1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3
   4   Copyright (C) 2010  Nokia Corporation
   5   Copyright (C) 2011-2012 Intel Corporation
   6
   7   This program is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU General Public License version 2 as
   9   published by the Free Software Foundation;
  10
  11   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22   SOFTWARE IS DISCLAIMED.
  23*/
  24
  25/* Bluetooth HCI Management interface */
  26
  27#include <linux/module.h>
  28#include <asm/unaligned.h>
  29
  30#include <net/bluetooth/bluetooth.h>
  31#include <net/bluetooth/hci_core.h>
  32#include <net/bluetooth/hci_sock.h>
  33#include <net/bluetooth/l2cap.h>
  34#include <net/bluetooth/mgmt.h>
  35
  36#include "hci_request.h"
  37#include "smp.h"
  38#include "mgmt_util.h"
  39
  40#define MGMT_VERSION	1
  41#define MGMT_REVISION	14
  42
  43static const u16 mgmt_commands[] = {
  44	MGMT_OP_READ_INDEX_LIST,
  45	MGMT_OP_READ_INFO,
  46	MGMT_OP_SET_POWERED,
  47	MGMT_OP_SET_DISCOVERABLE,
  48	MGMT_OP_SET_CONNECTABLE,
  49	MGMT_OP_SET_FAST_CONNECTABLE,
  50	MGMT_OP_SET_BONDABLE,
  51	MGMT_OP_SET_LINK_SECURITY,
  52	MGMT_OP_SET_SSP,
  53	MGMT_OP_SET_HS,
  54	MGMT_OP_SET_LE,
  55	MGMT_OP_SET_DEV_CLASS,
  56	MGMT_OP_SET_LOCAL_NAME,
  57	MGMT_OP_ADD_UUID,
  58	MGMT_OP_REMOVE_UUID,
  59	MGMT_OP_LOAD_LINK_KEYS,
  60	MGMT_OP_LOAD_LONG_TERM_KEYS,
  61	MGMT_OP_DISCONNECT,
  62	MGMT_OP_GET_CONNECTIONS,
  63	MGMT_OP_PIN_CODE_REPLY,
  64	MGMT_OP_PIN_CODE_NEG_REPLY,
  65	MGMT_OP_SET_IO_CAPABILITY,
  66	MGMT_OP_PAIR_DEVICE,
  67	MGMT_OP_CANCEL_PAIR_DEVICE,
  68	MGMT_OP_UNPAIR_DEVICE,
  69	MGMT_OP_USER_CONFIRM_REPLY,
  70	MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71	MGMT_OP_USER_PASSKEY_REPLY,
  72	MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73	MGMT_OP_READ_LOCAL_OOB_DATA,
  74	MGMT_OP_ADD_REMOTE_OOB_DATA,
  75	MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76	MGMT_OP_START_DISCOVERY,
  77	MGMT_OP_STOP_DISCOVERY,
  78	MGMT_OP_CONFIRM_NAME,
  79	MGMT_OP_BLOCK_DEVICE,
  80	MGMT_OP_UNBLOCK_DEVICE,
  81	MGMT_OP_SET_DEVICE_ID,
  82	MGMT_OP_SET_ADVERTISING,
  83	MGMT_OP_SET_BREDR,
  84	MGMT_OP_SET_STATIC_ADDRESS,
  85	MGMT_OP_SET_SCAN_PARAMS,
  86	MGMT_OP_SET_SECURE_CONN,
  87	MGMT_OP_SET_DEBUG_KEYS,
  88	MGMT_OP_SET_PRIVACY,
  89	MGMT_OP_LOAD_IRKS,
  90	MGMT_OP_GET_CONN_INFO,
  91	MGMT_OP_GET_CLOCK_INFO,
  92	MGMT_OP_ADD_DEVICE,
  93	MGMT_OP_REMOVE_DEVICE,
  94	MGMT_OP_LOAD_CONN_PARAM,
  95	MGMT_OP_READ_UNCONF_INDEX_LIST,
  96	MGMT_OP_READ_CONFIG_INFO,
  97	MGMT_OP_SET_EXTERNAL_CONFIG,
  98	MGMT_OP_SET_PUBLIC_ADDRESS,
  99	MGMT_OP_START_SERVICE_DISCOVERY,
 100	MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101	MGMT_OP_READ_EXT_INDEX_LIST,
 102	MGMT_OP_READ_ADV_FEATURES,
 103	MGMT_OP_ADD_ADVERTISING,
 104	MGMT_OP_REMOVE_ADVERTISING,
 105	MGMT_OP_GET_ADV_SIZE_INFO,
 106	MGMT_OP_START_LIMITED_DISCOVERY,
 107	MGMT_OP_READ_EXT_INFO,
 108	MGMT_OP_SET_APPEARANCE,
 109};
 110
 111static const u16 mgmt_events[] = {
 112	MGMT_EV_CONTROLLER_ERROR,
 113	MGMT_EV_INDEX_ADDED,
 114	MGMT_EV_INDEX_REMOVED,
 115	MGMT_EV_NEW_SETTINGS,
 116	MGMT_EV_CLASS_OF_DEV_CHANGED,
 117	MGMT_EV_LOCAL_NAME_CHANGED,
 118	MGMT_EV_NEW_LINK_KEY,
 119	MGMT_EV_NEW_LONG_TERM_KEY,
 120	MGMT_EV_DEVICE_CONNECTED,
 121	MGMT_EV_DEVICE_DISCONNECTED,
 122	MGMT_EV_CONNECT_FAILED,
 123	MGMT_EV_PIN_CODE_REQUEST,
 124	MGMT_EV_USER_CONFIRM_REQUEST,
 125	MGMT_EV_USER_PASSKEY_REQUEST,
 126	MGMT_EV_AUTH_FAILED,
 127	MGMT_EV_DEVICE_FOUND,
 128	MGMT_EV_DISCOVERING,
 129	MGMT_EV_DEVICE_BLOCKED,
 130	MGMT_EV_DEVICE_UNBLOCKED,
 131	MGMT_EV_DEVICE_UNPAIRED,
 132	MGMT_EV_PASSKEY_NOTIFY,
 133	MGMT_EV_NEW_IRK,
 134	MGMT_EV_NEW_CSRK,
 135	MGMT_EV_DEVICE_ADDED,
 136	MGMT_EV_DEVICE_REMOVED,
 137	MGMT_EV_NEW_CONN_PARAM,
 138	MGMT_EV_UNCONF_INDEX_ADDED,
 139	MGMT_EV_UNCONF_INDEX_REMOVED,
 140	MGMT_EV_NEW_CONFIG_OPTIONS,
 141	MGMT_EV_EXT_INDEX_ADDED,
 142	MGMT_EV_EXT_INDEX_REMOVED,
 143	MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144	MGMT_EV_ADVERTISING_ADDED,
 145	MGMT_EV_ADVERTISING_REMOVED,
 146	MGMT_EV_EXT_INFO_CHANGED,
 147};
 148
 149static const u16 mgmt_untrusted_commands[] = {
 150	MGMT_OP_READ_INDEX_LIST,
 151	MGMT_OP_READ_INFO,
 152	MGMT_OP_READ_UNCONF_INDEX_LIST,
 153	MGMT_OP_READ_CONFIG_INFO,
 154	MGMT_OP_READ_EXT_INDEX_LIST,
 155	MGMT_OP_READ_EXT_INFO,
 156};
 157
 158static const u16 mgmt_untrusted_events[] = {
 159	MGMT_EV_INDEX_ADDED,
 160	MGMT_EV_INDEX_REMOVED,
 161	MGMT_EV_NEW_SETTINGS,
 162	MGMT_EV_CLASS_OF_DEV_CHANGED,
 163	MGMT_EV_LOCAL_NAME_CHANGED,
 164	MGMT_EV_UNCONF_INDEX_ADDED,
 165	MGMT_EV_UNCONF_INDEX_REMOVED,
 166	MGMT_EV_NEW_CONFIG_OPTIONS,
 167	MGMT_EV_EXT_INDEX_ADDED,
 168	MGMT_EV_EXT_INDEX_REMOVED,
 169	MGMT_EV_EXT_INFO_CHANGED,
 170};
 171
 172#define CACHE_TIMEOUT	msecs_to_jiffies(2 * 1000)
 173
 174#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175		 "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177/* HCI to MGMT error code conversion table */
 178static u8 mgmt_status_table[] = {
 179	MGMT_STATUS_SUCCESS,
 180	MGMT_STATUS_UNKNOWN_COMMAND,	/* Unknown Command */
 181	MGMT_STATUS_NOT_CONNECTED,	/* No Connection */
 182	MGMT_STATUS_FAILED,		/* Hardware Failure */
 183	MGMT_STATUS_CONNECT_FAILED,	/* Page Timeout */
 184	MGMT_STATUS_AUTH_FAILED,	/* Authentication Failed */
 185	MGMT_STATUS_AUTH_FAILED,	/* PIN or Key Missing */
 186	MGMT_STATUS_NO_RESOURCES,	/* Memory Full */
 187	MGMT_STATUS_TIMEOUT,		/* Connection Timeout */
 188	MGMT_STATUS_NO_RESOURCES,	/* Max Number of Connections */
 189	MGMT_STATUS_NO_RESOURCES,	/* Max Number of SCO Connections */
 190	MGMT_STATUS_ALREADY_CONNECTED,	/* ACL Connection Exists */
 191	MGMT_STATUS_BUSY,		/* Command Disallowed */
 192	MGMT_STATUS_NO_RESOURCES,	/* Rejected Limited Resources */
 193	MGMT_STATUS_REJECTED,		/* Rejected Security */
 194	MGMT_STATUS_REJECTED,		/* Rejected Personal */
 195	MGMT_STATUS_TIMEOUT,		/* Host Timeout */
 196	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Feature */
 197	MGMT_STATUS_INVALID_PARAMS,	/* Invalid Parameters */
 198	MGMT_STATUS_DISCONNECTED,	/* OE User Ended Connection */
 199	MGMT_STATUS_NO_RESOURCES,	/* OE Low Resources */
 200	MGMT_STATUS_DISCONNECTED,	/* OE Power Off */
 201	MGMT_STATUS_DISCONNECTED,	/* Connection Terminated */
 202	MGMT_STATUS_BUSY,		/* Repeated Attempts */
 203	MGMT_STATUS_REJECTED,		/* Pairing Not Allowed */
 204	MGMT_STATUS_FAILED,		/* Unknown LMP PDU */
 205	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Remote Feature */
 206	MGMT_STATUS_REJECTED,		/* SCO Offset Rejected */
 207	MGMT_STATUS_REJECTED,		/* SCO Interval Rejected */
 208	MGMT_STATUS_REJECTED,		/* Air Mode Rejected */
 209	MGMT_STATUS_INVALID_PARAMS,	/* Invalid LMP Parameters */
 210	MGMT_STATUS_FAILED,		/* Unspecified Error */
 211	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported LMP Parameter Value */
 212	MGMT_STATUS_FAILED,		/* Role Change Not Allowed */
 213	MGMT_STATUS_TIMEOUT,		/* LMP Response Timeout */
 214	MGMT_STATUS_FAILED,		/* LMP Error Transaction Collision */
 215	MGMT_STATUS_FAILED,		/* LMP PDU Not Allowed */
 216	MGMT_STATUS_REJECTED,		/* Encryption Mode Not Accepted */
 217	MGMT_STATUS_FAILED,		/* Unit Link Key Used */
 218	MGMT_STATUS_NOT_SUPPORTED,	/* QoS Not Supported */
 219	MGMT_STATUS_TIMEOUT,		/* Instant Passed */
 220	MGMT_STATUS_NOT_SUPPORTED,	/* Pairing Not Supported */
 221	MGMT_STATUS_FAILED,		/* Transaction Collision */
 222	MGMT_STATUS_INVALID_PARAMS,	/* Unacceptable Parameter */
 223	MGMT_STATUS_REJECTED,		/* QoS Rejected */
 224	MGMT_STATUS_NOT_SUPPORTED,	/* Classification Not Supported */
 225	MGMT_STATUS_REJECTED,		/* Insufficient Security */
 226	MGMT_STATUS_INVALID_PARAMS,	/* Parameter Out Of Range */
 227	MGMT_STATUS_BUSY,		/* Role Switch Pending */
 228	MGMT_STATUS_FAILED,		/* Slot Violation */
 229	MGMT_STATUS_FAILED,		/* Role Switch Failed */
 230	MGMT_STATUS_INVALID_PARAMS,	/* EIR Too Large */
 231	MGMT_STATUS_NOT_SUPPORTED,	/* Simple Pairing Not Supported */
 232	MGMT_STATUS_BUSY,		/* Host Busy Pairing */
 233	MGMT_STATUS_REJECTED,		/* Rejected, No Suitable Channel */
 234	MGMT_STATUS_BUSY,		/* Controller Busy */
 235	MGMT_STATUS_INVALID_PARAMS,	/* Unsuitable Connection Interval */
 236	MGMT_STATUS_TIMEOUT,		/* Directed Advertising Timeout */
 237	MGMT_STATUS_AUTH_FAILED,	/* Terminated Due to MIC Failure */
 238	MGMT_STATUS_CONNECT_FAILED,	/* Connection Establishment Failed */
 239	MGMT_STATUS_CONNECT_FAILED,	/* MAC Connection Failed */
 240};
 241
 242static u8 mgmt_status(u8 hci_status)
 243{
 244	if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245		return mgmt_status_table[hci_status];
 246
 247	return MGMT_STATUS_FAILED;
 248}
 249
 250static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251			    u16 len, int flag)
 252{
 253	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254			       flag, NULL);
 255}
 256
 257static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258			      u16 len, int flag, struct sock *skip_sk)
 259{
 260	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261			       flag, skip_sk);
 262}
 263
 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265		      struct sock *skip_sk)
 266{
 267	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268			       HCI_SOCK_TRUSTED, skip_sk);
 269}
 270
 271static u8 le_addr_type(u8 mgmt_addr_type)
 272{
 273	if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274		return ADDR_LE_DEV_PUBLIC;
 275	else
 276		return ADDR_LE_DEV_RANDOM;
 277}
 278
 279void mgmt_fill_version_info(void *ver)
 280{
 281	struct mgmt_rp_read_version *rp = ver;
 282
 283	rp->version = MGMT_VERSION;
 284	rp->revision = cpu_to_le16(MGMT_REVISION);
 285}
 286
 287static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288			u16 data_len)
 289{
 290	struct mgmt_rp_read_version rp;
 291
 292	BT_DBG("sock %p", sk);
 293
 294	mgmt_fill_version_info(&rp);
 295
 296	return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297				 &rp, sizeof(rp));
 298}
 299
 300static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301			 u16 data_len)
 302{
 303	struct mgmt_rp_read_commands *rp;
 304	u16 num_commands, num_events;
 305	size_t rp_size;
 306	int i, err;
 307
 308	BT_DBG("sock %p", sk);
 309
 310	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311		num_commands = ARRAY_SIZE(mgmt_commands);
 312		num_events = ARRAY_SIZE(mgmt_events);
 313	} else {
 314		num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315		num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316	}
 317
 318	rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320	rp = kmalloc(rp_size, GFP_KERNEL);
 321	if (!rp)
 322		return -ENOMEM;
 323
 324	rp->num_commands = cpu_to_le16(num_commands);
 325	rp->num_events = cpu_to_le16(num_events);
 326
 327	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328		__le16 *opcode = rp->opcodes;
 329
 330		for (i = 0; i < num_commands; i++, opcode++)
 331			put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333		for (i = 0; i < num_events; i++, opcode++)
 334			put_unaligned_le16(mgmt_events[i], opcode);
 335	} else {
 336		__le16 *opcode = rp->opcodes;
 337
 338		for (i = 0; i < num_commands; i++, opcode++)
 339			put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341		for (i = 0; i < num_events; i++, opcode++)
 342			put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343	}
 344
 345	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346				rp, rp_size);
 347	kfree(rp);
 348
 349	return err;
 350}
 351
 352static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353			   u16 data_len)
 354{
 355	struct mgmt_rp_read_index_list *rp;
 356	struct hci_dev *d;
 357	size_t rp_len;
 358	u16 count;
 359	int err;
 360
 361	BT_DBG("sock %p", sk);
 362
 363	read_lock(&hci_dev_list_lock);
 364
 365	count = 0;
 366	list_for_each_entry(d, &hci_dev_list, list) {
 367		if (d->dev_type == HCI_PRIMARY &&
 368		    !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369			count++;
 370	}
 371
 372	rp_len = sizeof(*rp) + (2 * count);
 373	rp = kmalloc(rp_len, GFP_ATOMIC);
 374	if (!rp) {
 375		read_unlock(&hci_dev_list_lock);
 376		return -ENOMEM;
 377	}
 378
 379	count = 0;
 380	list_for_each_entry(d, &hci_dev_list, list) {
 381		if (hci_dev_test_flag(d, HCI_SETUP) ||
 382		    hci_dev_test_flag(d, HCI_CONFIG) ||
 383		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384			continue;
 385
 386		/* Devices marked as raw-only are neither configured
 387		 * nor unconfigured controllers.
 388		 */
 389		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390			continue;
 391
 392		if (d->dev_type == HCI_PRIMARY &&
 393		    !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394			rp->index[count++] = cpu_to_le16(d->id);
 395			BT_DBG("Added hci%u", d->id);
 396		}
 397	}
 398
 399	rp->num_controllers = cpu_to_le16(count);
 400	rp_len = sizeof(*rp) + (2 * count);
 401
 402	read_unlock(&hci_dev_list_lock);
 403
 404	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405				0, rp, rp_len);
 406
 407	kfree(rp);
 408
 409	return err;
 410}
 411
 412static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413				  void *data, u16 data_len)
 414{
 415	struct mgmt_rp_read_unconf_index_list *rp;
 416	struct hci_dev *d;
 417	size_t rp_len;
 418	u16 count;
 419	int err;
 420
 421	BT_DBG("sock %p", sk);
 422
 423	read_lock(&hci_dev_list_lock);
 424
 425	count = 0;
 426	list_for_each_entry(d, &hci_dev_list, list) {
 427		if (d->dev_type == HCI_PRIMARY &&
 428		    hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429			count++;
 430	}
 431
 432	rp_len = sizeof(*rp) + (2 * count);
 433	rp = kmalloc(rp_len, GFP_ATOMIC);
 434	if (!rp) {
 435		read_unlock(&hci_dev_list_lock);
 436		return -ENOMEM;
 437	}
 438
 439	count = 0;
 440	list_for_each_entry(d, &hci_dev_list, list) {
 441		if (hci_dev_test_flag(d, HCI_SETUP) ||
 442		    hci_dev_test_flag(d, HCI_CONFIG) ||
 443		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444			continue;
 445
 446		/* Devices marked as raw-only are neither configured
 447		 * nor unconfigured controllers.
 448		 */
 449		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450			continue;
 451
 452		if (d->dev_type == HCI_PRIMARY &&
 453		    hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454			rp->index[count++] = cpu_to_le16(d->id);
 455			BT_DBG("Added hci%u", d->id);
 456		}
 457	}
 458
 459	rp->num_controllers = cpu_to_le16(count);
 460	rp_len = sizeof(*rp) + (2 * count);
 461
 462	read_unlock(&hci_dev_list_lock);
 463
 464	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465				MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467	kfree(rp);
 468
 469	return err;
 470}
 471
 472static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473			       void *data, u16 data_len)
 474{
 475	struct mgmt_rp_read_ext_index_list *rp;
 476	struct hci_dev *d;
 
 477	u16 count;
 478	int err;
 479
 480	BT_DBG("sock %p", sk);
 481
 482	read_lock(&hci_dev_list_lock);
 483
 484	count = 0;
 485	list_for_each_entry(d, &hci_dev_list, list) {
 486		if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 487			count++;
 488	}
 489
 490	rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 
 491	if (!rp) {
 492		read_unlock(&hci_dev_list_lock);
 493		return -ENOMEM;
 494	}
 495
 496	count = 0;
 497	list_for_each_entry(d, &hci_dev_list, list) {
 498		if (hci_dev_test_flag(d, HCI_SETUP) ||
 499		    hci_dev_test_flag(d, HCI_CONFIG) ||
 500		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
 501			continue;
 502
 503		/* Devices marked as raw-only are neither configured
 504		 * nor unconfigured controllers.
 505		 */
 506		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 507			continue;
 508
 509		if (d->dev_type == HCI_PRIMARY) {
 510			if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511				rp->entry[count].type = 0x01;
 512			else
 513				rp->entry[count].type = 0x00;
 514		} else if (d->dev_type == HCI_AMP) {
 515			rp->entry[count].type = 0x02;
 516		} else {
 517			continue;
 518		}
 519
 520		rp->entry[count].bus = d->bus;
 521		rp->entry[count++].index = cpu_to_le16(d->id);
 522		BT_DBG("Added hci%u", d->id);
 523	}
 524
 525	rp->num_controllers = cpu_to_le16(count);
 
 526
 527	read_unlock(&hci_dev_list_lock);
 528
 529	/* If this command is called at least once, then all the
 530	 * default index and unconfigured index events are disabled
 531	 * and from now on only extended index events are used.
