  * Setting it to NULL explicitly will cause no
2980                  * termination of the link.
2981                  */
2982                 if (cp->disconnect)
2983                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2984                                                        &cp->addr.bdaddr);
2985                 else
2986                         conn = NULL;
2987
2988                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2989                 if (err < 0) {
2990                         err = mgmt_cmd_complete(sk, hdev->id,
2991                                                 MGMT_OP_UNPAIR_DEVICE,
2992                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2993                                                 sizeof(rp));
2994                         goto unlock;
2995                 }
2996
2997                 goto done;
2998         }
2999
3000         /* LE address type */
3001         addr_type = le_addr_type(cp->addr.type);
3002
3003         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3004         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3005         if (err < 0) {
3006                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3007                                         MGMT_STATUS_NOT_PAIRED, &rp,
3008                                         sizeof(rp));
3009                 goto unlock;
3010         }
3011
3012         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3013         if (!conn) {
3014                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3015                 goto done;
3016         }
3017
3018
3019         /* Defer clearing up the connection parameters until closing to
3020          * give a chance of keeping them if a repairing happens.
3021          */
3022         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3023
3024         /* Disable auto-connection parameters if present */
3025         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3026         if (params) {
3027                 if (params->explicit_connect)
3028                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3029                 else
3030                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3031         }
3032
3033         /* If disconnection is not requested, then clear the connection
3034          * variable so that the link is not terminated.
3035          */
3036         if (!cp->disconnect)
3037                 conn = NULL;
3038
3039 done:
3040         /* If the connection variable is set, then termination of the
3041          * link is requested.
3042          */
3043         if (!conn) {
3044                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3045                                         &rp, sizeof(rp));
3046                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3047                 goto unlock;
3048         }
3049
3050         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3051                                sizeof(*cp));
3052         if (!cmd) {
3053                 err = -ENOMEM;
3054                 goto unlock;
3055         }
3056
3057         cmd->cmd_complete = addr_cmd_complete;
3058
3059         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3060                                  unpair_device_complete);
3061         if (err < 0)
3062                 mgmt_pending_free(cmd);
3063
3064 unlock:
3065         hci_dev_unlock(hdev);
3066         return err;
3067 }
3068
3069 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3070                       u16 len)
3071 {
3072         struct mgmt_cp_disconnect *cp = data;
3073         struct mgmt_rp_disconnect rp;
3074         struct mgmt_pending_cmd *cmd;
3075         struct hci_conn *conn;
3076         int err;
3077
3078         bt_dev_dbg(hdev, "sock %p", sk);
3079
3080         memset(&rp, 0, sizeof(rp));
3081         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3082         rp.addr.type = cp->addr.type;
3083
3084         if (!bdaddr_type_is_valid(cp->addr.type))
3085                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3086                                          MGMT_STATUS_INVALID_PARAMS,
3087                                          &rp, sizeof(rp));
3088
3089         hci_dev_lock(hdev);
3090
3091         if (!test_bit(HCI_UP, &hdev->flags)) {
3092                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3093                                         MGMT_STATUS_NOT_POWERED, &rp,
3094                                         sizeof(rp));
3095                 goto failed;
3096         }
3097
3098         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3099                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3100                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3101                 goto failed;
3102         }
3103
3104         if (cp->addr.type == BDADDR_BREDR)
3105                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3106                                                &cp->addr.bdaddr);
3107         else
3108                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3109                                                le_addr_type(cp->addr.type));
3110
3111         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3112                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3113                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3114                                         sizeof(rp));
3115                 goto failed;
3116         }
3117
3118         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3119         if (!cmd) {
3120                 err = -ENOMEM;
3121                 goto failed;
3122         }
3123
3124         cmd->cmd_complete = generic_cmd_complete;
3125
3126         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3127         if (err < 0)
3128                 mgmt_pending_remove(cmd);
3129
3130 failed:
3131         hci_dev_unlock(hdev);
3132         return err;
3133 }
3134
3135 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3136 {
3137         switch (link_type) {
3138         case ISO_LINK:
3139         case LE_LINK:
3140                 switch (addr_type) {
3141                 case ADDR_LE_DEV_PUBLIC:
3142                         return BDADDR_LE_PUBLIC;
3143
3144                 default:
3145                         /* Fallback to LE Random address type */
3146                         return BDADDR_LE_RANDOM;
3147                 }
3148
3149         default:
3150                 /* Fallback to BR/EDR type */
3151                 return BDADDR_BREDR;
3152         }
3153 }
3154
3155 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3156                            u16 data_len)
3157 {
3158         struct mgmt_rp_get_connections *rp;
3159         struct hci_conn *c;
3160         int err;
3161         u16 i;
3162
3163         bt_dev_dbg(hdev, "sock %p", sk);
3164
3165         hci_dev_lock(hdev);
3166
3167         if (!hdev_is_powered(hdev)) {
3168                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3169                                       MGMT_STATUS_NOT_POWERED);
3170                 goto unlock;
3171         }
3172
3173         i = 0;
3174         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3175                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3176                         i++;
3177         }
3178
3179         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3180         if (!rp) {
3181                 err = -ENOMEM;
3182                 goto unlock;
3183         }
3184
3185         i = 0;
3186         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3187                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3188                         continue;
3189                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3190                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3191                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3192                         continue;
3193                 i++;
3194         }
3195
3196         rp->conn_count = cpu_to_le16(i);
3197
3198         /* Recalculate length in case of filtered SCO connections, etc */
3199         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3200                                 struct_size(rp, addr, i));
3201
3202         kfree(rp);
3203
3204 unlock:
3205         hci_dev_unlock(hdev);
3206         return err;
3207 }
3208
3209 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3210                                    struct mgmt_cp_pin_code_neg_reply *cp)
3211 {
3212         struct mgmt_pending_cmd *cmd;
3213         int err;
3214
3215         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3216                                sizeof(*cp));
3217         if (!cmd)
3218                 return -ENOMEM;
3219
3220         cmd->cmd_complete = addr_cmd_complete;
3221
3222         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3223                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3224         if (err < 0)
3225                 mgmt_pending_remove(cmd);
3226
3227         return err;
3228 }
3229
3230 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3231                           u16 len)
3232 {
3233         struct hci_conn *conn;
3234         struct mgmt_cp_pin_code_reply *cp = data;
3235         struct hci_cp_pin_code_reply reply;
3236         struct mgmt_pending_cmd *cmd;
3237         int err;
3238
3239         bt_dev_dbg(hdev, "sock %p", sk);
3240
3241         hci_dev_lock(hdev);
3242
3243         if (!hdev_is_powered(hdev)) {
3244                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3245                                       MGMT_STATUS_NOT_POWERED);
3246                 goto failed;
3247         }
3248
3249         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3250         if (!conn) {
3251                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3252                                       MGMT_STATUS_NOT_CONNECTED);
3253                 goto failed;
3254         }
3255
3256         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3257                 struct mgmt_cp_pin_code_neg_reply ncp;
3258
3259                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3260
3261                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3262
3263                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3264                 if (err >= 0)
3265                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3266                                               MGMT_STATUS_INVALID_PARAMS);
3267
3268                 goto failed;
3269         }
3270
3271         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3272         if (!cmd) {
3273                 err = -ENOMEM;
3274                 goto failed;
3275         }
3276
3277         cmd->cmd_complete = addr_cmd_complete;
3278
3279         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3280         reply.pin_len = cp->pin_len;
3281         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3282
3283         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3284         if (err < 0)
3285                 mgmt_pending_remove(cmd);
3286
3287 failed:
3288         hci_dev_unlock(hdev);
3289         return err;
3290 }
3291
3292 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3293                              u16 len)
3294 {
3295         struct mgmt_cp_set_io_capability *cp = data;
3296
3297         bt_dev_dbg(hdev, "sock %p", sk);
3298
3299         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3300                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3301                                        MGMT_STATUS_INVALID_PARAMS);
3302
3303         hci_dev_lock(hdev);
3304
3305         hdev->io_capability = cp->io_capability;
3306
3307         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3308
3309         hci_dev_unlock(hdev);
3310
3311         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3312                                  NULL, 0);
3313 }
3314
3315 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3316 {
3317         struct hci_dev *hdev = conn->hdev;
3318         struct mgmt_pending_cmd *cmd;
3319
3320         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3321                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3322                         continue;
3323
3324                 if (cmd->user_data != conn)
3325                         continue;
3326
3327                 return cmd;
3328         }
3329
3330         return NULL;
3331 }
3332
3333 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3334 {
3335         struct mgmt_rp_pair_device rp;
3336         struct hci_conn *conn = cmd->user_data;
3337         int err;
3338
3339         bacpy(&rp.addr.bdaddr, &conn->dst);
3340         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3341
3342         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3343                                 status, &rp, sizeof(rp));
3344
3345         /* So we don't get further callbacks for this connection */
3346         conn->connect_cfm_cb = NULL;
3347         conn->security_cfm_cb = NULL;
3348         conn->disconn_cfm_cb = NULL;
3349
3350         hci_conn_drop(conn);
3351
3352         /* The device is paired so there is no need to remove
3353          * its connection parameters anymore.
3354          */
3355         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3356
3357         hci_conn_put(conn);
3358
3359         return err;
3360 }
3361
3362 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3363 {
3364         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3365         struct mgmt_pending_cmd *cmd;
3366
3367         cmd = find_pairing(conn);
3368         if (cmd) {
3369                 cmd->cmd_complete(cmd, status);
3370                 mgmt_pending_remove(cmd);
3371         }
3372 }
3373
3374 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3375 {
3376         struct mgmt_pending_cmd *cmd;
3377
3378         BT_DBG("status %u", status);
3379
3380         cmd = find_pairing(conn);
3381         if (!cmd) {
3382                 BT_DBG("Unable to find a pending command");
3383                 return;
3384         }
3385
3386         cmd->cmd_complete(cmd, mgmt_status(status));
3387         mgmt_pending_remove(cmd);
3388 }
3389
3390 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3391 {
3392         struct mgmt_pending_cmd *cmd;
3393
3394         BT_DBG("status %u", status);
3395
3396         if (!status)
3397                 return;
3398
3399         cmd = find_pairing(conn);
3400         if (!cmd) {
3401                 BT_DBG("Unable to find a pending command");
3402                 return;
3403         }
3404
3405         cmd->cmd_complete(cmd, mgmt_status(status));
3406         mgmt_pending_remove(cmd);
3407 }
3408
3409 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3410                        u16 len)
3411 {
3412         struct mgmt_cp_pair_device *cp = data;
3413         struct mgmt_rp_pair_device rp;
3414         struct mgmt_pending_cmd *cmd;
3415         u8 sec_level, auth_type;
3416         struct hci_conn *conn;
3417         int err;
3418
3419         bt_dev_dbg(hdev, "sock %p", sk);
3420
3421         memset(&rp, 0, sizeof(rp));
3422         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3423         rp.addr.type = cp->addr.type;
3424
3425         if (!bdaddr_type_is_valid(cp->addr.type))
3426                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3427                                          MGMT_STATUS_INVALID_PARAMS,
3428                                          &rp, sizeof(rp));
3429
3430         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3431                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3432                                          MGMT_STATUS_INVALID_PARAMS,
3433                                          &rp, sizeof(rp));
3434
3435         hci_dev_lock(hdev);
3436
3437         if (!hdev_is_powered(hdev)) {
3438                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3439                                         MGMT_STATUS_NOT_POWERED, &rp,
3440                                         sizeof(rp));
3441                 goto unlock;
3442         }
3443
3444         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3445                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3446                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3447                                         sizeof(rp));
3448                 goto unlock;
3449         }
3450
3451         sec_level = BT_SECURITY_MEDIUM;
3452         auth_type = HCI_AT_DEDICATED_BONDING;
3453
3454         if (cp->addr.type == BDADDR_BREDR) {
3455                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3456                                        auth_type, CONN_REASON_PAIR_DEVICE,
3457                                        HCI_ACL_CONN_TIMEOUT);
3458         } else {
3459                 u8 addr_type = le_addr_type(cp->addr.type);
3460                 struct hci_conn_params *p;
3461
3462                 /* When pairing a new device, it is expected to remember
3463                  * this device for future connections. Adding the connection
3464                  * parameter information ahead of time allows tracking
3465                  * of the peripheral preferred values and will speed up any
3466                  * further connection establishment.
3467                  *
3468                  * If connection parameters already exist, then they
3469                  * will be kept and this function does nothing.
3470                  */
3471                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3472
3473                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3474                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3475
3476                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3477                                            sec_level, HCI_LE_CONN_TIMEOUT,
3478                                            CONN_REASON_PAIR_DEVICE);
3479         }
3480
3481         if (IS_ERR(conn)) {
3482                 int status;
3483
3484                 if (PTR_ERR(conn) == -EBUSY)
3485                         status = MGMT_STATUS_BUSY;
3486                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3487                         status = MGMT_STATUS_NOT_SUPPORTED;
3488                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3489                         status = MGMT_STATUS_REJECTED;
3490                 else
3491                         status = MGMT_STATUS_CONNECT_FAILED;
3492
3493                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3494                                         status, &rp, sizeof(rp));
3495                 goto unlock;
3496         }
3497
3498         if (conn->connect_cfm_cb) {
3499                 hci_conn_drop(conn);
3500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3501                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3502                 goto unlock;
3503         }
3504
3505         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3506         if (!cmd) {
3507                 err = -ENOMEM;
3508                 hci_conn_drop(conn);
3509                 goto unlock;
3510         }
3511
3512         cmd->cmd_complete = pairing_complete;
3513
3514         /* For LE, just connecting isn't a proof that the pairing finished */
3515         if (cp->addr.type == BDADDR_BREDR) {
3516                 conn->connect_cfm_cb = pairing_complete_cb;
3517                 conn->security_cfm_cb = pairing_complete_cb;
3518                 conn->disconn_cfm_cb = pairing_complete_cb;
3519         } else {
3520                 conn->connect_cfm_cb = le_pairing_complete_cb;
3521                 conn->security_cfm_cb = le_pairing_complete_cb;
3522                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3523         }
3524
3525         conn->io_capability = cp->io_cap;
3526         cmd->user_data = hci_conn_get(conn);
3527
3528         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3529             hci_conn_security(conn, sec_level, auth_type, true)) {
3530                 cmd->cmd_complete(cmd, 0);
3531                 mgmt_pending_remove(cmd);
3532         }
3533
3534         err = 0;
3535
3536 unlock:
3537         hci_dev_unlock(hdev);
3538         return err;
3539 }
3540
3541 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3542                               u16 len)
3543 {
3544         struct mgmt_addr_info *addr = data;
3545         struct mgmt_pending_cmd *cmd;
3546         struct hci_conn *conn;
3547         int err;
3548
3549         bt_dev_dbg(hdev, "sock %p", sk);
3550
3551         hci_dev_lock(hdev);
3552
3553         if (!hdev_is_powered(hdev)) {
3554                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3555                                       MGMT_STATUS_NOT_POWERED);
3556                 goto unlock;
3557         }
3558
3559         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3560         if (!cmd) {
3561                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3562                                       MGMT_STATUS_INVALID_PARAMS);
3563                 goto unlock;
3564         }
3565
3566         conn = cmd->user_data;
3567
3568         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3569                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3570                                       MGMT_STATUS_INVALID_PARAMS);
3571                 goto unlock;
3572         }
3573
3574         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3575         mgmt_pending_remove(cmd);
3576
3577         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3578                                 addr, sizeof(*addr));
3579
3580         /* Since user doesn't want to proceed with the connection, abort any
3581          * ongoing pairing and then terminate the link if it was created
3582          * because of the pair device action.
3583          */
3584         if (addr->type == BDADDR_BREDR)
3585                 hci_remove_link_key(hdev, &addr->bdaddr);
3586         else
3587                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3588                                               le_addr_type(addr->type));
3589
3590         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3591                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3592
3593 unlock:
3594         hci_dev_unlock(hdev);
3595         return err;
3596 }
3597
3598 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3599                              struct mgmt_addr_info *addr, u16 mgmt_op,
3600                              u16 hci_op, __le32 passkey)
3601 {
3602         struct mgmt_pending_cmd *cmd;
3603         struct hci_conn *conn;
3604         int err;
3605
3606         hci_dev_lock(hdev);
3607
3608         if (!hdev_is_powered(hdev)) {
3609                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3610                                         MGMT_STATUS_NOT_POWERED, addr,
3611                                         sizeof(*addr));
3612                 goto done;
3613         }
3614
3615         if (addr->type == BDADDR_BREDR)
3616                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3617         else
3618                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3619                                                le_addr_type(addr->type));
3620
3621         if (!conn) {
3622                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3623                                         MGMT_STATUS_NOT_CONNECTED, addr,
3624                                         sizeof(*addr));
3625                 goto done;
3626         }
3627
3628         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3629                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3630                 if (!err)
3631                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3632                                                 MGMT_STATUS_SUCCESS, addr,
3633                                                 sizeof(*addr));
3634                 else
3635                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3636                                                 MGMT_STATUS_FAILED, addr,
3637                                                 sizeof(*addr));
3638
3639                 goto done;
3640         }
3641
3642         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3643         if (!cmd) {
3644                 err = -ENOMEM;
3645                 goto done;
3646         }
3647
3648         cmd->cmd_complete = addr_cmd_complete;
3649
3650         /* Continue with pairing via HCI */
3651         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3652                 struct hci_cp_user_passkey_reply cp;
3653
3654                 bacpy(&cp.bdaddr, &addr->bdaddr);
3655                 cp.passkey = passkey;
3656                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3657         } else
3658                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3659                                    &addr->bdaddr);
3660
3661         if (err < 0)
3662                 mgmt_pending_remove(cmd);
3663
3664 done:
3665         hci_dev_unlock(hdev);
3666         return err;
3667 }
3668
3669 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3670                               void *data, u16 len)
3671 {
3672         struct mgmt_cp_pin_code_neg_reply *cp = data;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         return user_pairing_resp(sk, hdev, &cp->addr,
3677                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3678                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3679 }
3680
3681 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3682                               u16 len)
3683 {
3684         struct mgmt_cp_user_confirm_reply *cp = data;
3685
3686         bt_dev_dbg(hdev, "sock %p", sk);
3687
3688         if (len != sizeof(*cp))
3689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3690                                        MGMT_STATUS_INVALID_PARAMS);
3691
3692         return user_pairing_resp(sk, hdev, &cp->addr,
3693                                  MGMT_OP_USER_CONFIRM_REPLY,
3694                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3695 }
3696
3697 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3698                                   void *data, u16 len)
3699 {
3700         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3701
3702         bt_dev_dbg(hdev, "sock %p", sk);
3703
3704         return user_pairing_resp(sk, hdev, &cp->addr,
3705                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3706                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3707 }
3708
3709 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3710                               u16 len)
3711 {
3712         struct mgmt_cp_user_passkey_reply *cp = data;
3713
3714         bt_dev_dbg(hdev, "sock %p", sk);
3715
3716         return user_pairing_resp(sk, hdev, &cp->addr,
3717                                  MGMT_OP_USER_PASSKEY_REPLY,
3718                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3719 }
3720
3721 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3722                                   void *data, u16 len)
3723 {
3724         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3725
3726         bt_dev_dbg(hdev, "sock %p", sk);
3727
3728         return user_pairing_resp(sk, hdev, &cp->addr,
3729                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3730                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3731 }
3732
3733 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3734 {
3735         struct adv_info *adv_instance;
3736
3737         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3738         if (!adv_instance)
3739                 return 0;
3740
3741         /* stop if current instance doesn't need to be changed */
3742         if (!(adv_instance->flags & flags))
3743                 return 0;
3744
3745         cancel_adv_timeout(hdev);
3746
3747         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3748         if (!adv_instance)
3749                 return 0;
3750
3751         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3752
3753         return 0;
3754 }
3755
3756 static int name_changed_sync(struct hci_dev *hdev, void *data)
3757 {
3758         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3759 }
3760
3761 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3762 {
3763         struct mgmt_pending_cmd *cmd = data;
3764         struct mgmt_cp_set_local_name *cp = cmd->param;
3765         u8 status = mgmt_status(err);
3766
3767         bt_dev_dbg(hdev, "err %d", err);
3768
3769         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3770                 return;
3771
3772         if (status) {
3773                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3774                                 status);
3775         } else {
3776                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3777                                   cp, sizeof(*cp));
3778
3779                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3780                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3781         }
3782
3783         mgmt_pending_remove(cmd);
3784 }
3785
3786 static int set_name_sync(struct hci_dev *hdev, void *data)
3787 {
3788         if (lmp_bredr_capable(hdev)) {
3789                 hci_update_name_sync(hdev);
3790                 hci_update_eir_sync(hdev);
3791         }
3792
3793         /* The name is stored in the scan response data and so
3794          * no need to update the advertising data here.
3795          */
3796         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3797                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3798
3799         return 0;
3800 }
3801
3802 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3803                           u16 len)
3804 {
3805         struct mgmt_cp_set_local_name *cp = data;
3806         struct mgmt_pending_cmd *cmd;
3807         int err;
3808
3809         bt_dev_dbg(hdev, "sock %p", sk);
3810
3811         hci_dev_lock(hdev);
3812
3813         /* If the old values are the same as the new ones just return a
3814          * direct command complete event.