 532	 */
 533	hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 534	hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 535	hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 536
 537	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 538				MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 539				struct_size(rp, entry, count));
 540
 541	kfree(rp);
 542
 543	return err;
 544}
 545
 546static bool is_configured(struct hci_dev *hdev)
 547{
 548	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 549	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 550		return false;
 551
 552	if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 553	     test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 554	    !bacmp(&hdev->public_addr, BDADDR_ANY))
 555		return false;
 556
 557	return true;
 558}
 559
 560static __le32 get_missing_options(struct hci_dev *hdev)
 561{
 562	u32 options = 0;
 563
 564	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 565	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 566		options |= MGMT_OPTION_EXTERNAL_CONFIG;
 567
 568	if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 569	     test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 570	    !bacmp(&hdev->public_addr, BDADDR_ANY))
 571		options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573	return cpu_to_le32(options);
 574}
 575
 576static int new_options(struct hci_dev *hdev, struct sock *skip)
 577{
 578	__le32 options = get_missing_options(hdev);
 579
 580	return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581				  sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582}
 583
 584static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585{
 586	__le32 options = get_missing_options(hdev);
 587
 588	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589				 sizeof(options));
 590}
 591
 592static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593			    void *data, u16 data_len)
 594{
 595	struct mgmt_rp_read_config_info rp;
 596	u32 options = 0;
 597
 598	BT_DBG("sock %p %s", sk, hdev->name);
 599
 600	hci_dev_lock(hdev);
 601
 602	memset(&rp, 0, sizeof(rp));
 603	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606		options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608	if (hdev->set_bdaddr)
 609		options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611	rp.supported_options = cpu_to_le32(options);
 612	rp.missing_options = get_missing_options(hdev);
 613
 614	hci_dev_unlock(hdev);
 615
 616	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617				 &rp, sizeof(rp));
 618}
 619
 620static u32 get_supported_phys(struct hci_dev *hdev)
 621{
 622	u32 supported_phys = 0;
 623
 624	if (lmp_bredr_capable(hdev)) {
 625		supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 626
 627		if (hdev->features[0][0] & LMP_3SLOT)
 628			supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 629
 630		if (hdev->features[0][0] & LMP_5SLOT)
 631			supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 632
 633		if (lmp_edr_2m_capable(hdev)) {
 634			supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 635
 636			if (lmp_edr_3slot_capable(hdev))
 637				supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 638
 639			if (lmp_edr_5slot_capable(hdev))
 640				supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 641
 642			if (lmp_edr_3m_capable(hdev)) {
 643				supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 644
 645				if (lmp_edr_3slot_capable(hdev))
 646					supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 647
 648				if (lmp_edr_5slot_capable(hdev))
 649					supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 650			}
 651		}
 652	}
 653
 654	if (lmp_le_capable(hdev)) {
 655		supported_phys |= MGMT_PHY_LE_1M_TX;
 656		supported_phys |= MGMT_PHY_LE_1M_RX;
 657
 658		if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 659			supported_phys |= MGMT_PHY_LE_2M_TX;
 660			supported_phys |= MGMT_PHY_LE_2M_RX;
 661		}
 662
 663		if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 664			supported_phys |= MGMT_PHY_LE_CODED_TX;
 665			supported_phys |= MGMT_PHY_LE_CODED_RX;
 666		}
 667	}
 668
 669	return supported_phys;
 670}
 671
 672static u32 get_selected_phys(struct hci_dev *hdev)
 673{
 674	u32 selected_phys = 0;
 675
 676	if (lmp_bredr_capable(hdev)) {
 677		selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 678
 679		if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 680			selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 681
 682		if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 683			selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 684
 685		if (lmp_edr_2m_capable(hdev)) {
 686			if (!(hdev->pkt_type & HCI_2DH1))
 687				selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 688
 689			if (lmp_edr_3slot_capable(hdev) &&
 690			    !(hdev->pkt_type & HCI_2DH3))
 691				selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 692
 693			if (lmp_edr_5slot_capable(hdev) &&
 694			    !(hdev->pkt_type & HCI_2DH5))
 695				selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 696
 697			if (lmp_edr_3m_capable(hdev)) {
 698				if (!(hdev->pkt_type & HCI_3DH1))
 699					selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 700
 701				if (lmp_edr_3slot_capable(hdev) &&
 702				    !(hdev->pkt_type & HCI_3DH3))
 703					selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 704
 705				if (lmp_edr_5slot_capable(hdev) &&
 706				    !(hdev->pkt_type & HCI_3DH5))
 707					selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 708			}
 709		}
 710	}
 711
 712	if (lmp_le_capable(hdev)) {
 713		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 714			selected_phys |= MGMT_PHY_LE_1M_TX;
 715
 716		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 717			selected_phys |= MGMT_PHY_LE_1M_RX;
 718
 719		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 720			selected_phys |= MGMT_PHY_LE_2M_TX;
 721
 722		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 723			selected_phys |= MGMT_PHY_LE_2M_RX;
 724
 725		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 726			selected_phys |= MGMT_PHY_LE_CODED_TX;
 727
 728		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 729			selected_phys |= MGMT_PHY_LE_CODED_RX;
 730	}
 731
 732	return selected_phys;
 733}
 734
 735static u32 get_configurable_phys(struct hci_dev *hdev)
 736{
 737	return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 738		~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 739}
 740
 741static u32 get_supported_settings(struct hci_dev *hdev)
 742{
 743	u32 settings = 0;
 744
 745	settings |= MGMT_SETTING_POWERED;
 746	settings |= MGMT_SETTING_BONDABLE;
 747	settings |= MGMT_SETTING_DEBUG_KEYS;
 748	settings |= MGMT_SETTING_CONNECTABLE;
 749	settings |= MGMT_SETTING_DISCOVERABLE;
 750
 751	if (lmp_bredr_capable(hdev)) {
 752		if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 753			settings |= MGMT_SETTING_FAST_CONNECTABLE;
 754		settings |= MGMT_SETTING_BREDR;
 755		settings |= MGMT_SETTING_LINK_SECURITY;
 756
 757		if (lmp_ssp_capable(hdev)) {
 758			settings |= MGMT_SETTING_SSP;
 759			settings |= MGMT_SETTING_HS;
 760		}
 761
 762		if (lmp_sc_capable(hdev))
 763			settings |= MGMT_SETTING_SECURE_CONN;
 764	}
 765
 766	if (lmp_le_capable(hdev)) {
 767		settings |= MGMT_SETTING_LE;
 768		settings |= MGMT_SETTING_ADVERTISING;
 769		settings |= MGMT_SETTING_SECURE_CONN;
 770		settings |= MGMT_SETTING_PRIVACY;
 771		settings |= MGMT_SETTING_STATIC_ADDRESS;
 772	}
 773
 774	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 775	    hdev->set_bdaddr)
 776		settings |= MGMT_SETTING_CONFIGURATION;
 777
 778	settings |= MGMT_SETTING_PHY_CONFIGURATION;
 779
 780	return settings;
 781}
 782
 783static u32 get_current_settings(struct hci_dev *hdev)
 784{
 785	u32 settings = 0;
 786
 787	if (hdev_is_powered(hdev))
 788		settings |= MGMT_SETTING_POWERED;
 789
 790	if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 791		settings |= MGMT_SETTING_CONNECTABLE;
 792
 793	if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 794		settings |= MGMT_SETTING_FAST_CONNECTABLE;
 795
 796	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 797		settings |= MGMT_SETTING_DISCOVERABLE;
 798
 799	if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 800		settings |= MGMT_SETTING_BONDABLE;
 801
 802	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 803		settings |= MGMT_SETTING_BREDR;
 804
 805	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 806		settings |= MGMT_SETTING_LE;
 807
 808	if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 809		settings |= MGMT_SETTING_LINK_SECURITY;
 810
 811	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 812		settings |= MGMT_SETTING_SSP;
 813
 814	if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 815		settings |= MGMT_SETTING_HS;
 816
 817	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 818		settings |= MGMT_SETTING_ADVERTISING;
 819
 820	if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 821		settings |= MGMT_SETTING_SECURE_CONN;
 822
 823	if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 824		settings |= MGMT_SETTING_DEBUG_KEYS;
 825
 826	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 827		settings |= MGMT_SETTING_PRIVACY;
 828
 829	/* The current setting for static address has two purposes. The
 830	 * first is to indicate if the static address will be used and
 831	 * the second is to indicate if it is actually set.
 832	 *
 833	 * This means if the static address is not configured, this flag
 834	 * will never be set. If the address is configured, then if the
 835	 * address is actually used decides if the flag is set or not.
 836	 *
 837	 * For single mode LE only controllers and dual-mode controllers
 838	 * with BR/EDR disabled, the existence of the static address will
 839	 * be evaluated.
 840	 */
 841	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 842	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 843	    !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 844		if (bacmp(&hdev->static_addr, BDADDR_ANY))
 845			settings |= MGMT_SETTING_STATIC_ADDRESS;
 846	}
 847
 848	return settings;
 849}
 850
 851static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 852{
 853	return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 854}
 855
 856static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 857						  struct hci_dev *hdev,
 858						  const void *data)
 859{
 860	return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 861}
 862
 863u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 864{
 865	struct mgmt_pending_cmd *cmd;
 866
 867	/* If there's a pending mgmt command the flags will not yet have
 868	 * their final values, so check for this first.
 869	 */
 870	cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 871	if (cmd) {
 872		struct mgmt_mode *cp = cmd->param;
 873		if (cp->val == 0x01)
 874			return LE_AD_GENERAL;
 875		else if (cp->val == 0x02)
 876			return LE_AD_LIMITED;
 877	} else {
 878		if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 879			return LE_AD_LIMITED;
 880		else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 881			return LE_AD_GENERAL;
 882	}
 883
 884	return 0;
 885}
 886
 887bool mgmt_get_connectable(struct hci_dev *hdev)
 888{
 889	struct mgmt_pending_cmd *cmd;
 890
 891	/* If there's a pending mgmt command the flag will not yet have
 892	 * it's final value, so check for this first.
 893	 */
 894	cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 895	if (cmd) {
 896		struct mgmt_mode *cp = cmd->param;
 897
 898		return cp->val;
 899	}
 900
 901	return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 902}
 903
 904static void service_cache_off(struct work_struct *work)
 905{
 906	struct hci_dev *hdev = container_of(work, struct hci_dev,
 907					    service_cache.work);
 908	struct hci_request req;
 909
 910	if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 911		return;
 912
 913	hci_req_init(&req, hdev);
 914
 915	hci_dev_lock(hdev);
 916
 917	__hci_req_update_eir(&req);
 918	__hci_req_update_class(&req);
 919
 920	hci_dev_unlock(hdev);
 921
 922	hci_req_run(&req, NULL);
 923}
 924
 925static void rpa_expired(struct work_struct *work)
 926{
 927	struct hci_dev *hdev = container_of(work, struct hci_dev,
 928					    rpa_expired.work);
 929	struct hci_request req;
 930
 931	BT_DBG("");
 932
 933	hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 934
 935	if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 936		return;
 937
 938	/* The generation of a new RPA and programming it into the
 939	 * controller happens in the hci_req_enable_advertising()
 940	 * function.
 941	 */
 942	hci_req_init(&req, hdev);
 943	if (ext_adv_capable(hdev))
 944		__hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 945	else
 946		__hci_req_enable_advertising(&req);
 947	hci_req_run(&req, NULL);
 948}
 949
 950static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 951{
 952	if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 953		return;
 954
 955	INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 956	INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 957
 958	/* Non-mgmt controlled devices get this bit set
 959	 * implicitly so that pairing works for them, however
 960	 * for mgmt we require user-space to explicitly enable
 961	 * it
 962	 */
 963	hci_dev_clear_flag(hdev, HCI_BONDABLE);
 964}
 965
 966static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 967				void *data, u16 data_len)
 968{
 969	struct mgmt_rp_read_info rp;
 970
 971	BT_DBG("sock %p %s", sk, hdev->name);
 972
 973	hci_dev_lock(hdev);
 974
 975	memset(&rp, 0, sizeof(rp));
 976
 977	bacpy(&rp.bdaddr, &hdev->bdaddr);
 978
 979	rp.version = hdev->hci_ver;
 980	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 981
 982	rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 983	rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 984
 985	memcpy(rp.dev_class, hdev->dev_class, 3);
 986
 987	memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 988	memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 989
 990	hci_dev_unlock(hdev);
 991
 992	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 993				 sizeof(rp));
 994}
 995
 996static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 997{
 998	u16 eir_len = 0;
 999	size_t name_len;
1000
1001	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002		eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003					  hdev->dev_class, 3);
1004
1005	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006		eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007					  hdev->appearance);
1008
1009	name_len = strlen(hdev->dev_name);
1010	eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011				  hdev->dev_name, name_len);
1012
1013	name_len = strlen(hdev->short_name);
1014	eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015				  hdev->short_name, name_len);
1016
1017	return eir_len;
1018}
1019
1020static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021				    void *data, u16 data_len)
1022{
1023	char buf[512];
1024	struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025	u16 eir_len;
1026
1027	BT_DBG("sock %p %s", sk, hdev->name);
1028
1029	memset(&buf, 0, sizeof(buf));
1030
1031	hci_dev_lock(hdev);
1032
1033	bacpy(&rp->bdaddr, &hdev->bdaddr);
1034
1035	rp->version = hdev->hci_ver;
1036	rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037
1038	rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039	rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040
1041
1042	eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043	rp->eir_len = cpu_to_le16(eir_len);
1044
1045	hci_dev_unlock(hdev);
1046
1047	/* If this command is called at least once, then the events
1048	 * for class of device and local name changes are disabled
1049	 * and only the new extended controller information event
1050	 * is used.
1051	 */
1052	hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053	hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054	hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055
1056	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057				 sizeof(*rp) + eir_len);
1058}
1059
1060static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061{
1062	char buf[512];
1063	struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064	u16 eir_len;
1065
1066	memset(buf, 0, sizeof(buf));
1067
1068	eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069	ev->eir_len = cpu_to_le16(eir_len);
1070
1071	return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072				  sizeof(*ev) + eir_len,
1073				  HCI_MGMT_EXT_INFO_EVENTS, skip);
1074}
1075
1076static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077{
1078	__le32 settings = cpu_to_le32(get_current_settings(hdev));
1079
1080	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081				 sizeof(settings));
1082}
1083
1084static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085{
1086	BT_DBG("%s status 0x%02x", hdev->name, status);
1087
1088	if (hci_conn_count(hdev) == 0) {
1089		cancel_delayed_work(&hdev->power_off);
1090		queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091	}
1092}
1093
1094void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095{
1096	struct mgmt_ev_advertising_added ev;
1097
1098	ev.instance = instance;
1099
1100	mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101}
1102
1103void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104			      u8 instance)
1105{
1106	struct mgmt_ev_advertising_removed ev;
1107
1108	ev.instance = instance;
1109
1110	mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111}
1112
1113static void cancel_adv_timeout(struct hci_dev *hdev)
1114{
1115	if (hdev->adv_instance_timeout) {
1116		hdev->adv_instance_timeout = 0;
1117		cancel_delayed_work(&hdev->adv_instance_expire);
1118	}
1119}
1120
1121static int clean_up_hci_state(struct hci_dev *hdev)
1122{
1123	struct hci_request req;
1124	struct hci_conn *conn;
1125	bool discov_stopped;
1126	int err;
1127
1128	hci_req_init(&req, hdev);
1129
1130	if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131	    test_bit(HCI_PSCAN, &hdev->flags)) {
1132		u8 scan = 0x00;
1133		hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134	}
1135
1136	hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137
1138	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139		__hci_req_disable_advertising(&req);
1140
1141	discov_stopped = hci_req_stop_discovery(&req);
1142
1143	list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144		/* 0x15 == Terminated due to Power Off */
1145		__hci_abort_conn(&req, conn, 0x15);
1146	}
1147
1148	err = hci_req_run(&req, clean_up_hci_complete);
1149	if (!err && discov_stopped)
1150		hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151
1152	return err;
1153}
1154
1155static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156		       u16 len)
1157{
1158	struct mgmt_mode *cp = data;
1159	struct mgmt_pending_cmd *cmd;
1160	int err;
1161
1162	BT_DBG("request for %s", hdev->name);
1163
1164	if (cp->val != 0x00 && cp->val != 0x01)
1165		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166				       MGMT_STATUS_INVALID_PARAMS);
1167
1168	hci_dev_lock(hdev);
1169
1170	if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172				      MGMT_STATUS_BUSY);
1173		goto failed;
1174	}
1175
1176	if (!!cp->val == hdev_is_powered(hdev)) {
1177		err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178		goto failed;
1179	}
1180
1181	cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182	if (!cmd) {
1183		err = -ENOMEM;
1184		goto failed;
1185	}
1186
1187	if (cp->val) {
1188		queue_work(hdev->req_workqueue, &hdev->power_on);
1189		err = 0;
1190	} else {
1191		/* Disconnect connections, stop scans, etc */
1192		err = clean_up_hci_state(hdev);
1193		if (!err)
1194			queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195					   HCI_POWER_OFF_TIMEOUT);
1196
1197		/* ENODATA means there were no HCI commands queued */
1198		if (err == -ENODATA) {
1199			cancel_delayed_work(&hdev->power_off);
1200			queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201			err = 0;
1202		}
1203	}
1204
1205failed:
1206	hci_dev_unlock(hdev);
1207	return err;
1208}
1209
1210static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211{
1212	__le32 ev = cpu_to_le32(get_current_settings(hdev));
1213
1214	return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215				  sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216}
1217
1218int mgmt_new_settings(struct hci_dev *hdev)
1219{
1220	return new_settings(hdev, NULL);
1221}
1222
1223struct cmd_lookup {
1224	struct sock *sk;
1225	struct hci_dev *hdev;
1226	u8 mgmt_status;
1227};
1228
1229static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230{
1231	struct cmd_lookup *match = data;
1232
1233	send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234
1235	list_del(&cmd->list);
1236
1237	if (match->sk == NULL) {
1238		match->sk = cmd->sk;
1239		sock_hold(match->sk);
1240	}
1241
1242	mgmt_pending_free(cmd);
1243}
1244
1245static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246{
1247	u8 *status = data;
1248
1249	mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250	mgmt_pending_remove(cmd);
1251}
1252
1253static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254{
1255	if (cmd->cmd_complete) {
1256		u8 *status = data;
1257
1258		cmd->cmd_complete(cmd, *status);
1259		mgmt_pending_remove(cmd);
1260
1261		return;
1262	}
1263
1264	cmd_status_rsp(cmd, data);
1265}
1266
1267static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268{
1269	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270				 cmd->param, cmd->param_len);
1271}
1272
1273static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274{
1275	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276				 cmd->param, sizeof(struct mgmt_addr_info));
1277}
1278
1279static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280{
1281	if (!lmp_bredr_capable(hdev))
1282		return MGMT_STATUS_NOT_SUPPORTED;
1283	else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284		return MGMT_STATUS_REJECTED;
1285	else
1286		return MGMT_STATUS_SUCCESS;
1287}
1288
1289static u8 mgmt_le_support(struct hci_dev *hdev)
1290{
1291	if (!lmp_le_capable(hdev))
1292		return MGMT_STATUS_NOT_SUPPORTED;
1293	else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294		return MGMT_STATUS_REJECTED;
1295	else
1296		return MGMT_STATUS_SUCCESS;
1297}
1298
1299void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300{
1301	struct mgmt_pending_cmd *cmd;
1302
1303	BT_DBG("status 0x%02x", status);
1304
1305	hci_dev_lock(hdev);
1306
1307	cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308	if (!cmd)
1309		goto unlock;
1310
1311	if (status) {
1312		u8 mgmt_err = mgmt_status(status);
1313		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315		goto remove_cmd;
1316	}
1317
1318	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319	    hdev->discov_timeout > 0) {
1320		int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321		queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322	}
1323
1324	send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325	new_settings(hdev, cmd->sk);
1326
1327remove_cmd:
1328	mgmt_pending_remove(cmd);
1329
1330unlock:
1331	hci_dev_unlock(hdev);
1332}
1333
1334static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335			    u16 len)
1336{
1337	struct mgmt_cp_set_discoverable *cp = data;
1338	struct mgmt_pending_cmd *cmd;
1339	u16 timeout;
1340	int err;
1341
1342	BT_DBG("request for %s", hdev->name);
1343
1344	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347				       MGMT_STATUS_REJECTED);
1348
1349	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351				       MGMT_STATUS_INVALID_PARAMS);
1352
1353	timeout = __le16_to_cpu(cp->timeout);
1354
1355	/* Disabling discoverable requires that no timeout is set,
1356	 * and enabling limited discoverable requires a timeout.
1357	 */
1358	if ((cp->val == 0x00 && timeout > 0) ||
1359	    (cp->val == 0x02 && timeout == 0))
1360		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361				       MGMT_STATUS_INVALID_PARAMS);
1362
1363	hci_dev_lock(hdev);
1364
1365	if (!hdev_is_powered(hdev) && timeout > 0) {
1366		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367				      MGMT_STATUS_NOT_POWERED);
1368		goto failed;
1369	}
1370
1371	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374				      MGMT_STATUS_BUSY);
1375		goto failed;
1376	}
1377
1378	if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380				      MGMT_STATUS_REJECTED);
1381		goto failed;
1382	}
1383
1384	if (!hdev_is_powered(hdev)) {
1385		bool changed = false;
1386
1387		/* Setting limited discoverable when powered off is
1388		 * not a valid operation since it requires a timeout
1389		 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1390		 */
1391		if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392			hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393			changed = true;
1394		}
1395
1396		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397		if (err < 0)
1398			goto failed;
1399
1400		if (changed)
1401			err = new_settings(hdev, sk);
1402
1403		goto failed;
1404	}
1405
1406	/* If the current mode is the same, then just update the timeout
1407	 * value with the new value. And if only the timeout gets updated,
1408	 * then no need for any HCI transactions.
1409	 */
1410	if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411	    (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412						   HCI_LIMITED_DISCOVERABLE)) {
1413		cancel_delayed_work(&hdev->discov_off);
1414		hdev->discov_timeout = timeout;
1415
1416		if (cp->val && hdev->discov_timeout > 0) {
1417			int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418			queue_delayed_work(hdev->req_workqueue,
1419					   &hdev->discov_off, to);
1420		}
1421
1422		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423		goto failed;
1424	}
1425
1426	cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427	if (!cmd) {
1428		err = -ENOMEM;
1429		goto failed;
1430	}
1431
1432	/* Cancel any potential discoverable timeout that might be
1433	 * still active and store new timeout value. The arming of
1434	 * the timeout happens in the complete handler.
1435	 */
1436	cancel_delayed_work(&hdev->discov_off);
1437	hdev->discov_timeout = timeout;
1438
1439	if (cp->val)
1440		hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441	else
1442		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443
1444	/* Limited discoverable mode */
1445	if (cp->val == 0x02)
1446		hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447	else
1448		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449
1450	queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451	err = 0;
1452
1453failed:
1454	hci_dev_unlock(hdev);
1455	return err;
1456}
1457
1458void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459{
1460	struct mgmt_pending_cmd *cmd;
1461
1462	BT_DBG("status 0x%02x", status);
1463
1464	hci_dev_lock(hdev);
1465
1466	cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467	if (!cmd)
1468		goto unlock;
1469
1470	if (status) {
1471		u8 mgmt_err = mgmt_status(status);
1472		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473		goto remove_cmd;
1474	}
1475
1476	send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477	new_settings(hdev, cmd->sk);
1478
1479remove_cmd:
1480	mgmt_pending_remove(cmd);
1481
1482unlock:
1483	hci_dev_unlock(hdev);
1484}
1485
1486static int set_connectable_update_settings(struct hci_dev *hdev,
1487					   struct sock *sk, u8 val)
1488{
1489	bool changed = false;
1490	int err;
1491
1492	if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493		changed = true;
1494
1495	if (val) {
1496		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497	} else {
1498		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500	}
1501
1502	err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503	if (err < 0)
1504		return err;
1505
1506	if (changed) {
1507		hci_req_update_scan(hdev);
1508		hci_update_background_scan(hdev);
1509		return new_settings(hdev, sk);
1510	}
1511
1512	return 0;
1513}
1514
1515static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516			   u16 len)
1517{
1518	struct mgmt_mode *cp = data;
1519	struct mgmt_pending_cmd *cmd;
1520	int err;
1521
1522	BT_DBG("request for %s", hdev->name);
1523
1524	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527				       MGMT_STATUS_REJECTED);
1528
1529	if (cp->val != 0x00 && cp->val != 0x01)
1530		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531				       MGMT_STATUS_INVALID_PARAMS);
1532
1533	hci_dev_lock(hdev);
1534
1535	if (!hdev_is_powered(hdev)) {
1536		err = set_connectable_update_settings(hdev, sk, cp->val);
1537		goto failed;
1538	}
1539
1540	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543				      MGMT_STATUS_BUSY);
1544		goto failed;
1545	}
1546
1547	cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548	if (!cmd) {
1549		err = -ENOMEM;
1550		goto failed;
1551	}
1552
1553	if (cp->val) {
1554		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555	} else {
1556		if (hdev->discov_timeout > 0)
1557			cancel_delayed_work(&hdev->discov_off);
1558
1559		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562	}
1563
1564	queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565	err = 0;
1566
1567failed:
1568	hci_dev_unlock(hdev);
1569	return err;
1570}
1571
1572static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573			u16 len)
1574{
1575	struct mgmt_mode *cp = data;
1576	bool changed;
1577	int err;
1578
1579	BT_DBG("request for %s", hdev->name);
1580
1581	if (cp->val != 0x00 && cp->val != 0x01)
1582		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583				       MGMT_STATUS_INVALID_PARAMS);
1584
1585	hci_dev_lock(hdev);
1586
1587	if (cp->val)
1588		changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589	else
1590		changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591
1592	err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593	if (err < 0)
1594		goto unlock;
1595
1596	if (changed) {
1597		/* In limited privacy mode the change of bondable mode
1598		 * may affect the local advertising address.
1599		 */
1600		if (hdev_is_powered(hdev) &&
1601		    hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602		    hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603		    hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604			queue_work(hdev->req_workqueue,
1605				   &hdev->discoverable_update);
1606
1607		err = new_settings(hdev, sk);
1608	}
1609
1610unlock:
1611	hci_dev_unlock(hdev);
1612	return err;
1613}
1614
1615static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616			     u16 len)
1617{
1618	struct mgmt_mode *cp = data;
1619	struct mgmt_pending_cmd *cmd;
1620	u8 val, status;
1621	int err;
1622
1623	BT_DBG("request for %s", hdev->name);
1624
1625	status = mgmt_bredr_support(hdev);
1626	if (status)
1627		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628				       status);
1629
1630	if (cp->val != 0x00 && cp->val != 0x01)
1631		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632				       MGMT_STATUS_INVALID_PARAMS);
1633
1634	hci_dev_lock(hdev);
1635
1636	if (!hdev_is_powered(hdev)) {
1637		bool changed = false;
1638
1639		if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640			hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641			changed = true;
1642		}
1643
1644		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645		if (err < 0)
1646			goto failed;
1647
1648		if (changed)
1649			err = new_settings(hdev, sk);
1650
1651		goto failed;
1652	}
1653
1654	if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656				      MGMT_STATUS_BUSY);
1657		goto failed;
1658	}
1659
1660	val = !!cp->val;
1661
1662	if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664		goto failed;
1665	}
1666
1667	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668	if (!cmd) {
1669		err = -ENOMEM;
1670		goto failed;
1671	}
1672
1673	err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674	if (err < 0) {
1675		mgmt_pending_remove(cmd);
1676		goto failed;
1677	}
1678
1679failed:
1680	hci_dev_unlock(hdev);
1681	return err;
1682}
1683
1684static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685{
1686	struct mgmt_mode *cp = data;
1687	struct mgmt_pending_cmd *cmd;
1688	u8 status;
1689	int err;
1690
1691	BT_DBG("request for %s", hdev->name);
1692
1693	status = mgmt_bredr_support(hdev);
1694	if (status)
1695		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696
1697	if (!lmp_ssp_capable(hdev))
1698		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699				       MGMT_STATUS_NOT_SUPPORTED);
1700
1701	if (cp->val != 0x00 && cp->val != 0x01)
1702		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703				       MGMT_STATUS_INVALID_PARAMS);
1704
1705	hci_dev_lock(hdev);
1706
1707	if (!hdev_is_powered(hdev)) {
1708		bool changed;
1709
1710		if (cp->val) {
1711			changed = !hci_dev_test_and_set_flag(hdev,
1712							     HCI_SSP_ENABLED);
1713		} else {
1714			changed = hci_dev_test_and_clear_flag(hdev,
1715							      HCI_SSP_ENABLED);
1716			if (!changed)
1717				changed = hci_dev_test_and_clear_flag(hdev,
1718								      HCI_HS_ENABLED);
1719			else
1720				hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721		}
1722
1723		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724		if (err < 0)
1725			goto failed;
1726
1727		if (changed)
1728			err = new_settings(hdev, sk);
1729
1730		goto failed;
1731	}
1732
1733	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735				      MGMT_STATUS_BUSY);
1736		goto failed;
1737	}
1738
1739	if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741		goto failed;
1742	}
1743
1744	cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745	if (!cmd) {
1746		err = -ENOMEM;
1747		goto failed;
1748	}
1749
1750	if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751		hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752			     sizeof(cp->val), &cp->val);
1753
1754	err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755	if (err < 0) {
1756		mgmt_pending_remove(cmd);
1757		goto failed;
1758	}
1759
1760failed:
1761	hci_dev_unlock(hdev);
1762	return err;
1763}
1764
1765static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766{
1767	struct mgmt_mode *cp = data;
1768	bool changed;
1769	u8 status;
1770	int err;
1771
1772	BT_DBG("request for %s", hdev->name);
1773
1774	status = mgmt_bredr_support(hdev);
1775	if (status)
1776		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777
1778	if (!lmp_ssp_capable(hdev))
1779		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780				       MGMT_STATUS_NOT_SUPPORTED);
1781
1782	if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784				       MGMT_STATUS_REJECTED);
1785
1786	if (cp->val != 0x00 && cp->val != 0x01)
1787		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788				       MGMT_STATUS_INVALID_PARAMS);
1789
1790	hci_dev_lock(hdev);
1791
1792	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794				      MGMT_STATUS_BUSY);
1795		goto unlock;
1796	}
1797
1798	if (cp->val) {
1799		changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800	} else {
1801		if (hdev_is_powered(hdev)) {
1802			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803					      MGMT_STATUS_REJECTED);
1804			goto unlock;
1805		}
1806
1807		changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808	}
1809
1810	err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811	if (err < 0)
1812		goto unlock;
1813
1814	if (changed)
1815		err = new_settings(hdev, sk);
1816
1817unlock:
1818	hci_dev_unlock(hdev);
1819	return err;
1820}
1821
1822static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823{
1824	struct cmd_lookup match = { NULL, hdev };
1825
1826	hci_dev_lock(hdev);
1827
1828	if (status) {
1829		u8 mgmt_err = mgmt_status(status);
1830
1831		mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832				     &mgmt_err);
1833		goto unlock;
1834	}
1835
1836	mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837
1838	new_settings(hdev, match.sk);
1839
1840	if (match.sk)
1841		sock_put(match.sk);
1842
1843	/* Make sure the controller has a good default for
1844	 * advertising data. Restrict the update to when LE
1845	 * has actually been enabled. During power on, the
1846	 * update in powered_update_hci will take care of it.
1847	 */
1848	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849		struct hci_request req;
1850		hci_req_init(&req, hdev);
1851		if (ext_adv_capable(hdev)) {
1852			int err;
1853
1854			err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855			if (!err)
1856				__hci_req_update_scan_rsp_data(&req, 0x00);
1857		} else {
1858			__hci_req_update_adv_data(&req, 0x00);
1859			__hci_req_update_scan_rsp_data(&req, 0x00);
1860		}
1861		hci_req_run(&req, NULL);
1862		hci_update_background_scan(hdev);
1863	}
1864
1865unlock:
1866	hci_dev_unlock(hdev);
1867}
1868
1869static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870{
1871	struct mgmt_mode *cp = data;
1872	struct hci_cp_write_le_host_supported hci_cp;
1873	struct mgmt_pending_cmd *cmd;
1874	struct hci_request req;
1875	int err;
1876	u8 val, enabled;
1877
1878	BT_DBG("request for %s", hdev->name);
1879
1880	if (!lmp_le_capable(hdev))
1881		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882				       MGMT_STATUS_NOT_SUPPORTED);
1883
1884	if (cp->val != 0x00 && cp->val != 0x01)
1885		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886				       MGMT_STATUS_INVALID_PARAMS);
1887
1888	/* Bluetooth single mode LE only controllers or dual-mode
1889	 * controllers configured as LE only devices, do not allow
1890	 * switching LE off. These have either LE enabled explicitly
1891	 * or BR/EDR has been previously switched off.
1892	 *
1893	 * When trying to enable an already enabled LE, then gracefully
1894	 * send a positive response. Trying to disable it however will
1895	 * result into rejection.
1896	 */
1897	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898		if (cp->val == 0x01)
1899			return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900
1901		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902				       MGMT_STATUS_REJECTED);
1903	}
1904
1905	hci_dev_lock(hdev);
1906
1907	val = !!cp->val;
1908	enabled = lmp_host_le_capable(hdev);
1909
1910	if (!val)
1911		hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912
1913	if (!hdev_is_powered(hdev) || val == enabled) {
1914		bool changed = false;
1915
1916		if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917			hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918			changed = true;
1919		}
1920
1921		if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922			hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923			changed = true;
1924		}
1925
1926		err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927		if (err < 0)
1928			goto unlock;
1929
1930		if (changed)
1931			err = new_settings(hdev, sk);
1932
1933		goto unlock;
1934	}
1935
1936	if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937	    pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939				      MGMT_STATUS_BUSY);
1940		goto unlock;
1941	}
1942
1943	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944	if (!cmd) {
1945		err = -ENOMEM;
1946		goto unlock;
1947	}
1948
1949	hci_req_init(&req, hdev);
1950
1951	memset(&hci_cp, 0, sizeof(hci_cp));
1952
1953	if (val) {
1954		hci_cp.le = val;
1955		hci_cp.simul = 0x00;
1956	} else {
1957		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958			__hci_req_disable_advertising(&req);
1959
1960		if (ext_adv_capable(hdev))
1961			__hci_req_clear_ext_adv_sets(&req);
1962	}
1963
1964	hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965		    &hci_cp);
1966
1967	err = hci_req_run(&req, le_enable_complete);
1968	if (err < 0)
1969		mgmt_pending_remove(cmd);
1970
1971unlock:
1972	hci_dev_unlock(hdev);
1973	return err;
1974}
1975
1976/* This is a helper function to test for pending mgmt commands that can
1977 * cause CoD or EIR HCI commands. We can only allow one such pending
1978 * mgmt command at a time since otherwise we cannot easily track what
1979 * the current values are, will be, and based on that calculate if a new
1980 * HCI command needs to be sent and if yes with what value.
1981 */
1982static bool pending_eir_or_class(struct hci_dev *hdev)
1983{
1984	struct mgmt_pending_cmd *cmd;
1985
1986	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987		switch (cmd->opcode) {
1988		case MGMT_OP_ADD_UUID:
1989		case MGMT_OP_REMOVE_UUID:
1990		case MGMT_OP_SET_DEV_CLASS:
1991		case MGMT_OP_SET_POWERED:
1992			return true;
1993		}
1994	}
1995
1996	return false;
1997}
1998
1999static const u8 bluetooth_base_uuid[] = {
2000			0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002};
2003
2004static u8 get_uuid_size(const u8 *uuid)
2005{
2006	u32 val;
2007
2008	if (memcmp(uuid, bluetooth_base_uuid, 12))
2009		return 128;
2010
2011	val = get_unaligned_le32(&uuid[12]);
2012	if (val > 0xffff)
2013		return 32;
2014
2015	return 16;
2016}
2017
2018static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019{
2020	struct mgmt_pending_cmd *cmd;
2021
2022	hci_dev_lock(hdev);
2023
2024	cmd = pending_find(mgmt_op, hdev);
2025	if (!cmd)
2026		goto unlock;
2027
2028	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029			  mgmt_status(status), hdev->dev_class, 3);
2030
2031	mgmt_pending_remove(cmd);
2032
2033unlock:
2034	hci_dev_unlock(hdev);
2035}
2036
2037static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038{
2039	BT_DBG("status 0x%02x", status);
2040
2041	mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042}
2043
2044static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045{
2046	struct mgmt_cp_add_uuid *cp = data;
2047	struct mgmt_pending_cmd *cmd;
2048	struct hci_request req;
2049	struct bt_uuid *uuid;
2050	int err;
2051
2052	BT_DBG("request for %s", hdev->name);
2053
2054	hci_dev_lock(hdev);
2055
2056	if (pending_eir_or_class(hdev)) {
2057		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058				      MGMT_STATUS_BUSY);
2059		goto failed;
2060	}
2061
2062	uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063	if (!uuid) {
2064		err = -ENOMEM;
2065		goto failed;
2066	}
2067
2068	memcpy(uuid->uuid, cp->uuid, 16);
2069	uuid->svc_hint = cp->svc_hint;
2070	uuid->size = get_uuid_size(cp->uuid);
2071
2072	list_add_tail(&uuid->list, &hdev->uuids);
2073
2074	hci_req_init(&req, hdev);
2075
2076	__hci_req_update_class(&req);
2077	__hci_req_update_eir(&req);
2078
2079	err = hci_req_run(&req, add_uuid_complete);
2080	if (err < 0) {
2081		if (err != -ENODATA)
2082			goto failed;
2083
2084		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085					hdev->dev_class, 3);
2086		goto failed;
2087	}
2088
2089	cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090	if (!cmd) {
2091		err = -ENOMEM;
2092		goto failed;
2093	}
2094
2095	err = 0;
2096
2097failed:
2098	hci_dev_unlock(hdev);
2099	return err;
2100}
2101
2102static bool enable_service_cache(struct hci_dev *hdev)
2103{
2104	if (!hdev_is_powered(hdev))
2105		return false;
2106
2107	if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108		queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109				   CACHE_TIMEOUT);
2110		return true;
2111	}
2112
2113	return false;
2114}
2115
2116static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117{
2118	BT_DBG("status 0x%02x", status);
2119
2120	mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121}
2122
2123static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124		       u16 len)
2125{
2126	struct mgmt_cp_remove_uuid *cp = data;
2127	struct mgmt_pending_cmd *cmd;
2128	struct bt_uuid *match, *tmp;
2129	u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130	struct hci_request req;
2131	int err, found;
2132
2133	BT_DBG("request for %s", hdev->name);
2134
2135	hci_dev_lock(hdev);
2136
2137	if (pending_eir_or_class(hdev)) {
2138		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139				      MGMT_STATUS_BUSY);
2140		goto unlock;
2141	}
2142
2143	if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144		hci_uuids_clear(hdev);
2145
2146		if (enable_service_cache(hdev)) {
2147			err = mgmt_cmd_complete(sk, hdev->id,
2148						MGMT_OP_REMOVE_UUID,
2149						0, hdev->dev_class, 3);
2150			goto unlock;
2151		}
2152
2153		goto update_class;
2154	}
2155
2156	found = 0;
2157
2158	list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159		if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160			continue;
2161
2162		list_del(&match->list);
2163		kfree(match);
2164		found++;
2165	}
2166
2167	if (found == 0) {
2168		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169				      MGMT_STATUS_INVALID_PARAMS);
2170		goto unlock;
2171	}
2172
2173update_class:
2174	hci_req_init(&req, hdev);
2175
2176	__hci_req_update_class(&req);
2177	__hci_req_update_eir(&req);
2178
2179	err = hci_req_run(&req, remove_uuid_complete);
2180	if (err < 0) {
2181		if (err != -ENODATA)
2182			goto unlock;
2183
2184		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185					hdev->dev_class, 3);
2186		goto unlock;
2187	}
2188
2189	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190	if (!cmd) {
2191		err = -ENOMEM;
2192		goto unlock;
2193	}
2194
2195	err = 0;
2196
2197unlock:
2198	hci_dev_unlock(hdev);
2199	return err;
2200}
2201
2202static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203{
2204	BT_DBG("status 0x%02x", status);
2205
2206	mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207}
2208
2209static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210			 u16 len)
2211{
2212	struct mgmt_cp_set_dev_class *cp = data;
2213	struct mgmt_pending_cmd *cmd;
2214	struct hci_request req;
2215	int err;
2216
2217	BT_DBG("request for %s", hdev->name);
2218
2219	if (!lmp_bredr_capable(hdev))
2220		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221				       MGMT_STATUS_NOT_SUPPORTED);
2222
2223	hci_dev_lock(hdev);
2224
2225	if (pending_eir_or_class(hdev)) {
2226		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227				      MGMT_STATUS_BUSY);
2228		goto unlock;
2229	}
2230
2231	if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233				      MGMT_STATUS_INVALID_PARAMS);
2234		goto unlock;
2235	}
2236
2237	hdev->major_class = cp->major;
2238	hdev->minor_class = cp->minor;
2239
2240	if (!hdev_is_powered(hdev)) {
2241		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242					hdev->dev_class, 3);
2243		goto unlock;
2244	}
2245
2246	hci_req_init(&req, hdev);
2247
2248	if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249		hci_dev_unlock(hdev);
2250		cancel_delayed_work_sync(&hdev->service_cache);
2251		hci_dev_lock(hdev);
2252		__hci_req_update_eir(&req);
2253	}
2254
2255	__hci_req_update_class(&req);
2256
2257	err = hci_req_run(&req, set_class_complete);
2258	if (err < 0) {
2259		if (err != -ENODATA)
2260			goto unlock;
2261
2262		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263					hdev->dev_class, 3);
2264		goto unlock;
2265	}
2266
2267	cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268	if (!cmd) {
2269		err = -ENOMEM;
2270		goto unlock;
2271	}
2272
2273	err = 0;
2274
2275unlock:
2276	hci_dev_unlock(hdev);
2277	return err;
2278}
2279
2280static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281			  u16 len)
2282{
2283	struct mgmt_cp_load_link_keys *cp = data;
2284	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285				   sizeof(struct mgmt_link_key_info));
2286	u16 key_count, expected_len;
2287	bool changed;
2288	int i;
2289
2290	BT_DBG("request for %s", hdev->name);
2291
2292	if (!lmp_bredr_capable(hdev))
2293		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294				       MGMT_STATUS_NOT_SUPPORTED);
2295
2296	key_count = __le16_to_cpu(cp->key_count);
2297	if (key_count > max_key_count) {
2298		bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299			   key_count);
2300		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301				       MGMT_STATUS_INVALID_PARAMS);
2302	}
2303
2304	expected_len = struct_size(cp, keys, key_count);
 
2305	if (expected_len != len) {
2306		bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2307			   expected_len, len);
2308		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309				       MGMT_STATUS_INVALID_PARAMS);
2310	}
2311
2312	if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2313		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2314				       MGMT_STATUS_INVALID_PARAMS);
2315
2316	BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2317	       key_count);
2318
2319	for (i = 0; i < key_count; i++) {
2320		struct mgmt_link_key_info *key = &cp->keys[i];
2321
2322		if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2323			return mgmt_cmd_status(sk, hdev->id,
2324					       MGMT_OP_LOAD_LINK_KEYS,
2325					       MGMT_STATUS_INVALID_PARAMS);
2326	}
2327
2328	hci_dev_lock(hdev);
2329
2330	hci_link_keys_clear(hdev);
2331
2332	if (cp->debug_keys)
2333		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2334	else
2335		changed = hci_dev_test_and_clear_flag(hdev,
2336						      HCI_KEEP_DEBUG_KEYS);
2337
2338	if (changed)
2339		new_settings(hdev, NULL);
2340
2341	for (i = 0; i < key_count; i++) {
2342		struct mgmt_link_key_info *key = &cp->keys[i];
2343
2344		/* Always ignore debug keys and require a new pairing if
2345		 * the user wants to use them.