3815          */
3816         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3817             !memcmp(hdev->short_name, cp->short_name,
3818                     sizeof(hdev->short_name))) {
3819                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3820                                         data, len);
3821                 goto failed;
3822         }
3823
3824         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3825
3826         if (!hdev_is_powered(hdev)) {
3827                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3828
3829                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3830                                         data, len);
3831                 if (err < 0)
3832                         goto failed;
3833
3834                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3835                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3836                 ext_info_changed(hdev, sk);
3837
3838                 goto failed;
3839         }
3840
3841         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3842         if (!cmd)
3843                 err = -ENOMEM;
3844         else
3845                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3846                                          set_name_complete);
3847
3848         if (err < 0) {
3849                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3850                                       MGMT_STATUS_FAILED);
3851
3852                 if (cmd)
3853                         mgmt_pending_remove(cmd);
3854
3855                 goto failed;
3856         }
3857
3858         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3859
3860 failed:
3861         hci_dev_unlock(hdev);
3862         return err;
3863 }
3864
3865 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3866 {
3867         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3868 }
3869
3870 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3871                           u16 len)
3872 {
3873         struct mgmt_cp_set_appearance *cp = data;
3874         u16 appearance;
3875         int err;
3876
3877         bt_dev_dbg(hdev, "sock %p", sk);
3878
3879         if (!lmp_le_capable(hdev))
3880                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3881                                        MGMT_STATUS_NOT_SUPPORTED);
3882
3883         appearance = le16_to_cpu(cp->appearance);
3884
3885         hci_dev_lock(hdev);
3886
3887         if (hdev->appearance != appearance) {
3888                 hdev->appearance = appearance;
3889
3890                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3891                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3892                                            NULL);
3893
3894                 ext_info_changed(hdev, sk);
3895         }
3896
3897         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3898                                 0);
3899
3900         hci_dev_unlock(hdev);
3901
3902         return err;
3903 }
3904
3905 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3906                                  void *data, u16 len)
3907 {
3908         struct mgmt_rp_get_phy_configuration rp;
3909
3910         bt_dev_dbg(hdev, "sock %p", sk);
3911
3912         hci_dev_lock(hdev);
3913
3914         memset(&rp, 0, sizeof(rp));
3915
3916         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3917         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3918         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3919
3920         hci_dev_unlock(hdev);
3921
3922         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3923                                  &rp, sizeof(rp));
3924 }
3925
3926 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3927 {
3928         struct mgmt_ev_phy_configuration_changed ev;
3929
3930         memset(&ev, 0, sizeof(ev));
3931
3932         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3933
3934         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3935                           sizeof(ev), skip);
3936 }
3937
3938 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3939 {
3940         struct mgmt_pending_cmd *cmd = data;
3941         struct sk_buff *skb = cmd->skb;
3942         u8 status = mgmt_status(err);
3943
3944         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3945                 return;
3946
3947         if (!status) {
3948                 if (!skb)
3949                         status = MGMT_STATUS_FAILED;
3950                 else if (IS_ERR(skb))
3951                         status = mgmt_status(PTR_ERR(skb));
3952                 else
3953                         status = mgmt_status(skb->data[0]);
3954         }
3955
3956         bt_dev_dbg(hdev, "status %d", status);
3957
3958         if (status) {
3959                 mgmt_cmd_status(cmd->sk, hdev->id,
3960                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
3961         } else {
3962                 mgmt_cmd_complete(cmd->sk, hdev->id,
3963                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3964                                   NULL, 0);
3965
3966                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3967         }
3968
3969         if (skb && !IS_ERR(skb))
3970                 kfree_skb(skb);
3971
3972         mgmt_pending_remove(cmd);
3973 }
3974
3975 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
3976 {
3977         struct mgmt_pending_cmd *cmd = data;
3978         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
3979         struct hci_cp_le_set_default_phy cp_phy;
3980         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
3981
3982         memset(&cp_phy, 0, sizeof(cp_phy));
3983
3984         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3985                 cp_phy.all_phys |= 0x01;
3986
3987         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3988                 cp_phy.all_phys |= 0x02;
3989
3990         if (selected_phys & MGMT_PHY_LE_1M_TX)
3991                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3992
3993         if (selected_phys & MGMT_PHY_LE_2M_TX)
3994                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3995
3996         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3997                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3998
3999         if (selected_phys & MGMT_PHY_LE_1M_RX)
4000                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4001
4002         if (selected_phys & MGMT_PHY_LE_2M_RX)
4003                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4004
4005         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4006                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4007
4008         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4009                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4010
4011         return 0;
4012 }
4013
4014 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4015                                  void *data, u16 len)
4016 {
4017         struct mgmt_cp_set_phy_configuration *cp = data;
4018         struct mgmt_pending_cmd *cmd;
4019         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4020         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4021         bool changed = false;
4022         int err;
4023
4024         bt_dev_dbg(hdev, "sock %p", sk);
4025
4026         configurable_phys = get_configurable_phys(hdev);
4027         supported_phys = get_supported_phys(hdev);
4028         selected_phys = __le32_to_cpu(cp->selected_phys);
4029
4030         if (selected_phys & ~supported_phys)
4031                 return mgmt_cmd_status(sk, hdev->id,
4032                                        MGMT_OP_SET_PHY_CONFIGURATION,
4033                                        MGMT_STATUS_INVALID_PARAMS);
4034
4035         unconfigure_phys = supported_phys & ~configurable_phys;
4036
4037         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4038                 return mgmt_cmd_status(sk, hdev->id,
4039                                        MGMT_OP_SET_PHY_CONFIGURATION,
4040                                        MGMT_STATUS_INVALID_PARAMS);
4041
4042         if (selected_phys == get_selected_phys(hdev))
4043                 return mgmt_cmd_complete(sk, hdev->id,
4044                                          MGMT_OP_SET_PHY_CONFIGURATION,
4045                                          0, NULL, 0);
4046
4047         hci_dev_lock(hdev);
4048
4049         if (!hdev_is_powered(hdev)) {
4050                 err = mgmt_cmd_status(sk, hdev->id,
4051                                       MGMT_OP_SET_PHY_CONFIGURATION,
4052                                       MGMT_STATUS_REJECTED);
4053                 goto unlock;
4054         }
4055
4056         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4057                 err = mgmt_cmd_status(sk, hdev->id,
4058                                       MGMT_OP_SET_PHY_CONFIGURATION,
4059                                       MGMT_STATUS_BUSY);
4060                 goto unlock;
4061         }
4062
4063         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4064                 pkt_type |= (HCI_DH3 | HCI_DM3);
4065         else
4066                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4067
4068         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4069                 pkt_type |= (HCI_DH5 | HCI_DM5);
4070         else
4071                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4072
4073         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4074                 pkt_type &= ~HCI_2DH1;
4075         else
4076                 pkt_type |= HCI_2DH1;
4077
4078         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4079                 pkt_type &= ~HCI_2DH3;
4080         else
4081                 pkt_type |= HCI_2DH3;
4082
4083         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4084                 pkt_type &= ~HCI_2DH5;
4085         else
4086                 pkt_type |= HCI_2DH5;
4087
4088         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4089                 pkt_type &= ~HCI_3DH1;
4090         else
4091                 pkt_type |= HCI_3DH1;
4092
4093         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4094                 pkt_type &= ~HCI_3DH3;
4095         else
4096                 pkt_type |= HCI_3DH3;
4097
4098         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4099                 pkt_type &= ~HCI_3DH5;
4100         else
4101                 pkt_type |= HCI_3DH5;
4102
4103         if (pkt_type != hdev->pkt_type) {
4104                 hdev->pkt_type = pkt_type;
4105                 changed = true;
4106         }
4107
4108         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4109             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4110                 if (changed)
4111                         mgmt_phy_configuration_changed(hdev, sk);
4112
4113                 err = mgmt_cmd_complete(sk, hdev->id,
4114                                         MGMT_OP_SET_PHY_CONFIGURATION,
4115                                         0, NULL, 0);
4116
4117                 goto unlock;
4118         }
4119
4120         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4121                                len);
4122         if (!cmd)
4123                 err = -ENOMEM;
4124         else
4125                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4126                                          set_default_phy_complete);
4127
4128         if (err < 0) {
4129                 err = mgmt_cmd_status(sk, hdev->id,
4130                                       MGMT_OP_SET_PHY_CONFIGURATION,
4131                                       MGMT_STATUS_FAILED);
4132
4133                 if (cmd)
4134                         mgmt_pending_remove(cmd);
4135         }
4136
4137 unlock:
4138         hci_dev_unlock(hdev);
4139
4140         return err;
4141 }
4142
4143 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4144                             u16 len)
4145 {
4146         int err = MGMT_STATUS_SUCCESS;
4147         struct mgmt_cp_set_blocked_keys *keys = data;
4148         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4149                                    sizeof(struct mgmt_blocked_key_info));
4150         u16 key_count, expected_len;
4151         int i;
4152
4153         bt_dev_dbg(hdev, "sock %p", sk);
4154
4155         key_count = __le16_to_cpu(keys->key_count);
4156         if (key_count > max_key_count) {
4157                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4158                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4159                                        MGMT_STATUS_INVALID_PARAMS);
4160         }
4161
4162         expected_len = struct_size(keys, keys, key_count);
4163         if (expected_len != len) {
4164                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4165                            expected_len, len);
4166                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4167                                        MGMT_STATUS_INVALID_PARAMS);
4168         }
4169
4170         hci_dev_lock(hdev);
4171
4172         hci_blocked_keys_clear(hdev);
4173
4174         for (i = 0; i < key_count; ++i) {
4175                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4176
4177                 if (!b) {
4178                         err = MGMT_STATUS_NO_RESOURCES;
4179                         break;
4180                 }
4181
4182                 b->type = keys->keys[i].type;
4183                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4184                 list_add_rcu(&b->list, &hdev->blocked_keys);
4185         }
4186         hci_dev_unlock(hdev);
4187
4188         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4189                                 err, NULL, 0);
4190 }
4191
4192 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4193                                void *data, u16 len)
4194 {
4195         struct mgmt_mode *cp = data;
4196         int err;
4197         bool changed = false;
4198
4199         bt_dev_dbg(hdev, "sock %p", sk);
4200
4201         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4202                 return mgmt_cmd_status(sk, hdev->id,
4203                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4204                                        MGMT_STATUS_NOT_SUPPORTED);
4205
4206         if (cp->val != 0x00 && cp->val != 0x01)
4207                 return mgmt_cmd_status(sk, hdev->id,
4208                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4209                                        MGMT_STATUS_INVALID_PARAMS);
4210
4211         hci_dev_lock(hdev);
4212
4213         if (hdev_is_powered(hdev) &&
4214             !!cp->val != hci_dev_test_flag(hdev,
4215                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4216                 err = mgmt_cmd_status(sk, hdev->id,
4217                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4218                                       MGMT_STATUS_REJECTED);
4219                 goto unlock;
4220         }
4221
4222         if (cp->val)
4223                 changed = !hci_dev_test_and_set_flag(hdev,
4224                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4225         else
4226                 changed = hci_dev_test_and_clear_flag(hdev,
4227                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4228
4229         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4230         if (err < 0)
4231                 goto unlock;
4232
4233         if (changed)
4234                 err = new_settings(hdev, sk);
4235
4236 unlock:
4237         hci_dev_unlock(hdev);
4238         return err;
4239 }
4240
4241 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4242                                void *data, u16 data_len)
4243 {
4244         char buf[20];
4245         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4246         u16 cap_len = 0;
4247         u8 flags = 0;
4248         u8 tx_power_range[2];
4249
4250         bt_dev_dbg(hdev, "sock %p", sk);
4251
4252         memset(&buf, 0, sizeof(buf));
4253
4254         hci_dev_lock(hdev);
4255
4256         /* When the Read Simple Pairing Options command is supported, then
4257          * the remote public key validation is supported.
4258          *
4259          * Alternatively, when Microsoft extensions are available, they can
4260          * indicate support for public key validation as well.
4261          */
4262         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4263                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4264
4265         flags |= 0x02;          /* Remote public key validation (LE) */
4266
4267         /* When the Read Encryption Key Size command is supported, then the
4268          * encryption key size is enforced.
4269          */
4270         if (hdev->commands[20] & 0x10)
4271                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4272
4273         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4274
4275         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4276                                   &flags, 1);
4277
4278         /* When the Read Simple Pairing Options command is supported, then
4279          * also max encryption key size information is provided.
4280          */
4281         if (hdev->commands[41] & 0x08)
4282                 cap_len = eir_append_le16(rp->cap, cap_len,
4283                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4284                                           hdev->max_enc_key_size);
4285
4286         cap_len = eir_append_le16(rp->cap, cap_len,
4287                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4288                                   SMP_MAX_ENC_KEY_SIZE);
4289
4290         /* Append the min/max LE tx power parameters if we were able to fetch
4291          * it from the controller
4292          */
4293         if (hdev->commands[38] & 0x80) {
4294                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4295                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4296                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4297                                           tx_power_range, 2);
4298         }
4299
4300         rp->cap_len = cpu_to_le16(cap_len);
4301
4302         hci_dev_unlock(hdev);
4303
4304         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4305                                  rp, sizeof(*rp) + cap_len);
4306 }
4307
4308 #ifdef CONFIG_BT_FEATURE_DEBUG
4309 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4310 static const u8 debug_uuid[16] = {
4311         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4312         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4313 };
4314 #endif
4315
4316 /* 330859bc-7506-492d-9370-9a6f0614037f */
4317 static const u8 quality_report_uuid[16] = {
4318         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4319         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4320 };
4321
4322 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4323 static const u8 offload_codecs_uuid[16] = {
4324         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4325         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4326 };
4327
4328 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4329 static const u8 le_simultaneous_roles_uuid[16] = {
4330         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4331         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4332 };
4333
4334 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4335 static const u8 rpa_resolution_uuid[16] = {
4336         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4337         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4338 };
4339
4340 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4341 static const u8 iso_socket_uuid[16] = {
4342         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4343         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4344 };
4345
4346 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4347 static const u8 mgmt_mesh_uuid[16] = {
4348         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4349         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4350 };
4351
4352 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4353                                   void *data, u16 data_len)
4354 {
4355         struct mgmt_rp_read_exp_features_info *rp;
4356         size_t len;
4357         u16 idx = 0;
4358         u32 flags;
4359         int status;
4360
4361         bt_dev_dbg(hdev, "sock %p", sk);
4362
4363         /* Enough space for 7 features */
4364         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4365         rp = kzalloc(len, GFP_KERNEL);
4366         if (!rp)
4367                 return -ENOMEM;
4368
4369 #ifdef CONFIG_BT_FEATURE_DEBUG
4370         if (!hdev) {
4371                 flags = bt_dbg_get() ? BIT(0) : 0;
4372
4373                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4374                 rp->features[idx].flags = cpu_to_le32(flags);
4375                 idx++;
4376         }
4377 #endif
4378
4379         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4380                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4381                         flags = BIT(0);
4382                 else
4383                         flags = 0;
4384
4385                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4386                 rp->features[idx].flags = cpu_to_le32(flags);
4387                 idx++;
4388         }
4389
4390         if (hdev && ll_privacy_capable(hdev)) {
4391                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4392                         flags = BIT(0) | BIT(1);
4393                 else
4394                         flags = BIT(1);
4395
4396                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4397                 rp->features[idx].flags = cpu_to_le32(flags);
4398                 idx++;
4399         }
4400
4401         if (hdev && (aosp_has_quality_report(hdev) ||
4402                      hdev->set_quality_report)) {
4403                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4404                         flags = BIT(0);
4405                 else
4406                         flags = 0;
4407
4408                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4409                 rp->features[idx].flags = cpu_to_le32(flags);
4410                 idx++;
4411         }
4412
4413         if (hdev && hdev->get_data_path_id) {
4414                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4415                         flags = BIT(0);
4416                 else
4417                         flags = 0;
4418
4419                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4420                 rp->features[idx].flags = cpu_to_le32(flags);
4421                 idx++;
4422         }
4423
4424         if (IS_ENABLED(CONFIG_BT_LE)) {
4425                 flags = iso_enabled() ? BIT(0) : 0;
4426                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4427                 rp->features[idx].flags = cpu_to_le32(flags);
4428                 idx++;
4429         }
4430
4431         if (hdev && lmp_le_capable(hdev)) {
4432                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4433                         flags = BIT(0);
4434                 else
4435                         flags = 0;
4436
4437                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4438                 rp->features[idx].flags = cpu_to_le32(flags);
4439                 idx++;
4440         }
4441
4442         rp->feature_count = cpu_to_le16(idx);
4443
4444         /* After reading the experimental features information, enable
4445          * the events to update client on any future change.
4446          */
4447         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4448
4449         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4450                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4451                                    0, rp, sizeof(*rp) + (20 * idx));
4452
4453         kfree(rp);
4454         return status;
4455 }
4456
4457 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4458                                           struct sock *skip)
4459 {
4460         struct mgmt_ev_exp_feature_changed ev;
4461
4462         memset(&ev, 0, sizeof(ev));
4463         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4464         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4465
4466         // Do we need to be atomic with the conn_flags?
4467         if (enabled && privacy_mode_capable(hdev))
4468                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4469         else
4470                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4471
4472         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4473                                   &ev, sizeof(ev),
4474                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4475
4476 }
4477
4478 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4479                                bool enabled, struct sock *skip)
4480 {
4481         struct mgmt_ev_exp_feature_changed ev;
4482
4483         memset(&ev, 0, sizeof(ev));
4484         memcpy(ev.uuid, uuid, 16);
4485         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4486
4487         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4488                                   &ev, sizeof(ev),
4489                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4490 }
4491
4492 #define EXP_FEAT(_uuid, _set_func)      \
4493 {                                       \
4494         .uuid = _uuid,                  \
4495         .set_func = _set_func,          \
4496 }
4497
4498 /* The zero key uuid is special. Multiple exp features are set through it. */
4499 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4500                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4501 {
4502         struct mgmt_rp_set_exp_feature rp;
4503
4504         memset(rp.uuid, 0, 16);
4505         rp.flags = cpu_to_le32(0);
4506
4507 #ifdef CONFIG_BT_FEATURE_DEBUG
4508         if (!hdev) {
4509                 bool changed = bt_dbg_get();
4510
4511                 bt_dbg_set(false);
4512
4513                 if (changed)
4514                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4515         }
4516 #endif
4517
4518         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4519                 bool changed;
4520
4521                 changed = hci_dev_test_and_clear_flag(hdev,
4522                                                       HCI_ENABLE_LL_PRIVACY);
4523                 if (changed)
4524                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4525                                             sk);
4526         }
4527
4528         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4529
4530         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4531                                  MGMT_OP_SET_EXP_FEATURE, 0,
4532                                  &rp, sizeof(rp));
4533 }
4534
4535 #ifdef CONFIG_BT_FEATURE_DEBUG
4536 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4537                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4538 {
4539         struct mgmt_rp_set_exp_feature rp;
4540
4541         bool val, changed;
4542         int err;
4543
4544         /* Command requires to use the non-controller index */
4545         if (hdev)
4546                 return mgmt_cmd_status(sk, hdev->id,
4547                                        MGMT_OP_SET_EXP_FEATURE,
4548                                        MGMT_STATUS_INVALID_INDEX);
4549
4550         /* Parameters are limited to a single octet */
4551         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4552                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4553                                        MGMT_OP_SET_EXP_FEATURE,
4554                                        MGMT_STATUS_INVALID_PARAMS);
4555
4556         /* Only boolean on/off is supported */
4557         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4558                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4559                                        MGMT_OP_SET_EXP_FEATURE,
4560                                        MGMT_STATUS_INVALID_PARAMS);
4561
4562         val = !!cp->param[0];
4563         changed = val ? !bt_dbg_get() : bt_dbg_get();
4564         bt_dbg_set(val);
4565
4566         memcpy(rp.uuid, debug_uuid, 16);
4567         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4568
4569         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4570
4571         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4572                                 MGMT_OP_SET_EXP_FEATURE, 0,
4573                                 &rp, sizeof(rp));
4574
4575         if (changed)
4576                 exp_feature_changed(hdev, debug_uuid, val, sk);
4577
4578         return err;
4579 }
4580 #endif
4581
4582 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4583                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4584 {
4585         struct mgmt_rp_set_exp_feature rp;
4586         bool val, changed;
4587         int err;
4588
4589         /* Command requires to use the controller index */
4590         if (!hdev)
4591                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4592                                        MGMT_OP_SET_EXP_FEATURE,
4593                                        MGMT_STATUS_INVALID_INDEX);
4594
4595         /* Parameters are limited to a single octet */
4596         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4597                 return mgmt_cmd_status(sk, hdev->id,
4598                                        MGMT_OP_SET_EXP_FEATURE,
4599                                        MGMT_STATUS_INVALID_PARAMS);
4600
4601         /* Only boolean on/off is supported */
4602         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4603                 return mgmt_cmd_status(sk, hdev->id,
4604                                        MGMT_OP_SET_EXP_FEATURE,
4605                                        MGMT_STATUS_INVALID_PARAMS);
4606
4607         val = !!cp->param[0];
4608
4609         if (val) {
4610                 changed = !hci_dev_test_and_set_flag(hdev,
4611                                                      HCI_MESH_EXPERIMENTAL);
4612         } else {
4613                 hci_dev_clear_flag(hdev, HCI_MESH);
4614                 changed = hci_dev_test_and_clear_flag(hdev,
4615                                                       HCI_MESH_EXPERIMENTAL);
4616         }
4617
4618         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4619         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4620
4621         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4622
4623         err = mgmt_cmd_complete(sk, hdev->id,
4624                                 MGMT_OP_SET_EXP_FEATURE, 0,
4625                                 &rp, sizeof(rp));
4626
4627         if (changed)
4628                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4629
4630         return err;
4631 }
4632
4633 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4634                                    struct mgmt_cp_set_exp_feature *cp,
4635                                    u16 data_len)
4636 {
4637         struct mgmt_rp_set_exp_feature rp;
4638         bool val, changed;
4639         int err;
4640         u32 flags;
4641
4642         /* Command requires to use the controller index */
4643         if (!hdev)
4644                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4645                                        MGMT_OP_SET_EXP_FEATURE,
4646                                        MGMT_STATUS_INVALID_INDEX);
4647
4648         /* Changes can only be made when controller is powered down */
4649         if (hdev_is_powered(hdev))
4650                 return mgmt_cmd_status(sk, hdev->id,
4651                                        MGMT_OP_SET_EXP_FEATURE,
4652                                        MGMT_STATUS_REJECTED);
4653
4654         /* Parameters are limited to a single octet */
4655         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4656                 return mgmt_cmd_status(sk, hdev->id,
4657                                        MGMT_OP_SET_EXP_FEATURE,
4658                                        MGMT_STATUS_INVALID_PARAMS);
4659
4660         /* Only boolean on/off is supported */
4661         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4662                 return mgmt_cmd_status(sk, hdev->id,
4663                                        MGMT_OP_SET_EXP_FEATURE,
4664                                        MGMT_STATUS_INVALID_PARAMS);
4665
4666         val = !!cp->param[0];
4667
4668         if (val) {
4669                 changed = !hci_dev_test_and_set_flag(hdev,
4670                                                      HCI_ENABLE_LL_PRIVACY);
4671                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4672
4673                 /* Enable LL privacy + supported settings changed */
4674                 flags = BIT(0) | BIT(1);
4675         } else {
4676                 changed = hci_dev_test_and_clear_flag(hdev,
4677                                                       HCI_ENABLE_LL_PRIVACY);
4678
4679                 /* Disable LL privacy + supported settings changed */
4680                 flags = BIT(1);
4681         }
4682
4683         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4684         rp.flags = cpu_to_le32(flags);
4685
4686         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4687
4688         err = mgmt_cmd_complete(sk, hdev->id,
4689                                 MGMT_OP_SET_EXP_FEATURE, 0,
4690                                 &rp, sizeof(rp));
4691
4692         if (changed)
4693                 exp_ll_privacy_feature_changed(val, hdev, sk);
4694
4695         return err;
4696 }
4697
4698 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4699                                    struct mgmt_cp_set_exp_feature *cp,
4700                                    u16 data_len)
4701 {
4702         struct mgmt_rp_set_exp_feature rp;
4703         bool val, changed;
4704         int err;
4705
4706         /* Command requires to use a valid controller index */
4707         if (!hdev)
4708                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4709                                        MGMT_OP_SET_EXP_FEATURE,
4710                                        MGMT_STATUS_INVALID_INDEX);
4711
4712         /* Parameters are limited to a single octet */
4713         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4714                 return mgmt_cmd_status(sk, hdev->id,
4715                                        MGMT_OP_SET_EXP_FEATURE,
4716                                        MGMT_STATUS_INVALID_PARAMS);
4717
4718         /* Only boolean on/off is supported */
4719         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4720                 return mgmt_cmd_status(sk, hdev->id,
4721                                        MGMT_OP_SET_EXP_FEATURE,
4722                                        MGMT_STATUS_INVALID_PARAMS);
4723
4724         hci_req_sync_lock(hdev);
4725
4726         val = !!cp->param[0];
4727         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4728
4729         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4730                 err = mgmt_cmd_status(sk, hdev->id,
4731                                       MGMT_OP_SET_EXP_FEATURE,
4732                                       MGMT_STATUS_NOT_SUPPORTED);
4733                 goto unlock_quality_report;
4734         }
4735
4736         if (changed) {
4737                 if (hdev->set_quality_report)
4738                         err = hdev->set_quality_report(hdev, val);
4739                 else
4740                         err = aosp_set_quality_report(hdev, val);
4741
4742                 if (err) {
4743                         err = mgmt_cmd_status(sk, hdev->id,
4744                                               MGMT_OP_SET_EXP_FEATURE,
4745                                               MGMT_STATUS_FAILED);
4746                         goto unlock_quality_report;
4747                 }
4748
4749                 if (val)
4750                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4751                 else
4752                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4753         }
4754
4755         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4756
4757         memcpy(rp.uuid, quality_report_uuid, 16);
4758         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4759         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4760
4761         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4762                                 &rp, sizeof(rp));
4763
4764         if (changed)
4765                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4766
4767 unlock_quality_report:
4768         hci_req_sync_unlock(hdev);
4769         return err;
4770 }
4771
4772 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4773                                   struct mgmt_cp_set_exp_feature *cp,
4774                                   u16 data_len)
4775 {
4776         bool val, changed;
4777         int err;
4778         struct mgmt_rp_set_exp_feature rp;
4779
4780         /* Command requires to use a valid controller index */
4781         if (!hdev)
4782                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4783                                        MGMT_OP_SET_EXP_FEATURE,
4784                                        MGMT_STATUS_INVALID_INDEX);
4785
4786         /* Parameters are limited to a single octet */
4787         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4788                 return mgmt_cmd_status(sk, hdev->id,
4789                                        MGMT_OP_SET_EXP_FEATURE,
4790                                        MGMT_STATUS_INVALID_PARAMS);
4791
4792         /* Only boolean on/off is supported */
4793         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4794                 return mgmt_cmd_status(sk, hdev->id,
4795                                        MGMT_OP_SET_EXP_FEATURE,
4796                                        MGMT_STATUS_INVALID_PARAMS);
4797
4798         val = !!cp->param[0];
4799         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4800
4801         if (!hdev->get_data_path_id) {
4802                 return mgmt_cmd_status(sk, hdev->id,
4803                                        MGMT_OP_SET_EXP_FEATURE,
4804                                        MGMT_STATUS_NOT_SUPPORTED);
4805         }
4806
4807         if (changed) {
4808                 if (val)
4809                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4810                 else
4811                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4812         }
4813
4814         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4815                     val, changed);
4816
4817         memcpy(rp.uuid, offload_codecs_uuid, 16);
4818         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4819         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4820         err = mgmt_cmd_complete(sk, hdev->id,
4821                                 MGMT_OP_SET_EXP_FEATURE, 0,
4822                                 &rp, sizeof(rp));
4823
4824         if (changed)
4825                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4826
4827         return err;
4828 }
4829
4830 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4831                                           struct mgmt_cp_set_exp_feature *cp,
4832                                           u16 data_len)
4833 {
4834         bool val, changed;
4835         int err;
4836         struct mgmt_rp_set_exp_feature rp;
4837
4838         /* Command requires to use a valid controller index */
4839         if (!hdev)
4840                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4841                                        MGMT_OP_SET_EXP_FEATURE,
4842                                        MGMT_STATUS_INVALID_INDEX);
4843
4844         /* Parameters are limited to a single octet */
4845         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4846                 return mgmt_cmd_status(sk, hdev->id,
4847                                        MGMT_OP_SET_EXP_FEATURE,
4848                                        MGMT_STATUS_INVALID_PARAMS);
4849
4850         /* Only boolean on/off is supported */
4851         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4852                 return mgmt_cmd_status(sk, hdev->id,
4853                                        MGMT_OP_SET_EXP_FEATURE,
4854                                        MGMT_STATUS_INVALID_PARAMS);
4855
4856         val = !!cp->param[0];
4857         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4858
4859         if (!hci_dev_le_state_simultaneous(hdev)) {
4860                 return mgmt_cmd_status(sk, hdev->id,
4861                                        MGMT_OP_SET_EXP_FEATURE,
4862                                        MGMT_STATUS_NOT_SUPPORTED);
4863         }
4864
4865         if (changed) {
4866                 if (val)
4867                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4868                 else
4869                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4870         }
4871
4872         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4873                     val, changed);
4874
4875         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4876         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4877         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4878         err = mgmt_cmd_complete(sk, hdev->id,
4879                                 MGMT_OP_SET_EXP_FEATURE, 0,
4880                                 &rp, sizeof(rp));
4881
4882         if (changed)
4883                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4884
4885         return err;
4886 }
4887
4888 #ifdef CONFIG_BT_LE
4889 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4890                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4891 {
4892         struct mgmt_rp_set_exp_feature rp;
4893         bool val, changed = false;
4894         int err;
4895
4896         /* Command requires to use the non-controller index */
4897         if (hdev)
4898                 return mgmt_cmd_status(sk, hdev->id,
4899                                        MGMT_OP_SET_EXP_FEATURE,
4900                                        MGMT_STATUS_INVALID_INDEX);
4901
4902         /* Parameters are limited to a single octet */
4903         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4904                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4905                                        MGMT_OP_SET_EXP_FEATURE,
4906                                        MGMT_STATUS_INVALID_PARAMS);
4907
4908         /* Only boolean on/off is supported */
4909         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4910                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4911                                        MGMT_OP_SET_EXP_FEATURE,
4912                                        MGMT_STATUS_INVALID_PARAMS);
4913
4914         val = cp->param[0] ? true : false;
4915         if (val)
4916                 err = iso_init();
4917         else
4918                 err = iso_exit();
4919
4920         if (!err)
4921                 changed = true;
4922
4923         memcpy(rp.uuid, iso_socket_uuid, 16);
4924         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4925
4926         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4927
4928         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4929                                 MGMT_OP_SET_EXP_FEATURE, 0,
4930                                 &rp, sizeof(rp));
4931
4932         if (changed)
4933                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4934
4935         return err;
4936 }
4937 #endif
4938
4939 static const struct mgmt_exp_feature {
4940         const u8 *uuid;
4941         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4942                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4943 } exp_features[] = {
4944         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4945 #ifdef CONFIG_BT_FEATURE_DEBUG
4946         EXP_FEAT(debug_uuid, set_debug_func),
4947 #endif
4948         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4949         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4950         EXP_FEAT(quality_report_uuid, set_quality_report_func),
4951         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4952         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4953 #ifdef CONFIG_BT_LE
4954         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
4955 #endif
4956
4957         /* end with a null feature */
4958         EXP_FEAT(NULL, NULL)
4959 };
4960
4961 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4962                            void *data, u16 data_len)
4963 {
4964         struct mgmt_cp_set_exp_feature *cp = data;
4965         size_t i = 0;
4966
4967         bt_dev_dbg(hdev, "sock %p", sk);
4968
4969         for (i = 0; exp_features[i].uuid; i++) {
4970                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4971                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4972         }
4973
4974         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4975                                MGMT_OP_SET_EXP_FEATURE,
4976                                MGMT_STATUS_NOT_SUPPORTED);
4977 }
4978
4979 static u32 get_params_flags(struct hci_dev *hdev,
4980                             struct hci_conn_params *params)
4981 {
4982         u32 flags = hdev->conn_flags;
4983
4984         /* Devices using RPAs can only be programmed in the acceptlist if
4985          * LL Privacy has been enable otherwise they cannot mark
4986          * HCI_CONN_FLAG_REMOTE_WAKEUP.
4987          */
4988         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
4989             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
4990                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
4991
4992         return flags;
4993 }
4994
4995 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4996                             u16 data_len)
4997 {
4998         struct mgmt_cp_get_device_flags *cp = data;
4999         struct mgmt_rp_get_device_flags rp;
5000         struct bdaddr_list_with_flags *br_params;
5001         struct hci_conn_params *params;
5002         u32 supported_flags;
5003         u32 current_flags = 0;
5004         u8 status = MGMT_STATUS_INVALID_PARAMS;
5005
5006         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5007                    &cp->addr.bdaddr, cp->addr.type);
5008
5009         hci_dev_lock(hdev);
5010
5011         supported_flags = hdev->conn_flags;
5012
5013         memset(&rp, 0, sizeof(rp));
5014
5015         if (cp->addr.type == BDADDR_BREDR) {
5016                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5017                                                               &cp->addr.bdaddr,
5018                                                               cp->addr.type);
5019                 if (!br_params)
5020                         goto done;
5021
5022                 current_flags = br_params->flags;
5023         } else {
5024                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5025                                                 le_addr_type(cp->addr.type));
5026                 if (!params)
5027                         goto done;
5028
5029                 supported_flags = get_params_flags(hdev, params);
5030                 current_flags = params->flags;
5031         }
5032
5033         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5034         rp.addr.type = cp->addr.type;
5035         rp.supported_flags = cpu_to_le32(supported_flags);
5036         rp.current_flags = cpu_to_le32(current_flags);
5037
5038         status = MGMT_STATUS_SUCCESS;
5039
5040 done:
5041         hci_dev_unlock(hdev);
5042
5043         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5044                                 &rp, sizeof(rp));
5045 }
5046
5047 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5048                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5049                                  u32 supported_flags, u32 current_flags)
5050 {
5051         struct mgmt_ev_device_flags_changed ev;
5052
5053         bacpy(&ev.addr.bdaddr, bdaddr);
5054         ev.addr.type = bdaddr_type;
5055         ev.supported_flags = cpu_to_le32(supported_flags);
5056         ev.current_flags = cpu_to_le32(current_flags);
5057
5058         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5059 }
5060
5061 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5062                             u16 len)
5063 {
5064         struct mgmt_cp_set_device_flags *cp = data;
5065         struct bdaddr_list_with_flags *br_params;
5066         struct hci_conn_params *params;
5067         u8 status = MGMT_STATUS_INVALID_PARAMS;
5068         u32 supported_flags;
5069         u32 current_flags = __le32_to_cpu(cp->current_flags);
5070
5071         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5072                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5073
5074         // We should take hci_dev_lock() early, I think.. conn_flags can change
5075         supported_flags = hdev->conn_flags;
5076
5077         if ((supported_flags | current_flags) != supported_flags) {
5078                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5079                             current_flags, supported_flags);
5080                 goto done;
5081         }
5082
5083         hci_dev_lock(hdev);
5084
5085         if (cp->addr.type == BDADDR_BREDR) {
5086                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5087                                                               &cp->addr.bdaddr,
5088                                                               cp->addr.type);
5089
5090                 if (br_params) {
5091                         br_params->flags = current_flags;
5092                         status = MGMT_STATUS_SUCCESS;
5093                 } else {
5094                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5095                                     &cp->addr.bdaddr, cp->addr.type);
5096                 }
5097
5098                 goto unlock;
5099         }
5100
5101         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5102                                         le_addr_type(cp->addr.type));
5103         if (!params) {
5104                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5105                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5106                 goto unlock;
5107         }
5108
5109         supported_flags = get_params_flags(hdev, params);
5110
5111         if ((supported_flags | current_flags) != supported_flags) {
5112                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5113                             current_flags, supported_flags);
5114                 goto unlock;
5115         }
5116
5117         WRITE_ONCE(params->flags, current_flags);
5118         status = MGMT_STATUS_SUCCESS;
5119
5120         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5121          * has been set.
5122          */
5123         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5124                 hci_update_passive_scan(hdev);
5125
5126 unlock:
5127         hci_dev_unlock(hdev);
5128
5129 done:
5130         if (status == MGMT_STATUS_SUCCESS)
5131                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5132                                      supported_flags, current_flags);
5133
5134         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5135                                  &cp->addr, sizeof(cp->addr));
5136 }
5137
5138 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5139                                    u16 handle)
5140 {
5141         struct mgmt_ev_adv_monitor_added ev;
5142
5143         ev.monitor_handle = cpu_to_le16(handle);
5144
5145         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5146 }
5147
5148 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5149 {
5150         struct mgmt_ev_adv_monitor_removed ev;
5151         struct mgmt_pending_cmd *cmd;
5152         struct sock *sk_skip = NULL;
5153         struct mgmt_cp_remove_adv_monitor *cp;
5154
5155         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5156         if (cmd) {
5157                 cp = cmd->param;
5158
5159                 if (cp->monitor_handle)
5160                         sk_skip = cmd->sk;
5161         }
5162
5163         ev.monitor_handle = cpu_to_le16(handle);
5164
5165         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5166 }
5167
5168 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5169                                  void *data, u16 len)
5170 {
5171         struct adv_monitor *monitor = NULL;
5172         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5173         int handle, err;
5174         size_t rp_size = 0;
5175         __u32 supported = 0;
5176         __u32 enabled = 0;
5177         __u16 num_handles = 0;
5178         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5179
5180         BT_DBG("request for %s", hdev->name);
5181
5182         hci_dev_lock(hdev);
5183
5184         if (msft_monitor_supported(hdev))
5185                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5186
5187         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5188                 handles[num_handles++] = monitor->handle;
5189
5190         hci_dev_unlock(hdev);
5191
5192         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5193         rp = kmalloc(rp_size, GFP_KERNEL);
5194         if (!rp)
5195                 return -ENOMEM;
5196
5197         /* All supported features are currently enabled */
5198         enabled = supported;
5199
5200         rp->supported_features = cpu_to_le32(supported);
5201         rp->enabled_features = cpu_to_le32(enabled);
5202         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5203         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5204         rp->num_handles = cpu_to_le16(num_handles);
5205         if (num_handles)
5206                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5207
5208         err = mgmt_cmd_complete(sk, hdev->id,
5209                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5210                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5211
5212         kfree(rp);
5213
5214         return err;
5215 }
5216
5217 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5218                                                    void *data, int status)
5219 {
5220         struct mgmt_rp_add_adv_patterns_monitor rp;
5221         struct mgmt_pending_cmd *cmd = data;
5222         struct adv_monitor *monitor = cmd->user_data;
5223
5224         hci_dev_lock(hdev);
5225
5226         rp.monitor_handle = cpu_to_le16(monitor->handle);
5227
5228         if (!status) {
5229                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5230                 hdev->adv_monitors_cnt++;
5231                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5232                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5233                 hci_update_passive_scan(hdev);
5234         }
5235
5236         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5237                           mgmt_status(status), &rp, sizeof(rp));
5238         mgmt_pending_remove(cmd);
5239
5240         hci_dev_unlock(hdev);
5241         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5242                    rp.monitor_handle, status);
5243 }
5244
5245 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5246 {
5247         struct mgmt_pending_cmd *cmd = data;
5248         struct adv_monitor *monitor = cmd->user_data;
5249
5250         return hci_add_adv_monitor(hdev, monitor);
5251 }
5252
5253 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5254                                       struct adv_monitor *m, u8 status,
5255                                       void *data, u16 len, u16 op)
5256 {
5257         struct mgmt_pending_cmd *cmd;
5258         int err;
5259
5260         hci_dev_lock(hdev);
5261
5262         if (status)
5263                 goto unlock;
5264
5265         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5266             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5267             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5268             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5269                 status = MGMT_STATUS_BUSY;
5270                 goto unlock;
5271         }
5272
5273         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5274         if (!cmd) {
5275                 status = MGMT_STATUS_NO_RESOURCES;
5276                 goto unlock;
5277         }
5278
5279         cmd->user_data = m;
5280         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5281                                  mgmt_add_adv_patterns_monitor_complete);
5282         if (err) {
5283                 if (err == -ENOMEM)
5284                         status = MGMT_STATUS_NO_RESOURCES;
5285                 else
5286                         status = MGMT_STATUS_FAILED;
5287
5288                 goto unlock;
5289         }
5290
5291         hci_dev_unlock(hdev);
5292
5293         return 0;
5294
5295 unlock:
5296         hci_free_adv_monitor(hdev, m);
5297         hci_dev_unlock(hdev);
5298         return mgmt_cmd_status(sk, hdev->id, op, status);
5299 }
5300
5301 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5302                                    struct mgmt_adv_rssi_thresholds *rssi)
5303 {
5304         if (rssi) {
5305                 m->rssi.low_threshold = rssi->low_threshold;
5306                 m->rssi.low_threshold_timeout =
5307                     __le16_to_cpu(rssi->low_threshold_timeout);
5308                 m->rssi.high_threshold = rssi->high_threshold;
5309                 m->rssi.high_threshold_timeout =
5310                     __le16_to_cpu(rssi->high_threshold_timeout);
5311                 m->rssi.sampling_period = rssi->sampling_period;
5312         } else {
5313                 /* Default values. These numbers are the least constricting
5314                  * parameters for MSFT API to work, so it behaves as if there
5315                  * are no rssi parameter to consider. May need to be changed
5316                  * if other API are to be supported.
5317                  */
5318                 m->rssi.low_threshold = -127;
5319                 m->rssi.low_threshold_timeout = 60;
5320                 m->rssi.high_threshold = -127;
5321                 m->rssi.high_threshold_timeout = 0;
5322                 m->rssi.sampling_period = 0;
5323         }
5324 }
5325
5326 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5327                                     struct mgmt_adv_pattern *patterns)
5328 {
5329         u8 offset = 0, length = 0;
5330         struct adv_pattern *p = NULL;
5331         int i;
5332
5333         for (i = 0; i < pattern_count; i++) {
5334                 offset = patterns[i].offset;
5335                 length = patterns[i].length;
5336                 if (offset >= HCI_MAX_EXT_AD_LENGTH ||
5337                     length > HCI_MAX_EXT_AD_LENGTH ||
5338                     (offset + length) > HCI_MAX_EXT_AD_LENGTH)
5339                         return MGMT_STATUS_INVALID_PARAMS;
5340
5341                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5342                 if (!p)
5343                         return MGMT_STATUS_NO_RESOURCES;
5344
5345                 p->ad_type = patterns[i].ad_type;
5346                 p->offset = patterns[i].offset;
5347                 p->length = patterns[i].length;
5348                 memcpy(p->value, patterns[i].value, p->length);
5349
5350                 INIT_LIST_HEAD(&p->list);
5351                 list_add(&p->list, &m->patterns);
5352         }
5353
5354         return MGMT_STATUS_SUCCESS;
5355 }
5356
5357 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5358                                     void *data, u16 len)
5359 {
5360         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5361         struct adv_monitor *m = NULL;
5362         u8 status = MGMT_STATUS_SUCCESS;
5363         size_t expected_size = sizeof(*cp);
5364
5365         BT_DBG("request for %s", hdev->name);
5366
5367         if (len <= sizeof(*cp)) {
5368                 status = MGMT_STATUS_INVALID_PARAMS;
5369                 goto done;
5370         }
5371
5372         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5373         if (len != expected_size) {
5374                 status = MGMT_STATUS_INVALID_PARAMS;
5375                 goto done;
5376         }
5377
5378         m = kzalloc(sizeof(*m), GFP_KERNEL);
5379         if (!m) {
5380                 status = MGMT_STATUS_NO_RESOURCES;
5381                 goto done;
5382         }
5383
5384         INIT_LIST_HEAD(&m->patterns);
5385
5386         parse_adv_monitor_rssi(m, NULL);
5387         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5388
5389 done:
5390         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5391                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5392 }
5393
5394 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5395                                          void *data, u16 len)
5396 {
5397         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5398         struct adv_monitor *m = NULL;
5399         u8 status = MGMT_STATUS_SUCCESS;
5400         size_t expected_size = sizeof(*cp);
5401
5402         BT_DBG("request for %s", hdev->name);
5403
5404         if (len <= sizeof(*cp)) {
5405                 status = MGMT_STATUS_INVALID_PARAMS;
5406                 goto done;
5407         }
5408
5409         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5410         if (len != expected_size) {
5411                 status = MGMT_STATUS_INVALID_PARAMS;
5412                 goto done;
5413         }
5414
5415         m = kzalloc(sizeof(*m), GFP_KERNEL);
5416         if (!m) {
5417                 status = MGMT_STATUS_NO_RESOURCES;
5418                 goto done;
5419         }
5420
5421         INIT_LIST_HEAD(&m->patterns);
5422
5423         parse_adv_monitor_rssi(m, &cp->rssi);
5424         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5425
5426 done:
5427         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5428                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5429 }
5430
5431 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5432                                              void *data, int status)
5433 {
5434         struct mgmt_rp_remove_adv_monitor rp;
5435         struct mgmt_pending_cmd *cmd = data;
5436         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5437
5438         hci_dev_lock(hdev);
5439
5440         rp.monitor_handle = cp->monitor_handle;
5441
5442         if (!status)
5443                 hci_update_passive_scan(hdev);
5444
5445         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5446                           mgmt_status(status), &rp, sizeof(rp));
5447         mgmt_pending_remove(cmd);
5448
5449         hci_dev_unlock(hdev);
5450         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5451                    rp.monitor_handle, status);
5452 }
5453
5454 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5455 {
5456         struct mgmt_pending_cmd *cmd = data;
5457         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5458         u16 handle = __le16_to_cpu(cp->monitor_handle);
5459
5460         if (!handle)
5461                 return hci_remove_all_adv_monitor(hdev);
5462
5463         return hci_remove_single_adv_monitor(hdev, handle);
5464 }
5465
5466 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5467                               void *data, u16 len)
5468 {
5469         struct mgmt_pending_cmd *cmd;
5470         int err, status;
5471
5472         hci_dev_lock(hdev);
5473
5474         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5475             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5476             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5477             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5478                 status = MGMT_STATUS_BUSY;
5479                 goto unlock;
5480         }
5481
5482         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5483         if (!cmd) {
5484                 status = MGMT_STATUS_NO_RESOURCES;
5485                 goto unlock;
5486         }
5487
5488         err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
5489                                   mgmt_remove_adv_monitor_complete);
5490
5491         if (err) {
5492                 mgmt_pending_remove(cmd);
5493
5494                 if (err == -ENOMEM)
5495                         status = MGMT_STATUS_NO_RESOURCES;
5496                 else
5497                         status = MGMT_STATUS_FAILED;
5498
5499                 goto unlock;
5500         }
5501
5502         hci_dev_unlock(hdev);
5503
5504         return 0;
5505
5506 unlock:
5507         hci_dev_unlock(hdev);
5508         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5509                                status);
5510 }
5511
5512 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5513 {
5514         struct mgmt_rp_read_local_oob_data mgmt_rp;
5515         size_t rp_size = sizeof(mgmt_rp);
5516         struct mgmt_pending_cmd *cmd = data;
5517         struct sk_buff *skb = cmd->skb;
5518         u8 status = mgmt_status(err);
5519
5520         if (!status) {
5521                 if (!skb)
5522                         status = MGMT_STATUS_FAILED;
5523                 else if (IS_ERR(skb))
5524                         status = mgmt_status(PTR_ERR(skb));
5525                 else
5526                         status = mgmt_status(skb->data[0]);
5527         }
5528
5529         bt_dev_dbg(hdev, "status %d", status);
5530
5531         if (status) {
5532                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5533                 goto remove;
5534         }
5535
5536         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5537
5538         if (!bredr_sc_enabled(hdev)) {
5539                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5540
5541                 if (skb->len < sizeof(*rp)) {
5542                         mgmt_cmd_status(cmd->sk, hdev->id,
5543                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5544                                         MGMT_STATUS_FAILED);
5545                         goto remove;
5546                 }
5547
5548                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5549                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5550
5551                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5552         } else {
5553                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5554
5555                 if (skb->len < sizeof(*rp)) {
5556                         mgmt_cmd_status(cmd->sk, hdev->id,
5557                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5558                                         MGMT_STATUS_FAILED);
5559                         goto remove;
5560                 }
5561
5562                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5563                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5564
5565                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5566                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5567         }
5568
5569         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5570                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5571
5572 remove:
5573         if (skb && !IS_ERR(skb))
5574                 kfree_skb(skb);
5575
5576         mgmt_pending_free(cmd);
5577 }
5578
5579 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5580 {
5581         struct mgmt_pending_cmd *cmd = data;
5582
5583         if (bredr_sc_enabled(hdev))
5584                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5585         else
5586                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5587
5588         if (IS_ERR(cmd->skb))
5589                 return PTR_ERR(cmd->skb);
5590         else
5591                 return 0;
5592 }
5593
5594 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5595                                void *data, u16 data_len)
5596 {
5597         struct mgmt_pending_cmd *cmd;
5598         int err;
5599
5600         bt_dev_dbg(hdev, "sock %p", sk);
5601
5602         hci_dev_lock(hdev);
5603
5604         if (!hdev_is_powered(hdev)) {
5605                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5606                                       MGMT_STATUS_NOT_POWERED);
5607                 goto unlock;
5608         }
5609
5610         if (!lmp_ssp_capable(hdev)) {
5611                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5612                                       MGMT_STATUS_NOT_SUPPORTED);
5613                 goto unlock;
5614         }
5615
5616         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5617         if (!cmd)
5618                 err = -ENOMEM;
5619         else
5620                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5621                                          read_local_oob_data_complete);
5622
5623         if (err < 0) {
5624                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5625                                       MGMT_STATUS_FAILED);
5626
5627                 if (cmd)
5628                         mgmt_pending_free(cmd);
5629         }
5630
5631 unlock:
5632         hci_dev_unlock(hdev);
5633         return err;
5634 }
5635
5636 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5637                                void *data, u16 len)
5638 {
5639         struct mgmt_addr_info *addr = data;
5640         int err;
5641
5642         bt_dev_dbg(hdev, "sock %p", sk);
5643
5644         if (!bdaddr_type_is_valid(addr->type))
5645                 return mgmt_cmd_complete(sk, hdev->id,
5646                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5647                                          MGMT_STATUS_INVALID_PARAMS,
5648                                          addr, sizeof(*addr));
5649
5650         hci_dev_lock(hdev);
5651
5652         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5653                 struct mgmt_cp_add_remote_oob_data *cp = data;
5654                 u8 status;
5655
5656                 if (cp->addr.type != BDADDR_BREDR) {
5657                         err = mgmt_cmd_complete(sk, hdev->id,
5658                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5659                                                 MGMT_STATUS_INVALID_PARAMS,
5660                                                 &cp->addr, sizeof(cp->addr));
5661                         goto unlock;
5662                 }
5663
5664                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5665                                               cp->addr.type, cp->hash,
5666                                               cp->rand, NULL, NULL);
5667                 if (err < 0)
5668                         status = MGMT_STATUS_FAILED;
5669                 else
5670                         status = MGMT_STATUS_SUCCESS;
5671
5672                 err = mgmt_cmd_complete(sk, hdev->id,
5673                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5674                                         &cp->addr, sizeof(cp->addr));
5675         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5676                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5677                 u8 *rand192, *hash192, *rand256, *hash256;
5678                 u8 status;
5679
5680                 if (bdaddr_type_is_le(cp->addr.type)) {
5681                         /* Enforce zero-valued 192-bit parameters as
5682                          * long as legacy SMP OOB isn't implemented.
5683                          */
5684                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5685                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5686                                 err = mgmt_cmd_complete(sk, hdev->id,
5687                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5688                                                         MGMT_STATUS_INVALID_PARAMS,
5689                                                         addr, sizeof(*addr));
5690                                 goto unlock;
5691                         }
5692
5693                         rand192 = NULL;
5694                         hash192 = NULL;
5695                 } else {
5696                         /* In case one of the P-192 values is set to zero,
5697                          * then just disable OOB data for P-192.
5698                          */
5699                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5700                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5701                                 rand192 = NULL;
5702                                 hash192 = NULL;
5703                         } else {
5704                                 rand192 = cp->rand192;
5705                                 hash192 = cp->hash192;
5706                         }
5707                 }
5708
5709                 /* In case one of the P-256 values is set to zero, then just
5710                  * disable OOB data for P-256.
5711                  */
5712                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5713                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5714                         rand256 = NULL;
5715                         hash256 = NULL;
5716                 } else {
5717                         rand256 = cp->rand256;
5718                         hash256 = cp->hash256;
5719                 }
5720
5721                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5722                                               cp->addr.type, hash192, rand192,
5723                                               hash256, rand256);
5724                 if (err < 0)
5725                         status = MGMT_STATUS_FAILED;
5726                 else
5727                         status = MGMT_STATUS_SUCCESS;
5728
5729                 err = mgmt_cmd_complete(sk, hdev->id,
5730                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5731                                         status, &cp->addr, sizeof(cp->addr));
5732         } else {
5733                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5734                            len);
5735                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5736                                       MGMT_STATUS_INVALID_PARAMS);
5737         }
5738
5739 unlock:
5740         hci_dev_unlock(hdev);
5741         return err;
5742 }
5743
5744 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5745                                   void *data, u16 len)
5746 {
5747         struct mgmt_cp_remove_remote_oob_data *cp = data;
5748         u8 status;
5749         int err;
5750
5751         bt_dev_dbg(hdev, "sock %p", sk);
5752
5753         if (cp->addr.type != BDADDR_BREDR)
5754                 return mgmt_cmd_complete(sk, hdev->id,
5755                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5756                                          MGMT_STATUS_INVALID_PARAMS,
5757                                          &cp->addr, sizeof(cp->addr));
5758
5759         hci_dev_lock(hdev);
5760
5761         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5762                 hci_remote_oob_data_clear(hdev);
5763                 status = MGMT_STATUS_SUCCESS;
5764                 goto done;
5765         }
5766
5767         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5768         if (err < 0)
5769                 status = MGMT_STATUS_INVALID_PARAMS;
5770         else
5771                 status = MGMT_STATUS_SUCCESS;
5772
5773 done:
5774         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5775                                 status, &cp->addr, sizeof(cp->addr));
5776
5777         hci_dev_unlock(hdev);
5778         return err;
5779 }
5780
5781 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5782 {
5783         struct mgmt_pending_cmd *cmd;
5784
5785         bt_dev_dbg(hdev, "status %u", status);
5786
5787         hci_dev_lock(hdev);
5788
5789         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5790         if (!cmd)
5791                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5792
5793         if (!cmd)
5794                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5795
5796         if (cmd) {
5797                 cmd->cmd_complete(cmd, mgmt_status(status));
5798                 mgmt_pending_remove(cmd);
5799         }
5800
5801         hci_dev_unlock(hdev);
5802 }
5803
5804 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5805                                     uint8_t *mgmt_status)
5806 {
5807         switch (type) {
5808         case DISCOV_TYPE_LE:
5809                 *mgmt_status = mgmt_le_support(hdev);
5810                 if (*mgmt_status)
5811                         return false;
5812                 break;
5813         case DISCOV_TYPE_INTERLEAVED:
5814                 *mgmt_status = mgmt_le_support(hdev);
5815                 if (*mgmt_status)
5816                         return false;
5817                 fallthrough;
5818         case DISCOV_TYPE_BREDR:
5819                 *mgmt_status = mgmt_bredr_support(hdev);
5820                 if (*mgmt_status)
5821                         return false;
5822                 break;
5823         default:
5824                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5825                 return false;
5826         }
5827
5828         return true;
5829 }
5830
5831 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5832 {
5833         struct mgmt_pending_cmd *cmd = data;
5834
5835         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5836             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5837             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5838                 return;
5839
5840         bt_dev_dbg(hdev, "err %d", err);
5841
5842         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5843                           cmd->param, 1);
5844         mgmt_pending_remove(cmd);
5845
5846         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5847                                 DISCOVERY_FINDING);
5848 }
5849
5850 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5851 {
5852         return hci_start_discovery_sync(hdev);
5853 }
5854
5855 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5856                                     u16 op, void *data, u16 len)
5857 {
5858         struct mgmt_cp_start_discovery *cp = data;
5859         struct mgmt_pending_cmd *cmd;
5860         u8 status;
5861         int err;
5862
5863         bt_dev_dbg(hdev, "sock %p", sk);
5864
5865         hci_dev_lock(hdev);
5866
5867         if (!hdev_is_powered(hdev)) {
5868                 err = mgmt_cmd_complete(sk, hdev->id, op,
5869                                         MGMT_STATUS_NOT_POWERED,
5870                                         &cp->type, sizeof(cp->type));
5871                 goto failed;
5872         }
5873
5874         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5875             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5876                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5877                                         &cp->type, sizeof(cp->type));
5878                 goto failed;
5879         }
5880
5881         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5882                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5883                                         &cp->type, sizeof(cp->type));
5884                 goto failed;
5885         }
5886
5887         /* Can't start discovery when it is paused */
5888         if (hdev->discovery_paused) {
5889                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5890                                         &cp->type, sizeof(cp->type));
5891                 goto failed;
5892         }
5893
5894         /* Clear the discovery filter first to free any previously
5895          * allocated memory for the UUID list.