2346		 */
2347		if (key->type == HCI_LK_DEBUG_COMBINATION)
2348			continue;
2349
2350		hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2351				 key->type, key->pin_len, NULL);
2352	}
2353
2354	mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2355
2356	hci_dev_unlock(hdev);
2357
2358	return 0;
2359}
2360
2361static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2362			   u8 addr_type, struct sock *skip_sk)
2363{
2364	struct mgmt_ev_device_unpaired ev;
2365
2366	bacpy(&ev.addr.bdaddr, bdaddr);
2367	ev.addr.type = addr_type;
2368
2369	return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2370			  skip_sk);
2371}
2372
2373static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2374			 u16 len)
2375{
2376	struct mgmt_cp_unpair_device *cp = data;
2377	struct mgmt_rp_unpair_device rp;
2378	struct hci_conn_params *params;
2379	struct mgmt_pending_cmd *cmd;
2380	struct hci_conn *conn;
2381	u8 addr_type;
2382	int err;
2383
2384	memset(&rp, 0, sizeof(rp));
2385	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2386	rp.addr.type = cp->addr.type;
2387
2388	if (!bdaddr_type_is_valid(cp->addr.type))
2389		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2390					 MGMT_STATUS_INVALID_PARAMS,
2391					 &rp, sizeof(rp));
2392
2393	if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2394		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2395					 MGMT_STATUS_INVALID_PARAMS,
2396					 &rp, sizeof(rp));
2397
2398	hci_dev_lock(hdev);
2399
2400	if (!hdev_is_powered(hdev)) {
2401		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2402					MGMT_STATUS_NOT_POWERED, &rp,
2403					sizeof(rp));
2404		goto unlock;
2405	}
2406
2407	if (cp->addr.type == BDADDR_BREDR) {
2408		/* If disconnection is requested, then look up the
2409		 * connection. If the remote device is connected, it
2410		 * will be later used to terminate the link.
2411		 *
2412		 * Setting it to NULL explicitly will cause no
2413		 * termination of the link.
2414		 */
2415		if (cp->disconnect)
2416			conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2417						       &cp->addr.bdaddr);
2418		else
2419			conn = NULL;
2420
2421		err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2422		if (err < 0) {
2423			err = mgmt_cmd_complete(sk, hdev->id,
2424						MGMT_OP_UNPAIR_DEVICE,
2425						MGMT_STATUS_NOT_PAIRED, &rp,
2426						sizeof(rp));
2427			goto unlock;
2428		}
2429
2430		goto done;
2431	}
2432
2433	/* LE address type */
2434	addr_type = le_addr_type(cp->addr.type);
2435
2436	/* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2437	err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
 
2438	if (err < 0) {
2439		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2440					MGMT_STATUS_NOT_PAIRED, &rp,
2441					sizeof(rp));
2442		goto unlock;
2443	}
2444
2445	conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2446	if (!conn) {
2447		hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2448		goto done;
2449	}
2450
 
 
2451
2452	/* Defer clearing up the connection parameters until closing to
2453	 * give a chance of keeping them if a repairing happens.
2454	 */
2455	set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2456
2457	/* Disable auto-connection parameters if present */
2458	params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2459	if (params) {
2460		if (params->explicit_connect)
2461			params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2462		else
2463			params->auto_connect = HCI_AUTO_CONN_DISABLED;
2464	}
2465
2466	/* If disconnection is not requested, then clear the connection
2467	 * variable so that the link is not terminated.
2468	 */
2469	if (!cp->disconnect)
2470		conn = NULL;
2471
2472done:
2473	/* If the connection variable is set, then termination of the
2474	 * link is requested.
2475	 */
2476	if (!conn) {
2477		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2478					&rp, sizeof(rp));
2479		device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2480		goto unlock;
2481	}
2482
2483	cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2484			       sizeof(*cp));
2485	if (!cmd) {
2486		err = -ENOMEM;
2487		goto unlock;
2488	}
2489
2490	cmd->cmd_complete = addr_cmd_complete;
2491
2492	err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2493	if (err < 0)
2494		mgmt_pending_remove(cmd);
2495
2496unlock:
2497	hci_dev_unlock(hdev);
2498	return err;
2499}
2500
2501static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2502		      u16 len)
2503{
2504	struct mgmt_cp_disconnect *cp = data;
2505	struct mgmt_rp_disconnect rp;
2506	struct mgmt_pending_cmd *cmd;
2507	struct hci_conn *conn;
2508	int err;
2509
2510	BT_DBG("");
2511
2512	memset(&rp, 0, sizeof(rp));
2513	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2514	rp.addr.type = cp->addr.type;
2515
2516	if (!bdaddr_type_is_valid(cp->addr.type))
2517		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2518					 MGMT_STATUS_INVALID_PARAMS,
2519					 &rp, sizeof(rp));
2520
2521	hci_dev_lock(hdev);
2522
2523	if (!test_bit(HCI_UP, &hdev->flags)) {
2524		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2525					MGMT_STATUS_NOT_POWERED, &rp,
2526					sizeof(rp));
2527		goto failed;
2528	}
2529
2530	if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2531		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2532					MGMT_STATUS_BUSY, &rp, sizeof(rp));
2533		goto failed;
2534	}
2535
2536	if (cp->addr.type == BDADDR_BREDR)
2537		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2538					       &cp->addr.bdaddr);
2539	else
2540		conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2541					       le_addr_type(cp->addr.type));
2542
2543	if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2544		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2545					MGMT_STATUS_NOT_CONNECTED, &rp,
2546					sizeof(rp));
2547		goto failed;
2548	}
2549
2550	cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2551	if (!cmd) {
2552		err = -ENOMEM;
2553		goto failed;
2554	}
2555
2556	cmd->cmd_complete = generic_cmd_complete;
2557
2558	err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2559	if (err < 0)
2560		mgmt_pending_remove(cmd);
2561
2562failed:
2563	hci_dev_unlock(hdev);
2564	return err;
2565}
2566
2567static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2568{
2569	switch (link_type) {
2570	case LE_LINK:
2571		switch (addr_type) {
2572		case ADDR_LE_DEV_PUBLIC:
2573			return BDADDR_LE_PUBLIC;
2574
2575		default:
2576			/* Fallback to LE Random address type */
2577			return BDADDR_LE_RANDOM;
2578		}
2579
2580	default:
2581		/* Fallback to BR/EDR type */
2582		return BDADDR_BREDR;
2583	}
2584}
2585
2586static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2587			   u16 data_len)
2588{
2589	struct mgmt_rp_get_connections *rp;
2590	struct hci_conn *c;
 
2591	int err;
2592	u16 i;
2593
2594	BT_DBG("");
2595
2596	hci_dev_lock(hdev);
2597
2598	if (!hdev_is_powered(hdev)) {
2599		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2600				      MGMT_STATUS_NOT_POWERED);
2601		goto unlock;
2602	}
2603
2604	i = 0;
2605	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2606		if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2607			i++;
2608	}
2609
2610	rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
 
2611	if (!rp) {
2612		err = -ENOMEM;
2613		goto unlock;
2614	}
2615
2616	i = 0;
2617	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2618		if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2619			continue;
2620		bacpy(&rp->addr[i].bdaddr, &c->dst);
2621		rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2622		if (c->type == SCO_LINK || c->type == ESCO_LINK)
2623			continue;
2624		i++;
2625	}
2626
2627	rp->conn_count = cpu_to_le16(i);
2628
2629	/* Recalculate length in case of filtered SCO connections, etc */
 
 
2630	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2631				struct_size(rp, addr, i));
2632
2633	kfree(rp);
2634
2635unlock:
2636	hci_dev_unlock(hdev);
2637	return err;
2638}
2639
2640static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2641				   struct mgmt_cp_pin_code_neg_reply *cp)
2642{
2643	struct mgmt_pending_cmd *cmd;
2644	int err;
2645
2646	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2647			       sizeof(*cp));
2648	if (!cmd)
2649		return -ENOMEM;
2650
2651	cmd->cmd_complete = addr_cmd_complete;
2652
2653	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2654			   sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2655	if (err < 0)
2656		mgmt_pending_remove(cmd);
2657
2658	return err;
2659}
2660
2661static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2662			  u16 len)
2663{
2664	struct hci_conn *conn;
2665	struct mgmt_cp_pin_code_reply *cp = data;
2666	struct hci_cp_pin_code_reply reply;
2667	struct mgmt_pending_cmd *cmd;
2668	int err;
2669
2670	BT_DBG("");
2671
2672	hci_dev_lock(hdev);
2673
2674	if (!hdev_is_powered(hdev)) {
2675		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2676				      MGMT_STATUS_NOT_POWERED);
2677		goto failed;
2678	}
2679
2680	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2681	if (!conn) {
2682		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2683				      MGMT_STATUS_NOT_CONNECTED);
2684		goto failed;
2685	}
2686
2687	if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2688		struct mgmt_cp_pin_code_neg_reply ncp;
2689
2690		memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2691
2692		bt_dev_err(hdev, "PIN code is not 16 bytes long");
2693
2694		err = send_pin_code_neg_reply(sk, hdev, &ncp);
2695		if (err >= 0)
2696			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2697					      MGMT_STATUS_INVALID_PARAMS);
2698
2699		goto failed;
2700	}
2701
2702	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2703	if (!cmd) {
2704		err = -ENOMEM;
2705		goto failed;
2706	}
2707
2708	cmd->cmd_complete = addr_cmd_complete;
2709
2710	bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2711	reply.pin_len = cp->pin_len;
2712	memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2713
2714	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2715	if (err < 0)
2716		mgmt_pending_remove(cmd);
2717
2718failed:
2719	hci_dev_unlock(hdev);
2720	return err;
2721}
2722
2723static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2724			     u16 len)
2725{
2726	struct mgmt_cp_set_io_capability *cp = data;
2727
2728	BT_DBG("");
2729
2730	if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2731		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2732				       MGMT_STATUS_INVALID_PARAMS);
2733
2734	hci_dev_lock(hdev);
2735
2736	hdev->io_capability = cp->io_capability;
2737
2738	BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2739	       hdev->io_capability);
2740
2741	hci_dev_unlock(hdev);
2742
2743	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2744				 NULL, 0);
2745}
2746
2747static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2748{
2749	struct hci_dev *hdev = conn->hdev;
2750	struct mgmt_pending_cmd *cmd;
2751
2752	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2753		if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2754			continue;
2755
2756		if (cmd->user_data != conn)
2757			continue;
2758
2759		return cmd;
2760	}
2761
2762	return NULL;
2763}
2764
2765static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2766{
2767	struct mgmt_rp_pair_device rp;
2768	struct hci_conn *conn = cmd->user_data;
2769	int err;
2770
2771	bacpy(&rp.addr.bdaddr, &conn->dst);
2772	rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2773
2774	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2775				status, &rp, sizeof(rp));
2776
2777	/* So we don't get further callbacks for this connection */
2778	conn->connect_cfm_cb = NULL;
2779	conn->security_cfm_cb = NULL;
2780	conn->disconn_cfm_cb = NULL;
2781
2782	hci_conn_drop(conn);
2783
2784	/* The device is paired so there is no need to remove
2785	 * its connection parameters anymore.
2786	 */
2787	clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2788
2789	hci_conn_put(conn);
2790
2791	return err;
2792}
2793
2794void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2795{
2796	u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2797	struct mgmt_pending_cmd *cmd;
2798
2799	cmd = find_pairing(conn);
2800	if (cmd) {
2801		cmd->cmd_complete(cmd, status);
2802		mgmt_pending_remove(cmd);
2803	}
2804}
2805
2806static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2807{
2808	struct mgmt_pending_cmd *cmd;
2809
2810	BT_DBG("status %u", status);
2811
2812	cmd = find_pairing(conn);
2813	if (!cmd) {
2814		BT_DBG("Unable to find a pending command");
2815		return;
2816	}
2817
2818	cmd->cmd_complete(cmd, mgmt_status(status));
2819	mgmt_pending_remove(cmd);
2820}
2821
2822static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2823{
2824	struct mgmt_pending_cmd *cmd;
2825
2826	BT_DBG("status %u", status);
2827
2828	if (!status)
2829		return;
2830
2831	cmd = find_pairing(conn);
2832	if (!cmd) {
2833		BT_DBG("Unable to find a pending command");
2834		return;
2835	}
2836
2837	cmd->cmd_complete(cmd, mgmt_status(status));
2838	mgmt_pending_remove(cmd);
2839}
2840
2841static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2842		       u16 len)
2843{
2844	struct mgmt_cp_pair_device *cp = data;
2845	struct mgmt_rp_pair_device rp;
2846	struct mgmt_pending_cmd *cmd;
2847	u8 sec_level, auth_type;
2848	struct hci_conn *conn;
2849	int err;
2850
2851	BT_DBG("");
2852
2853	memset(&rp, 0, sizeof(rp));
2854	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2855	rp.addr.type = cp->addr.type;
2856
2857	if (!bdaddr_type_is_valid(cp->addr.type))
2858		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2859					 MGMT_STATUS_INVALID_PARAMS,
2860					 &rp, sizeof(rp));
2861
2862	if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2863		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2864					 MGMT_STATUS_INVALID_PARAMS,
2865					 &rp, sizeof(rp));
2866
2867	hci_dev_lock(hdev);
2868
2869	if (!hdev_is_powered(hdev)) {
2870		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2871					MGMT_STATUS_NOT_POWERED, &rp,
2872					sizeof(rp));
2873		goto unlock;
2874	}
2875
2876	if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2877		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2878					MGMT_STATUS_ALREADY_PAIRED, &rp,
2879					sizeof(rp));
2880		goto unlock;
2881	}
2882
2883	sec_level = BT_SECURITY_MEDIUM;
2884	auth_type = HCI_AT_DEDICATED_BONDING;
2885
2886	if (cp->addr.type == BDADDR_BREDR) {
2887		conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2888				       auth_type);
2889	} else {
2890		u8 addr_type = le_addr_type(cp->addr.type);
2891		struct hci_conn_params *p;
2892
2893		/* When pairing a new device, it is expected to remember
2894		 * this device for future connections. Adding the connection
2895		 * parameter information ahead of time allows tracking
2896		 * of the slave preferred values and will speed up any
2897		 * further connection establishment.
2898		 *
2899		 * If connection parameters already exist, then they
2900		 * will be kept and this function does nothing.
2901		 */
2902		p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2903
2904		if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2905			p->auto_connect = HCI_AUTO_CONN_DISABLED;
2906
2907		conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2908					   addr_type, sec_level,
2909					   HCI_LE_CONN_TIMEOUT);
2910	}
2911
2912	if (IS_ERR(conn)) {
2913		int status;
2914
2915		if (PTR_ERR(conn) == -EBUSY)
2916			status = MGMT_STATUS_BUSY;
2917		else if (PTR_ERR(conn) == -EOPNOTSUPP)
2918			status = MGMT_STATUS_NOT_SUPPORTED;
2919		else if (PTR_ERR(conn) == -ECONNREFUSED)
2920			status = MGMT_STATUS_REJECTED;
2921		else
2922			status = MGMT_STATUS_CONNECT_FAILED;
2923
2924		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2925					status, &rp, sizeof(rp));
2926		goto unlock;
2927	}
2928
2929	if (conn->connect_cfm_cb) {
2930		hci_conn_drop(conn);
2931		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2932					MGMT_STATUS_BUSY, &rp, sizeof(rp));
2933		goto unlock;
2934	}
2935
2936	cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2937	if (!cmd) {
2938		err = -ENOMEM;
2939		hci_conn_drop(conn);
2940		goto unlock;
2941	}
2942
2943	cmd->cmd_complete = pairing_complete;
2944
2945	/* For LE, just connecting isn't a proof that the pairing finished */
2946	if (cp->addr.type == BDADDR_BREDR) {
2947		conn->connect_cfm_cb = pairing_complete_cb;
2948		conn->security_cfm_cb = pairing_complete_cb;
2949		conn->disconn_cfm_cb = pairing_complete_cb;
2950	} else {
2951		conn->connect_cfm_cb = le_pairing_complete_cb;
2952		conn->security_cfm_cb = le_pairing_complete_cb;
2953		conn->disconn_cfm_cb = le_pairing_complete_cb;
2954	}
2955
2956	conn->io_capability = cp->io_cap;
2957	cmd->user_data = hci_conn_get(conn);
2958
2959	if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2960	    hci_conn_security(conn, sec_level, auth_type, true)) {
2961		cmd->cmd_complete(cmd, 0);
2962		mgmt_pending_remove(cmd);
2963	}
2964
2965	err = 0;
2966
2967unlock:
2968	hci_dev_unlock(hdev);
2969	return err;
2970}
2971
2972static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2973			      u16 len)
2974{
2975	struct mgmt_addr_info *addr = data;
2976	struct mgmt_pending_cmd *cmd;
2977	struct hci_conn *conn;
2978	int err;
2979
2980	BT_DBG("");
2981
2982	hci_dev_lock(hdev);
2983
2984	if (!hdev_is_powered(hdev)) {
2985		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2986				      MGMT_STATUS_NOT_POWERED);
2987		goto unlock;
2988	}
2989
2990	cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2991	if (!cmd) {
2992		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2993				      MGMT_STATUS_INVALID_PARAMS);
2994		goto unlock;
2995	}
2996
2997	conn = cmd->user_data;
2998
2999	if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3000		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001				      MGMT_STATUS_INVALID_PARAMS);
3002		goto unlock;
3003	}
3004
3005	cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3006	mgmt_pending_remove(cmd);
3007
3008	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3009				addr, sizeof(*addr));
3010unlock:
3011	hci_dev_unlock(hdev);
3012	return err;
3013}
3014
3015static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3016			     struct mgmt_addr_info *addr, u16 mgmt_op,
3017			     u16 hci_op, __le32 passkey)
3018{
3019	struct mgmt_pending_cmd *cmd;
3020	struct hci_conn *conn;
3021	int err;
3022
3023	hci_dev_lock(hdev);
3024
3025	if (!hdev_is_powered(hdev)) {
3026		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3027					MGMT_STATUS_NOT_POWERED, addr,
3028					sizeof(*addr));
3029		goto done;
3030	}
3031
3032	if (addr->type == BDADDR_BREDR)
3033		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3034	else
3035		conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3036					       le_addr_type(addr->type));
3037
3038	if (!conn) {
3039		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3040					MGMT_STATUS_NOT_CONNECTED, addr,
3041					sizeof(*addr));
3042		goto done;
3043	}
3044
3045	if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3046		err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3047		if (!err)
3048			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3049						MGMT_STATUS_SUCCESS, addr,
3050						sizeof(*addr));
3051		else
3052			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3053						MGMT_STATUS_FAILED, addr,
3054						sizeof(*addr));
3055
3056		goto done;
3057	}
3058
3059	cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3060	if (!cmd) {
3061		err = -ENOMEM;
3062		goto done;
3063	}
3064
3065	cmd->cmd_complete = addr_cmd_complete;
3066
3067	/* Continue with pairing via HCI */
3068	if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3069		struct hci_cp_user_passkey_reply cp;
3070
3071		bacpy(&cp.bdaddr, &addr->bdaddr);
3072		cp.passkey = passkey;
3073		err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3074	} else
3075		err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3076				   &addr->bdaddr);
3077
3078	if (err < 0)
3079		mgmt_pending_remove(cmd);
3080
3081done:
3082	hci_dev_unlock(hdev);
3083	return err;
3084}
3085
3086static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3087			      void *data, u16 len)
3088{
3089	struct mgmt_cp_pin_code_neg_reply *cp = data;
3090
3091	BT_DBG("");
3092
3093	return user_pairing_resp(sk, hdev, &cp->addr,
3094				MGMT_OP_PIN_CODE_NEG_REPLY,
3095				HCI_OP_PIN_CODE_NEG_REPLY, 0);
3096}
3097
3098static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3099			      u16 len)
3100{
3101	struct mgmt_cp_user_confirm_reply *cp = data;
3102
3103	BT_DBG("");
3104
3105	if (len != sizeof(*cp))
3106		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3107				       MGMT_STATUS_INVALID_PARAMS);
3108
3109	return user_pairing_resp(sk, hdev, &cp->addr,
3110				 MGMT_OP_USER_CONFIRM_REPLY,
3111				 HCI_OP_USER_CONFIRM_REPLY, 0);
3112}
3113
3114static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3115				  void *data, u16 len)
3116{
3117	struct mgmt_cp_user_confirm_neg_reply *cp = data;
3118
3119	BT_DBG("");
3120
3121	return user_pairing_resp(sk, hdev, &cp->addr,
3122				 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3123				 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3124}
3125
3126static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3127			      u16 len)
3128{
3129	struct mgmt_cp_user_passkey_reply *cp = data;
3130
3131	BT_DBG("");
3132
3133	return user_pairing_resp(sk, hdev, &cp->addr,
3134				 MGMT_OP_USER_PASSKEY_REPLY,
3135				 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3136}
3137
3138static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3139				  void *data, u16 len)
3140{
3141	struct mgmt_cp_user_passkey_neg_reply *cp = data;
3142
3143	BT_DBG("");
3144
3145	return user_pairing_resp(sk, hdev, &cp->addr,
3146				 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3147				 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3148}
3149
3150static void adv_expire(struct hci_dev *hdev, u32 flags)
3151{
3152	struct adv_info *adv_instance;
3153	struct hci_request req;
3154	int err;
3155
3156	adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3157	if (!adv_instance)
3158		return;
3159
3160	/* stop if current instance doesn't need to be changed */
3161	if (!(adv_instance->flags & flags))
3162		return;
3163
3164	cancel_adv_timeout(hdev);
3165
3166	adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3167	if (!adv_instance)
3168		return;
3169
3170	hci_req_init(&req, hdev);
3171	err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3172					      true);
3173	if (err)
3174		return;
3175
3176	hci_req_run(&req, NULL);
3177}
3178
3179static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3180{
3181	struct mgmt_cp_set_local_name *cp;
3182	struct mgmt_pending_cmd *cmd;
3183
3184	BT_DBG("status 0x%02x", status);
3185
3186	hci_dev_lock(hdev);
3187
3188	cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3189	if (!cmd)
3190		goto unlock;
3191
3192	cp = cmd->param;
3193
3194	if (status) {
3195		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3196			        mgmt_status(status));
3197	} else {
3198		mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3199				  cp, sizeof(*cp));
3200
3201		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3202			adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3203	}
3204
3205	mgmt_pending_remove(cmd);
3206
3207unlock:
3208	hci_dev_unlock(hdev);
3209}
3210
3211static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3212			  u16 len)
3213{
3214	struct mgmt_cp_set_local_name *cp = data;
3215	struct mgmt_pending_cmd *cmd;
3216	struct hci_request req;
3217	int err;
3218
3219	BT_DBG("");
3220
3221	hci_dev_lock(hdev);
3222
3223	/* If the old values are the same as the new ones just return a
3224	 * direct command complete event.