5896          */
5897         hci_discovery_filter_clear(hdev);
5898
5899         hdev->discovery.type = cp->type;
5900         hdev->discovery.report_invalid_rssi = false;
5901         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5902                 hdev->discovery.limited = true;
5903         else
5904                 hdev->discovery.limited = false;
5905
5906         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5907         if (!cmd) {
5908                 err = -ENOMEM;
5909                 goto failed;
5910         }
5911
5912         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5913                                  start_discovery_complete);
5914         if (err < 0) {
5915                 mgmt_pending_remove(cmd);
5916                 goto failed;
5917         }
5918
5919         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5920
5921 failed:
5922         hci_dev_unlock(hdev);
5923         return err;
5924 }
5925
5926 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5927                            void *data, u16 len)
5928 {
5929         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5930                                         data, len);
5931 }
5932
5933 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5934                                    void *data, u16 len)
5935 {
5936         return start_discovery_internal(sk, hdev,
5937                                         MGMT_OP_START_LIMITED_DISCOVERY,
5938                                         data, len);
5939 }
5940
5941 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5942                                    void *data, u16 len)
5943 {
5944         struct mgmt_cp_start_service_discovery *cp = data;
5945         struct mgmt_pending_cmd *cmd;
5946         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5947         u16 uuid_count, expected_len;
5948         u8 status;
5949         int err;
5950
5951         bt_dev_dbg(hdev, "sock %p", sk);
5952
5953         hci_dev_lock(hdev);
5954
5955         if (!hdev_is_powered(hdev)) {
5956                 err = mgmt_cmd_complete(sk, hdev->id,
5957                                         MGMT_OP_START_SERVICE_DISCOVERY,
5958                                         MGMT_STATUS_NOT_POWERED,
5959                                         &cp->type, sizeof(cp->type));
5960                 goto failed;
5961         }
5962
5963         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5964             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5965                 err = mgmt_cmd_complete(sk, hdev->id,
5966                                         MGMT_OP_START_SERVICE_DISCOVERY,
5967                                         MGMT_STATUS_BUSY, &cp->type,
5968                                         sizeof(cp->type));
5969                 goto failed;
5970         }
5971
5972         if (hdev->discovery_paused) {
5973                 err = mgmt_cmd_complete(sk, hdev->id,
5974                                         MGMT_OP_START_SERVICE_DISCOVERY,
5975                                         MGMT_STATUS_BUSY, &cp->type,
5976                                         sizeof(cp->type));
5977                 goto failed;
5978         }
5979
5980         uuid_count = __le16_to_cpu(cp->uuid_count);
5981         if (uuid_count > max_uuid_count) {
5982                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5983                            uuid_count);
5984                 err = mgmt_cmd_complete(sk, hdev->id,
5985                                         MGMT_OP_START_SERVICE_DISCOVERY,
5986                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5987                                         sizeof(cp->type));
5988                 goto failed;
5989         }
5990
5991         expected_len = sizeof(*cp) + uuid_count * 16;
5992         if (expected_len != len) {
5993                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5994                            expected_len, len);
5995                 err = mgmt_cmd_complete(sk, hdev->id,
5996                                         MGMT_OP_START_SERVICE_DISCOVERY,
5997                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5998                                         sizeof(cp->type));
5999                 goto failed;
6000         }
6001
6002         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6003                 err = mgmt_cmd_complete(sk, hdev->id,
6004                                         MGMT_OP_START_SERVICE_DISCOVERY,
6005                                         status, &cp->type, sizeof(cp->type));
6006                 goto failed;
6007         }
6008
6009         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6010                                hdev, data, len);
6011         if (!cmd) {
6012                 err = -ENOMEM;
6013                 goto failed;
6014         }
6015
6016         /* Clear the discovery filter first to free any previously
6017          * allocated memory for the UUID list.
6018          */
6019         hci_discovery_filter_clear(hdev);
6020
6021         hdev->discovery.result_filtering = true;
6022         hdev->discovery.type = cp->type;
6023         hdev->discovery.rssi = cp->rssi;
6024         hdev->discovery.uuid_count = uuid_count;
6025
6026         if (uuid_count > 0) {
6027                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6028                                                 GFP_KERNEL);
6029                 if (!hdev->discovery.uuids) {
6030                         err = mgmt_cmd_complete(sk, hdev->id,
6031                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6032                                                 MGMT_STATUS_FAILED,
6033                                                 &cp->type, sizeof(cp->type));
6034                         mgmt_pending_remove(cmd);
6035                         goto failed;
6036                 }
6037         }
6038
6039         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6040                                  start_discovery_complete);
6041         if (err < 0) {
6042                 mgmt_pending_remove(cmd);
6043                 goto failed;
6044         }
6045
6046         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6047
6048 failed:
6049         hci_dev_unlock(hdev);
6050         return err;
6051 }
6052
6053 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6054 {
6055         struct mgmt_pending_cmd *cmd;
6056
6057         bt_dev_dbg(hdev, "status %u", status);
6058
6059         hci_dev_lock(hdev);
6060
6061         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6062         if (cmd) {
6063                 cmd->cmd_complete(cmd, mgmt_status(status));
6064                 mgmt_pending_remove(cmd);
6065         }
6066
6067         hci_dev_unlock(hdev);
6068 }
6069
6070 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6071 {
6072         struct mgmt_pending_cmd *cmd = data;
6073
6074         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6075                 return;
6076
6077         bt_dev_dbg(hdev, "err %d", err);
6078
6079         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6080                           cmd->param, 1);
6081         mgmt_pending_remove(cmd);
6082
6083         if (!err)
6084                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6085 }
6086
6087 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6088 {
6089         return hci_stop_discovery_sync(hdev);
6090 }
6091
6092 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6093                           u16 len)
6094 {
6095         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6096         struct mgmt_pending_cmd *cmd;
6097         int err;
6098
6099         bt_dev_dbg(hdev, "sock %p", sk);
6100
6101         hci_dev_lock(hdev);
6102
6103         if (!hci_discovery_active(hdev)) {
6104                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6105                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6106                                         sizeof(mgmt_cp->type));
6107                 goto unlock;
6108         }
6109
6110         if (hdev->discovery.type != mgmt_cp->type) {
6111                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6112                                         MGMT_STATUS_INVALID_PARAMS,
6113                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6114                 goto unlock;
6115         }
6116
6117         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6118         if (!cmd) {
6119                 err = -ENOMEM;
6120                 goto unlock;
6121         }
6122
6123         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6124                                  stop_discovery_complete);
6125         if (err < 0) {
6126                 mgmt_pending_remove(cmd);
6127                 goto unlock;
6128         }
6129
6130         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6131
6132 unlock:
6133         hci_dev_unlock(hdev);
6134         return err;
6135 }
6136
6137 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6138                         u16 len)
6139 {
6140         struct mgmt_cp_confirm_name *cp = data;
6141         struct inquiry_entry *e;
6142         int err;
6143
6144         bt_dev_dbg(hdev, "sock %p", sk);
6145
6146         hci_dev_lock(hdev);
6147
6148         if (!hci_discovery_active(hdev)) {
6149                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6150                                         MGMT_STATUS_FAILED, &cp->addr,
6151                                         sizeof(cp->addr));
6152                 goto failed;
6153         }
6154
6155         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6156         if (!e) {
6157                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6158                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6159                                         sizeof(cp->addr));
6160                 goto failed;
6161         }
6162
6163         if (cp->name_known) {
6164                 e->name_state = NAME_KNOWN;
6165                 list_del(&e->list);
6166         } else {
6167                 e->name_state = NAME_NEEDED;
6168                 hci_inquiry_cache_update_resolve(hdev, e);
6169         }
6170
6171         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6172                                 &cp->addr, sizeof(cp->addr));
6173
6174 failed:
6175         hci_dev_unlock(hdev);
6176         return err;
6177 }
6178
6179 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6180                         u16 len)
6181 {
6182         struct mgmt_cp_block_device *cp = data;
6183         u8 status;
6184         int err;
6185
6186         bt_dev_dbg(hdev, "sock %p", sk);
6187
6188         if (!bdaddr_type_is_valid(cp->addr.type))
6189                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6190                                          MGMT_STATUS_INVALID_PARAMS,
6191                                          &cp->addr, sizeof(cp->addr));
6192
6193         hci_dev_lock(hdev);
6194
6195         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6196                                   cp->addr.type);
6197         if (err < 0) {
6198                 status = MGMT_STATUS_FAILED;
6199                 goto done;
6200         }
6201
6202         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6203                    sk);
6204         status = MGMT_STATUS_SUCCESS;
6205
6206 done:
6207         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6208                                 &cp->addr, sizeof(cp->addr));
6209
6210         hci_dev_unlock(hdev);
6211
6212         return err;
6213 }
6214
6215 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6216                           u16 len)
6217 {
6218         struct mgmt_cp_unblock_device *cp = data;
6219         u8 status;
6220         int err;
6221
6222         bt_dev_dbg(hdev, "sock %p", sk);
6223
6224         if (!bdaddr_type_is_valid(cp->addr.type))
6225                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6226                                          MGMT_STATUS_INVALID_PARAMS,
6227                                          &cp->addr, sizeof(cp->addr));
6228
6229         hci_dev_lock(hdev);
6230
6231         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6232                                   cp->addr.type);
6233         if (err < 0) {
6234                 status = MGMT_STATUS_INVALID_PARAMS;
6235                 goto done;
6236         }
6237
6238         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6239                    sk);
6240         status = MGMT_STATUS_SUCCESS;
6241
6242 done:
6243         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6244                                 &cp->addr, sizeof(cp->addr));
6245
6246         hci_dev_unlock(hdev);
6247
6248         return err;
6249 }
6250
6251 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6252 {
6253         return hci_update_eir_sync(hdev);
6254 }
6255
6256 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6257                          u16 len)
6258 {
6259         struct mgmt_cp_set_device_id *cp = data;
6260         int err;
6261         __u16 source;
6262
6263         bt_dev_dbg(hdev, "sock %p", sk);
6264
6265         source = __le16_to_cpu(cp->source);
6266
6267         if (source > 0x0002)
6268                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6269                                        MGMT_STATUS_INVALID_PARAMS);
6270
6271         hci_dev_lock(hdev);
6272
6273         hdev->devid_source = source;
6274         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6275         hdev->devid_product = __le16_to_cpu(cp->product);
6276         hdev->devid_version = __le16_to_cpu(cp->version);
6277
6278         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6279                                 NULL, 0);
6280
6281         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6282
6283         hci_dev_unlock(hdev);
6284
6285         return err;
6286 }
6287
6288 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6289 {
6290         if (err)
6291                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6292         else
6293                 bt_dev_dbg(hdev, "status %d", err);
6294 }
6295
6296 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6297 {
6298         struct cmd_lookup match = { NULL, hdev };
6299         u8 instance;
6300         struct adv_info *adv_instance;
6301         u8 status = mgmt_status(err);
6302
6303         if (status) {
6304                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6305                                      cmd_status_rsp, &status);
6306                 return;
6307         }
6308
6309         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6310                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6311         else
6312                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6313
6314         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6315                              &match);
6316
6317         new_settings(hdev, match.sk);
6318
6319         if (match.sk)
6320                 sock_put(match.sk);
6321
6322         /* If "Set Advertising" was just disabled and instance advertising was
6323          * set up earlier, then re-enable multi-instance advertising.
6324          */
6325         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6326             list_empty(&hdev->adv_instances))
6327                 return;
6328
6329         instance = hdev->cur_adv_instance;
6330         if (!instance) {
6331                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6332                                                         struct adv_info, list);
6333                 if (!adv_instance)
6334                         return;
6335
6336                 instance = adv_instance->instance;
6337         }
6338
6339         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6340
6341         enable_advertising_instance(hdev, err);
6342 }
6343
6344 static int set_adv_sync(struct hci_dev *hdev, void *data)
6345 {
6346         struct mgmt_pending_cmd *cmd = data;
6347         struct mgmt_mode *cp = cmd->param;
6348         u8 val = !!cp->val;
6349
6350         if (cp->val == 0x02)
6351                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6352         else
6353                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6354
6355         cancel_adv_timeout(hdev);
6356
6357         if (val) {
6358                 /* Switch to instance "0" for the Set Advertising setting.
6359                  * We cannot use update_[adv|scan_rsp]_data() here as the
6360                  * HCI_ADVERTISING flag is not yet set.
6361                  */
6362                 hdev->cur_adv_instance = 0x00;
6363
6364                 if (ext_adv_capable(hdev)) {
6365                         hci_start_ext_adv_sync(hdev, 0x00);
6366                 } else {
6367                         hci_update_adv_data_sync(hdev, 0x00);
6368                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6369                         hci_enable_advertising_sync(hdev);
6370                 }
6371         } else {
6372                 hci_disable_advertising_sync(hdev);
6373         }
6374
6375         return 0;
6376 }
6377
6378 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6379                            u16 len)
6380 {
6381         struct mgmt_mode *cp = data;
6382         struct mgmt_pending_cmd *cmd;
6383         u8 val, status;
6384         int err;
6385
6386         bt_dev_dbg(hdev, "sock %p", sk);
6387
6388         status = mgmt_le_support(hdev);
6389         if (status)
6390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6391                                        status);
6392
6393         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6394                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6395                                        MGMT_STATUS_INVALID_PARAMS);
6396
6397         if (hdev->advertising_paused)
6398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6399                                        MGMT_STATUS_BUSY);
6400
6401         hci_dev_lock(hdev);
6402
6403         val = !!cp->val;
6404
6405         /* The following conditions are ones which mean that we should
6406          * not do any HCI communication but directly send a mgmt
6407          * response to user space (after toggling the flag if
6408          * necessary).
6409          */
6410         if (!hdev_is_powered(hdev) ||
6411             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6412              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6413             hci_dev_test_flag(hdev, HCI_MESH) ||
6414             hci_conn_num(hdev, LE_LINK) > 0 ||
6415             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6416              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6417                 bool changed;
6418
6419                 if (cp->val) {
6420                         hdev->cur_adv_instance = 0x00;
6421                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6422                         if (cp->val == 0x02)
6423                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6424                         else
6425                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6426                 } else {
6427                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6428                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6429                 }
6430
6431                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6432                 if (err < 0)
6433                         goto unlock;
6434
6435                 if (changed)
6436                         err = new_settings(hdev, sk);
6437
6438                 goto unlock;
6439         }
6440
6441         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6442             pending_find(MGMT_OP_SET_LE, hdev)) {
6443                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6444                                       MGMT_STATUS_BUSY);
6445                 goto unlock;
6446         }
6447
6448         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6449         if (!cmd)
6450                 err = -ENOMEM;
6451         else
6452                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6453                                          set_advertising_complete);
6454
6455         if (err < 0 && cmd)
6456                 mgmt_pending_remove(cmd);
6457
6458 unlock:
6459         hci_dev_unlock(hdev);
6460         return err;
6461 }
6462
6463 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6464                               void *data, u16 len)
6465 {
6466         struct mgmt_cp_set_static_address *cp = data;
6467         int err;
6468
6469         bt_dev_dbg(hdev, "sock %p", sk);
6470
6471         if (!lmp_le_capable(hdev))
6472                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6473                                        MGMT_STATUS_NOT_SUPPORTED);
6474
6475         if (hdev_is_powered(hdev))
6476                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6477                                        MGMT_STATUS_REJECTED);
6478
6479         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6480                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6481                         return mgmt_cmd_status(sk, hdev->id,
6482                                                MGMT_OP_SET_STATIC_ADDRESS,
6483                                                MGMT_STATUS_INVALID_PARAMS);
6484
6485                 /* Two most significant bits shall be set */
6486                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6487                         return mgmt_cmd_status(sk, hdev->id,
6488                                                MGMT_OP_SET_STATIC_ADDRESS,
6489                                                MGMT_STATUS_INVALID_PARAMS);
6490         }
6491
6492         hci_dev_lock(hdev);
6493
6494         bacpy(&hdev->static_addr, &cp->bdaddr);
6495
6496         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6497         if (err < 0)
6498                 goto unlock;
6499
6500         err = new_settings(hdev, sk);
6501
6502 unlock:
6503         hci_dev_unlock(hdev);
6504         return err;
6505 }
6506
6507 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6508                            void *data, u16 len)
6509 {
6510         struct mgmt_cp_set_scan_params *cp = data;
6511         __u16 interval, window;
6512         int err;
6513
6514         bt_dev_dbg(hdev, "sock %p", sk);
6515
6516         if (!lmp_le_capable(hdev))
6517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6518                                        MGMT_STATUS_NOT_SUPPORTED);
6519
6520         interval = __le16_to_cpu(cp->interval);
6521
6522         if (interval < 0x0004 || interval > 0x4000)
6523                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6524                                        MGMT_STATUS_INVALID_PARAMS);
6525
6526         window = __le16_to_cpu(cp->window);
6527
6528         if (window < 0x0004 || window > 0x4000)
6529                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6530                                        MGMT_STATUS_INVALID_PARAMS);
6531
6532         if (window > interval)
6533                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6534                                        MGMT_STATUS_INVALID_PARAMS);
6535
6536         hci_dev_lock(hdev);
6537
6538         hdev->le_scan_interval = interval;
6539         hdev->le_scan_window = window;
6540
6541         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6542                                 NULL, 0);
6543
6544         /* If background scan is running, restart it so new parameters are
6545          * loaded.
6546          */
6547         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6548             hdev->discovery.state == DISCOVERY_STOPPED)
6549                 hci_update_passive_scan(hdev);
6550
6551         hci_dev_unlock(hdev);
6552
6553         return err;
6554 }
6555
6556 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6557 {
6558         struct mgmt_pending_cmd *cmd = data;
6559
6560         bt_dev_dbg(hdev, "err %d", err);
6561
6562         if (err) {
6563                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6564                                 mgmt_status(err));
6565         } else {
6566                 struct mgmt_mode *cp = cmd->param;
6567
6568                 if (cp->val)
6569                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6570                 else
6571                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6572
6573                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6574                 new_settings(hdev, cmd->sk);
6575         }
6576
6577         mgmt_pending_free(cmd);
6578 }
6579
6580 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6581 {
6582         struct mgmt_pending_cmd *cmd = data;
6583         struct mgmt_mode *cp = cmd->param;
6584
6585         return hci_write_fast_connectable_sync(hdev, cp->val);
6586 }
6587
6588 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6589                                 void *data, u16 len)
6590 {
6591         struct mgmt_mode *cp = data;
6592         struct mgmt_pending_cmd *cmd;
6593         int err;
6594
6595         bt_dev_dbg(hdev, "sock %p", sk);
6596
6597         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6598             hdev->hci_ver < BLUETOOTH_VER_1_2)
6599                 return mgmt_cmd_status(sk, hdev->id,
6600                                        MGMT_OP_SET_FAST_CONNECTABLE,
6601                                        MGMT_STATUS_NOT_SUPPORTED);
6602
6603         if (cp->val != 0x00 && cp->val != 0x01)
6604                 return mgmt_cmd_status(sk, hdev->id,
6605                                        MGMT_OP_SET_FAST_CONNECTABLE,
6606                                        MGMT_STATUS_INVALID_PARAMS);
6607
6608         hci_dev_lock(hdev);
6609
6610         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6611                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6612                 goto unlock;
6613         }
6614
6615         if (!hdev_is_powered(hdev)) {
6616                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6617                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6618                 new_settings(hdev, sk);
6619                 goto unlock;
6620         }
6621
6622         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6623                                len);
6624         if (!cmd)
6625                 err = -ENOMEM;
6626         else
6627                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6628                                          fast_connectable_complete);
6629
6630         if (err < 0) {
6631                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6632                                 MGMT_STATUS_FAILED);
6633
6634                 if (cmd)
6635                         mgmt_pending_free(cmd);
6636         }
6637
6638 unlock:
6639         hci_dev_unlock(hdev);
6640
6641         return err;
6642 }
6643
6644 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6645 {
6646         struct mgmt_pending_cmd *cmd = data;
6647
6648         bt_dev_dbg(hdev, "err %d", err);
6649
6650         if (err) {
6651                 u8 mgmt_err = mgmt_status(err);
6652
6653                 /* We need to restore the flag if related HCI commands
6654                  * failed.
6655                  */
6656                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6657
6658                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6659         } else {
6660                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6661                 new_settings(hdev, cmd->sk);
6662         }
6663
6664         mgmt_pending_free(cmd);
6665 }
6666
6667 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6668 {
6669         int status;
6670
6671         status = hci_write_fast_connectable_sync(hdev, false);
6672
6673         if (!status)
6674                 status = hci_update_scan_sync(hdev);
6675
6676         /* Since only the advertising data flags will change, there
6677          * is no need to update the scan response data.
6678          */
6679         if (!status)
6680                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6681
6682         return status;
6683 }
6684
6685 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6686 {
6687         struct mgmt_mode *cp = data;
6688         struct mgmt_pending_cmd *cmd;
6689         int err;
6690
6691         bt_dev_dbg(hdev, "sock %p", sk);
6692
6693         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6694                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6695                                        MGMT_STATUS_NOT_SUPPORTED);
6696
6697         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6698                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6699                                        MGMT_STATUS_REJECTED);
6700
6701         if (cp->val != 0x00 && cp->val != 0x01)
6702                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6703                                        MGMT_STATUS_INVALID_PARAMS);
6704
6705         hci_dev_lock(hdev);
6706
6707         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6708                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6709                 goto unlock;
6710         }
6711
6712         if (!hdev_is_powered(hdev)) {
6713                 if (!cp->val) {
6714                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6715                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6716                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6717                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6718                 }
6719
6720                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6721
6722                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6723                 if (err < 0)
6724                         goto unlock;
6725
6726                 err = new_settings(hdev, sk);
6727                 goto unlock;
6728         }
6729
6730         /* Reject disabling when powered on */
6731         if (!cp->val) {
6732                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6733                                       MGMT_STATUS_REJECTED);
6734                 goto unlock;
6735         } else {
6736                 /* When configuring a dual-mode controller to operate
6737                  * with LE only and using a static address, then switching
6738                  * BR/EDR back on is not allowed.
6739                  *
6740                  * Dual-mode controllers shall operate with the public
6741                  * address as its identity address for BR/EDR and LE. So
6742                  * reject the attempt to create an invalid configuration.
6743                  *
6744                  * The same restrictions applies when secure connections
6745                  * has been enabled. For BR/EDR this is a controller feature
6746                  * while for LE it is a host stack feature. This means that
6747                  * switching BR/EDR back on when secure connections has been
6748                  * enabled is not a supported transaction.
6749                  */
6750                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6751                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6752                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6753                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6754                                               MGMT_STATUS_REJECTED);
6755                         goto unlock;
6756                 }
6757         }
6758
6759         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6760         if (!cmd)
6761                 err = -ENOMEM;
6762         else
6763                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6764                                          set_bredr_complete);
6765
6766         if (err < 0) {
6767                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6768                                 MGMT_STATUS_FAILED);
6769                 if (cmd)
6770                         mgmt_pending_free(cmd);
6771
6772                 goto unlock;
6773         }
6774
6775         /* We need to flip the bit already here so that
6776          * hci_req_update_adv_data generates the correct flags.
6777          */
6778         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6779
6780 unlock:
6781         hci_dev_unlock(hdev);
6782         return err;
6783 }
6784
6785 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6786 {
6787         struct mgmt_pending_cmd *cmd = data;
6788         struct mgmt_mode *cp;
6789
6790         bt_dev_dbg(hdev, "err %d", err);
6791
6792         if (err) {
6793                 u8 mgmt_err = mgmt_status(err);
6794
6795                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6796                 goto done;
6797         }
6798
6799         cp = cmd->param;
6800
6801         switch (cp->val) {
6802         case 0x00:
6803                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6804                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6805                 break;
6806         case 0x01:
6807                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6808                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6809                 break;
6810         case 0x02:
6811                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6812                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6813                 break;
6814         }
6815
6816         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6817         new_settings(hdev, cmd->sk);
6818
6819 done:
6820         mgmt_pending_free(cmd);
6821 }
6822
6823 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6824 {
6825         struct mgmt_pending_cmd *cmd = data;
6826         struct mgmt_mode *cp = cmd->param;
6827         u8 val = !!cp->val;
6828
6829         /* Force write of val */
6830         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6831
6832         return hci_write_sc_support_sync(hdev, val);
6833 }
6834
6835 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6836                            void *data, u16 len)
6837 {
6838         struct mgmt_mode *cp = data;
6839         struct mgmt_pending_cmd *cmd;
6840         u8 val;
6841         int err;
6842
6843         bt_dev_dbg(hdev, "sock %p", sk);
6844
6845         if (!lmp_sc_capable(hdev) &&
6846             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6848                                        MGMT_STATUS_NOT_SUPPORTED);
6849
6850         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6851             lmp_sc_capable(hdev) &&
6852             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6853                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6854                                        MGMT_STATUS_REJECTED);
6855
6856         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6857                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6858                                        MGMT_STATUS_INVALID_PARAMS);
6859
6860         hci_dev_lock(hdev);
6861
6862         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6863             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6864                 bool changed;
6865
6866                 if (cp->val) {
6867                         changed = !hci_dev_test_and_set_flag(hdev,
6868                                                              HCI_SC_ENABLED);
6869                         if (cp->val == 0x02)
6870                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6871                         else
6872                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6873                 } else {
6874                         changed = hci_dev_test_and_clear_flag(hdev,
6875                                                               HCI_SC_ENABLED);
6876                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6877                 }
6878
6879                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6880                 if (err < 0)
6881                         goto failed;
6882
6883                 if (changed)
6884                         err = new_settings(hdev, sk);
6885
6886                 goto failed;
6887         }
6888
6889         val = !!cp->val;
6890
6891         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6892             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6893                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6894                 goto failed;
6895         }
6896
6897         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6898         if (!cmd)
6899                 err = -ENOMEM;
6900         else
6901                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6902                                          set_secure_conn_complete);
6903
6904         if (err < 0) {
6905                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6906                                 MGMT_STATUS_FAILED);
6907                 if (cmd)
6908                         mgmt_pending_free(cmd);
6909         }
6910
6911 failed:
6912         hci_dev_unlock(hdev);
6913         return err;
6914 }
6915
6916 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6917                           void *data, u16 len)
6918 {
6919         struct mgmt_mode *cp = data;
6920         bool changed, use_changed;
6921         int err;
6922
6923         bt_dev_dbg(hdev, "sock %p", sk);
6924
6925         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6926                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6927                                        MGMT_STATUS_INVALID_PARAMS);
6928
6929         hci_dev_lock(hdev);
6930
6931         if (cp->val)
6932                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6933         else
6934                 changed = hci_dev_test_and_clear_flag(hdev,
6935                                                       HCI_KEEP_DEBUG_KEYS);
6936
6937         if (cp->val == 0x02)
6938                 use_changed = !hci_dev_test_and_set_flag(hdev,
6939                                                          HCI_USE_DEBUG_KEYS);
6940         else
6941                 use_changed = hci_dev_test_and_clear_flag(hdev,
6942                                                           HCI_USE_DEBUG_KEYS);
6943
6944         if (hdev_is_powered(hdev) && use_changed &&
6945             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6946                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6947                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6948                              sizeof(mode), &mode);
6949         }
6950
6951         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6952         if (err < 0)
6953                 goto unlock;
6954
6955         if (changed)
6956                 err = new_settings(hdev, sk);
6957
6958 unlock:
6959         hci_dev_unlock(hdev);
6960         return err;
6961 }
6962
6963 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6964                        u16 len)
6965 {
6966         struct mgmt_cp_set_privacy *cp = cp_data;
6967         bool changed;
6968         int err;
6969
6970         bt_dev_dbg(hdev, "sock %p", sk);
6971
6972         if (!lmp_le_capable(hdev))
6973                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6974                                        MGMT_STATUS_NOT_SUPPORTED);
6975
6976         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6977                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6978                                        MGMT_STATUS_INVALID_PARAMS);
6979
6980         if (hdev_is_powered(hdev))
6981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6982                                        MGMT_STATUS_REJECTED);
6983
6984         hci_dev_lock(hdev);
6985
6986         /* If user space supports this command it is also expected to
6987          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6988          */
6989         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6990
6991         if (cp->privacy) {
6992                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6993                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6994                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6995                 hci_adv_instances_set_rpa_expired(hdev, true);
6996                 if (cp->privacy == 0x02)
6997                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6998                 else
6999                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7000         } else {
7001                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7002                 memset(hdev->irk, 0, sizeof(hdev->irk));
7003                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7004                 hci_adv_instances_set_rpa_expired(hdev, false);
7005                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7006         }
7007
7008         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7009         if (err < 0)
7010                 goto unlock;
7011
7012         if (changed)
7013                 err = new_settings(hdev, sk);
7014
7015 unlock:
7016         hci_dev_unlock(hdev);
7017         return err;
7018 }
7019
7020 static bool irk_is_valid(struct mgmt_irk_info *irk)
7021 {
7022         switch (irk->addr.type) {
7023         case BDADDR_LE_PUBLIC:
7024                 return true;
7025
7026         case BDADDR_LE_RANDOM:
7027                 /* Two most significant bits shall be set */
7028                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7029                         return false;
7030                 return true;
7031         }
7032
7033         return false;
7034 }
7035
7036 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7037                      u16 len)
7038 {
7039         struct mgmt_cp_load_irks *cp = cp_data;
7040         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7041                                    sizeof(struct mgmt_irk_info));
7042         u16 irk_count, expected_len;
7043         int i, err;
7044
7045         bt_dev_dbg(hdev, "sock %p", sk);
7046
7047         if (!lmp_le_capable(hdev))
7048                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7049                                        MGMT_STATUS_NOT_SUPPORTED);
7050
7051         irk_count = __le16_to_cpu(cp->irk_count);
7052         if (irk_count > max_irk_count) {
7053                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7054                            irk_count);
7055                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7056                                        MGMT_STATUS_INVALID_PARAMS);
7057         }
7058
7059         expected_len = struct_size(cp, irks, irk_count);
7060         if (expected_len != len) {
7061                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7062                            expected_len, len);
7063                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7064                                        MGMT_STATUS_INVALID_PARAMS);
7065         }
7066
7067         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7068
7069         for (i = 0; i < irk_count; i++) {
7070                 struct mgmt_irk_info *key = &cp->irks[i];
7071
7072                 if (!irk_is_valid(key))
7073                         return mgmt_cmd_status(sk, hdev->id,
7074                                                MGMT_OP_LOAD_IRKS,
7075                                                MGMT_STATUS_INVALID_PARAMS);
7076         }
7077
7078         hci_dev_lock(hdev);
7079
7080         hci_smp_irks_clear(hdev);
7081
7082         for (i = 0; i < irk_count; i++) {
7083                 struct mgmt_irk_info *irk = &cp->irks[i];
7084                 u8 addr_type = le_addr_type(irk->addr.type);
7085
7086                 if (hci_is_blocked_key(hdev,
7087                                        HCI_BLOCKED_KEY_TYPE_IRK,
7088                                        irk->val)) {
7089                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7090                                     &irk->addr.bdaddr);
7091                         continue;
7092                 }
7093
7094                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7095                 if (irk->addr.type == BDADDR_BREDR)
7096                         addr_type = BDADDR_BREDR;
7097
7098                 hci_add_irk(hdev, &irk->addr.bdaddr,
7099                             addr_type, irk->val,
7100                             BDADDR_ANY);
7101         }
7102
7103         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7104
7105         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7106
7107         hci_dev_unlock(hdev);
7108
7109         return err;
7110 }
7111
7112 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7113 {
7114         if (key->initiator != 0x00 && key->initiator != 0x01)
7115                 return false;
7116
7117         switch (key->addr.type) {
7118         case BDADDR_LE_PUBLIC:
7119                 return true;
7120
7121         case BDADDR_LE_RANDOM:
7122                 /* Two most significant bits shall be set */
7123                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7124                         return false;
7125                 return true;
7126         }
7127
7128         return false;
7129 }
7130
7131 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7132                                void *cp_data, u16 len)
7133 {
7134         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7135         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7136                                    sizeof(struct mgmt_ltk_info));
7137         u16 key_count, expected_len;
7138         int i, err;
7139
7140         bt_dev_dbg(hdev, "sock %p", sk);
7141
7142         if (!lmp_le_capable(hdev))
7143                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7144                                        MGMT_STATUS_NOT_SUPPORTED);
7145
7146         key_count = __le16_to_cpu(cp->key_count);
7147         if (key_count > max_key_count) {
7148                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7149                            key_count);
7150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7151                                        MGMT_STATUS_INVALID_PARAMS);
7152         }
7153
7154         expected_len = struct_size(cp, keys, key_count);
7155         if (expected_len != len) {
7156                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7157                            expected_len, len);
7158                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7159                                        MGMT_STATUS_INVALID_PARAMS);
7160         }
7161
7162         bt_dev_dbg(hdev, "key_count %u", key_count);
7163
7164         for (i = 0; i < key_count; i++) {
7165                 struct mgmt_ltk_info *key = &cp->keys[i];
7166
7167                 if (!ltk_is_valid(key))
7168                         return mgmt_cmd_status(sk, hdev->id,
7169                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7170                                                MGMT_STATUS_INVALID_PARAMS);
7171         }
7172
7173         hci_dev_lock(hdev);
7174
7175         hci_smp_ltks_clear(hdev);
7176
7177         for (i = 0; i < key_count; i++) {
7178                 struct mgmt_ltk_info *key = &cp->keys[i];
7179                 u8 type, authenticated;
7180                 u8 addr_type = le_addr_type(key->addr.type);
7181
7182                 if (hci_is_blocked_key(hdev,
7183                                        HCI_BLOCKED_KEY_TYPE_LTK,
7184                                        key->val)) {
7185                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7186                                     &key->addr.bdaddr);
7187                         continue;
7188                 }
7189
7190                 switch (key->type) {
7191                 case MGMT_LTK_UNAUTHENTICATED:
7192                         authenticated = 0x00;
7193                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7194                         break;
7195                 case MGMT_LTK_AUTHENTICATED:
7196                         authenticated = 0x01;
7197                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7198                         break;
7199                 case MGMT_LTK_P256_UNAUTH:
7200                         authenticated = 0x00;
7201                         type = SMP_LTK_P256;
7202                         break;
7203                 case MGMT_LTK_P256_AUTH:
7204                         authenticated = 0x01;
7205                         type = SMP_LTK_P256;
7206                         break;
7207                 case MGMT_LTK_P256_DEBUG:
7208                         authenticated = 0x00;
7209                         type = SMP_LTK_P256_DEBUG;
7210                         fallthrough;
7211                 default:
7212                         continue;
7213                 }
7214
7215                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7216                 if (key->addr.type == BDADDR_BREDR)
7217                         addr_type = BDADDR_BREDR;
7218
7219                 hci_add_ltk(hdev, &key->addr.bdaddr,
7220                             addr_type, type, authenticated,
7221                             key->val, key->enc_size, key->ediv, key->rand);
7222         }
7223
7224         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7225                            NULL, 0);
7226
7227         hci_dev_unlock(hdev);
7228
7229         return err;
7230 }
7231
7232 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7233 {
7234         struct mgmt_pending_cmd *cmd = data;
7235         struct hci_conn *conn = cmd->user_data;
7236         struct mgmt_cp_get_conn_info *cp = cmd->param;
7237         struct mgmt_rp_get_conn_info rp;
7238         u8 status;
7239
7240         bt_dev_dbg(hdev, "err %d", err);
7241
7242         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
7243
7244         status = mgmt_status(err);
7245         if (status == MGMT_STATUS_SUCCESS) {
7246                 rp.rssi = conn->rssi;
7247                 rp.tx_power = conn->tx_power;
7248                 rp.max_tx_power = conn->max_tx_power;
7249         } else {
7250                 rp.rssi = HCI_RSSI_INVALID;
7251                 rp.tx_power = HCI_TX_POWER_INVALID;
7252                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7253         }
7254
7255         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7256                           &rp, sizeof(rp));
7257
7258         mgmt_pending_free(cmd);
7259 }
7260
7261 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7262 {
7263         struct mgmt_pending_cmd *cmd = data;
7264         struct mgmt_cp_get_conn_info *cp = cmd->param;
7265         struct hci_conn *conn;
7266         int err;
7267         __le16   handle;
7268
7269         /* Make sure we are still connected */
7270         if (cp->addr.type == BDADDR_BREDR)
7271                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7272                                                &cp->addr.bdaddr);
7273         else
7274                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7275
7276         if (!conn || conn->state != BT_CONNECTED)
7277                 return MGMT_STATUS_NOT_CONNECTED;
7278
7279         cmd->user_data = conn;
7280         handle = cpu_to_le16(conn->handle);
7281
7282         /* Refresh RSSI each time */
7283         err = hci_read_rssi_sync(hdev, handle);
7284
7285         /* For LE links TX power does not change thus we don't need to
7286          * query for it once value is known.
7287          */
7288         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7289                      conn->tx_power == HCI_TX_POWER_INVALID))
7290                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7291
7292         /* Max TX power needs to be read only once per connection */
7293         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7294                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7295
7296         return err;
7297 }
7298
7299 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7300                          u16 len)
7301 {
7302         struct mgmt_cp_get_conn_info *cp = data;
7303         struct mgmt_rp_get_conn_info rp;
7304         struct hci_conn *conn;
7305         unsigned long conn_info_age;
7306         int err = 0;
7307
7308         bt_dev_dbg(hdev, "sock %p", sk);
7309
7310         memset(&rp, 0, sizeof(rp));
7311         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7312         rp.addr.type = cp->addr.type;
7313
7314         if (!bdaddr_type_is_valid(cp->addr.type))
7315                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7316                                          MGMT_STATUS_INVALID_PARAMS,
7317                                          &rp, sizeof(rp));
7318
7319         hci_dev_lock(hdev);
7320
7321         if (!hdev_is_powered(hdev)) {
7322                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7323                                         MGMT_STATUS_NOT_POWERED, &rp,
7324                                         sizeof(rp));
7325                 goto unlock;
7326         }
7327
7328         if (cp->addr.type == BDADDR_BREDR)
7329                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7330                                                &cp->addr.bdaddr);
7331         else
7332                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7333
7334         if (!conn || conn->state != BT_CONNECTED) {
7335                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7336                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7337                                         sizeof(rp));
7338                 goto unlock;
7339         }
7340
7341         /* To avoid client trying to guess when to poll again for information we
7342          * calculate conn info age as random value between min/max set in hdev.
7343          */
7344         conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7345                                                  hdev->conn_info_max_age - 1);
7346
7347         /* Query controller to refresh cached values if they are too old or were
7348          * never read.
7349          */
7350         if (time_after(jiffies, conn->conn_info_timestamp +
7351                        msecs_to_jiffies(conn_info_age)) ||
7352             !conn->conn_info_timestamp) {
7353                 struct mgmt_pending_cmd *cmd;
7354
7355                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7356                                        len);
7357                 if (!cmd) {
7358                         err = -ENOMEM;
7359                 } else {
7360                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7361                                                  cmd, get_conn_info_complete);
7362                 }
7363
7364                 if (err < 0) {
7365                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7366                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
7367
7368                         if (cmd)
7369                                 mgmt_pending_free(cmd);
7370
7371                         goto unlock;
7372                 }
7373
7374                 conn->conn_info_timestamp = jiffies;
7375         } else {
7376                 /* Cache is valid, just reply with values cached in hci_conn */
7377                 rp.rssi = conn->rssi;
7378                 rp.tx_power = conn->tx_power;
7379                 rp.max_tx_power = conn->max_tx_power;
7380
7381                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7382                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7383         }
7384
7385 unlock:
7386         hci_dev_unlock(hdev);
7387         return err;
7388 }
7389
7390 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7391 {
7392         struct mgmt_pending_cmd *cmd = data;
7393         struct mgmt_cp_get_clock_info *cp = cmd->param;
7394         struct mgmt_rp_get_clock_info rp;
7395         struct hci_conn *conn = cmd->user_data;
7396         u8 status = mgmt_status(err);
7397
7398         bt_dev_dbg(hdev, "err %d", err);
7399
7400         memset(&rp, 0, sizeof(rp));
7401         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7402         rp.addr.type = cp->addr.type;
7403
7404         if (err)
7405                 goto complete;
7406
7407         rp.local_clock = cpu_to_le32(hdev->clock);
7408
7409         if (conn) {
7410                 rp.piconet_clock = cpu_to_le32(conn->clock);
7411                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7412         }
7413
7414 complete:
7415         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7416                           sizeof(rp));
7417
7418         mgmt_pending_free(cmd);
7419 }
7420
7421 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7422 {
7423         struct mgmt_pending_cmd *cmd = data;
7424         struct mgmt_cp_get_clock_info *cp = cmd->param;
7425         struct hci_cp_read_clock hci_cp;
7426         struct hci_conn *conn;
7427
7428         memset(&hci_cp, 0, sizeof(hci_cp));
7429         hci_read_clock_sync(hdev, &hci_cp);
7430
7431         /* Make sure connection still exists */
7432         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7433         if (!conn || conn->state != BT_CONNECTED)
7434                 return MGMT_STATUS_NOT_CONNECTED;
7435
7436         cmd->user_data = conn;
7437         hci_cp.handle = cpu_to_le16(conn->handle);
7438         hci_cp.which = 0x01; /* Piconet clock */
7439
7440         return hci_read_clock_sync(hdev, &hci_cp);
7441 }
7442
7443 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7444                                                                 u16 len)
7445 {
7446         struct mgmt_cp_get_clock_info *cp = data;
7447         struct mgmt_rp_get_clock_info rp;
7448         struct mgmt_pending_cmd *cmd;
7449         struct hci_conn *conn;
7450         int err;
7451
7452         bt_dev_dbg(hdev, "sock %p", sk);
7453
7454         memset(&rp, 0, sizeof(rp));
7455         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7456         rp.addr.type = cp->addr.type;
7457
7458         if (cp->addr.type != BDADDR_BREDR)
7459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7460                                          MGMT_STATUS_INVALID_PARAMS,
7461                                          &rp, sizeof(rp));
7462
7463         hci_dev_lock(hdev);
7464
7465         if (!hdev_is_powered(hdev)) {
7466                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7467                                         MGMT_STATUS_NOT_POWERED, &rp,
7468                                         sizeof(rp));
7469                 goto unlock;
7470         }
7471
7472         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7473                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7474                                                &cp->addr.bdaddr);
7475                 if (!conn || conn->state != BT_CONNECTED) {
7476                         err = mgmt_cmd_complete(sk, hdev->id,
7477                                                 MGMT_OP_GET_CLOCK_INFO,
7478                                                 MGMT_STATUS_NOT_CONNECTED,
7479                                                 &rp, sizeof(rp));
7480                         goto unlock;
7481                 }
7482         } else {
7483                 conn = NULL;
7484         }
7485
7486         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7487         if (!cmd)
7488                 err = -ENOMEM;
7489         else
7490                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7491                                          get_clock_info_complete);
7492
7493         if (err < 0) {
7494                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7495                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
7496
7497                 if (cmd)
7498                         mgmt_pending_free(cmd);
7499         }
7500
7501
7502 unlock:
7503         hci_dev_unlock(hdev);
7504         return err;
7505 }
7506
7507 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7508 {
7509         struct hci_conn *conn;
7510
7511         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7512         if (!conn)
7513                 return false;
7514
7515         if (conn->dst_type != type)
7516                 return false;
7517
7518         if (conn->state != BT_CONNECTED)
7519                 return false;
7520
7521         return true;
7522 }
7523
7524 /* This function requires the caller holds hdev->lock */
7525 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
7526                                u8 addr_type, u8 auto_connect)
7527 {
7528         struct hci_conn_params *params;
7529
7530         params = hci_conn_params_add(hdev, addr, addr_type);
7531         if (!params)
7532                 return -EIO;
7533
7534         if (params->auto_connect == auto_connect)
7535                 return 0;
7536
7537         hci_pend_le_list_del_init(params);
7538
7539         switch (auto_connect) {
7540         case HCI_AUTO_CONN_DISABLED:
7541         case HCI_AUTO_CONN_LINK_LOSS:
7542                 /* If auto connect is being disabled when we're trying to
7543                  * connect to device, keep connecting.
7544                  */
7545                 if (params->explicit_connect)
7546                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7547                 break;
7548         case HCI_AUTO_CONN_REPORT:
7549                 if (params->explicit_connect)
7550                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7551                 else
7552                         hci_pend_le_list_add(params, &hdev->pend_le_reports);
7553                 break;
7554         case HCI_AUTO_CONN_DIRECT:
7555         case HCI_AUTO_CONN_ALWAYS:
7556                 if (!is_connected(hdev, addr, addr_type))
7557                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
7558                 break;
7559         }
7560
7561         params->auto_connect = auto_connect;
7562
7563         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7564                    addr, addr_type, auto_connect);
7565
7566         return 0;
7567 }
7568
7569 static void device_added(struct sock *sk, struct hci_dev *hdev,
7570                          bdaddr_t *bdaddr, u8 type, u8 action)
7571 {
7572         struct mgmt_ev_device_added ev;
7573
7574         bacpy(&ev.addr.bdaddr, bdaddr);
7575         ev.addr.type = type;
7576         ev.action = action;
7577
7578         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7579 }
7580
7581 static int add_device_sync(struct hci_dev *hdev, void *data)
7582 {
7583         return hci_update_passive_scan_sync(hdev);
7584 }
7585
7586 static int add_device(struct sock *sk, struct hci_dev *hdev,
7587                       void *data, u16 len)
7588 {
7589         struct mgmt_cp_add_device *cp = data;
7590         u8 auto_conn, addr_type;
7591         struct hci_conn_params *params;
7592         int err;
7593         u32 current_flags = 0;
7594         u32 supported_flags;
7595
7596         bt_dev_dbg(hdev, "sock %p", sk);
7597
7598         if (!bdaddr_type_is_valid(cp->addr.type) ||
7599             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7600                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7601                                          MGMT_STATUS_INVALID_PARAMS,
7602                                          &cp->addr, sizeof(cp->addr));
7603
7604         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7605                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7606                                          MGMT_STATUS_INVALID_PARAMS,
7607                                          &cp->addr, sizeof(cp->addr));
7608
7609         hci_dev_lock(hdev);
7610
7611         if (cp->addr.type == BDADDR_BREDR) {
7612                 /* Only incoming connections action is supported for now */
7613                 if (cp->action != 0x01) {
7614                         err = mgmt_cmd_complete(sk, hdev->id,
7615                                                 MGMT_OP_ADD_DEVICE,
7616                                                 MGMT_STATUS_INVALID_PARAMS,
7617                                                 &cp->addr, sizeof(cp->addr));
7618                         goto unlock;
7619                 }
7620
7621                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7622                                                      &cp->addr.bdaddr,
7623                                                      cp->addr.type, 0);
7624                 if (err)
7625                         goto unlock;
7626
7627                 hci_update_scan(hdev);
7628
7629                 goto added;
7630         }
7631
7632         addr_type = le_addr_type(cp->addr.type);
7633
7634         if (cp->action == 0x02)
7635                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7636         else if (cp->action == 0x01)
7637                 auto_conn = HCI_AUTO_CONN_DIRECT;
7638         else
7639                 auto_conn = HCI_AUTO_CONN_REPORT;
7640
7641         /* Kernel internally uses conn_params with resolvable private
7642          * address, but Add Device allows only identity addresses.
7643          * Make sure it is enforced before calling
7644          * hci_conn_params_lookup.
7645          */
7646         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7647                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7648                                         MGMT_STATUS_INVALID_PARAMS,
7649                                         &cp->addr, sizeof(cp->addr));
7650                 goto unlock;
7651         }
7652
7653         /* If the connection parameters don't exist for this device,
7654          * they will be created and configured with defaults.