3225	 */
3226	if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3227	    !memcmp(hdev->short_name, cp->short_name,
3228		    sizeof(hdev->short_name))) {
3229		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3230					data, len);
3231		goto failed;
3232	}
3233
3234	memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3235
3236	if (!hdev_is_powered(hdev)) {
3237		memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3238
3239		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3240					data, len);
3241		if (err < 0)
3242			goto failed;
3243
3244		err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3245					 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3246		ext_info_changed(hdev, sk);
3247
3248		goto failed;
3249	}
3250
3251	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3252	if (!cmd) {
3253		err = -ENOMEM;
3254		goto failed;
3255	}
3256
3257	memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3258
3259	hci_req_init(&req, hdev);
3260
3261	if (lmp_bredr_capable(hdev)) {
3262		__hci_req_update_name(&req);
3263		__hci_req_update_eir(&req);
3264	}
3265
3266	/* The name is stored in the scan response data and so
3267	 * no need to udpate the advertising data here.
3268	 */
3269	if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3270		__hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3271
3272	err = hci_req_run(&req, set_name_complete);
3273	if (err < 0)
3274		mgmt_pending_remove(cmd);
3275
3276failed:
3277	hci_dev_unlock(hdev);
3278	return err;
3279}
3280
3281static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3282			  u16 len)
3283{
3284	struct mgmt_cp_set_appearance *cp = data;
3285	u16 apperance;
3286	int err;
3287
3288	BT_DBG("");
3289
3290	if (!lmp_le_capable(hdev))
3291		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3292				       MGMT_STATUS_NOT_SUPPORTED);
3293
3294	apperance = le16_to_cpu(cp->appearance);
3295
3296	hci_dev_lock(hdev);
3297
3298	if (hdev->appearance != apperance) {
3299		hdev->appearance = apperance;
3300
3301		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3302			adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3303
3304		ext_info_changed(hdev, sk);
3305	}
3306
3307	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3308				0);
3309
3310	hci_dev_unlock(hdev);
3311
3312	return err;
3313}
3314
3315static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3316				 void *data, u16 len)
3317{
3318	struct mgmt_rp_get_phy_confguration rp;
3319
3320	BT_DBG("sock %p %s", sk, hdev->name);
3321
3322	hci_dev_lock(hdev);
3323
3324	memset(&rp, 0, sizeof(rp));
3325
3326	rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3327	rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3328	rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3329
3330	hci_dev_unlock(hdev);
3331
3332	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3333				 &rp, sizeof(rp));
3334}
3335
3336int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3337{
3338	struct mgmt_ev_phy_configuration_changed ev;
3339
3340	memset(&ev, 0, sizeof(ev));
3341
3342	ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3343
3344	return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3345			  sizeof(ev), skip);
3346}
3347
3348static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3349				     u16 opcode, struct sk_buff *skb)
3350{
3351	struct mgmt_pending_cmd *cmd;
3352
3353	BT_DBG("status 0x%02x", status);
3354
3355	hci_dev_lock(hdev);
3356
3357	cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3358	if (!cmd)
3359		goto unlock;
3360
3361	if (status) {
3362		mgmt_cmd_status(cmd->sk, hdev->id,
3363				MGMT_OP_SET_PHY_CONFIGURATION,
3364				mgmt_status(status));
3365	} else {
3366		mgmt_cmd_complete(cmd->sk, hdev->id,
3367				  MGMT_OP_SET_PHY_CONFIGURATION, 0,
3368				  NULL, 0);
3369
3370		mgmt_phy_configuration_changed(hdev, cmd->sk);
3371	}
3372
3373	mgmt_pending_remove(cmd);
3374
3375unlock:
3376	hci_dev_unlock(hdev);
3377}
3378
3379static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3380				 void *data, u16 len)
3381{
3382	struct mgmt_cp_set_phy_confguration *cp = data;
3383	struct hci_cp_le_set_default_phy cp_phy;
3384	struct mgmt_pending_cmd *cmd;
3385	struct hci_request req;
3386	u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3387	u16 pkt_type = (HCI_DH1 | HCI_DM1);
3388	bool changed = false;
3389	int err;
3390
3391	BT_DBG("sock %p %s", sk, hdev->name);
3392
3393	configurable_phys = get_configurable_phys(hdev);
3394	supported_phys = get_supported_phys(hdev);
3395	selected_phys = __le32_to_cpu(cp->selected_phys);
3396
3397	if (selected_phys & ~supported_phys)
3398		return mgmt_cmd_status(sk, hdev->id,
3399				       MGMT_OP_SET_PHY_CONFIGURATION,
3400				       MGMT_STATUS_INVALID_PARAMS);
3401
3402	unconfigure_phys = supported_phys & ~configurable_phys;
3403
3404	if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3405		return mgmt_cmd_status(sk, hdev->id,
3406				       MGMT_OP_SET_PHY_CONFIGURATION,
3407				       MGMT_STATUS_INVALID_PARAMS);
3408
3409	if (selected_phys == get_selected_phys(hdev))
3410		return mgmt_cmd_complete(sk, hdev->id,
3411					 MGMT_OP_SET_PHY_CONFIGURATION,
3412					 0, NULL, 0);
3413
3414	hci_dev_lock(hdev);
3415
3416	if (!hdev_is_powered(hdev)) {
3417		err = mgmt_cmd_status(sk, hdev->id,
3418				      MGMT_OP_SET_PHY_CONFIGURATION,
3419				      MGMT_STATUS_REJECTED);
3420		goto unlock;
3421	}
3422
3423	if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3424		err = mgmt_cmd_status(sk, hdev->id,
3425				      MGMT_OP_SET_PHY_CONFIGURATION,
3426				      MGMT_STATUS_BUSY);
3427		goto unlock;
3428	}
3429
3430	if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3431		pkt_type |= (HCI_DH3 | HCI_DM3);
3432	else
3433		pkt_type &= ~(HCI_DH3 | HCI_DM3);
3434
3435	if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3436		pkt_type |= (HCI_DH5 | HCI_DM5);
3437	else
3438		pkt_type &= ~(HCI_DH5 | HCI_DM5);
3439
3440	if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3441		pkt_type &= ~HCI_2DH1;
3442	else
3443		pkt_type |= HCI_2DH1;
3444
3445	if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3446		pkt_type &= ~HCI_2DH3;
3447	else
3448		pkt_type |= HCI_2DH3;
3449
3450	if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3451		pkt_type &= ~HCI_2DH5;
3452	else
3453		pkt_type |= HCI_2DH5;
3454
3455	if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3456		pkt_type &= ~HCI_3DH1;
3457	else
3458		pkt_type |= HCI_3DH1;
3459
3460	if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3461		pkt_type &= ~HCI_3DH3;
3462	else
3463		pkt_type |= HCI_3DH3;
3464
3465	if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3466		pkt_type &= ~HCI_3DH5;
3467	else
3468		pkt_type |= HCI_3DH5;
3469
3470	if (pkt_type != hdev->pkt_type) {
3471		hdev->pkt_type = pkt_type;
3472		changed = true;
3473	}
3474
3475	if ((selected_phys & MGMT_PHY_LE_MASK) ==
3476	    (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3477		if (changed)
3478			mgmt_phy_configuration_changed(hdev, sk);
3479
3480		err = mgmt_cmd_complete(sk, hdev->id,
3481					MGMT_OP_SET_PHY_CONFIGURATION,
3482					0, NULL, 0);
3483
3484		goto unlock;
3485	}
3486
3487	cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3488			       len);
3489	if (!cmd) {
3490		err = -ENOMEM;
3491		goto unlock;
3492	}
3493
3494	hci_req_init(&req, hdev);
3495
3496	memset(&cp_phy, 0, sizeof(cp_phy));
3497
3498	if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3499		cp_phy.all_phys |= 0x01;
3500
3501	if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3502		cp_phy.all_phys |= 0x02;
3503
3504	if (selected_phys & MGMT_PHY_LE_1M_TX)
3505		cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3506
3507	if (selected_phys & MGMT_PHY_LE_2M_TX)
3508		cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3509
3510	if (selected_phys & MGMT_PHY_LE_CODED_TX)
3511		cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3512
3513	if (selected_phys & MGMT_PHY_LE_1M_RX)
3514		cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3515
3516	if (selected_phys & MGMT_PHY_LE_2M_RX)
3517		cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3518
3519	if (selected_phys & MGMT_PHY_LE_CODED_RX)
3520		cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3521
3522	hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3523
3524	err = hci_req_run_skb(&req, set_default_phy_complete);
3525	if (err < 0)
3526		mgmt_pending_remove(cmd);
3527
3528unlock:
3529	hci_dev_unlock(hdev);
3530
3531	return err;
3532}
3533
3534static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3535				         u16 opcode, struct sk_buff *skb)
3536{
3537	struct mgmt_rp_read_local_oob_data mgmt_rp;
3538	size_t rp_size = sizeof(mgmt_rp);
3539	struct mgmt_pending_cmd *cmd;
3540
3541	BT_DBG("%s status %u", hdev->name, status);
3542
3543	cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3544	if (!cmd)
3545		return;
3546
3547	if (status || !skb) {
3548		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3549				status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3550		goto remove;
3551	}
3552
3553	memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3554
3555	if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3556		struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3557
3558		if (skb->len < sizeof(*rp)) {
3559			mgmt_cmd_status(cmd->sk, hdev->id,
3560					MGMT_OP_READ_LOCAL_OOB_DATA,
3561					MGMT_STATUS_FAILED);
3562			goto remove;
3563		}
3564
3565		memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3566		memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3567
3568		rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3569	} else {
3570		struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3571
3572		if (skb->len < sizeof(*rp)) {
3573			mgmt_cmd_status(cmd->sk, hdev->id,
3574					MGMT_OP_READ_LOCAL_OOB_DATA,
3575					MGMT_STATUS_FAILED);
3576			goto remove;
3577		}
3578
3579		memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3580		memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3581
3582		memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3583		memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3584	}
3585
3586	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3587			  MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3588
3589remove:
3590	mgmt_pending_remove(cmd);
3591}
3592
3593static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3594			       void *data, u16 data_len)
3595{
3596	struct mgmt_pending_cmd *cmd;
3597	struct hci_request req;
3598	int err;
3599
3600	BT_DBG("%s", hdev->name);
3601
3602	hci_dev_lock(hdev);
3603
3604	if (!hdev_is_powered(hdev)) {
3605		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3606				      MGMT_STATUS_NOT_POWERED);
3607		goto unlock;
3608	}
3609
3610	if (!lmp_ssp_capable(hdev)) {
3611		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3612				      MGMT_STATUS_NOT_SUPPORTED);
3613		goto unlock;
3614	}
3615
3616	if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3617		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3618				      MGMT_STATUS_BUSY);
3619		goto unlock;
3620	}
3621
3622	cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3623	if (!cmd) {
3624		err = -ENOMEM;
3625		goto unlock;
3626	}
3627
3628	hci_req_init(&req, hdev);
3629
3630	if (bredr_sc_enabled(hdev))
3631		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3632	else
3633		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3634
3635	err = hci_req_run_skb(&req, read_local_oob_data_complete);
3636	if (err < 0)
3637		mgmt_pending_remove(cmd);
3638
3639unlock:
3640	hci_dev_unlock(hdev);
3641	return err;
3642}
3643
3644static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3645			       void *data, u16 len)
3646{
3647	struct mgmt_addr_info *addr = data;
3648	int err;
3649
3650	BT_DBG("%s ", hdev->name);
3651
3652	if (!bdaddr_type_is_valid(addr->type))
3653		return mgmt_cmd_complete(sk, hdev->id,
3654					 MGMT_OP_ADD_REMOTE_OOB_DATA,
3655					 MGMT_STATUS_INVALID_PARAMS,
3656					 addr, sizeof(*addr));
3657
3658	hci_dev_lock(hdev);
3659
3660	if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3661		struct mgmt_cp_add_remote_oob_data *cp = data;
3662		u8 status;
3663
3664		if (cp->addr.type != BDADDR_BREDR) {
3665			err = mgmt_cmd_complete(sk, hdev->id,
3666						MGMT_OP_ADD_REMOTE_OOB_DATA,
3667						MGMT_STATUS_INVALID_PARAMS,
3668						&cp->addr, sizeof(cp->addr));
3669			goto unlock;
3670		}
3671
3672		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3673					      cp->addr.type, cp->hash,
3674					      cp->rand, NULL, NULL);
3675		if (err < 0)
3676			status = MGMT_STATUS_FAILED;
3677		else
3678			status = MGMT_STATUS_SUCCESS;
3679
3680		err = mgmt_cmd_complete(sk, hdev->id,
3681					MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3682					&cp->addr, sizeof(cp->addr));
3683	} else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3684		struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3685		u8 *rand192, *hash192, *rand256, *hash256;
3686		u8 status;
3687
3688		if (bdaddr_type_is_le(cp->addr.type)) {
3689			/* Enforce zero-valued 192-bit parameters as
3690			 * long as legacy SMP OOB isn't implemented.
3691			 */
3692			if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3693			    memcmp(cp->hash192, ZERO_KEY, 16)) {
3694				err = mgmt_cmd_complete(sk, hdev->id,
3695							MGMT_OP_ADD_REMOTE_OOB_DATA,
3696							MGMT_STATUS_INVALID_PARAMS,
3697							addr, sizeof(*addr));
3698				goto unlock;
3699			}
3700
3701			rand192 = NULL;
3702			hash192 = NULL;
3703		} else {
3704			/* In case one of the P-192 values is set to zero,
3705			 * then just disable OOB data for P-192.
3706			 */
3707			if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3708			    !memcmp(cp->hash192, ZERO_KEY, 16)) {
3709				rand192 = NULL;
3710				hash192 = NULL;
3711			} else {
3712				rand192 = cp->rand192;
3713				hash192 = cp->hash192;
3714			}
3715		}
3716
3717		/* In case one of the P-256 values is set to zero, then just
3718		 * disable OOB data for P-256.
3719		 */
3720		if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3721		    !memcmp(cp->hash256, ZERO_KEY, 16)) {
3722			rand256 = NULL;
3723			hash256 = NULL;
3724		} else {
3725			rand256 = cp->rand256;
3726			hash256 = cp->hash256;
3727		}
3728
3729		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3730					      cp->addr.type, hash192, rand192,
3731					      hash256, rand256);
3732		if (err < 0)
3733			status = MGMT_STATUS_FAILED;
3734		else
3735			status = MGMT_STATUS_SUCCESS;
3736
3737		err = mgmt_cmd_complete(sk, hdev->id,
3738					MGMT_OP_ADD_REMOTE_OOB_DATA,
3739					status, &cp->addr, sizeof(cp->addr));
3740	} else {
3741		bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3742			   len);
3743		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3744				      MGMT_STATUS_INVALID_PARAMS);
3745	}
3746
3747unlock:
3748	hci_dev_unlock(hdev);
3749	return err;
3750}
3751
3752static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3753				  void *data, u16 len)
3754{
3755	struct mgmt_cp_remove_remote_oob_data *cp = data;
3756	u8 status;
3757	int err;
3758
3759	BT_DBG("%s", hdev->name);
3760
3761	if (cp->addr.type != BDADDR_BREDR)
3762		return mgmt_cmd_complete(sk, hdev->id,
3763					 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3764					 MGMT_STATUS_INVALID_PARAMS,
3765					 &cp->addr, sizeof(cp->addr));
3766
3767	hci_dev_lock(hdev);
3768
3769	if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3770		hci_remote_oob_data_clear(hdev);
3771		status = MGMT_STATUS_SUCCESS;
3772		goto done;
3773	}
3774
3775	err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3776	if (err < 0)
3777		status = MGMT_STATUS_INVALID_PARAMS;
3778	else
3779		status = MGMT_STATUS_SUCCESS;
3780
3781done:
3782	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3783				status, &cp->addr, sizeof(cp->addr));
3784
3785	hci_dev_unlock(hdev);
3786	return err;
3787}
3788
3789void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3790{
3791	struct mgmt_pending_cmd *cmd;
3792
3793	BT_DBG("status %d", status);
3794
3795	hci_dev_lock(hdev);
3796
3797	cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3798	if (!cmd)
3799		cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3800
3801	if (!cmd)
3802		cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3803
3804	if (cmd) {
3805		cmd->cmd_complete(cmd, mgmt_status(status));
3806		mgmt_pending_remove(cmd);
3807	}
3808
3809	hci_dev_unlock(hdev);
3810}
3811
3812static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3813				    uint8_t *mgmt_status)
3814{
3815	switch (type) {
3816	case DISCOV_TYPE_LE:
3817		*mgmt_status = mgmt_le_support(hdev);
3818		if (*mgmt_status)
3819			return false;
3820		break;
3821	case DISCOV_TYPE_INTERLEAVED:
3822		*mgmt_status = mgmt_le_support(hdev);
3823		if (*mgmt_status)
3824			return false;
3825		/* Intentional fall-through */
3826	case DISCOV_TYPE_BREDR:
3827		*mgmt_status = mgmt_bredr_support(hdev);
3828		if (*mgmt_status)
3829			return false;
3830		break;
3831	default:
3832		*mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3833		return false;
3834	}
3835
3836	return true;
3837}
3838
3839static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3840				    u16 op, void *data, u16 len)
3841{
3842	struct mgmt_cp_start_discovery *cp = data;
3843	struct mgmt_pending_cmd *cmd;
3844	u8 status;
3845	int err;
3846
3847	BT_DBG("%s", hdev->name);
3848
3849	hci_dev_lock(hdev);
3850
3851	if (!hdev_is_powered(hdev)) {
3852		err = mgmt_cmd_complete(sk, hdev->id, op,
3853					MGMT_STATUS_NOT_POWERED,
3854					&cp->type, sizeof(cp->type));
3855		goto failed;
3856	}
3857
3858	if (hdev->discovery.state != DISCOVERY_STOPPED ||
3859	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3860		err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3861					&cp->type, sizeof(cp->type));
3862		goto failed;
3863	}
3864
3865	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3866		err = mgmt_cmd_complete(sk, hdev->id, op, status,
3867					&cp->type, sizeof(cp->type));
3868		goto failed;
3869	}
3870
3871	/* Clear the discovery filter first to free any previously
3872	 * allocated memory for the UUID list.
3873	 */
3874	hci_discovery_filter_clear(hdev);
3875
3876	hdev->discovery.type = cp->type;
3877	hdev->discovery.report_invalid_rssi = false;
3878	if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3879		hdev->discovery.limited = true;
3880	else
3881		hdev->discovery.limited = false;
3882
3883	cmd = mgmt_pending_add(sk, op, hdev, data, len);
3884	if (!cmd) {
3885		err = -ENOMEM;
3886		goto failed;
3887	}
3888
3889	cmd->cmd_complete = generic_cmd_complete;
3890
3891	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3892	queue_work(hdev->req_workqueue, &hdev->discov_update);
3893	err = 0;
3894
3895failed:
3896	hci_dev_unlock(hdev);
3897	return err;
3898}
3899
3900static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3901			   void *data, u16 len)
3902{
3903	return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3904					data, len);
3905}
3906
3907static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3908				   void *data, u16 len)
3909{
3910	return start_discovery_internal(sk, hdev,
3911					MGMT_OP_START_LIMITED_DISCOVERY,
3912					data, len);
3913}
3914
3915static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3916					  u8 status)
3917{
3918	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3919				 cmd->param, 1);
3920}
3921
3922static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3923				   void *data, u16 len)
3924{
3925	struct mgmt_cp_start_service_discovery *cp = data;
3926	struct mgmt_pending_cmd *cmd;
3927	const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3928	u16 uuid_count, expected_len;
3929	u8 status;
3930	int err;
3931
3932	BT_DBG("%s", hdev->name);
3933
3934	hci_dev_lock(hdev);
3935
3936	if (!hdev_is_powered(hdev)) {
3937		err = mgmt_cmd_complete(sk, hdev->id,
3938					MGMT_OP_START_SERVICE_DISCOVERY,
3939					MGMT_STATUS_NOT_POWERED,
3940					&cp->type, sizeof(cp->type));
3941		goto failed;
3942	}
3943
3944	if (hdev->discovery.state != DISCOVERY_STOPPED ||
3945	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3946		err = mgmt_cmd_complete(sk, hdev->id,
3947					MGMT_OP_START_SERVICE_DISCOVERY,
3948					MGMT_STATUS_BUSY, &cp->type,
3949					sizeof(cp->type));
3950		goto failed;
3951	}
3952
3953	uuid_count = __le16_to_cpu(cp->uuid_count);
3954	if (uuid_count > max_uuid_count) {
3955		bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3956			   uuid_count);
3957		err = mgmt_cmd_complete(sk, hdev->id,
3958					MGMT_OP_START_SERVICE_DISCOVERY,
3959					MGMT_STATUS_INVALID_PARAMS, &cp->type,
3960					sizeof(cp->type));
3961		goto failed;
3962	}
3963
3964	expected_len = sizeof(*cp) + uuid_count * 16;
3965	if (expected_len != len) {
3966		bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3967			   expected_len, len);
3968		err = mgmt_cmd_complete(sk, hdev->id,
3969					MGMT_OP_START_SERVICE_DISCOVERY,
3970					MGMT_STATUS_INVALID_PARAMS, &cp->type,
3971					sizeof(cp->type));
3972		goto failed;
3973	}
3974
3975	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3976		err = mgmt_cmd_complete(sk, hdev->id,
3977					MGMT_OP_START_SERVICE_DISCOVERY,
3978					status, &cp->type, sizeof(cp->type));
3979		goto failed;
3980	}
3981
3982	cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3983			       hdev, data, len);
3984	if (!cmd) {
3985		err = -ENOMEM;
3986		goto failed;
3987	}
3988
3989	cmd->cmd_complete = service_discovery_cmd_complete;
3990
3991	/* Clear the discovery filter first to free any previously
3992	 * allocated memory for the UUID list.