7655          */
7656         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7657                                 auto_conn) < 0) {
7658                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7659                                         MGMT_STATUS_FAILED, &cp->addr,
7660                                         sizeof(cp->addr));
7661                 goto unlock;
7662         } else {
7663                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7664                                                 addr_type);
7665                 if (params)
7666                         current_flags = params->flags;
7667         }
7668
7669         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7670         if (err < 0)
7671                 goto unlock;
7672
7673 added:
7674         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7675         supported_flags = hdev->conn_flags;
7676         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7677                              supported_flags, current_flags);
7678
7679         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7680                                 MGMT_STATUS_SUCCESS, &cp->addr,
7681                                 sizeof(cp->addr));
7682
7683 unlock:
7684         hci_dev_unlock(hdev);
7685         return err;
7686 }
7687
7688 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7689                            bdaddr_t *bdaddr, u8 type)
7690 {
7691         struct mgmt_ev_device_removed ev;
7692
7693         bacpy(&ev.addr.bdaddr, bdaddr);
7694         ev.addr.type = type;
7695
7696         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7697 }
7698
7699 static int remove_device_sync(struct hci_dev *hdev, void *data)
7700 {
7701         return hci_update_passive_scan_sync(hdev);
7702 }
7703
7704 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7705                          void *data, u16 len)
7706 {
7707         struct mgmt_cp_remove_device *cp = data;
7708         int err;
7709
7710         bt_dev_dbg(hdev, "sock %p", sk);
7711
7712         hci_dev_lock(hdev);
7713
7714         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7715                 struct hci_conn_params *params;
7716                 u8 addr_type;
7717
7718                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7719                         err = mgmt_cmd_complete(sk, hdev->id,
7720                                                 MGMT_OP_REMOVE_DEVICE,
7721                                                 MGMT_STATUS_INVALID_PARAMS,
7722                                                 &cp->addr, sizeof(cp->addr));
7723                         goto unlock;
7724                 }
7725
7726                 if (cp->addr.type == BDADDR_BREDR) {
7727                         err = hci_bdaddr_list_del(&hdev->accept_list,
7728                                                   &cp->addr.bdaddr,
7729                                                   cp->addr.type);
7730                         if (err) {
7731                                 err = mgmt_cmd_complete(sk, hdev->id,
7732                                                         MGMT_OP_REMOVE_DEVICE,
7733                                                         MGMT_STATUS_INVALID_PARAMS,
7734                                                         &cp->addr,
7735                                                         sizeof(cp->addr));
7736                                 goto unlock;
7737                         }
7738
7739                         hci_update_scan(hdev);
7740
7741                         device_removed(sk, hdev, &cp->addr.bdaddr,
7742                                        cp->addr.type);
7743                         goto complete;
7744                 }
7745
7746                 addr_type = le_addr_type(cp->addr.type);
7747
7748                 /* Kernel internally uses conn_params with resolvable private
7749                  * address, but Remove Device allows only identity addresses.
7750                  * Make sure it is enforced before calling
7751                  * hci_conn_params_lookup.
7752                  */
7753                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7754                         err = mgmt_cmd_complete(sk, hdev->id,
7755                                                 MGMT_OP_REMOVE_DEVICE,
7756                                                 MGMT_STATUS_INVALID_PARAMS,
7757                                                 &cp->addr, sizeof(cp->addr));
7758                         goto unlock;
7759                 }
7760
7761                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7762                                                 addr_type);
7763                 if (!params) {
7764                         err = mgmt_cmd_complete(sk, hdev->id,
7765                                                 MGMT_OP_REMOVE_DEVICE,
7766                                                 MGMT_STATUS_INVALID_PARAMS,
7767                                                 &cp->addr, sizeof(cp->addr));
7768                         goto unlock;
7769                 }
7770
7771                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7772                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7773                         err = mgmt_cmd_complete(sk, hdev->id,
7774                                                 MGMT_OP_REMOVE_DEVICE,
7775                                                 MGMT_STATUS_INVALID_PARAMS,
7776                                                 &cp->addr, sizeof(cp->addr));
7777                         goto unlock;
7778                 }
7779
7780                 hci_conn_params_free(params);
7781
7782                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7783         } else {
7784                 struct hci_conn_params *p, *tmp;
7785                 struct bdaddr_list *b, *btmp;
7786
7787                 if (cp->addr.type) {
7788                         err = mgmt_cmd_complete(sk, hdev->id,
7789                                                 MGMT_OP_REMOVE_DEVICE,
7790                                                 MGMT_STATUS_INVALID_PARAMS,
7791                                                 &cp->addr, sizeof(cp->addr));
7792                         goto unlock;
7793                 }
7794
7795                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7796                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7797                         list_del(&b->list);
7798                         kfree(b);
7799                 }
7800
7801                 hci_update_scan(hdev);
7802
7803                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7804                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7805                                 continue;
7806                         device_removed(sk, hdev, &p->addr, p->addr_type);
7807                         if (p->explicit_connect) {
7808                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7809                                 continue;
7810                         }
7811                         hci_conn_params_free(p);
7812                 }
7813
7814                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
7815         }
7816
7817         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7818
7819 complete:
7820         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7821                                 MGMT_STATUS_SUCCESS, &cp->addr,
7822                                 sizeof(cp->addr));
7823 unlock:
7824         hci_dev_unlock(hdev);
7825         return err;
7826 }
7827
7828 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7829                            u16 len)
7830 {
7831         struct mgmt_cp_load_conn_param *cp = data;
7832         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7833                                      sizeof(struct mgmt_conn_param));
7834         u16 param_count, expected_len;
7835         int i;
7836
7837         if (!lmp_le_capable(hdev))
7838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7839                                        MGMT_STATUS_NOT_SUPPORTED);
7840
7841         param_count = __le16_to_cpu(cp->param_count);
7842         if (param_count > max_param_count) {
7843                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7844                            param_count);
7845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7846                                        MGMT_STATUS_INVALID_PARAMS);
7847         }
7848
7849         expected_len = struct_size(cp, params, param_count);
7850         if (expected_len != len) {
7851                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7852                            expected_len, len);
7853                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7854                                        MGMT_STATUS_INVALID_PARAMS);
7855         }
7856
7857         bt_dev_dbg(hdev, "param_count %u", param_count);
7858
7859         hci_dev_lock(hdev);
7860
7861         hci_conn_params_clear_disabled(hdev);
7862
7863         for (i = 0; i < param_count; i++) {
7864                 struct mgmt_conn_param *param = &cp->params[i];
7865                 struct hci_conn_params *hci_param;
7866                 u16 min, max, latency, timeout;
7867                 u8 addr_type;
7868
7869                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7870                            param->addr.type);
7871
7872                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7873                         addr_type = ADDR_LE_DEV_PUBLIC;
7874                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7875                         addr_type = ADDR_LE_DEV_RANDOM;
7876                 } else {
7877                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7878                         continue;
7879                 }
7880
7881                 min = le16_to_cpu(param->min_interval);
7882                 max = le16_to_cpu(param->max_interval);
7883                 latency = le16_to_cpu(param->latency);
7884                 timeout = le16_to_cpu(param->timeout);
7885
7886                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7887                            min, max, latency, timeout);
7888
7889                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7890                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7891                         continue;
7892                 }
7893
7894                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7895                                                 addr_type);
7896                 if (!hci_param) {
7897                         bt_dev_err(hdev, "failed to add connection parameters");
7898                         continue;
7899                 }
7900
7901                 hci_param->conn_min_interval = min;
7902                 hci_param->conn_max_interval = max;
7903                 hci_param->conn_latency = latency;
7904                 hci_param->supervision_timeout = timeout;
7905         }
7906
7907         hci_dev_unlock(hdev);
7908
7909         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7910                                  NULL, 0);
7911 }
7912
7913 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7914                                void *data, u16 len)
7915 {
7916         struct mgmt_cp_set_external_config *cp = data;
7917         bool changed;
7918         int err;
7919
7920         bt_dev_dbg(hdev, "sock %p", sk);
7921
7922         if (hdev_is_powered(hdev))
7923                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7924                                        MGMT_STATUS_REJECTED);
7925
7926         if (cp->config != 0x00 && cp->config != 0x01)
7927                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7928                                          MGMT_STATUS_INVALID_PARAMS);
7929
7930         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7931                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7932                                        MGMT_STATUS_NOT_SUPPORTED);
7933
7934         hci_dev_lock(hdev);
7935
7936         if (cp->config)
7937                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7938         else
7939                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7940
7941         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7942         if (err < 0)
7943                 goto unlock;
7944
7945         if (!changed)
7946                 goto unlock;
7947
7948         err = new_options(hdev, sk);
7949
7950         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7951                 mgmt_index_removed(hdev);
7952
7953                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7954                         hci_dev_set_flag(hdev, HCI_CONFIG);
7955                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7956
7957                         queue_work(hdev->req_workqueue, &hdev->power_on);
7958                 } else {
7959                         set_bit(HCI_RAW, &hdev->flags);
7960                         mgmt_index_added(hdev);
7961                 }
7962         }
7963
7964 unlock:
7965         hci_dev_unlock(hdev);
7966         return err;
7967 }
7968
7969 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7970                               void *data, u16 len)
7971 {
7972         struct mgmt_cp_set_public_address *cp = data;
7973         bool changed;
7974         int err;
7975
7976         bt_dev_dbg(hdev, "sock %p", sk);
7977
7978         if (hdev_is_powered(hdev))
7979                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7980                                        MGMT_STATUS_REJECTED);
7981
7982         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7983                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7984                                        MGMT_STATUS_INVALID_PARAMS);
7985
7986         if (!hdev->set_bdaddr)
7987                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7988                                        MGMT_STATUS_NOT_SUPPORTED);
7989
7990         hci_dev_lock(hdev);
7991
7992         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7993         bacpy(&hdev->public_addr, &cp->bdaddr);
7994
7995         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7996         if (err < 0)
7997                 goto unlock;
7998
7999         if (!changed)
8000                 goto unlock;
8001
8002         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8003                 err = new_options(hdev, sk);
8004
8005         if (is_configured(hdev)) {
8006                 mgmt_index_removed(hdev);
8007
8008                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8009
8010                 hci_dev_set_flag(hdev, HCI_CONFIG);
8011                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8012
8013                 queue_work(hdev->req_workqueue, &hdev->power_on);
8014         }
8015
8016 unlock:
8017         hci_dev_unlock(hdev);
8018         return err;
8019 }
8020
8021 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8022                                              int err)
8023 {
8024         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8025         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8026         u8 *h192, *r192, *h256, *r256;
8027         struct mgmt_pending_cmd *cmd = data;
8028         struct sk_buff *skb = cmd->skb;
8029         u8 status = mgmt_status(err);
8030         u16 eir_len;
8031
8032         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
8033                 return;
8034
8035         if (!status) {
8036                 if (!skb)
8037                         status = MGMT_STATUS_FAILED;
8038                 else if (IS_ERR(skb))
8039                         status = mgmt_status(PTR_ERR(skb));
8040                 else
8041                         status = mgmt_status(skb->data[0]);
8042         }
8043
8044         bt_dev_dbg(hdev, "status %u", status);
8045
8046         mgmt_cp = cmd->param;
8047
8048         if (status) {
8049                 status = mgmt_status(status);
8050                 eir_len = 0;
8051
8052                 h192 = NULL;
8053                 r192 = NULL;
8054                 h256 = NULL;
8055                 r256 = NULL;
8056         } else if (!bredr_sc_enabled(hdev)) {
8057                 struct hci_rp_read_local_oob_data *rp;
8058
8059                 if (skb->len != sizeof(*rp)) {
8060                         status = MGMT_STATUS_FAILED;
8061                         eir_len = 0;
8062                 } else {
8063                         status = MGMT_STATUS_SUCCESS;
8064                         rp = (void *)skb->data;
8065
8066                         eir_len = 5 + 18 + 18;
8067                         h192 = rp->hash;
8068                         r192 = rp->rand;
8069                         h256 = NULL;
8070                         r256 = NULL;
8071                 }
8072         } else {
8073                 struct hci_rp_read_local_oob_ext_data *rp;
8074
8075                 if (skb->len != sizeof(*rp)) {
8076                         status = MGMT_STATUS_FAILED;
8077                         eir_len = 0;
8078                 } else {
8079                         status = MGMT_STATUS_SUCCESS;
8080                         rp = (void *)skb->data;
8081
8082                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8083                                 eir_len = 5 + 18 + 18;
8084                                 h192 = NULL;
8085                                 r192 = NULL;
8086                         } else {
8087                                 eir_len = 5 + 18 + 18 + 18 + 18;
8088                                 h192 = rp->hash192;
8089                                 r192 = rp->rand192;
8090                         }
8091
8092                         h256 = rp->hash256;
8093                         r256 = rp->rand256;
8094                 }
8095         }
8096
8097         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8098         if (!mgmt_rp)
8099                 goto done;
8100
8101         if (eir_len == 0)
8102                 goto send_rsp;
8103
8104         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8105                                   hdev->dev_class, 3);
8106
8107         if (h192 && r192) {
8108                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8109                                           EIR_SSP_HASH_C192, h192, 16);
8110                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8111                                           EIR_SSP_RAND_R192, r192, 16);
8112         }
8113
8114         if (h256 && r256) {
8115                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8116                                           EIR_SSP_HASH_C256, h256, 16);
8117                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8118                                           EIR_SSP_RAND_R256, r256, 16);
8119         }
8120
8121 send_rsp:
8122         mgmt_rp->type = mgmt_cp->type;
8123         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8124
8125         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8126                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8127                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8128         if (err < 0 || status)
8129                 goto done;
8130
8131         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8132
8133         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8134                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8135                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8136 done:
8137         if (skb && !IS_ERR(skb))
8138                 kfree_skb(skb);
8139
8140         kfree(mgmt_rp);
8141         mgmt_pending_remove(cmd);
8142 }
8143
8144 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8145                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8146 {
8147         struct mgmt_pending_cmd *cmd;
8148         int err;
8149
8150         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8151                                cp, sizeof(*cp));
8152         if (!cmd)
8153                 return -ENOMEM;
8154
8155         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8156                                  read_local_oob_ext_data_complete);
8157
8158         if (err < 0) {
8159                 mgmt_pending_remove(cmd);
8160                 return err;
8161         }
8162
8163         return 0;
8164 }
8165
8166 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8167                                    void *data, u16 data_len)
8168 {
8169         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8170         struct mgmt_rp_read_local_oob_ext_data *rp;
8171         size_t rp_len;
8172         u16 eir_len;
8173         u8 status, flags, role, addr[7], hash[16], rand[16];
8174         int err;
8175
8176         bt_dev_dbg(hdev, "sock %p", sk);
8177
8178         if (hdev_is_powered(hdev)) {
8179                 switch (cp->type) {
8180                 case BIT(BDADDR_BREDR):
8181                         status = mgmt_bredr_support(hdev);
8182                         if (status)
8183                                 eir_len = 0;
8184                         else
8185                                 eir_len = 5;
8186                         break;
8187                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8188                         status = mgmt_le_support(hdev);
8189                         if (status)
8190                                 eir_len = 0;
8191                         else
8192                                 eir_len = 9 + 3 + 18 + 18 + 3;
8193                         break;
8194                 default:
8195                         status = MGMT_STATUS_INVALID_PARAMS;
8196                         eir_len = 0;
8197                         break;
8198                 }
8199         } else {
8200                 status = MGMT_STATUS_NOT_POWERED;
8201                 eir_len = 0;
8202         }
8203
8204         rp_len = sizeof(*rp) + eir_len;
8205         rp = kmalloc(rp_len, GFP_ATOMIC);
8206         if (!rp)
8207                 return -ENOMEM;
8208
8209         if (!status && !lmp_ssp_capable(hdev)) {
8210                 status = MGMT_STATUS_NOT_SUPPORTED;
8211                 eir_len = 0;
8212         }
8213
8214         if (status)
8215                 goto complete;
8216
8217         hci_dev_lock(hdev);
8218
8219         eir_len = 0;
8220         switch (cp->type) {
8221         case BIT(BDADDR_BREDR):
8222                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8223                         err = read_local_ssp_oob_req(hdev, sk, cp);
8224                         hci_dev_unlock(hdev);
8225                         if (!err)
8226                                 goto done;
8227
8228                         status = MGMT_STATUS_FAILED;
8229                         goto complete;
8230                 } else {
8231                         eir_len = eir_append_data(rp->eir, eir_len,
8232                                                   EIR_CLASS_OF_DEV,
8233                                                   hdev->dev_class, 3);
8234                 }
8235                 break;
8236         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8237                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8238                     smp_generate_oob(hdev, hash, rand) < 0) {
8239                         hci_dev_unlock(hdev);
8240                         status = MGMT_STATUS_FAILED;
8241                         goto complete;
8242                 }
8243
8244                 /* This should return the active RPA, but since the RPA
8245                  * is only programmed on demand, it is really hard to fill
8246                  * this in at the moment. For now disallow retrieving
8247                  * local out-of-band data when privacy is in use.
8248                  *
8249                  * Returning the identity address will not help here since
8250                  * pairing happens before the identity resolving key is
8251                  * known and thus the connection establishment happens
8252                  * based on the RPA and not the identity address.
8253                  */
8254                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8255                         hci_dev_unlock(hdev);
8256                         status = MGMT_STATUS_REJECTED;
8257                         goto complete;
8258                 }
8259
8260                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8261                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8262                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8263                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8264                         memcpy(addr, &hdev->static_addr, 6);
8265                         addr[6] = 0x01;
8266                 } else {
8267                         memcpy(addr, &hdev->bdaddr, 6);
8268                         addr[6] = 0x00;
8269                 }
8270
8271                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8272                                           addr, sizeof(addr));
8273
8274                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8275                         role = 0x02;
8276                 else
8277                         role = 0x01;
8278
8279                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8280                                           &role, sizeof(role));
8281
8282                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8283                         eir_len = eir_append_data(rp->eir, eir_len,
8284                                                   EIR_LE_SC_CONFIRM,
8285                                                   hash, sizeof(hash));
8286
8287                         eir_len = eir_append_data(rp->eir, eir_len,
8288                                                   EIR_LE_SC_RANDOM,
8289                                                   rand, sizeof(rand));
8290                 }
8291
8292                 flags = mgmt_get_adv_discov_flags(hdev);
8293
8294                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8295                         flags |= LE_AD_NO_BREDR;
8296
8297                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8298                                           &flags, sizeof(flags));
8299                 break;
8300         }
8301
8302         hci_dev_unlock(hdev);
8303
8304         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8305
8306         status = MGMT_STATUS_SUCCESS;
8307
8308 complete:
8309         rp->type = cp->type;
8310         rp->eir_len = cpu_to_le16(eir_len);
8311
8312         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8313                                 status, rp, sizeof(*rp) + eir_len);
8314         if (err < 0 || status)
8315                 goto done;
8316
8317         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8318                                  rp, sizeof(*rp) + eir_len,
8319                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8320
8321 done:
8322         kfree(rp);
8323
8324         return err;
8325 }
8326
8327 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8328 {
8329         u32 flags = 0;
8330
8331         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8332         flags |= MGMT_ADV_FLAG_DISCOV;
8333         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8334         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8335         flags |= MGMT_ADV_FLAG_APPEARANCE;
8336         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8337         flags |= MGMT_ADV_PARAM_DURATION;
8338         flags |= MGMT_ADV_PARAM_TIMEOUT;
8339         flags |= MGMT_ADV_PARAM_INTERVALS;
8340         flags |= MGMT_ADV_PARAM_TX_POWER;
8341         flags |= MGMT_ADV_PARAM_SCAN_RSP;
8342
8343         /* In extended adv TX_POWER returned from Set Adv Param
8344          * will be always valid.
8345          */
8346         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8347                 flags |= MGMT_ADV_FLAG_TX_POWER;
8348
8349         if (ext_adv_capable(hdev)) {
8350                 flags |= MGMT_ADV_FLAG_SEC_1M;
8351                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8352                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8353
8354                 if (le_2m_capable(hdev))
8355                         flags |= MGMT_ADV_FLAG_SEC_2M;
8356
8357                 if (le_coded_capable(hdev))
8358                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8359         }
8360
8361         return flags;
8362 }
8363
8364 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8365                              void *data, u16 data_len)
8366 {
8367         struct mgmt_rp_read_adv_features *rp;
8368         size_t rp_len;
8369         int err;
8370         struct adv_info *adv_instance;
8371         u32 supported_flags;
8372         u8 *instance;
8373
8374         bt_dev_dbg(hdev, "sock %p", sk);
8375
8376         if (!lmp_le_capable(hdev))
8377                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8378                                        MGMT_STATUS_REJECTED);
8379
8380         hci_dev_lock(hdev);
8381
8382         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8383         rp = kmalloc(rp_len, GFP_ATOMIC);
8384         if (!rp) {
8385                 hci_dev_unlock(hdev);
8386                 return -ENOMEM;
8387         }
8388
8389         supported_flags = get_supported_adv_flags(hdev);
8390
8391         rp->supported_flags = cpu_to_le32(supported_flags);
8392         rp->max_adv_data_len = max_adv_len(hdev);
8393         rp->max_scan_rsp_len = max_adv_len(hdev);
8394         rp->max_instances = hdev->le_num_of_adv_sets;
8395         rp->num_instances = hdev->adv_instance_cnt;
8396
8397         instance = rp->instance;
8398         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8399                 /* Only instances 1-le_num_of_adv_sets are externally visible */
8400                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8401                         *instance = adv_instance->instance;
8402                         instance++;
8403                 } else {
8404                         rp->num_instances--;
8405                         rp_len--;
8406                 }
8407         }
8408
8409         hci_dev_unlock(hdev);
8410
8411         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8412                                 MGMT_STATUS_SUCCESS, rp, rp_len);
8413
8414         kfree(rp);
8415
8416         return err;
8417 }
8418
8419 static u8 calculate_name_len(struct hci_dev *hdev)
8420 {
8421         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
8422
8423         return eir_append_local_name(hdev, buf, 0);
8424 }
8425
8426 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8427                            bool is_adv_data)
8428 {
8429         u8 max_len = max_adv_len(hdev);
8430
8431         if (is_adv_data) {
8432                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8433                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
8434                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
8435                         max_len -= 3;
8436
8437                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8438                         max_len -= 3;
8439         } else {
8440                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8441                         max_len -= calculate_name_len(hdev);
8442
8443                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8444                         max_len -= 4;
8445         }
8446
8447         return max_len;
8448 }
8449
8450 static bool flags_managed(u32 adv_flags)
8451 {
8452         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8453                             MGMT_ADV_FLAG_LIMITED_DISCOV |
8454                             MGMT_ADV_FLAG_MANAGED_FLAGS);
8455 }
8456
8457 static bool tx_power_managed(u32 adv_flags)
8458 {
8459         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8460 }
8461
8462 static bool name_managed(u32 adv_flags)
8463 {
8464         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8465 }
8466
8467 static bool appearance_managed(u32 adv_flags)
8468 {
8469         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8470 }
8471
8472 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8473                               u8 len, bool is_adv_data)
8474 {
8475         int i, cur_len;
8476         u8 max_len;
8477
8478         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8479
8480         if (len > max_len)
8481                 return false;
8482
8483         /* Make sure that the data is correctly formatted. */
8484         for (i = 0; i < len; i += (cur_len + 1)) {
8485                 cur_len = data[i];
8486
8487                 if (!cur_len)
8488                         continue;
8489
8490                 if (data[i + 1] == EIR_FLAGS &&
8491                     (!is_adv_data || flags_managed(adv_flags)))
8492                         return false;
8493
8494                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8495                         return false;
8496
8497                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8498                         return false;
8499
8500                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8501                         return false;
8502
8503                 if (data[i + 1] == EIR_APPEARANCE &&
8504                     appearance_managed(adv_flags))
8505                         return false;
8506
8507                 /* If the current field length would exceed the total data
8508                  * length, then it's invalid.
8509                  */
8510                 if (i + cur_len >= len)
8511                         return false;
8512         }
8513
8514         return true;
8515 }
8516
8517 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8518 {
8519         u32 supported_flags, phy_flags;
8520
8521         /* The current implementation only supports a subset of the specified
8522          * flags. Also need to check mutual exclusiveness of sec flags.
8523          */
8524         supported_flags = get_supported_adv_flags(hdev);
8525         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8526         if (adv_flags & ~supported_flags ||
8527             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8528                 return false;
8529
8530         return true;
8531 }
8532
8533 static bool adv_busy(struct hci_dev *hdev)
8534 {
8535         return pending_find(MGMT_OP_SET_LE, hdev);
8536 }
8537
8538 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8539                              int err)
8540 {
8541         struct adv_info *adv, *n;
8542
8543         bt_dev_dbg(hdev, "err %d", err);
8544
8545         hci_dev_lock(hdev);
8546
8547         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8548                 u8 instance;
8549
8550                 if (!adv->pending)
8551                         continue;
8552
8553                 if (!err) {
8554                         adv->pending = false;
8555                         continue;
8556                 }
8557
8558                 instance = adv->instance;
8559
8560                 if (hdev->cur_adv_instance == instance)
8561                         cancel_adv_timeout(hdev);
8562
8563                 hci_remove_adv_instance(hdev, instance);
8564                 mgmt_advertising_removed(sk, hdev, instance);
8565         }
8566
8567         hci_dev_unlock(hdev);
8568 }
8569
8570 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8571 {
8572         struct mgmt_pending_cmd *cmd = data;
8573         struct mgmt_cp_add_advertising *cp = cmd->param;
8574         struct mgmt_rp_add_advertising rp;
8575
8576         memset(&rp, 0, sizeof(rp));
8577
8578         rp.instance = cp->instance;
8579
8580         if (err)
8581                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8582                                 mgmt_status(err));
8583         else
8584                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8585                                   mgmt_status(err), &rp, sizeof(rp));
8586
8587         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8588
8589         mgmt_pending_free(cmd);
8590 }
8591
8592 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8593 {
8594         struct mgmt_pending_cmd *cmd = data;
8595         struct mgmt_cp_add_advertising *cp = cmd->param;
8596
8597         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8598 }
8599
8600 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8601                            void *data, u16 data_len)
8602 {
8603         struct mgmt_cp_add_advertising *cp = data;
8604         struct mgmt_rp_add_advertising rp;
8605         u32 flags;
8606         u8 status;
8607         u16 timeout, duration;
8608         unsigned int prev_instance_cnt;
8609         u8 schedule_instance = 0;
8610         struct adv_info *adv, *next_instance;
8611         int err;
8612         struct mgmt_pending_cmd *cmd;
8613
8614         bt_dev_dbg(hdev, "sock %p", sk);
8615
8616         status = mgmt_le_support(hdev);
8617         if (status)
8618                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8619                                        status);
8620
8621         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8622                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8623                                        MGMT_STATUS_INVALID_PARAMS);
8624
8625         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8626                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8627                                        MGMT_STATUS_INVALID_PARAMS);
8628
8629         flags = __le32_to_cpu(cp->flags);
8630         timeout = __le16_to_cpu(cp->timeout);
8631         duration = __le16_to_cpu(cp->duration);
8632
8633         if (!requested_adv_flags_are_valid(hdev, flags))
8634                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8635                                        MGMT_STATUS_INVALID_PARAMS);
8636
8637         hci_dev_lock(hdev);
8638
8639         if (timeout && !hdev_is_powered(hdev)) {
8640                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8641                                       MGMT_STATUS_REJECTED);
8642                 goto unlock;
8643         }
8644
8645         if (adv_busy(hdev)) {
8646                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8647                                       MGMT_STATUS_BUSY);
8648                 goto unlock;
8649         }
8650
8651         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8652             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8653                                cp->scan_rsp_len, false)) {
8654                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8655                                       MGMT_STATUS_INVALID_PARAMS);
8656                 goto unlock;
8657         }
8658
8659         prev_instance_cnt = hdev->adv_instance_cnt;
8660
8661         adv = hci_add_adv_instance(hdev, cp->instance, flags,
8662                                    cp->adv_data_len, cp->data,
8663                                    cp->scan_rsp_len,
8664                                    cp->data + cp->adv_data_len,
8665                                    timeout, duration,
8666                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
8667                                    hdev->le_adv_min_interval,
8668                                    hdev->le_adv_max_interval, 0);
8669         if (IS_ERR(adv)) {
8670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8671                                       MGMT_STATUS_FAILED);
8672                 goto unlock;
8673         }
8674
8675         /* Only trigger an advertising added event if a new instance was
8676          * actually added.
8677          */
8678         if (hdev->adv_instance_cnt > prev_instance_cnt)
8679                 mgmt_advertising_added(sk, hdev, cp->instance);
8680
8681         if (hdev->cur_adv_instance == cp->instance) {
8682                 /* If the currently advertised instance is being changed then
8683                  * cancel the current advertising and schedule the next
8684                  * instance. If there is only one instance then the overridden
8685                  * advertising data will be visible right away.
8686                  */
8687                 cancel_adv_timeout(hdev);
8688
8689                 next_instance = hci_get_next_instance(hdev, cp->instance);
8690                 if (next_instance)
8691                         schedule_instance = next_instance->instance;
8692         } else if (!hdev->adv_instance_timeout) {
8693                 /* Immediately advertise the new instance if no other
8694                  * instance is currently being advertised.
8695                  */
8696                 schedule_instance = cp->instance;
8697         }
8698
8699         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
8700          * there is no instance to be advertised then we have no HCI
8701          * communication to make. Simply return.
8702          */
8703         if (!hdev_is_powered(hdev) ||
8704             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8705             !schedule_instance) {
8706                 rp.instance = cp->instance;
8707                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8708                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8709                 goto unlock;
8710         }
8711
8712         /* We're good to go, update advertising data, parameters, and start
8713          * advertising.
8714          */
8715         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8716                                data_len);
8717         if (!cmd) {
8718                 err = -ENOMEM;
8719                 goto unlock;
8720         }
8721
8722         cp->instance = schedule_instance;
8723
8724         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8725                                  add_advertising_complete);
8726         if (err < 0)
8727                 mgmt_pending_free(cmd);
8728
8729 unlock:
8730         hci_dev_unlock(hdev);
8731
8732         return err;
8733 }
8734
8735 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8736                                         int err)
8737 {
8738         struct mgmt_pending_cmd *cmd = data;
8739         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8740         struct mgmt_rp_add_ext_adv_params rp;
8741         struct adv_info *adv;
8742         u32 flags;
8743
8744         BT_DBG("%s", hdev->name);
8745
8746         hci_dev_lock(hdev);
8747
8748         adv = hci_find_adv_instance(hdev, cp->instance);
8749         if (!adv)
8750                 goto unlock;
8751
8752         rp.instance = cp->instance;
8753         rp.tx_power = adv->tx_power;
8754
8755         /* While we're at it, inform userspace of the available space for this
8756          * advertisement, given the flags that will be used.
8757          */
8758         flags = __le32_to_cpu(cp->flags);
8759         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8760         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8761
8762         if (err) {
8763                 /* If this advertisement was previously advertising and we
8764                  * failed to update it, we signal that it has been removed and
8765                  * delete its structure
8766                  */
8767                 if (!adv->pending)
8768                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8769
8770                 hci_remove_adv_instance(hdev, cp->instance);
8771
8772                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8773                                 mgmt_status(err));
8774         } else {
8775                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8776                                   mgmt_status(err), &rp, sizeof(rp));
8777         }
8778
8779 unlock:
8780         mgmt_pending_free(cmd);
8781
8782         hci_dev_unlock(hdev);
8783 }
8784
8785 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8786 {
8787         struct mgmt_pending_cmd *cmd = data;
8788         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8789
8790         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8791 }
8792
8793 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8794                               void *data, u16 data_len)
8795 {
8796         struct mgmt_cp_add_ext_adv_params *cp = data;
8797         struct mgmt_rp_add_ext_adv_params rp;
8798         struct mgmt_pending_cmd *cmd = NULL;
8799         struct adv_info *adv;
8800         u32 flags, min_interval, max_interval;
8801         u16 timeout, duration;
8802         u8 status;
8803         s8 tx_power;
8804         int err;
8805
8806         BT_DBG("%s", hdev->name);
8807
8808         status = mgmt_le_support(hdev);
8809         if (status)
8810                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8811                                        status);
8812
8813         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8815                                        MGMT_STATUS_INVALID_PARAMS);
8816
8817         /* The purpose of breaking add_advertising into two separate MGMT calls
8818          * for params and data is to allow more parameters to be added to this
8819          * structure in the future. For this reason, we verify that we have the
8820          * bare minimum structure we know of when the interface was defined. Any
8821          * extra parameters we don't know about will be ignored in this request.
8822          */
8823         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8824                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8825                                        MGMT_STATUS_INVALID_PARAMS);
8826
8827         flags = __le32_to_cpu(cp->flags);
8828
8829         if (!requested_adv_flags_are_valid(hdev, flags))
8830                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8831                                        MGMT_STATUS_INVALID_PARAMS);
8832
8833         hci_dev_lock(hdev);
8834
8835         /* In new interface, we require that we are powered to register */
8836         if (!hdev_is_powered(hdev)) {
8837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8838                                       MGMT_STATUS_REJECTED);
8839                 goto unlock;
8840         }
8841
8842         if (adv_busy(hdev)) {
8843                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8844                                       MGMT_STATUS_BUSY);
8845                 goto unlock;
8846         }
8847
8848         /* Parse defined parameters from request, use defaults otherwise */
8849         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8850                   __le16_to_cpu(cp->timeout) : 0;
8851
8852         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8853                    __le16_to_cpu(cp->duration) :
8854                    hdev->def_multi_adv_rotation_duration;
8855
8856         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8857                        __le32_to_cpu(cp->min_interval) :
8858                        hdev->le_adv_min_interval;
8859
8860         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8861                        __le32_to_cpu(cp->max_interval) :
8862                        hdev->le_adv_max_interval;
8863
8864         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8865                    cp->tx_power :
8866                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8867
8868         /* Create advertising instance with no advertising or response data */
8869         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
8870                                    timeout, duration, tx_power, min_interval,
8871                                    max_interval, 0);
8872
8873         if (IS_ERR(adv)) {
8874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8875                                       MGMT_STATUS_FAILED);
8876                 goto unlock;
8877         }
8878
8879         /* Submit request for advertising params if ext adv available */
8880         if (ext_adv_capable(hdev)) {
8881                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8882                                        data, data_len);
8883                 if (!cmd) {
8884                         err = -ENOMEM;
8885                         hci_remove_adv_instance(hdev, cp->instance);
8886                         goto unlock;
8887                 }
8888
8889                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8890                                          add_ext_adv_params_complete);
8891                 if (err < 0)
8892                         mgmt_pending_free(cmd);
8893         } else {
8894                 rp.instance = cp->instance;
8895                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8896                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8897                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8898                 err = mgmt_cmd_complete(sk, hdev->id,
8899                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8900                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8901         }
8902
8903 unlock:
8904         hci_dev_unlock(hdev);
8905
8906         return err;
8907 }
8908
8909 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8910 {
8911         struct mgmt_pending_cmd *cmd = data;
8912         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8913         struct mgmt_rp_add_advertising rp;
8914
8915         add_adv_complete(hdev, cmd->sk, cp->instance, err);
8916
8917         memset(&rp, 0, sizeof(rp));
8918
8919         rp.instance = cp->instance;
8920
8921         if (err)
8922                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8923                                 mgmt_status(err));
8924         else
8925                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8926                                   mgmt_status(err), &rp, sizeof(rp));
8927
8928         mgmt_pending_free(cmd);
8929 }
8930
8931 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8932 {
8933         struct mgmt_pending_cmd *cmd = data;
8934         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8935         int err;
8936
8937         if (ext_adv_capable(hdev)) {
8938                 err = hci_update_adv_data_sync(hdev, cp->instance);
8939                 if (err)
8940                         return err;
8941
8942                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8943                 if (err)
8944                         return err;
8945
8946                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
8947         }
8948
8949         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8950 }
8951
8952 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8953                             u16 data_len)
8954 {
8955         struct mgmt_cp_add_ext_adv_data *cp = data;
8956         struct mgmt_rp_add_ext_adv_data rp;
8957         u8 schedule_instance = 0;
8958         struct adv_info *next_instance;
8959         struct adv_info *adv_instance;
8960         int err = 0;
8961         struct mgmt_pending_cmd *cmd;
8962
8963         BT_DBG("%s", hdev->name);
8964
8965         hci_dev_lock(hdev);
8966
8967         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8968
8969         if (!adv_instance) {
8970                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8971                                       MGMT_STATUS_INVALID_PARAMS);
8972                 goto unlock;
8973         }
8974
8975         /* In new interface, we require that we are powered to register */
8976         if (!hdev_is_powered(hdev)) {
8977                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8978                                       MGMT_STATUS_REJECTED);
8979                 goto clear_new_instance;
8980         }
8981
8982         if (adv_busy(hdev)) {
8983                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8984                                       MGMT_STATUS_BUSY);
8985                 goto clear_new_instance;
8986         }
8987
8988         /* Validate new data */
8989         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8990                                cp->adv_data_len, true) ||
8991             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8992                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8994                                       MGMT_STATUS_INVALID_PARAMS);
8995                 goto clear_new_instance;
8996         }
8997
8998         /* Set the data in the advertising instance */
8999         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9000                                   cp->data, cp->scan_rsp_len,
9001                                   cp->data + cp->adv_data_len);
9002
9003         /* If using software rotation, determine next instance to use */
9004         if (hdev->cur_adv_instance == cp->instance) {
9005                 /* If the currently advertised instance is being changed
9006                  * then cancel the current advertising and schedule the
9007                  * next instance. If there is only one instance then the
9008                  * overridden advertising data will be visible right
9009                  * away
9010                  */
9011                 cancel_adv_timeout(hdev);
9012
9013                 next_instance = hci_get_next_instance(hdev, cp->instance);
9014                 if (next_instance)
9015                         schedule_instance = next_instance->instance;
9016         } else if (!hdev->adv_instance_timeout) {
9017                 /* Immediately advertise the new instance if no other
9018                  * instance is currently being advertised.
9019                  */
9020                 schedule_instance = cp->instance;
9021         }
9022
9023         /* If the HCI_ADVERTISING flag is set or there is no instance to
9024          * be advertised then we have no HCI communication to make.
9025          * Simply return.
9026          */
9027         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9028                 if (adv_instance->pending) {
9029                         mgmt_advertising_added(sk, hdev, cp->instance);
9030                         adv_instance->pending = false;
9031                 }
9032                 rp.instance = cp->instance;
9033                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9034                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9035                 goto unlock;
9036         }
9037
9038         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9039                                data_len);
9040         if (!cmd) {
9041                 err = -ENOMEM;
9042                 goto clear_new_instance;
9043         }
9044
9045         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9046                                  add_ext_adv_data_complete);
9047         if (err < 0) {
9048                 mgmt_pending_free(cmd);
9049                 goto clear_new_instance;
9050         }
9051
9052         /* We were successful in updating data, so trigger advertising_added
9053          * event if this is an instance that wasn't previously advertising. If
9054          * a failure occurs in the requests we initiated, we will remove the
9055          * instance again in add_advertising_complete
9056          */
9057         if (adv_instance->pending)
9058                 mgmt_advertising_added(sk, hdev, cp->instance);
9059
9060         goto unlock;
9061
9062 clear_new_instance:
9063         hci_remove_adv_instance(hdev, cp->instance);
9064
9065 unlock:
9066         hci_dev_unlock(hdev);
9067
9068         return err;
9069 }
9070
9071 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9072                                         int err)
9073 {
9074         struct mgmt_pending_cmd *cmd = data;
9075         struct mgmt_cp_remove_advertising *cp = cmd->param;
9076         struct mgmt_rp_remove_advertising rp;
9077
9078         bt_dev_dbg(hdev, "err %d", err);
9079
9080         memset(&rp, 0, sizeof(rp));
9081         rp.instance = cp->instance;
9082
9083         if (err)
9084                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9085                                 mgmt_status(err));
9086         else
9087                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9088                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9089
9090         mgmt_pending_free(cmd);
9091 }
9092
9093 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9094 {
9095         struct mgmt_pending_cmd *cmd = data;
9096         struct mgmt_cp_remove_advertising *cp = cmd->param;
9097         int err;
9098
9099         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9100         if (err)
9101                 return err;
9102
9103         if (list_empty(&hdev->adv_instances))
9104                 err = hci_disable_advertising_sync(hdev);
9105
9106         return err;
9107 }
9108
9109 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9110                               void *data, u16 data_len)
9111 {
9112         struct mgmt_cp_remove_advertising *cp = data;
9113         struct mgmt_pending_cmd *cmd;
9114         int err;
9115
9116         bt_dev_dbg(hdev, "sock %p", sk);
9117
9118         hci_dev_lock(hdev);
9119
9120         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9121                 err = mgmt_cmd_status(sk, hdev->id,
9122                                       MGMT_OP_REMOVE_ADVERTISING,
9123                                       MGMT_STATUS_INVALID_PARAMS);
9124                 goto unlock;
9125         }
9126
9127         if (pending_find(MGMT_OP_SET_LE, hdev)) {
9128                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9129                                       MGMT_STATUS_BUSY);
9130                 goto unlock;
9131         }
9132
9133         if (list_empty(&hdev->adv_instances)) {
9134                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9135                                       MGMT_STATUS_INVALID_PARAMS);
9136                 goto unlock;
9137         }
9138
9139         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9140                                data_len);
9141         if (!cmd) {
9142                 err = -ENOMEM;
9143                 goto unlock;
9144         }
9145
9146         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9147                                  remove_advertising_complete);
9148         if (err < 0)
9149                 mgmt_pending_free(cmd);
9150
9151 unlock:
9152         hci_dev_unlock(hdev);
9153
9154         return err;
9155 }
9156
9157 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9158                              void *data, u16 data_len)
9159 {
9160         struct mgmt_cp_get_adv_size_info *cp = data;
9161         struct mgmt_rp_get_adv_size_info rp;
9162         u32 flags, supported_flags;
9163
9164         bt_dev_dbg(hdev, "sock %p", sk);
9165
9166         if (!lmp_le_capable(hdev))
9167                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9168                                        MGMT_STATUS_REJECTED);
9169
9170         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9171                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9172                                        MGMT_STATUS_INVALID_PARAMS);
9173
9174         flags = __le32_to_cpu(cp->flags);
9175
9176         /* The current implementation only supports a subset of the specified
9177          * flags.
9178          */
9179         supported_flags = get_supported_adv_flags(hdev);
9180         if (flags & ~supported_flags)
9181                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9182                                        MGMT_STATUS_INVALID_PARAMS);
9183
9184         rp.instance = cp->instance;
9185         rp.flags = cp->flags;
9186         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9187         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9188
9189         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9190                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9191 }
9192
9193 static const struct hci_mgmt_handler mgmt_handlers[] = {
9194         { NULL }, /* 0x0000 (no command) */
9195         { read_version,            MGMT_READ_VERSION_SIZE,
9196                                                 HCI_MGMT_NO_HDEV |
9197                                                 HCI_MGMT_UNTRUSTED },
9198         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9199                                                 HCI_MGMT_NO_HDEV |
9200                                                 HCI_MGMT_UNTRUSTED },
9201         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9202                                                 HCI_MGMT_NO_HDEV |
9203                                                 HCI_MGMT_UNTRUSTED },
9204         { read_controller_info,    MGMT_READ_INFO_SIZE,
9205                                                 HCI_MGMT_UNTRUSTED },
9206         { set_powered,             MGMT_SETTING_SIZE },
9207         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9208         { set_connectable,         MGMT_SETTING_SIZE },
9209         { set_fast_connectable,    MGMT_SETTING_SIZE },
9210         { set_bondable,            MGMT_SETTING_SIZE },
9211         { set_link_security,       MGMT_SETTING_SIZE },
9212         { set_ssp,                 MGMT_SETTING_SIZE },
9213         { set_hs,                  MGMT_SETTING_SIZE },
9214         { set_le,                  MGMT_SETTING_SIZE },
9215         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9216         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9217         { add_uuid,                MGMT_ADD_UUID_SIZE },
9218         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9219         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9220                                                 HCI_MGMT_VAR_LEN },
9221         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9222                                                 HCI_MGMT_VAR_LEN },
9223         { disconnect,              MGMT_DISCONNECT_SIZE },
9224         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9225         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9226         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9227         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9228         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9229         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9230         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9231         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9232         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9233         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9234         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9235         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9236         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9237                                                 HCI_MGMT_VAR_LEN },
9238         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9239         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9240         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9241         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9242         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9243         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9244         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9245         { set_advertising,         MGMT_SETTING_SIZE },
9246         { set_bredr,               MGMT_SETTING_SIZE },
9247         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9248         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9249         { set_secure_conn,         MGMT_SETTING_SIZE },
9250         { set_debug_keys,          MGMT_SETTING_SIZE },
9251         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9252         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9253                                                 HCI_MGMT_VAR_LEN },
9254         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9255         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9256         { add_device,              MGMT_ADD_DEVICE_SIZE },
9257         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9258         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9259                                                 HCI_MGMT_VAR_LEN },
9260         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9261                                                 HCI_MGMT_NO_HDEV |
9262                                                 HCI_MGMT_UNTRUSTED },
9263         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9264                                                 HCI_MGMT_UNCONFIGURED |
9265                                                 HCI_MGMT_UNTRUSTED },
9266         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9267                                                 HCI_MGMT_UNCONFIGURED },
9268         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9269                                                 HCI_MGMT_UNCONFIGURED },
9270         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9271                                                 HCI_MGMT_VAR_LEN },
9272         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9273         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9274                                                 HCI_MGMT_NO_HDEV |
9275                                                 HCI_MGMT_UNTRUSTED },
9276         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9277         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9278                                                 HCI_MGMT_VAR_LEN },
9279         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9280         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9281         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9282         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9283                                                 HCI_MGMT_UNTRUSTED },
9284         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9285         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9286         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9287         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9288                                                 HCI_MGMT_VAR_LEN },
9289         { set_wideband_speech,     MGMT_SETTING_SIZE },
9290         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
9291                                                 HCI_MGMT_UNTRUSTED },
9292         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9293                                                 HCI_MGMT_UNTRUSTED |
9294                                                 HCI_MGMT_HDEV_OPTIONAL },
9295         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9296                                                 HCI_MGMT_VAR_LEN |
9297                                                 HCI_MGMT_HDEV_OPTIONAL },
9298         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9299                                                 HCI_MGMT_UNTRUSTED },
9300         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9301                                                 HCI_MGMT_VAR_LEN },
9302         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9303                                                 HCI_MGMT_UNTRUSTED },
9304         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9305                                                 HCI_MGMT_VAR_LEN },
9306         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9307         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9308         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9309         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9310                                                 HCI_MGMT_VAR_LEN },
9311         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9312         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9313                                                 HCI_MGMT_VAR_LEN },
9314         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
9315                                                 HCI_MGMT_VAR_LEN },
9316         { add_adv_patterns_monitor_rssi,
9317                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9318                                                 HCI_MGMT_VAR_LEN },
9319         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
9320                                                 HCI_MGMT_VAR_LEN },
9321         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
9322         { mesh_send,               MGMT_MESH_SEND_SIZE,
9323                                                 HCI_MGMT_VAR_LEN },
9324         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
9325 };
9326
9327 void mgmt_index_added(struct hci_dev *hdev)
9328 {
9329         struct mgmt_ev_ext_index ev;
9330
9331         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9332                 return;
9333
9334         switch (hdev->dev_type) {
9335         case HCI_PRIMARY:
9336                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9337                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9338                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9339                         ev.type = 0x01;
9340                 } else {
9341                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9342                                          HCI_MGMT_INDEX_EVENTS);
9343                         ev.type = 0x00;
9344                 }
9345                 break;
9346         case HCI_AMP:
9347                 ev.type = 0x02;
9348                 break;
9349         default:
9350                 return;
9351         }
9352
9353         ev.bus = hdev->bus;
9354
9355         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9356                          HCI_MGMT_EXT_INDEX_EVENTS);
9357 }
9358
9359 void mgmt_index_removed(struct hci_dev *hdev)
9360 {
9361         struct mgmt_ev_ext_index ev;
9362         u8 status = MGMT_STATUS_INVALID_INDEX;
9363
9364         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9365                 return;
9366
9367         switch (hdev->dev_type) {
9368         case HCI_PRIMARY:
9369                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9370
9371                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9372                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9373                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9374                         ev.type = 0x01;
9375                 } else {
9376                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9377                                          HCI_MGMT_INDEX_EVENTS);
9378                         ev.type = 0x00;
9379                 }
9380                 break;
9381         case HCI_AMP:
9382                 ev.type = 0x02;
9383                 break;
9384         default:
9385                 return;
9386         }
9387
9388         ev.bus = hdev->bus;
9389
9390         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9391                          HCI_MGMT_EXT_INDEX_EVENTS);
9392
9393         /* Cancel any remaining timed work */
9394         if (!hci_dev_test_flag(hdev, HCI_MGMT))
9395                 return;
9396         cancel_delayed_work_sync(&hdev->discov_off);
9397         cancel_delayed_work_sync(&hdev->service_cache);
9398         cancel_delayed_work_sync(&hdev->rpa_expired);
9399 }
9400
9401 void mgmt_power_on(struct hci_dev *hdev, int err)
9402 {
9403         struct cmd_lookup match = { NULL, hdev };
9404
9405         bt_dev_dbg(hdev, "err %d", err);
9406
9407         hci_dev_lock(hdev);
9408
9409         if (!err) {
9410                 restart_le_actions(hdev);
9411                 hci_update_passive_scan(hdev);
9412         }
9413
9414         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9415
9416         new_settings(hdev, match.sk);
9417
9418         if (match.sk)
9419                 sock_put(match.sk);
9420
9421         hci_dev_unlock(hdev);
9422 }
9423
9424 void __mgmt_power_off(struct hci_dev *hdev)
9425 {
9426         struct cmd_lookup match = { NULL, hdev };
9427         u8 status, zero_cod[] = { 0, 0, 0 };
9428
9429         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9430
9431         /* If the power off is because of hdev unregistration let
9432          * use the appropriate INVALID_INDEX status. Otherwise use
9433          * NOT_POWERED. We cover both scenarios here since later in
9434          * mgmt_index_removed() any hci_conn callbacks will have already
9435          * been triggered, potentially causing misleading DISCONNECTED
9436          * status responses.
9437          */
9438         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9439                 status = MGMT_STATUS_INVALID_INDEX;
9440         else
9441                 status = MGMT_STATUS_NOT_POWERED;
9442
9443         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9444
9445         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9446                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9447                                    zero_cod, sizeof(zero_cod),
9448                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9449                 ext_info_changed(hdev, NULL);
9450         }
9451
9452         new_settings(hdev, match.sk);
9453
9454         if (match.sk)
9455                 sock_put(match.sk);
9456 }
9457
9458 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9459 {
9460         struct mgmt_pending_cmd *cmd;
9461         u8 status;
9462
9463         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9464         if (!cmd)
9465                 return;
9466
9467         if (err == -ERFKILL)
9468                 status = MGMT_STATUS_RFKILLED;
9469         else
9470                 status = MGMT_STATUS_FAILED;
9471
9472         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9473
9474         mgmt_pending_remove(cmd);
9475 }
9476
9477 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9478                        bool persistent)
9479 {
9480         struct mgmt_ev_new_link_key ev;
9481
9482         memset(&ev, 0, sizeof(ev));
9483
9484         ev.store_hint = persistent;
9485         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9486         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
9487         ev.key.type = key->type;
9488         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9489         ev.key.pin_len = key->pin_len;
9490
9491         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9492 }
9493
9494 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9495 {
9496         switch (ltk->type) {
9497         case SMP_LTK:
9498         case SMP_LTK_RESPONDER:
9499                 if (ltk->authenticated)
9500                         return MGMT_LTK_AUTHENTICATED;
9501                 return MGMT_LTK_UNAUTHENTICATED;
9502         case SMP_LTK_P256:
9503                 if (ltk->authenticated)
9504                         return MGMT_LTK_P256_AUTH;
9505                 return MGMT_LTK_P256_UNAUTH;
9506         case SMP_LTK_P256_DEBUG:
9507                 return MGMT_LTK_P256_DEBUG;
9508         }
9509
9510         return MGMT_LTK_UNAUTHENTICATED;
9511 }
9512
9513 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9514 {
9515         struct mgmt_ev_new_long_term_key ev;
9516
9517         memset(&ev, 0, sizeof(ev));
9518
9519         /* Devices using resolvable or non-resolvable random addresses
9520          * without providing an identity resolving key don't require
9521          * to store long term keys. Their addresses will change the
9522          * next time around.