3993	 */
3994	hci_discovery_filter_clear(hdev);
3995
3996	hdev->discovery.result_filtering = true;
3997	hdev->discovery.type = cp->type;
3998	hdev->discovery.rssi = cp->rssi;
3999	hdev->discovery.uuid_count = uuid_count;
4000
4001	if (uuid_count > 0) {
4002		hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4003						GFP_KERNEL);
4004		if (!hdev->discovery.uuids) {
4005			err = mgmt_cmd_complete(sk, hdev->id,
4006						MGMT_OP_START_SERVICE_DISCOVERY,
4007						MGMT_STATUS_FAILED,
4008						&cp->type, sizeof(cp->type));
4009			mgmt_pending_remove(cmd);
4010			goto failed;
4011		}
4012	}
4013
4014	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4015	queue_work(hdev->req_workqueue, &hdev->discov_update);
4016	err = 0;
4017
4018failed:
4019	hci_dev_unlock(hdev);
4020	return err;
4021}
4022
4023void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4024{
4025	struct mgmt_pending_cmd *cmd;
4026
4027	BT_DBG("status %d", status);
4028
4029	hci_dev_lock(hdev);
4030
4031	cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4032	if (cmd) {
4033		cmd->cmd_complete(cmd, mgmt_status(status));
4034		mgmt_pending_remove(cmd);
4035	}
4036
4037	hci_dev_unlock(hdev);
4038}
4039
4040static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4041			  u16 len)
4042{
4043	struct mgmt_cp_stop_discovery *mgmt_cp = data;
4044	struct mgmt_pending_cmd *cmd;
4045	int err;
4046
4047	BT_DBG("%s", hdev->name);
4048
4049	hci_dev_lock(hdev);
4050
4051	if (!hci_discovery_active(hdev)) {
4052		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4053					MGMT_STATUS_REJECTED, &mgmt_cp->type,
4054					sizeof(mgmt_cp->type));
4055		goto unlock;
4056	}
4057
4058	if (hdev->discovery.type != mgmt_cp->type) {
4059		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4060					MGMT_STATUS_INVALID_PARAMS,
4061					&mgmt_cp->type, sizeof(mgmt_cp->type));
4062		goto unlock;
4063	}
4064
4065	cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4066	if (!cmd) {
4067		err = -ENOMEM;
4068		goto unlock;
4069	}
4070
4071	cmd->cmd_complete = generic_cmd_complete;
4072
4073	hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4074	queue_work(hdev->req_workqueue, &hdev->discov_update);
4075	err = 0;
4076
4077unlock:
4078	hci_dev_unlock(hdev);
4079	return err;
4080}
4081
4082static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4083			u16 len)
4084{
4085	struct mgmt_cp_confirm_name *cp = data;
4086	struct inquiry_entry *e;
4087	int err;
4088
4089	BT_DBG("%s", hdev->name);
4090
4091	hci_dev_lock(hdev);
4092
4093	if (!hci_discovery_active(hdev)) {
4094		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4095					MGMT_STATUS_FAILED, &cp->addr,
4096					sizeof(cp->addr));
4097		goto failed;
4098	}
4099
4100	e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4101	if (!e) {
4102		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103					MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4104					sizeof(cp->addr));
4105		goto failed;
4106	}
4107
4108	if (cp->name_known) {
4109		e->name_state = NAME_KNOWN;
4110		list_del(&e->list);
4111	} else {
4112		e->name_state = NAME_NEEDED;
4113		hci_inquiry_cache_update_resolve(hdev, e);
4114	}
4115
4116	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4117				&cp->addr, sizeof(cp->addr));
4118
4119failed:
4120	hci_dev_unlock(hdev);
4121	return err;
4122}
4123
4124static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4125			u16 len)
4126{
4127	struct mgmt_cp_block_device *cp = data;
4128	u8 status;
4129	int err;
4130
4131	BT_DBG("%s", hdev->name);
4132
4133	if (!bdaddr_type_is_valid(cp->addr.type))
4134		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4135					 MGMT_STATUS_INVALID_PARAMS,
4136					 &cp->addr, sizeof(cp->addr));
4137
4138	hci_dev_lock(hdev);
4139
4140	err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4141				  cp->addr.type);
4142	if (err < 0) {
4143		status = MGMT_STATUS_FAILED;
4144		goto done;
4145	}
4146
4147	mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4148		   sk);
4149	status = MGMT_STATUS_SUCCESS;
4150
4151done:
4152	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4153				&cp->addr, sizeof(cp->addr));
4154
4155	hci_dev_unlock(hdev);
4156
4157	return err;
4158}
4159
4160static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4161			  u16 len)
4162{
4163	struct mgmt_cp_unblock_device *cp = data;
4164	u8 status;
4165	int err;
4166
4167	BT_DBG("%s", hdev->name);
4168
4169	if (!bdaddr_type_is_valid(cp->addr.type))
4170		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4171					 MGMT_STATUS_INVALID_PARAMS,
4172					 &cp->addr, sizeof(cp->addr));
4173
4174	hci_dev_lock(hdev);
4175
4176	err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4177				  cp->addr.type);
4178	if (err < 0) {
4179		status = MGMT_STATUS_INVALID_PARAMS;
4180		goto done;
4181	}
4182
4183	mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4184		   sk);
4185	status = MGMT_STATUS_SUCCESS;
4186
4187done:
4188	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4189				&cp->addr, sizeof(cp->addr));
4190
4191	hci_dev_unlock(hdev);
4192
4193	return err;
4194}
4195
4196static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4197			 u16 len)
4198{
4199	struct mgmt_cp_set_device_id *cp = data;
4200	struct hci_request req;
4201	int err;
4202	__u16 source;
4203
4204	BT_DBG("%s", hdev->name);
4205
4206	source = __le16_to_cpu(cp->source);
4207
4208	if (source > 0x0002)
4209		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4210				       MGMT_STATUS_INVALID_PARAMS);
4211
4212	hci_dev_lock(hdev);
4213
4214	hdev->devid_source = source;
4215	hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4216	hdev->devid_product = __le16_to_cpu(cp->product);
4217	hdev->devid_version = __le16_to_cpu(cp->version);
4218
4219	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4220				NULL, 0);
4221
4222	hci_req_init(&req, hdev);
4223	__hci_req_update_eir(&req);
4224	hci_req_run(&req, NULL);
4225
4226	hci_dev_unlock(hdev);
4227
4228	return err;
4229}
4230
4231static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4232					u16 opcode)
4233{
4234	BT_DBG("status %d", status);
4235}
4236
4237static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4238				     u16 opcode)
4239{
4240	struct cmd_lookup match = { NULL, hdev };
4241	struct hci_request req;
4242	u8 instance;
4243	struct adv_info *adv_instance;
4244	int err;
4245
4246	hci_dev_lock(hdev);
4247
4248	if (status) {
4249		u8 mgmt_err = mgmt_status(status);
4250
4251		mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4252				     cmd_status_rsp, &mgmt_err);
4253		goto unlock;
4254	}
4255
4256	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4257		hci_dev_set_flag(hdev, HCI_ADVERTISING);
4258	else
4259		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4260
4261	mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4262			     &match);
4263
4264	new_settings(hdev, match.sk);
4265
4266	if (match.sk)
4267		sock_put(match.sk);
4268
4269	/* If "Set Advertising" was just disabled and instance advertising was
4270	 * set up earlier, then re-enable multi-instance advertising.
4271	 */
4272	if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4273	    list_empty(&hdev->adv_instances))
4274		goto unlock;
4275
4276	instance = hdev->cur_adv_instance;
4277	if (!instance) {
4278		adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4279							struct adv_info, list);
4280		if (!adv_instance)
4281			goto unlock;
4282
4283		instance = adv_instance->instance;
4284	}
4285
4286	hci_req_init(&req, hdev);
4287
4288	err = __hci_req_schedule_adv_instance(&req, instance, true);
4289
4290	if (!err)
4291		err = hci_req_run(&req, enable_advertising_instance);
4292
4293	if (err)
4294		bt_dev_err(hdev, "failed to re-configure advertising");
4295
4296unlock:
4297	hci_dev_unlock(hdev);
4298}
4299
4300static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4301			   u16 len)
4302{
4303	struct mgmt_mode *cp = data;
4304	struct mgmt_pending_cmd *cmd;
4305	struct hci_request req;
4306	u8 val, status;
4307	int err;
4308
4309	BT_DBG("request for %s", hdev->name);
4310
4311	status = mgmt_le_support(hdev);
4312	if (status)
4313		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4314				       status);
4315
4316	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4317		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4318				       MGMT_STATUS_INVALID_PARAMS);
4319
4320	hci_dev_lock(hdev);
4321
4322	val = !!cp->val;
4323
4324	/* The following conditions are ones which mean that we should
4325	 * not do any HCI communication but directly send a mgmt
4326	 * response to user space (after toggling the flag if
4327	 * necessary).
4328	 */
4329	if (!hdev_is_powered(hdev) ||
4330	    (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4331	     (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4332	    hci_conn_num(hdev, LE_LINK) > 0 ||
4333	    (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4334	     hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4335		bool changed;
4336
4337		if (cp->val) {
4338			hdev->cur_adv_instance = 0x00;
4339			changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4340			if (cp->val == 0x02)
4341				hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4342			else
4343				hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4344		} else {
4345			changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4346			hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347		}
4348
4349		err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4350		if (err < 0)
4351			goto unlock;
4352
4353		if (changed)
4354			err = new_settings(hdev, sk);
4355
4356		goto unlock;
4357	}
4358
4359	if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4360	    pending_find(MGMT_OP_SET_LE, hdev)) {
4361		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4362				      MGMT_STATUS_BUSY);
4363		goto unlock;
4364	}
4365
4366	cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4367	if (!cmd) {
4368		err = -ENOMEM;
4369		goto unlock;
4370	}
4371
4372	hci_req_init(&req, hdev);
4373
4374	if (cp->val == 0x02)
4375		hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4376	else
4377		hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4378
4379	cancel_adv_timeout(hdev);
4380
4381	if (val) {
4382		/* Switch to instance "0" for the Set Advertising setting.
4383		 * We cannot use update_[adv|scan_rsp]_data() here as the
4384		 * HCI_ADVERTISING flag is not yet set.
4385		 */
4386		hdev->cur_adv_instance = 0x00;
4387
4388		if (ext_adv_capable(hdev)) {
4389			__hci_req_start_ext_adv(&req, 0x00);
4390		} else {
4391			__hci_req_update_adv_data(&req, 0x00);
4392			__hci_req_update_scan_rsp_data(&req, 0x00);
4393			__hci_req_enable_advertising(&req);
4394		}
4395	} else {
4396		__hci_req_disable_advertising(&req);
4397	}
4398
4399	err = hci_req_run(&req, set_advertising_complete);
4400	if (err < 0)
4401		mgmt_pending_remove(cmd);
4402
4403unlock:
4404	hci_dev_unlock(hdev);
4405	return err;
4406}
4407
4408static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4409			      void *data, u16 len)
4410{
4411	struct mgmt_cp_set_static_address *cp = data;
4412	int err;
4413
4414	BT_DBG("%s", hdev->name);
4415
4416	if (!lmp_le_capable(hdev))
4417		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4418				       MGMT_STATUS_NOT_SUPPORTED);
4419
4420	if (hdev_is_powered(hdev))
4421		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4422				       MGMT_STATUS_REJECTED);
4423
4424	if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4425		if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4426			return mgmt_cmd_status(sk, hdev->id,
4427					       MGMT_OP_SET_STATIC_ADDRESS,
4428					       MGMT_STATUS_INVALID_PARAMS);
4429
4430		/* Two most significant bits shall be set */
4431		if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4432			return mgmt_cmd_status(sk, hdev->id,
4433					       MGMT_OP_SET_STATIC_ADDRESS,
4434					       MGMT_STATUS_INVALID_PARAMS);
4435	}
4436
4437	hci_dev_lock(hdev);
4438
4439	bacpy(&hdev->static_addr, &cp->bdaddr);
4440
4441	err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4442	if (err < 0)
4443		goto unlock;
4444
4445	err = new_settings(hdev, sk);
4446
4447unlock:
4448	hci_dev_unlock(hdev);
4449	return err;
4450}
4451
4452static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4453			   void *data, u16 len)
4454{
4455	struct mgmt_cp_set_scan_params *cp = data;
4456	__u16 interval, window;
4457	int err;
4458
4459	BT_DBG("%s", hdev->name);
4460
4461	if (!lmp_le_capable(hdev))
4462		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4463				       MGMT_STATUS_NOT_SUPPORTED);
4464
4465	interval = __le16_to_cpu(cp->interval);
4466
4467	if (interval < 0x0004 || interval > 0x4000)
4468		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4469				       MGMT_STATUS_INVALID_PARAMS);
4470
4471	window = __le16_to_cpu(cp->window);
4472
4473	if (window < 0x0004 || window > 0x4000)
4474		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4475				       MGMT_STATUS_INVALID_PARAMS);
4476
4477	if (window > interval)
4478		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4479				       MGMT_STATUS_INVALID_PARAMS);
4480
4481	hci_dev_lock(hdev);
4482
4483	hdev->le_scan_interval = interval;
4484	hdev->le_scan_window = window;
4485
4486	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4487				NULL, 0);
4488
4489	/* If background scan is running, restart it so new parameters are
4490	 * loaded.
4491	 */
4492	if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4493	    hdev->discovery.state == DISCOVERY_STOPPED) {
4494		struct hci_request req;
4495
4496		hci_req_init(&req, hdev);
4497
4498		hci_req_add_le_scan_disable(&req);
4499		hci_req_add_le_passive_scan(&req);
4500
4501		hci_req_run(&req, NULL);
4502	}
4503
4504	hci_dev_unlock(hdev);
4505
4506	return err;
4507}
4508
4509static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4510				      u16 opcode)
4511{
4512	struct mgmt_pending_cmd *cmd;
4513
4514	BT_DBG("status 0x%02x", status);
4515
4516	hci_dev_lock(hdev);
4517
4518	cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4519	if (!cmd)
4520		goto unlock;
4521
4522	if (status) {
4523		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4524			        mgmt_status(status));
4525	} else {
4526		struct mgmt_mode *cp = cmd->param;
4527
4528		if (cp->val)
4529			hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4530		else
4531			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4532
4533		send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4534		new_settings(hdev, cmd->sk);
4535	}
4536
4537	mgmt_pending_remove(cmd);
4538
4539unlock:
4540	hci_dev_unlock(hdev);
4541}
4542
4543static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4544				void *data, u16 len)
4545{
4546	struct mgmt_mode *cp = data;
4547	struct mgmt_pending_cmd *cmd;
4548	struct hci_request req;
4549	int err;
4550
4551	BT_DBG("%s", hdev->name);
4552
4553	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4554	    hdev->hci_ver < BLUETOOTH_VER_1_2)
4555		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4556				       MGMT_STATUS_NOT_SUPPORTED);
4557
4558	if (cp->val != 0x00 && cp->val != 0x01)
4559		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560				       MGMT_STATUS_INVALID_PARAMS);
4561
4562	hci_dev_lock(hdev);
4563
4564	if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4565		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4566				      MGMT_STATUS_BUSY);
4567		goto unlock;
4568	}
4569
4570	if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4571		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4572					hdev);
4573		goto unlock;
4574	}
4575
4576	if (!hdev_is_powered(hdev)) {
4577		hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4578		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4579					hdev);
4580		new_settings(hdev, sk);
4581		goto unlock;
4582	}
4583
4584	cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4585			       data, len);
4586	if (!cmd) {
4587		err = -ENOMEM;
4588		goto unlock;
4589	}
4590
4591	hci_req_init(&req, hdev);
4592
4593	__hci_req_write_fast_connectable(&req, cp->val);
4594
4595	err = hci_req_run(&req, fast_connectable_complete);
4596	if (err < 0) {
4597		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4598				      MGMT_STATUS_FAILED);
4599		mgmt_pending_remove(cmd);
4600	}
4601
4602unlock:
4603	hci_dev_unlock(hdev);
4604
4605	return err;
4606}
4607
4608static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4609{
4610	struct mgmt_pending_cmd *cmd;
4611
4612	BT_DBG("status 0x%02x", status);
4613
4614	hci_dev_lock(hdev);
4615
4616	cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4617	if (!cmd)
4618		goto unlock;
4619
4620	if (status) {
4621		u8 mgmt_err = mgmt_status(status);
4622
4623		/* We need to restore the flag if related HCI commands
4624		 * failed.
4625		 */
4626		hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4627
4628		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4629	} else {
4630		send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4631		new_settings(hdev, cmd->sk);
4632	}
4633
4634	mgmt_pending_remove(cmd);
4635
4636unlock:
4637	hci_dev_unlock(hdev);
4638}
4639
4640static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4641{
4642	struct mgmt_mode *cp = data;
4643	struct mgmt_pending_cmd *cmd;
4644	struct hci_request req;
4645	int err;
4646
4647	BT_DBG("request for %s", hdev->name);
4648
4649	if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4650		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4651				       MGMT_STATUS_NOT_SUPPORTED);
4652
4653	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4654		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4655				       MGMT_STATUS_REJECTED);
4656
4657	if (cp->val != 0x00 && cp->val != 0x01)
4658		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659				       MGMT_STATUS_INVALID_PARAMS);
4660
4661	hci_dev_lock(hdev);
4662
4663	if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4664		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4665		goto unlock;
4666	}
4667
4668	if (!hdev_is_powered(hdev)) {
4669		if (!cp->val) {
4670			hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4671			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4672			hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4673			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4674			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4675		}
4676
4677		hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4678
4679		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4680		if (err < 0)
4681			goto unlock;
4682
4683		err = new_settings(hdev, sk);
4684		goto unlock;
4685	}
4686
4687	/* Reject disabling when powered on */
4688	if (!cp->val) {
4689		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4690				      MGMT_STATUS_REJECTED);
4691		goto unlock;
4692	} else {
4693		/* When configuring a dual-mode controller to operate
4694		 * with LE only and using a static address, then switching
4695		 * BR/EDR back on is not allowed.
4696		 *
4697		 * Dual-mode controllers shall operate with the public
4698		 * address as its identity address for BR/EDR and LE. So
4699		 * reject the attempt to create an invalid configuration.
4700		 *
4701		 * The same restrictions applies when secure connections
4702		 * has been enabled. For BR/EDR this is a controller feature
4703		 * while for LE it is a host stack feature. This means that
4704		 * switching BR/EDR back on when secure connections has been
4705		 * enabled is not a supported transaction.
4706		 */
4707		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4708		    (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4709		     hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4710			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4711					      MGMT_STATUS_REJECTED);
4712			goto unlock;
4713		}
4714	}
4715
4716	if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4717		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4718				      MGMT_STATUS_BUSY);
4719		goto unlock;
4720	}
4721
4722	cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4723	if (!cmd) {
4724		err = -ENOMEM;
4725		goto unlock;
4726	}
4727
4728	/* We need to flip the bit already here so that
4729	 * hci_req_update_adv_data generates the correct flags.
4730	 */
4731	hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4732
4733	hci_req_init(&req, hdev);
4734
4735	__hci_req_write_fast_connectable(&req, false);
4736	__hci_req_update_scan(&req);
4737
4738	/* Since only the advertising data flags will change, there
4739	 * is no need to update the scan response data.
4740	 */
4741	__hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4742
4743	err = hci_req_run(&req, set_bredr_complete);
4744	if (err < 0)
4745		mgmt_pending_remove(cmd);
4746
4747unlock:
4748	hci_dev_unlock(hdev);
4749	return err;
4750}
4751
4752static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4753{
4754	struct mgmt_pending_cmd *cmd;
4755	struct mgmt_mode *cp;
4756
4757	BT_DBG("%s status %u", hdev->name, status);
4758
4759	hci_dev_lock(hdev);
4760
4761	cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4762	if (!cmd)
4763		goto unlock;
4764
4765	if (status) {
4766		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4767			        mgmt_status(status));
4768		goto remove;
4769	}
4770
4771	cp = cmd->param;
4772
4773	switch (cp->val) {
4774	case 0x00:
4775		hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4776		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4777		break;
4778	case 0x01:
4779		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4780		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4781		break;
4782	case 0x02:
4783		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4784		hci_dev_set_flag(hdev, HCI_SC_ONLY);
4785		break;
4786	}
4787
4788	send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4789	new_settings(hdev, cmd->sk);
4790
4791remove:
4792	mgmt_pending_remove(cmd);
4793unlock:
4794	hci_dev_unlock(hdev);
4795}
4796
4797static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4798			   void *data, u16 len)
4799{
4800	struct mgmt_mode *cp = data;
4801	struct mgmt_pending_cmd *cmd;
4802	struct hci_request req;
4803	u8 val;
4804	int err;
4805
4806	BT_DBG("request for %s", hdev->name);
4807
4808	if (!lmp_sc_capable(hdev) &&
4809	    !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4810		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4811				       MGMT_STATUS_NOT_SUPPORTED);
4812
4813	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4814	    lmp_sc_capable(hdev) &&
4815	    !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4816		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4817				       MGMT_STATUS_REJECTED);
4818
4819	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4820		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4821				  MGMT_STATUS_INVALID_PARAMS);
4822
4823	hci_dev_lock(hdev);
4824
4825	if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4826	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4827		bool changed;
4828
4829		if (cp->val) {
4830			changed = !hci_dev_test_and_set_flag(hdev,
4831							     HCI_SC_ENABLED);
4832			if (cp->val == 0x02)
4833				hci_dev_set_flag(hdev, HCI_SC_ONLY);
4834			else
4835				hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4836		} else {
4837			changed = hci_dev_test_and_clear_flag(hdev,
4838							      HCI_SC_ENABLED);
4839			hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4840		}
4841
4842		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4843		if (err < 0)
4844			goto failed;
4845
4846		if (changed)
4847			err = new_settings(hdev, sk);
4848
4849		goto failed;
4850	}
4851
4852	if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4853		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4854				      MGMT_STATUS_BUSY);
4855		goto failed;
4856	}
4857
4858	val = !!cp->val;
4859
4860	if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4861	    (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4862		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4863		goto failed;
4864	}
4865
4866	cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4867	if (!cmd) {
4868		err = -ENOMEM;
4869		goto failed;
4870	}
4871
4872	hci_req_init(&req, hdev);
4873	hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4874	err = hci_req_run(&req, sc_enable_complete);
4875	if (err < 0) {
4876		mgmt_pending_remove(cmd);
4877		goto failed;
4878	}
4879
4880failed:
4881	hci_dev_unlock(hdev);
4882	return err;
4883}
4884
4885static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4886			  void *data, u16 len)
4887{
4888	struct mgmt_mode *cp = data;
4889	bool changed, use_changed;
4890	int err;
4891
4892	BT_DBG("request for %s", hdev->name);
4893
4894	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4895		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4896				       MGMT_STATUS_INVALID_PARAMS);
4897
4898	hci_dev_lock(hdev);
4899
4900	if (cp->val)
4901		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4902	else
4903		changed = hci_dev_test_and_clear_flag(hdev,
4904						      HCI_KEEP_DEBUG_KEYS);
4905
4906	if (cp->val == 0x02)
4907		use_changed = !hci_dev_test_and_set_flag(hdev,
4908							 HCI_USE_DEBUG_KEYS);
4909	else
4910		use_changed = hci_dev_test_and_clear_flag(hdev,
4911							  HCI_USE_DEBUG_KEYS);
4912
4913	if (hdev_is_powered(hdev) && use_changed &&
4914	    hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4915		u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4916		hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4917			     sizeof(mode), &mode);
4918	}
4919
4920	err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4921	if (err < 0)
4922		goto unlock;
4923
4924	if (changed)
4925		err = new_settings(hdev, sk);
4926
4927unlock:
4928	hci_dev_unlock(hdev);
4929	return err;
4930}
4931
4932static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4933		       u16 len)
4934{
4935	struct mgmt_cp_set_privacy *cp = cp_data;
4936	bool changed;
4937	int err;
4938
4939	BT_DBG("request for %s", hdev->name);
4940
4941	if (!lmp_le_capable(hdev))
4942		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4943				       MGMT_STATUS_NOT_SUPPORTED);
4944
4945	if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4946		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4947				       MGMT_STATUS_INVALID_PARAMS);
4948
4949	if (hdev_is_powered(hdev))
4950		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951				       MGMT_STATUS_REJECTED);
4952
4953	hci_dev_lock(hdev);
4954
4955	/* If user space supports this command it is also expected to
4956	 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4957	 */
4958	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4959
4960	if (cp->privacy) {
4961		changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4962		memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4963		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4964		hci_adv_instances_set_rpa_expired(hdev, true);
4965		if (cp->privacy == 0x02)
4966			hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4967		else
4968			hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4969	} else {
4970		changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4971		memset(hdev->irk, 0, sizeof(hdev->irk));
4972		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4973		hci_adv_instances_set_rpa_expired(hdev, false);
4974		hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4975	}
4976
4977	err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4978	if (err < 0)
4979		goto unlock;
4980
4981	if (changed)
4982		err = new_settings(hdev, sk);
4983
4984unlock:
4985	hci_dev_unlock(hdev);
4986	return err;
4987}
4988
4989static bool irk_is_valid(struct mgmt_irk_info *irk)
4990{
4991	switch (irk->addr.type) {
4992	case BDADDR_LE_PUBLIC:
4993		return true;
4994
4995	case BDADDR_LE_RANDOM:
4996		/* Two most significant bits shall be set */
4997		if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4998			return false;
4999		return true;
5000	}
5001
5002	return false;
5003}
5004
5005static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5006		     u16 len)
5007{
5008	struct mgmt_cp_load_irks *cp = cp_data;
5009	const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5010				   sizeof(struct mgmt_irk_info));
5011	u16 irk_count, expected_len;
5012	int i, err;
5013
5014	BT_DBG("request for %s", hdev->name);
5015
5016	if (!lmp_le_capable(hdev))
5017		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5018				       MGMT_STATUS_NOT_SUPPORTED);
5019
5020	irk_count = __le16_to_cpu(cp->irk_count);
5021	if (irk_count > max_irk_count) {
5022		bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5023			   irk_count);
5024		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5025				       MGMT_STATUS_INVALID_PARAMS);
5026	}
5027
5028	expected_len = struct_size(cp, irks, irk_count);
5029	if (expected_len != len) {
5030		bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5031			   expected_len, len);
5032		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033				       MGMT_STATUS_INVALID_PARAMS);
5034	}
5035
5036	BT_DBG("%s irk_count %u", hdev->name, irk_count);
5037
5038	for (i = 0; i < irk_count; i++) {
5039		struct mgmt_irk_info *key = &cp->irks[i];
5040
5041		if (!irk_is_valid(key))
5042			return mgmt_cmd_status(sk, hdev->id,
5043					       MGMT_OP_LOAD_IRKS,
5044					       MGMT_STATUS_INVALID_PARAMS);
5045	}
5046
5047	hci_dev_lock(hdev);
5048
5049	hci_smp_irks_clear(hdev);
5050
5051	for (i = 0; i < irk_count; i++) {
5052		struct mgmt_irk_info *irk = &cp->irks[i];
5053
5054		hci_add_irk(hdev, &irk->addr.bdaddr,
5055			    le_addr_type(irk->addr.type), irk->val,
5056			    BDADDR_ANY);
5057	}
5058
5059	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5060
5061	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5062
5063	hci_dev_unlock(hdev);
5064
5065	return err;
5066}
5067
5068static bool ltk_is_valid(struct mgmt_ltk_info *key)
5069{
5070	if (key->master != 0x00 && key->master != 0x01)
5071		return false;
5072
5073	switch (key->addr.type) {
5074	case BDADDR_LE_PUBLIC:
5075		return true;
5076
5077	case BDADDR_LE_RANDOM:
5078		/* Two most significant bits shall be set */
5079		if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5080			return false;
5081		return true;
5082	}
5083
5084	return false;
5085}
5086
5087static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5088			       void *cp_data, u16 len)
5089{
5090	struct mgmt_cp_load_long_term_keys *cp = cp_data;
5091	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5092				   sizeof(struct mgmt_ltk_info));
5093	u16 key_count, expected_len;
5094	int i, err;
5095
5096	BT_DBG("request for %s", hdev->name);
5097
5098	if (!lmp_le_capable(hdev))
5099		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5100				       MGMT_STATUS_NOT_SUPPORTED);
5101
5102	key_count = __le16_to_cpu(cp->key_count);
5103	if (key_count > max_key_count) {
5104		bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5105			   key_count);
5106		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5107				       MGMT_STATUS_INVALID_PARAMS);
5108	}
5109
5110	expected_len = struct_size(cp, keys, key_count);
 
5111	if (expected_len != len) {
5112		bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5113			   expected_len, len);
5114		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115				       MGMT_STATUS_INVALID_PARAMS);
5116	}
5117
5118	BT_DBG("%s key_count %u", hdev->name, key_count);
5119
5120	for (i = 0; i < key_count; i++) {
5121		struct mgmt_ltk_info *key = &cp->keys[i];
5122
5123		if (!ltk_is_valid(key))
5124			return mgmt_cmd_status(sk, hdev->id,
5125					       MGMT_OP_LOAD_LONG_TERM_KEYS,
5126					       MGMT_STATUS_INVALID_PARAMS);
5127	}
5128
5129	hci_dev_lock(hdev);
5130
5131	hci_smp_ltks_clear(hdev);
5132
5133	for (i = 0; i < key_count; i++) {
5134		struct mgmt_ltk_info *key = &cp->keys[i];
5135		u8 type, authenticated;
5136
5137		switch (key->type) {
5138		case MGMT_LTK_UNAUTHENTICATED:
5139			authenticated = 0x00;
5140			type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5141			break;
5142		case MGMT_LTK_AUTHENTICATED:
5143			authenticated = 0x01;
5144			type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5145			break;
5146		case MGMT_LTK_P256_UNAUTH:
5147			authenticated = 0x00;
5148			type = SMP_LTK_P256;
5149			break;
5150		case MGMT_LTK_P256_AUTH:
5151			authenticated = 0x01;
5152			type = SMP_LTK_P256;
5153			break;
5154		case MGMT_LTK_P256_DEBUG:
5155			authenticated = 0x00;
5156			type = SMP_LTK_P256_DEBUG;
5157			/* fall through */
5158		default:
5159			continue;
5160		}
5161
5162		hci_add_ltk(hdev, &key->addr.bdaddr,
5163			    le_addr_type(key->addr.type), type, authenticated,
5164			    key->val, key->enc_size, key->ediv, key->rand);
5165	}
5166
5167	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5168			   NULL, 0);
5169
5170	hci_dev_unlock(hdev);
5171
5172	return err;
5173}
5174
5175static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5176{
5177	struct hci_conn *conn = cmd->user_data;
5178	struct mgmt_rp_get_conn_info rp;
5179	int err;
5180
5181	memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5182
5183	if (status == MGMT_STATUS_SUCCESS) {
5184		rp.rssi = conn->rssi;
5185		rp.tx_power = conn->tx_power;
5186		rp.max_tx_power = conn->max_tx_power;
5187	} else {
5188		rp.rssi = HCI_RSSI_INVALID;
5189		rp.tx_power = HCI_TX_POWER_INVALID;
5190		rp.max_tx_power = HCI_TX_POWER_INVALID;
5191	}
5192
5193	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5194				status, &rp, sizeof(rp));
5195
5196	hci_conn_drop(conn);
5197	hci_conn_put(conn);
5198
5199	return err;
5200}
5201
5202static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5203				       u16 opcode)
5204{
5205	struct hci_cp_read_rssi *cp;
5206	struct mgmt_pending_cmd *cmd;
5207	struct hci_conn *conn;
5208	u16 handle;
5209	u8 status;
5210
5211	BT_DBG("status 0x%02x", hci_status);
5212
5213	hci_dev_lock(hdev);
5214
5215	/* Commands sent in request are either Read RSSI or Read Transmit Power
5216	 * Level so we check which one was last sent to retrieve connection
5217	 * handle.  Both commands have handle as first parameter so it's safe to
5218	 * cast data on the same command struct.
5219	 *
5220	 * First command sent is always Read RSSI and we fail only if it fails.
5221	 * In other case we simply override error to indicate success as we
5222	 * already remembered if TX power value is actually valid.
5223	 */
5224	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5225	if (!cp) {
5226		cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5227		status = MGMT_STATUS_SUCCESS;
5228	} else {
5229		status = mgmt_status(hci_status);
5230	}
5231
5232	if (!cp) {
5233		bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5234		goto unlock;
5235	}
5236
5237	handle = __le16_to_cpu(cp->handle);
5238	conn = hci_conn_hash_lookup_handle(hdev, handle);
5239	if (!conn) {
5240		bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5241			   handle);
5242		goto unlock;
5243	}
5244
5245	cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5246	if (!cmd)
5247		goto unlock;
5248
5249	cmd->cmd_complete(cmd, status);
5250	mgmt_pending_remove(cmd);
5251
5252unlock:
5253	hci_dev_unlock(hdev);
5254}
5255
5256static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5257			 u16 len)
5258{
5259	struct mgmt_cp_get_conn_info *cp = data;
5260	struct mgmt_rp_get_conn_info rp;
5261	struct hci_conn *conn;
5262	unsigned long conn_info_age;
5263	int err = 0;
5264
5265	BT_DBG("%s", hdev->name);
5266
5267	memset(&rp, 0, sizeof(rp));
5268	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5269	rp.addr.type = cp->addr.type;
5270
5271	if (!bdaddr_type_is_valid(cp->addr.type))
5272		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5273					 MGMT_STATUS_INVALID_PARAMS,
5274					 &rp, sizeof(rp));
5275
5276	hci_dev_lock(hdev);
5277
5278	if (!hdev_is_powered(hdev)) {
5279		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5280					MGMT_STATUS_NOT_POWERED, &rp,
5281					sizeof(rp));
5282		goto unlock;
5283	}
5284
5285	if (cp->addr.type == BDADDR_BREDR)
5286		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5287					       &cp->addr.bdaddr);
5288	else
5289		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5290
5291	if (!conn || conn->state != BT_CONNECTED) {
5292		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5293					MGMT_STATUS_NOT_CONNECTED, &rp,
5294					sizeof(rp));
5295		goto unlock;
5296	}
5297
5298	if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5299		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5300					MGMT_STATUS_BUSY, &rp, sizeof(rp));
5301		goto unlock;
5302	}
5303
5304	/* To avoid client trying to guess when to poll again for information we
5305	 * calculate conn info age as random value between min/max set in hdev.
5306	 */
5307	conn_info_age = hdev->conn_info_min_age +
5308			prandom_u32_max(hdev->conn_info_max_age -
5309					hdev->conn_info_min_age);
5310
5311	/* Query controller to refresh cached values if they are too old or were
5312	 * never read.
5313	 */
5314	if (time_after(jiffies, conn->conn_info_timestamp +
5315		       msecs_to_jiffies(conn_info_age)) ||
5316	    !conn->conn_info_timestamp) {
5317		struct hci_request req;
5318		struct hci_cp_read_tx_power req_txp_cp;
5319		struct hci_cp_read_rssi req_rssi_cp;
5320		struct mgmt_pending_cmd *cmd;
5321
5322		hci_req_init(&req, hdev);
5323		req_rssi_cp.handle = cpu_to_le16(conn->handle);
5324		hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5325			    &req_rssi_cp);
5326
5327		/* For LE links TX power does not change thus we don't need to
5328		 * query for it once value is known.
5329		 */
5330		if (!bdaddr_type_is_le(cp->addr.type) ||
5331		    conn->tx_power == HCI_TX_POWER_INVALID) {
5332			req_txp_cp.handle = cpu_to_le16(conn->handle);
5333			req_txp_cp.type = 0x00;
5334			hci_req_add(&req, HCI_OP_READ_TX_POWER,
5335				    sizeof(req_txp_cp), &req_txp_cp);
5336		}
5337
5338		/* Max TX power needs to be read only once per connection */
5339		if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5340			req_txp_cp.handle = cpu_to_le16(conn->handle);
5341			req_txp_cp.type = 0x01;
5342			hci_req_add(&req, HCI_OP_READ_TX_POWER,
5343				    sizeof(req_txp_cp), &req_txp_cp);
5344		}
5345
5346		err = hci_req_run(&req, conn_info_refresh_complete);
5347		if (err < 0)
5348			goto unlock;
5349
5350		cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5351				       data, len);
5352		if (!cmd) {
5353			err = -ENOMEM;
5354			goto unlock;
5355		}
5356
5357		hci_conn_hold(conn);
5358		cmd->user_data = hci_conn_get(conn);
5359		cmd->cmd_complete = conn_info_cmd_complete;
5360
5361		conn->conn_info_timestamp = jiffies;
5362	} else {
5363		/* Cache is valid, just reply with values cached in hci_conn */
5364		rp.rssi = conn->rssi;
5365		rp.tx_power = conn->tx_power;
5366		rp.max_tx_power = conn->max_tx_power;
5367
5368		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5369					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5370	}
5371
5372unlock:
5373	hci_dev_unlock(hdev);
5374	return err;
5375}
5376
5377static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5378{
5379	struct hci_conn *conn = cmd->user_data;
5380	struct mgmt_rp_get_clock_info rp;
5381	struct hci_dev *hdev;
5382	int err;
5383
5384	memset(&rp, 0, sizeof(rp));
5385	memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5386
5387	if (status)
5388		goto complete;
5389
5390	hdev = hci_dev_get(cmd->index);
5391	if (hdev) {
5392		rp.local_clock = cpu_to_le32(hdev->clock);
5393		hci_dev_put(hdev);
5394	}
5395
5396	if (conn) {
5397		rp.piconet_clock = cpu_to_le32(conn->clock);
5398		rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5399	}
5400
5401complete:
5402	err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5403				sizeof(rp));
5404
5405	if (conn) {
5406		hci_conn_drop(conn);
5407		hci_conn_put(conn);
5408	}
5409
5410	return err;
5411}
5412
5413static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5414{
5415	struct hci_cp_read_clock *hci_cp;
5416	struct mgmt_pending_cmd *cmd;
5417	struct hci_conn *conn;
5418
5419	BT_DBG("%s status %u", hdev->name, status);
5420
5421	hci_dev_lock(hdev);
5422
5423	hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5424	if (!hci_cp)
5425		goto unlock;
5426
5427	if (hci_cp->which) {
5428		u16 handle = __le16_to_cpu(hci_cp->handle);
5429		conn = hci_conn_hash_lookup_handle(hdev, handle);
5430	} else {
5431		conn = NULL;
5432	}
5433
5434	cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5435	if (!cmd)
5436		goto unlock;
5437
5438	cmd->cmd_complete(cmd, mgmt_status(status));
5439	mgmt_pending_remove(cmd);
5440
5441unlock:
5442	hci_dev_unlock(hdev);
5443}
5444
5445static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5446			 u16 len)
5447{
5448	struct mgmt_cp_get_clock_info *cp = data;
5449	struct mgmt_rp_get_clock_info rp;
5450	struct hci_cp_read_clock hci_cp;
5451	struct mgmt_pending_cmd *cmd;
5452	struct hci_request req;
5453	struct hci_conn *conn;
5454	int err;
5455
5456	BT_DBG("%s", hdev->name);
5457
5458	memset(&rp, 0, sizeof(rp));
5459	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5460	rp.addr.type = cp->addr.type;
5461
5462	if (cp->addr.type != BDADDR_BREDR)
5463		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5464					 MGMT_STATUS_INVALID_PARAMS,
5465					 &rp, sizeof(rp));
5466
5467	hci_dev_lock(hdev);
5468
5469	if (!hdev_is_powered(hdev)) {
5470		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5471					MGMT_STATUS_NOT_POWERED, &rp,
5472					sizeof(rp));
5473		goto unlock;
5474	}
5475
5476	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5477		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5478					       &cp->addr.bdaddr);
5479		if (!conn || conn->state != BT_CONNECTED) {
5480			err = mgmt_cmd_complete(sk, hdev->id,
5481						MGMT_OP_GET_CLOCK_INFO,
5482						MGMT_STATUS_NOT_CONNECTED,
5483						&rp, sizeof(rp));
5484			goto unlock;
5485		}
5486	} else {
5487		conn = NULL;
5488	}
5489
5490	cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5491	if (!cmd) {
5492		err = -ENOMEM;
5493		goto unlock;
5494	}
5495
5496	cmd->cmd_complete = clock_info_cmd_complete;
5497
5498	hci_req_init(&req, hdev);
5499
5500	memset(&hci_cp, 0, sizeof(hci_cp));
5501	hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5502
5503	if (conn) {
5504		hci_conn_hold(conn);
5505		cmd->user_data = hci_conn_get(conn);
5506
5507		hci_cp.handle = cpu_to_le16(conn->handle);
5508		hci_cp.which = 0x01; /* Piconet clock */
5509		hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5510	}
5511
5512	err = hci_req_run(&req, get_clock_info_complete);
5513	if (err < 0)
5514		mgmt_pending_remove(cmd);
5515
5516unlock:
5517	hci_dev_unlock(hdev);
5518	return err;
5519}
5520
5521static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5522{
5523	struct hci_conn *conn;
5524
5525	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5526	if (!conn)
5527		return false;
5528
5529	if (conn->dst_type != type)
5530		return false;
5531
5532	if (conn->state != BT_CONNECTED)
5533		return false;
5534
5535	return true;
5536}
5537
5538/* This function requires the caller holds hdev->lock */
5539static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5540			       u8 addr_type, u8 auto_connect)
5541{
5542	struct hci_conn_params *params;
5543
5544	params = hci_conn_params_add(hdev, addr, addr_type);
5545	if (!params)
5546		return -EIO;
5547
5548	if (params->auto_connect == auto_connect)
5549		return 0;
5550
5551	list_del_init(&params->action);
5552
5553	switch (auto_connect) {
5554	case HCI_AUTO_CONN_DISABLED:
5555	case HCI_AUTO_CONN_LINK_LOSS:
5556		/* If auto connect is being disabled when we're trying to
5557		 * connect to device, keep connecting.