9523          *
9524          * Only when a remote device provides an identity address
9525          * make sure the long term key is stored. If the remote
9526          * identity is known, the long term keys are internally
9527          * mapped to the identity address. So allow static random
9528          * and public addresses here.
9529          */
9530         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9531             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9532                 ev.store_hint = 0x00;
9533         else
9534                 ev.store_hint = persistent;
9535
9536         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9537         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
9538         ev.key.type = mgmt_ltk_type(key);
9539         ev.key.enc_size = key->enc_size;
9540         ev.key.ediv = key->ediv;
9541         ev.key.rand = key->rand;
9542
9543         if (key->type == SMP_LTK)
9544                 ev.key.initiator = 1;
9545
9546         /* Make sure we copy only the significant bytes based on the
9547          * encryption key size, and set the rest of the value to zeroes.
9548          */
9549         memcpy(ev.key.val, key->val, key->enc_size);
9550         memset(ev.key.val + key->enc_size, 0,
9551                sizeof(ev.key.val) - key->enc_size);
9552
9553         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9554 }
9555
9556 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9557 {
9558         struct mgmt_ev_new_irk ev;
9559
9560         memset(&ev, 0, sizeof(ev));
9561
9562         ev.store_hint = persistent;
9563
9564         bacpy(&ev.rpa, &irk->rpa);
9565         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9566         ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
9567         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9568
9569         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9570 }
9571
9572 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9573                    bool persistent)
9574 {
9575         struct mgmt_ev_new_csrk ev;
9576
9577         memset(&ev, 0, sizeof(ev));
9578
9579         /* Devices using resolvable or non-resolvable random addresses
9580          * without providing an identity resolving key don't require
9581          * to store signature resolving keys. Their addresses will change
9582          * the next time around.
9583          *
9584          * Only when a remote device provides an identity address
9585          * make sure the signature resolving key is stored. So allow
9586          * static random and public addresses here.
9587          */
9588         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9589             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9590                 ev.store_hint = 0x00;
9591         else
9592                 ev.store_hint = persistent;
9593
9594         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9595         ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
9596         ev.key.type = csrk->type;
9597         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9598
9599         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9600 }
9601
9602 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9603                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9604                          u16 max_interval, u16 latency, u16 timeout)
9605 {
9606         struct mgmt_ev_new_conn_param ev;
9607
9608         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9609                 return;
9610
9611         memset(&ev, 0, sizeof(ev));
9612         bacpy(&ev.addr.bdaddr, bdaddr);
9613         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9614         ev.store_hint = store_hint;
9615         ev.min_interval = cpu_to_le16(min_interval);
9616         ev.max_interval = cpu_to_le16(max_interval);
9617         ev.latency = cpu_to_le16(latency);
9618         ev.timeout = cpu_to_le16(timeout);
9619
9620         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9621 }
9622
9623 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9624                            u8 *name, u8 name_len)
9625 {
9626         struct sk_buff *skb;
9627         struct mgmt_ev_device_connected *ev;
9628         u16 eir_len = 0;
9629         u32 flags = 0;
9630
9631         if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
9632                 return;
9633
9634         /* allocate buff for LE or BR/EDR adv */
9635         if (conn->le_adv_data_len > 0)
9636                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9637                                      sizeof(*ev) + conn->le_adv_data_len);
9638         else
9639                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9640                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
9641                                      eir_precalc_len(sizeof(conn->dev_class)));
9642
9643         ev = skb_put(skb, sizeof(*ev));
9644         bacpy(&ev->addr.bdaddr, &conn->dst);
9645         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9646
9647         if (conn->out)
9648                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9649
9650         ev->flags = __cpu_to_le32(flags);
9651
9652         /* We must ensure that the EIR Data fields are ordered and
9653          * unique. Keep it simple for now and avoid the problem by not
9654          * adding any BR/EDR data to the LE adv.
9655          */
9656         if (conn->le_adv_data_len > 0) {
9657                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9658                 eir_len = conn->le_adv_data_len;
9659         } else {
9660                 if (name)
9661                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
9662
9663                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
9664                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
9665                                                     conn->dev_class, sizeof(conn->dev_class));
9666         }
9667
9668         ev->eir_len = cpu_to_le16(eir_len);
9669
9670         mgmt_event_skb(skb, NULL);
9671 }
9672
9673 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9674 {
9675         struct sock **sk = data;
9676
9677         cmd->cmd_complete(cmd, 0);
9678
9679         *sk = cmd->sk;
9680         sock_hold(*sk);
9681
9682         mgmt_pending_remove(cmd);
9683 }
9684
9685 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9686 {
9687         struct hci_dev *hdev = data;
9688         struct mgmt_cp_unpair_device *cp = cmd->param;
9689
9690         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9691
9692         cmd->cmd_complete(cmd, 0);
9693         mgmt_pending_remove(cmd);
9694 }
9695
9696 bool mgmt_powering_down(struct hci_dev *hdev)
9697 {
9698         struct mgmt_pending_cmd *cmd;
9699         struct mgmt_mode *cp;
9700
9701         if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
9702                 return true;
9703
9704         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9705         if (!cmd)
9706                 return false;
9707
9708         cp = cmd->param;
9709         if (!cp->val)
9710                 return true;
9711
9712         return false;
9713 }
9714
9715 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9716                               u8 link_type, u8 addr_type, u8 reason,
9717                               bool mgmt_connected)
9718 {
9719         struct mgmt_ev_device_disconnected ev;
9720         struct sock *sk = NULL;
9721
9722         if (!mgmt_connected)
9723                 return;
9724
9725         if (link_type != ACL_LINK && link_type != LE_LINK)
9726                 return;
9727
9728         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9729
9730         bacpy(&ev.addr.bdaddr, bdaddr);
9731         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9732         ev.reason = reason;
9733
9734         /* Report disconnects due to suspend */
9735         if (hdev->suspended)
9736                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9737
9738         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9739
9740         if (sk)
9741                 sock_put(sk);
9742
9743         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9744                              hdev);
9745 }
9746
9747 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9748                             u8 link_type, u8 addr_type, u8 status)
9749 {
9750         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9751         struct mgmt_cp_disconnect *cp;
9752         struct mgmt_pending_cmd *cmd;
9753
9754         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9755                              hdev);
9756
9757         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9758         if (!cmd)
9759                 return;
9760
9761         cp = cmd->param;
9762
9763         if (bacmp(bdaddr, &cp->addr.bdaddr))
9764                 return;
9765
9766         if (cp->addr.type != bdaddr_type)
9767                 return;
9768
9769         cmd->cmd_complete(cmd, mgmt_status(status));
9770         mgmt_pending_remove(cmd);
9771 }
9772
9773 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9774                          u8 addr_type, u8 status)
9775 {
9776         struct mgmt_ev_connect_failed ev;
9777
9778         bacpy(&ev.addr.bdaddr, bdaddr);
9779         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9780         ev.status = mgmt_status(status);
9781
9782         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9783 }
9784
9785 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9786 {
9787         struct mgmt_ev_pin_code_request ev;
9788
9789         bacpy(&ev.addr.bdaddr, bdaddr);
9790         ev.addr.type = BDADDR_BREDR;
9791         ev.secure = secure;
9792
9793         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9794 }
9795
9796 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9797                                   u8 status)
9798 {
9799         struct mgmt_pending_cmd *cmd;
9800
9801         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9802         if (!cmd)
9803                 return;
9804
9805         cmd->cmd_complete(cmd, mgmt_status(status));
9806         mgmt_pending_remove(cmd);
9807 }
9808
9809 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9810                                       u8 status)
9811 {
9812         struct mgmt_pending_cmd *cmd;
9813
9814         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9815         if (!cmd)
9816                 return;
9817
9818         cmd->cmd_complete(cmd, mgmt_status(status));
9819         mgmt_pending_remove(cmd);
9820 }
9821
9822 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9823                               u8 link_type, u8 addr_type, u32 value,
9824                               u8 confirm_hint)
9825 {
9826         struct mgmt_ev_user_confirm_request ev;
9827
9828         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9829
9830         bacpy(&ev.addr.bdaddr, bdaddr);
9831         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9832         ev.confirm_hint = confirm_hint;
9833         ev.value = cpu_to_le32(value);
9834
9835         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9836                           NULL);
9837 }
9838
9839 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9840                               u8 link_type, u8 addr_type)
9841 {
9842         struct mgmt_ev_user_passkey_request ev;
9843
9844         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9845
9846         bacpy(&ev.addr.bdaddr, bdaddr);
9847         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9848
9849         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9850                           NULL);
9851 }
9852
9853 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9854                                       u8 link_type, u8 addr_type, u8 status,
9855                                       u8 opcode)
9856 {
9857         struct mgmt_pending_cmd *cmd;
9858
9859         cmd = pending_find(opcode, hdev);
9860         if (!cmd)
9861                 return -ENOENT;
9862
9863         cmd->cmd_complete(cmd, mgmt_status(status));
9864         mgmt_pending_remove(cmd);
9865
9866         return 0;
9867 }
9868
9869 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9870                                      u8 link_type, u8 addr_type, u8 status)
9871 {
9872         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9873                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9874 }
9875
9876 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9877                                          u8 link_type, u8 addr_type, u8 status)
9878 {
9879         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9880                                           status,
9881                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9882 }
9883
9884 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9885                                      u8 link_type, u8 addr_type, u8 status)
9886 {
9887         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9888                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9889 }
9890
9891 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9892                                          u8 link_type, u8 addr_type, u8 status)
9893 {
9894         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9895                                           status,
9896                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9897 }
9898
9899 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9900                              u8 link_type, u8 addr_type, u32 passkey,
9901                              u8 entered)
9902 {
9903         struct mgmt_ev_passkey_notify ev;
9904
9905         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9906
9907         bacpy(&ev.addr.bdaddr, bdaddr);
9908         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9909         ev.passkey = __cpu_to_le32(passkey);
9910         ev.entered = entered;
9911
9912         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9913 }
9914
9915 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9916 {
9917         struct mgmt_ev_auth_failed ev;
9918         struct mgmt_pending_cmd *cmd;
9919         u8 status = mgmt_status(hci_status);
9920
9921         bacpy(&ev.addr.bdaddr, &conn->dst);
9922         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9923         ev.status = status;
9924
9925         cmd = find_pairing(conn);
9926
9927         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9928                     cmd ? cmd->sk : NULL);
9929
9930         if (cmd) {
9931                 cmd->cmd_complete(cmd, status);
9932                 mgmt_pending_remove(cmd);
9933         }
9934 }
9935
9936 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9937 {
9938         struct cmd_lookup match = { NULL, hdev };
9939         bool changed;
9940
9941         if (status) {
9942                 u8 mgmt_err = mgmt_status(status);
9943                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9944                                      cmd_status_rsp, &mgmt_err);
9945                 return;
9946         }
9947
9948         if (test_bit(HCI_AUTH, &hdev->flags))
9949                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9950         else
9951                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9952
9953         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9954                              &match);
9955
9956         if (changed)
9957                 new_settings(hdev, match.sk);
9958
9959         if (match.sk)
9960                 sock_put(match.sk);
9961 }
9962
9963 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9964 {
9965         struct cmd_lookup *match = data;
9966
9967         if (match->sk == NULL) {
9968                 match->sk = cmd->sk;
9969                 sock_hold(match->sk);
9970         }
9971 }
9972
9973 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9974                                     u8 status)
9975 {
9976         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9977
9978         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9979         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9980         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9981
9982         if (!status) {
9983                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9984                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9985                 ext_info_changed(hdev, NULL);
9986         }
9987
9988         if (match.sk)
9989                 sock_put(match.sk);
9990 }
9991
9992 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9993 {
9994         struct mgmt_cp_set_local_name ev;
9995         struct mgmt_pending_cmd *cmd;
9996
9997         if (status)
9998                 return;
9999
10000         memset(&ev, 0, sizeof(ev));
10001         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10002         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10003
10004         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10005         if (!cmd) {
10006                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10007
10008                 /* If this is a HCI command related to powering on the
10009                  * HCI dev don't send any mgmt signals.
10010                  */
10011                 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10012                         return;
10013
10014                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10015                         return;
10016         }
10017
10018         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10019                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10020         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10021 }
10022
10023 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10024 {
10025         int i;
10026
10027         for (i = 0; i < uuid_count; i++) {
10028                 if (!memcmp(uuid, uuids[i], 16))
10029                         return true;
10030         }
10031
10032         return false;
10033 }
10034
10035 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10036 {
10037         u16 parsed = 0;
10038
10039         while (parsed < eir_len) {
10040                 u8 field_len = eir[0];
10041                 u8 uuid[16];
10042                 int i;
10043
10044                 if (field_len == 0)
10045                         break;
10046
10047                 if (eir_len - parsed < field_len + 1)
10048                         break;
10049
10050                 switch (eir[1]) {
10051                 case EIR_UUID16_ALL:
10052                 case EIR_UUID16_SOME:
10053                         for (i = 0; i + 3 <= field_len; i += 2) {
10054                                 memcpy(uuid, bluetooth_base_uuid, 16);
10055                                 uuid[13] = eir[i + 3];
10056                                 uuid[12] = eir[i + 2];
10057                                 if (has_uuid(uuid, uuid_count, uuids))
10058                                         return true;
10059                         }
10060                         break;
10061                 case EIR_UUID32_ALL:
10062                 case EIR_UUID32_SOME:
10063                         for (i = 0; i + 5 <= field_len; i += 4) {
10064                                 memcpy(uuid, bluetooth_base_uuid, 16);
10065                                 uuid[15] = eir[i + 5];
10066                                 uuid[14] = eir[i + 4];
10067                                 uuid[13] = eir[i + 3];
10068                                 uuid[12] = eir[i + 2];
10069                                 if (has_uuid(uuid, uuid_count, uuids))
10070                                         return true;
10071                         }
10072                         break;
10073                 case EIR_UUID128_ALL:
10074                 case EIR_UUID128_SOME:
10075                         for (i = 0; i + 17 <= field_len; i += 16) {
10076                                 memcpy(uuid, eir + i + 2, 16);
10077                                 if (has_uuid(uuid, uuid_count, uuids))
10078                                         return true;
10079                         }
10080                         break;
10081                 }
10082
10083                 parsed += field_len + 1;
10084                 eir += field_len + 1;
10085         }
10086
10087         return false;
10088 }
10089
10090 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10091                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10092 {
10093         /* If a RSSI threshold has been specified, and
10094          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10095          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10096          * is set, let it through for further processing, as we might need to
10097          * restart the scan.
10098          *
10099          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10100          * the results are also dropped.
10101          */
10102         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10103             (rssi == HCI_RSSI_INVALID ||
10104             (rssi < hdev->discovery.rssi &&
10105              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10106                 return  false;
10107
10108         if (hdev->discovery.uuid_count != 0) {
10109                 /* If a list of UUIDs is provided in filter, results with no
10110                  * matching UUID should be dropped.
10111                  */
10112                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10113                                    hdev->discovery.uuids) &&
10114                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10115                                    hdev->discovery.uuid_count,
10116                                    hdev->discovery.uuids))
10117                         return false;
10118         }
10119
10120         /* If duplicate filtering does not report RSSI changes, then restart
10121          * scanning to ensure updated result with updated RSSI values.
10122          */
10123         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10124                 /* Validate RSSI value against the RSSI threshold once more. */
10125                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10126                     rssi < hdev->discovery.rssi)
10127                         return false;
10128         }
10129
10130         return true;
10131 }
10132
10133 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10134                                   bdaddr_t *bdaddr, u8 addr_type)
10135 {
10136         struct mgmt_ev_adv_monitor_device_lost ev;
10137
10138         ev.monitor_handle = cpu_to_le16(handle);
10139         bacpy(&ev.addr.bdaddr, bdaddr);
10140         ev.addr.type = addr_type;
10141
10142         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10143                    NULL);
10144 }
10145
10146 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10147                                                struct sk_buff *skb,
10148                                                struct sock *skip_sk,
10149                                                u16 handle)
10150 {
10151         struct sk_buff *advmon_skb;
10152         size_t advmon_skb_len;
10153         __le16 *monitor_handle;
10154
10155         if (!skb)
10156                 return;
10157
10158         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10159                           sizeof(struct mgmt_ev_device_found)) + skb->len;
10160         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10161                                     advmon_skb_len);
10162         if (!advmon_skb)
10163                 return;
10164
10165         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10166          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10167          * store monitor_handle of the matched monitor.
10168          */
10169         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10170         *monitor_handle = cpu_to_le16(handle);
10171         skb_put_data(advmon_skb, skb->data, skb->len);
10172
10173         mgmt_event_skb(advmon_skb, skip_sk);
10174 }
10175
10176 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10177                                           bdaddr_t *bdaddr, bool report_device,
10178                                           struct sk_buff *skb,
10179                                           struct sock *skip_sk)
10180 {
10181         struct monitored_device *dev, *tmp;
10182         bool matched = false;
10183         bool notified = false;
10184
10185         /* We have received the Advertisement Report because:
10186          * 1. the kernel has initiated active discovery
10187          * 2. if not, we have pend_le_reports > 0 in which case we are doing
10188          *    passive scanning
10189          * 3. if none of the above is true, we have one or more active
10190          *    Advertisement Monitor
10191          *
10192          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10193          * and report ONLY one advertisement per device for the matched Monitor
10194          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10195          *
10196          * For case 3, since we are not active scanning and all advertisements
10197          * received are due to a matched Advertisement Monitor, report all
10198          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10199          */
10200         if (report_device && !hdev->advmon_pend_notify) {
10201                 mgmt_event_skb(skb, skip_sk);
10202                 return;
10203         }
10204
10205         hdev->advmon_pend_notify = false;
10206
10207         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10208                 if (!bacmp(&dev->bdaddr, bdaddr)) {
10209                         matched = true;
10210
10211                         if (!dev->notified) {
10212                                 mgmt_send_adv_monitor_device_found(hdev, skb,
10213                                                                    skip_sk,
10214                                                                    dev->handle);
10215                                 notified = true;
10216                                 dev->notified = true;
10217                         }
10218                 }
10219
10220                 if (!dev->notified)
10221                         hdev->advmon_pend_notify = true;
10222         }
10223
10224         if (!report_device &&
10225             ((matched && !notified) || !msft_monitor_supported(hdev))) {
10226                 /* Handle 0 indicates that we are not active scanning and this
10227                  * is a subsequent advertisement report for an already matched
10228                  * Advertisement Monitor or the controller offloading support
10229                  * is not available.
10230                  */
10231                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10232         }
10233
10234         if (report_device)
10235                 mgmt_event_skb(skb, skip_sk);
10236         else
10237                 kfree_skb(skb);
10238 }
10239
10240 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10241                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10242                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10243                               u64 instant)
10244 {
10245         struct sk_buff *skb;
10246         struct mgmt_ev_mesh_device_found *ev;
10247         int i, j;
10248
10249         if (!hdev->mesh_ad_types[0])
10250                 goto accepted;
10251
10252         /* Scan for requested AD types */
10253         if (eir_len > 0) {
10254                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10255                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10256                                 if (!hdev->mesh_ad_types[j])
10257                                         break;
10258
10259                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
10260                                         goto accepted;
10261                         }
10262                 }
10263         }
10264
10265         if (scan_rsp_len > 0) {
10266                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10267                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10268                                 if (!hdev->mesh_ad_types[j])
10269                                         break;
10270
10271                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10272                                         goto accepted;
10273                         }
10274                 }
10275         }
10276
10277         return;
10278
10279 accepted:
10280         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10281                              sizeof(*ev) + eir_len + scan_rsp_len);
10282         if (!skb)
10283                 return;
10284
10285         ev = skb_put(skb, sizeof(*ev));
10286
10287         bacpy(&ev->addr.bdaddr, bdaddr);
10288         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10289         ev->rssi = rssi;
10290         ev->flags = cpu_to_le32(flags);
10291         ev->instant = cpu_to_le64(instant);
10292
10293         if (eir_len > 0)
10294                 /* Copy EIR or advertising data into event */
10295                 skb_put_data(skb, eir, eir_len);
10296
10297         if (scan_rsp_len > 0)
10298                 /* Append scan response data to event */
10299                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10300
10301         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10302
10303         mgmt_event_skb(skb, NULL);
10304 }
10305
10306 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10307                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10308                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10309                        u64 instant)
10310 {
10311         struct sk_buff *skb;
10312         struct mgmt_ev_device_found *ev;
10313         bool report_device = hci_discovery_active(hdev);
10314
10315         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10316                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10317                                   eir, eir_len, scan_rsp, scan_rsp_len,
10318                                   instant);
10319
10320         /* Don't send events for a non-kernel initiated discovery. With
10321          * LE one exception is if we have pend_le_reports > 0 in which
10322          * case we're doing passive scanning and want these events.
10323          */
10324         if (!hci_discovery_active(hdev)) {
10325                 if (link_type == ACL_LINK)
10326                         return;
10327                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10328                         report_device = true;
10329                 else if (!hci_is_adv_monitoring(hdev))
10330                         return;
10331         }
10332
10333         if (hdev->discovery.result_filtering) {
10334                 /* We are using service discovery */
10335                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10336                                      scan_rsp_len))
10337                         return;
10338         }
10339
10340         if (hdev->discovery.limited) {
10341                 /* Check for limited discoverable bit */
10342                 if (dev_class) {
10343                         if (!(dev_class[1] & 0x20))
10344                                 return;
10345                 } else {
10346                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10347                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10348                                 return;
10349                 }
10350         }
10351
10352         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10353         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10354                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
10355         if (!skb)
10356                 return;
10357
10358         ev = skb_put(skb, sizeof(*ev));
10359
10360         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10361          * RSSI value was reported as 0 when not available. This behavior
10362          * is kept when using device discovery. This is required for full
10363          * backwards compatibility with the API.
10364          *
10365          * However when using service discovery, the value 127 will be
10366          * returned when the RSSI is not available.
10367          */
10368         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10369             link_type == ACL_LINK)
10370                 rssi = 0;
10371
10372         bacpy(&ev->addr.bdaddr, bdaddr);
10373         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10374         ev->rssi = rssi;
10375         ev->flags = cpu_to_le32(flags);
10376
10377         if (eir_len > 0)
10378                 /* Copy EIR or advertising data into event */
10379                 skb_put_data(skb, eir, eir_len);
10380
10381         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10382                 u8 eir_cod[5];
10383
10384                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10385                                            dev_class, 3);
10386                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10387         }
10388
10389         if (scan_rsp_len > 0)
10390                 /* Append scan response data to event */
10391                 skb_put_data(skb, scan_rsp, scan_rsp_len);
10392
10393         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10394
10395         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10396 }
10397
10398 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10399                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10400 {
10401         struct sk_buff *skb;
10402         struct mgmt_ev_device_found *ev;
10403         u16 eir_len = 0;
10404         u32 flags = 0;
10405
10406         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10407                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10408
10409         ev = skb_put(skb, sizeof(*ev));
10410         bacpy(&ev->addr.bdaddr, bdaddr);
10411         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10412         ev->rssi = rssi;
10413
10414         if (name)
10415                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10416         else
10417                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10418
10419         ev->eir_len = cpu_to_le16(eir_len);
10420         ev->flags = cpu_to_le32(flags);
10421
10422         mgmt_event_skb(skb, NULL);
10423 }
10424
10425 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10426 {
10427         struct mgmt_ev_discovering ev;
10428
10429         bt_dev_dbg(hdev, "discovering %u", discovering);
10430
10431         memset(&ev, 0, sizeof(ev));
10432         ev.type = hdev->discovery.type;
10433         ev.discovering = discovering;
10434
10435         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10436 }
10437
10438 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10439 {
10440         struct mgmt_ev_controller_suspend ev;
10441
10442         ev.suspend_state = state;
10443         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10444 }
10445
10446 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10447                    u8 addr_type)
10448 {
10449         struct mgmt_ev_controller_resume ev;
10450
10451         ev.wake_reason = reason;
10452         if (bdaddr) {
10453                 bacpy(&ev.addr.bdaddr, bdaddr);
10454                 ev.addr.type = addr_type;
10455         } else {
10456                 memset(&ev.addr, 0, sizeof(ev.addr));
10457         }
10458
10459         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10460 }
10461
10462 static struct hci_mgmt_chan chan = {
10463         .channel        = HCI_CHANNEL_CONTROL,
10464         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10465         .handlers       = mgmt_handlers,
10466         .hdev_init      = mgmt_init_hdev,
10467 };
10468
10469 int mgmt_init(void)
10470 {
10471         return hci_mgmt_chan_register(&chan);
10472 }
10473
10474 void mgmt_exit(void)
10475 {
10476         hci_mgmt_chan_unregister(&chan);
10477 }
10478
10479 void mgmt_cleanup(struct sock *sk)
10480 {
10481         struct mgmt_mesh_tx *mesh_tx;
10482         struct hci_dev *hdev;
10483
10484         read_lock(&hci_dev_list_lock);
10485
10486         list_for_each_entry(hdev, &hci_dev_list, list) {
10487                 do {
10488                         mesh_tx = mgmt_mesh_next(hdev, sk);
10489
10490                         if (mesh_tx)
10491                                 mesh_send_complete(hdev, mesh_tx, true);
10492                 } while (mesh_tx);
10493         }
10494
10495         read_unlock(&hci_dev_list_lock);
10496 }