5558		 */
5559		if (params->explicit_connect)
5560			list_add(&params->action, &hdev->pend_le_conns);
5561		break;
5562	case HCI_AUTO_CONN_REPORT:
5563		if (params->explicit_connect)
5564			list_add(&params->action, &hdev->pend_le_conns);
5565		else
5566			list_add(&params->action, &hdev->pend_le_reports);
5567		break;
5568	case HCI_AUTO_CONN_DIRECT:
5569	case HCI_AUTO_CONN_ALWAYS:
5570		if (!is_connected(hdev, addr, addr_type))
5571			list_add(&params->action, &hdev->pend_le_conns);
5572		break;
5573	}
5574
5575	params->auto_connect = auto_connect;
5576
5577	BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5578	       auto_connect);
5579
5580	return 0;
5581}
5582
5583static void device_added(struct sock *sk, struct hci_dev *hdev,
5584			 bdaddr_t *bdaddr, u8 type, u8 action)
5585{
5586	struct mgmt_ev_device_added ev;
5587
5588	bacpy(&ev.addr.bdaddr, bdaddr);
5589	ev.addr.type = type;
5590	ev.action = action;
5591
5592	mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5593}
5594
5595static int add_device(struct sock *sk, struct hci_dev *hdev,
5596		      void *data, u16 len)
5597{
5598	struct mgmt_cp_add_device *cp = data;
5599	u8 auto_conn, addr_type;
5600	int err;
5601
5602	BT_DBG("%s", hdev->name);
5603
5604	if (!bdaddr_type_is_valid(cp->addr.type) ||
5605	    !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5606		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5607					 MGMT_STATUS_INVALID_PARAMS,
5608					 &cp->addr, sizeof(cp->addr));
5609
5610	if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5611		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5612					 MGMT_STATUS_INVALID_PARAMS,
5613					 &cp->addr, sizeof(cp->addr));
5614
5615	hci_dev_lock(hdev);
5616
5617	if (cp->addr.type == BDADDR_BREDR) {
5618		/* Only incoming connections action is supported for now */
5619		if (cp->action != 0x01) {
5620			err = mgmt_cmd_complete(sk, hdev->id,
5621						MGMT_OP_ADD_DEVICE,
5622						MGMT_STATUS_INVALID_PARAMS,
5623						&cp->addr, sizeof(cp->addr));
5624			goto unlock;
5625		}
5626
5627		err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5628					  cp->addr.type);
5629		if (err)
5630			goto unlock;
5631
5632		hci_req_update_scan(hdev);
5633
5634		goto added;
5635	}
5636
5637	addr_type = le_addr_type(cp->addr.type);
5638
5639	if (cp->action == 0x02)
5640		auto_conn = HCI_AUTO_CONN_ALWAYS;
5641	else if (cp->action == 0x01)
5642		auto_conn = HCI_AUTO_CONN_DIRECT;
5643	else
5644		auto_conn = HCI_AUTO_CONN_REPORT;
5645
5646	/* Kernel internally uses conn_params with resolvable private
5647	 * address, but Add Device allows only identity addresses.
5648	 * Make sure it is enforced before calling
5649	 * hci_conn_params_lookup.
5650	 */
5651	if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5652		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5653					MGMT_STATUS_INVALID_PARAMS,
5654					&cp->addr, sizeof(cp->addr));
5655		goto unlock;
5656	}
5657
5658	/* If the connection parameters don't exist for this device,
5659	 * they will be created and configured with defaults.
5660	 */
5661	if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5662				auto_conn) < 0) {
5663		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5664					MGMT_STATUS_FAILED, &cp->addr,
5665					sizeof(cp->addr));
5666		goto unlock;
5667	}
5668
5669	hci_update_background_scan(hdev);
5670
5671added:
5672	device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5673
5674	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5675				MGMT_STATUS_SUCCESS, &cp->addr,
5676				sizeof(cp->addr));
5677
5678unlock:
5679	hci_dev_unlock(hdev);
5680	return err;
5681}
5682
5683static void device_removed(struct sock *sk, struct hci_dev *hdev,
5684			   bdaddr_t *bdaddr, u8 type)
5685{
5686	struct mgmt_ev_device_removed ev;
5687
5688	bacpy(&ev.addr.bdaddr, bdaddr);
5689	ev.addr.type = type;
5690
5691	mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5692}
5693
5694static int remove_device(struct sock *sk, struct hci_dev *hdev,
5695			 void *data, u16 len)
5696{
5697	struct mgmt_cp_remove_device *cp = data;
5698	int err;
5699
5700	BT_DBG("%s", hdev->name);
5701
5702	hci_dev_lock(hdev);
5703
5704	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5705		struct hci_conn_params *params;
5706		u8 addr_type;
5707
5708		if (!bdaddr_type_is_valid(cp->addr.type)) {
5709			err = mgmt_cmd_complete(sk, hdev->id,
5710						MGMT_OP_REMOVE_DEVICE,
5711						MGMT_STATUS_INVALID_PARAMS,
5712						&cp->addr, sizeof(cp->addr));
5713			goto unlock;
5714		}
5715
5716		if (cp->addr.type == BDADDR_BREDR) {
5717			err = hci_bdaddr_list_del(&hdev->whitelist,
5718						  &cp->addr.bdaddr,
5719						  cp->addr.type);
5720			if (err) {
5721				err = mgmt_cmd_complete(sk, hdev->id,
5722							MGMT_OP_REMOVE_DEVICE,
5723							MGMT_STATUS_INVALID_PARAMS,
5724							&cp->addr,
5725							sizeof(cp->addr));
5726				goto unlock;
5727			}
5728
5729			hci_req_update_scan(hdev);
5730
5731			device_removed(sk, hdev, &cp->addr.bdaddr,
5732				       cp->addr.type);
5733			goto complete;
5734		}
5735
5736		addr_type = le_addr_type(cp->addr.type);
5737
5738		/* Kernel internally uses conn_params with resolvable private
5739		 * address, but Remove Device allows only identity addresses.
5740		 * Make sure it is enforced before calling
5741		 * hci_conn_params_lookup.
5742		 */
5743		if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5744			err = mgmt_cmd_complete(sk, hdev->id,
5745						MGMT_OP_REMOVE_DEVICE,
5746						MGMT_STATUS_INVALID_PARAMS,
5747						&cp->addr, sizeof(cp->addr));
5748			goto unlock;
5749		}
5750
5751		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5752						addr_type);
5753		if (!params) {
5754			err = mgmt_cmd_complete(sk, hdev->id,
5755						MGMT_OP_REMOVE_DEVICE,
5756						MGMT_STATUS_INVALID_PARAMS,
5757						&cp->addr, sizeof(cp->addr));
5758			goto unlock;
5759		}
5760
5761		if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5762		    params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5763			err = mgmt_cmd_complete(sk, hdev->id,
5764						MGMT_OP_REMOVE_DEVICE,
5765						MGMT_STATUS_INVALID_PARAMS,
5766						&cp->addr, sizeof(cp->addr));
5767			goto unlock;
5768		}
5769
5770		list_del(&params->action);
5771		list_del(&params->list);
5772		kfree(params);
5773		hci_update_background_scan(hdev);
5774
5775		device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5776	} else {
5777		struct hci_conn_params *p, *tmp;
5778		struct bdaddr_list *b, *btmp;
5779
5780		if (cp->addr.type) {
5781			err = mgmt_cmd_complete(sk, hdev->id,
5782						MGMT_OP_REMOVE_DEVICE,
5783						MGMT_STATUS_INVALID_PARAMS,
5784						&cp->addr, sizeof(cp->addr));
5785			goto unlock;
5786		}
5787
5788		list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5789			device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5790			list_del(&b->list);
5791			kfree(b);
5792		}
5793
5794		hci_req_update_scan(hdev);
5795
5796		list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5797			if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5798				continue;
5799			device_removed(sk, hdev, &p->addr, p->addr_type);
5800			if (p->explicit_connect) {
5801				p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5802				continue;
5803			}
5804			list_del(&p->action);
5805			list_del(&p->list);
5806			kfree(p);
5807		}
5808
5809		BT_DBG("All LE connection parameters were removed");
5810
5811		hci_update_background_scan(hdev);
5812	}
5813
5814complete:
5815	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5816				MGMT_STATUS_SUCCESS, &cp->addr,
5817				sizeof(cp->addr));
5818unlock:
5819	hci_dev_unlock(hdev);
5820	return err;
5821}
5822
5823static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5824			   u16 len)
5825{
5826	struct mgmt_cp_load_conn_param *cp = data;
5827	const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5828				     sizeof(struct mgmt_conn_param));
5829	u16 param_count, expected_len;
5830	int i;
5831
5832	if (!lmp_le_capable(hdev))
5833		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5834				       MGMT_STATUS_NOT_SUPPORTED);
5835
5836	param_count = __le16_to_cpu(cp->param_count);
5837	if (param_count > max_param_count) {
5838		bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5839			   param_count);
5840		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5841				       MGMT_STATUS_INVALID_PARAMS);
5842	}
5843
5844	expected_len = struct_size(cp, params, param_count);
 
5845	if (expected_len != len) {
5846		bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5847			   expected_len, len);
5848		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5849				       MGMT_STATUS_INVALID_PARAMS);
5850	}
5851
5852	BT_DBG("%s param_count %u", hdev->name, param_count);
5853
5854	hci_dev_lock(hdev);
5855
5856	hci_conn_params_clear_disabled(hdev);
5857
5858	for (i = 0; i < param_count; i++) {
5859		struct mgmt_conn_param *param = &cp->params[i];
5860		struct hci_conn_params *hci_param;
5861		u16 min, max, latency, timeout;
5862		u8 addr_type;
5863
5864		BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5865		       param->addr.type);
5866
5867		if (param->addr.type == BDADDR_LE_PUBLIC) {
5868			addr_type = ADDR_LE_DEV_PUBLIC;
5869		} else if (param->addr.type == BDADDR_LE_RANDOM) {
5870			addr_type = ADDR_LE_DEV_RANDOM;
5871		} else {
5872			bt_dev_err(hdev, "ignoring invalid connection parameters");
5873			continue;
5874		}
5875
5876		min = le16_to_cpu(param->min_interval);
5877		max = le16_to_cpu(param->max_interval);
5878		latency = le16_to_cpu(param->latency);
5879		timeout = le16_to_cpu(param->timeout);
5880
5881		BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5882		       min, max, latency, timeout);
5883
5884		if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5885			bt_dev_err(hdev, "ignoring invalid connection parameters");
5886			continue;
5887		}
5888
5889		hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5890						addr_type);
5891		if (!hci_param) {
5892			bt_dev_err(hdev, "failed to add connection parameters");
5893			continue;
5894		}
5895
5896		hci_param->conn_min_interval = min;
5897		hci_param->conn_max_interval = max;
5898		hci_param->conn_latency = latency;
5899		hci_param->supervision_timeout = timeout;
5900	}
5901
5902	hci_dev_unlock(hdev);
5903
5904	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5905				 NULL, 0);
5906}
5907
5908static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5909			       void *data, u16 len)
5910{
5911	struct mgmt_cp_set_external_config *cp = data;
5912	bool changed;
5913	int err;
5914
5915	BT_DBG("%s", hdev->name);
5916
5917	if (hdev_is_powered(hdev))
5918		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5919				       MGMT_STATUS_REJECTED);
5920
5921	if (cp->config != 0x00 && cp->config != 0x01)
5922		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5923				         MGMT_STATUS_INVALID_PARAMS);
5924
5925	if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5926		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5927				       MGMT_STATUS_NOT_SUPPORTED);
5928
5929	hci_dev_lock(hdev);
5930
5931	if (cp->config)
5932		changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5933	else
5934		changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5935
5936	err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5937	if (err < 0)
5938		goto unlock;
5939
5940	if (!changed)
5941		goto unlock;
5942
5943	err = new_options(hdev, sk);
5944
5945	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5946		mgmt_index_removed(hdev);
5947
5948		if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5949			hci_dev_set_flag(hdev, HCI_CONFIG);
5950			hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5951
5952			queue_work(hdev->req_workqueue, &hdev->power_on);
5953		} else {
5954			set_bit(HCI_RAW, &hdev->flags);
5955			mgmt_index_added(hdev);
5956		}
5957	}
5958
5959unlock:
5960	hci_dev_unlock(hdev);
5961	return err;
5962}
5963
5964static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5965			      void *data, u16 len)
5966{
5967	struct mgmt_cp_set_public_address *cp = data;
5968	bool changed;
5969	int err;
5970
5971	BT_DBG("%s", hdev->name);
5972
5973	if (hdev_is_powered(hdev))
5974		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5975				       MGMT_STATUS_REJECTED);
5976
5977	if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5978		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5979				       MGMT_STATUS_INVALID_PARAMS);
5980
5981	if (!hdev->set_bdaddr)
5982		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5983				       MGMT_STATUS_NOT_SUPPORTED);
5984
5985	hci_dev_lock(hdev);
5986
5987	changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5988	bacpy(&hdev->public_addr, &cp->bdaddr);
5989
5990	err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5991	if (err < 0)
5992		goto unlock;
5993
5994	if (!changed)
5995		goto unlock;
5996
5997	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5998		err = new_options(hdev, sk);
5999
6000	if (is_configured(hdev)) {
6001		mgmt_index_removed(hdev);
6002
6003		hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6004
6005		hci_dev_set_flag(hdev, HCI_CONFIG);
6006		hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6007
6008		queue_work(hdev->req_workqueue, &hdev->power_on);
6009	}
6010
6011unlock:
6012	hci_dev_unlock(hdev);
6013	return err;
6014}
6015
6016static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6017					     u16 opcode, struct sk_buff *skb)
6018{
6019	const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6020	struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6021	u8 *h192, *r192, *h256, *r256;
6022	struct mgmt_pending_cmd *cmd;
6023	u16 eir_len;
6024	int err;
6025
6026	BT_DBG("%s status %u", hdev->name, status);
6027
6028	cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6029	if (!cmd)
6030		return;
6031
6032	mgmt_cp = cmd->param;
6033
6034	if (status) {
6035		status = mgmt_status(status);
6036		eir_len = 0;
6037
6038		h192 = NULL;
6039		r192 = NULL;
6040		h256 = NULL;
6041		r256 = NULL;
6042	} else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6043		struct hci_rp_read_local_oob_data *rp;
6044
6045		if (skb->len != sizeof(*rp)) {
6046			status = MGMT_STATUS_FAILED;
6047			eir_len = 0;
6048		} else {
6049			status = MGMT_STATUS_SUCCESS;
6050			rp = (void *)skb->data;
6051
6052			eir_len = 5 + 18 + 18;
6053			h192 = rp->hash;
6054			r192 = rp->rand;
6055			h256 = NULL;
6056			r256 = NULL;
6057		}
6058	} else {
6059		struct hci_rp_read_local_oob_ext_data *rp;
6060
6061		if (skb->len != sizeof(*rp)) {
6062			status = MGMT_STATUS_FAILED;
6063			eir_len = 0;
6064		} else {
6065			status = MGMT_STATUS_SUCCESS;
6066			rp = (void *)skb->data;
6067
6068			if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6069				eir_len = 5 + 18 + 18;
6070				h192 = NULL;
6071				r192 = NULL;
6072			} else {
6073				eir_len = 5 + 18 + 18 + 18 + 18;
6074				h192 = rp->hash192;
6075				r192 = rp->rand192;
6076			}
6077
6078			h256 = rp->hash256;
6079			r256 = rp->rand256;
6080		}
6081	}
6082
6083	mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6084	if (!mgmt_rp)
6085		goto done;
6086
6087	if (status)
6088		goto send_rsp;
6089
6090	eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6091				  hdev->dev_class, 3);
6092
6093	if (h192 && r192) {
6094		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6095					  EIR_SSP_HASH_C192, h192, 16);
6096		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6097					  EIR_SSP_RAND_R192, r192, 16);
6098	}
6099
6100	if (h256 && r256) {
6101		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6102					  EIR_SSP_HASH_C256, h256, 16);
6103		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6104					  EIR_SSP_RAND_R256, r256, 16);
6105	}
6106
6107send_rsp:
6108	mgmt_rp->type = mgmt_cp->type;
6109	mgmt_rp->eir_len = cpu_to_le16(eir_len);
6110
6111	err = mgmt_cmd_complete(cmd->sk, hdev->id,
6112				MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6113				mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6114	if (err < 0 || status)
6115		goto done;
6116
6117	hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6118
6119	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6120				 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6121				 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6122done:
6123	kfree(mgmt_rp);
6124	mgmt_pending_remove(cmd);
6125}
6126
6127static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6128				  struct mgmt_cp_read_local_oob_ext_data *cp)
6129{
6130	struct mgmt_pending_cmd *cmd;
6131	struct hci_request req;
6132	int err;
6133
6134	cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6135			       cp, sizeof(*cp));
6136	if (!cmd)
6137		return -ENOMEM;
6138
6139	hci_req_init(&req, hdev);
6140
6141	if (bredr_sc_enabled(hdev))
6142		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6143	else
6144		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6145
6146	err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6147	if (err < 0) {
6148		mgmt_pending_remove(cmd);
6149		return err;
6150	}
6151
6152	return 0;
6153}
6154
6155static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6156				   void *data, u16 data_len)
6157{
6158	struct mgmt_cp_read_local_oob_ext_data *cp = data;
6159	struct mgmt_rp_read_local_oob_ext_data *rp;
6160	size_t rp_len;
6161	u16 eir_len;
6162	u8 status, flags, role, addr[7], hash[16], rand[16];
6163	int err;
6164
6165	BT_DBG("%s", hdev->name);
6166
6167	if (hdev_is_powered(hdev)) {
6168		switch (cp->type) {
6169		case BIT(BDADDR_BREDR):
6170			status = mgmt_bredr_support(hdev);
6171			if (status)
6172				eir_len = 0;
6173			else
6174				eir_len = 5;
6175			break;
6176		case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6177			status = mgmt_le_support(hdev);
6178			if (status)
6179				eir_len = 0;
6180			else
6181				eir_len = 9 + 3 + 18 + 18 + 3;
6182			break;
6183		default:
6184			status = MGMT_STATUS_INVALID_PARAMS;
6185			eir_len = 0;
6186			break;
6187		}
6188	} else {
6189		status = MGMT_STATUS_NOT_POWERED;
6190		eir_len = 0;
6191	}
6192
6193	rp_len = sizeof(*rp) + eir_len;
6194	rp = kmalloc(rp_len, GFP_ATOMIC);
6195	if (!rp)
6196		return -ENOMEM;
6197
6198	if (status)
6199		goto complete;
6200
6201	hci_dev_lock(hdev);
6202
6203	eir_len = 0;
6204	switch (cp->type) {
6205	case BIT(BDADDR_BREDR):
6206		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6207			err = read_local_ssp_oob_req(hdev, sk, cp);
6208			hci_dev_unlock(hdev);
6209			if (!err)
6210				goto done;
6211
6212			status = MGMT_STATUS_FAILED;
6213			goto complete;
6214		} else {
6215			eir_len = eir_append_data(rp->eir, eir_len,
6216						  EIR_CLASS_OF_DEV,
6217						  hdev->dev_class, 3);
6218		}
6219		break;
6220	case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6221		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6222		    smp_generate_oob(hdev, hash, rand) < 0) {
6223			hci_dev_unlock(hdev);
6224			status = MGMT_STATUS_FAILED;
6225			goto complete;
6226		}
6227
6228		/* This should return the active RPA, but since the RPA
6229		 * is only programmed on demand, it is really hard to fill
6230		 * this in at the moment. For now disallow retrieving
6231		 * local out-of-band data when privacy is in use.
6232		 *
6233		 * Returning the identity address will not help here since
6234		 * pairing happens before the identity resolving key is
6235		 * known and thus the connection establishment happens
6236		 * based on the RPA and not the identity address.
6237		 */
6238		if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6239			hci_dev_unlock(hdev);
6240			status = MGMT_STATUS_REJECTED;
6241			goto complete;
6242		}
6243
6244		if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6245		   !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6246		   (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6247		    bacmp(&hdev->static_addr, BDADDR_ANY))) {
6248			memcpy(addr, &hdev->static_addr, 6);
6249			addr[6] = 0x01;
6250		} else {
6251			memcpy(addr, &hdev->bdaddr, 6);
6252			addr[6] = 0x00;
6253		}
6254
6255		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6256					  addr, sizeof(addr));
6257
6258		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6259			role = 0x02;
6260		else
6261			role = 0x01;
6262
6263		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6264					  &role, sizeof(role));
6265
6266		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6267			eir_len = eir_append_data(rp->eir, eir_len,
6268						  EIR_LE_SC_CONFIRM,
6269						  hash, sizeof(hash));
6270
6271			eir_len = eir_append_data(rp->eir, eir_len,
6272						  EIR_LE_SC_RANDOM,
6273						  rand, sizeof(rand));
6274		}
6275
6276		flags = mgmt_get_adv_discov_flags(hdev);
6277
6278		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6279			flags |= LE_AD_NO_BREDR;
6280
6281		eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6282					  &flags, sizeof(flags));
6283		break;
6284	}
6285
6286	hci_dev_unlock(hdev);
6287
6288	hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6289
6290	status = MGMT_STATUS_SUCCESS;
6291
6292complete:
6293	rp->type = cp->type;
6294	rp->eir_len = cpu_to_le16(eir_len);
6295
6296	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6297				status, rp, sizeof(*rp) + eir_len);
6298	if (err < 0 || status)
6299		goto done;
6300
6301	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6302				 rp, sizeof(*rp) + eir_len,
6303				 HCI_MGMT_OOB_DATA_EVENTS, sk);
6304
6305done:
6306	kfree(rp);
6307
6308	return err;
6309}
6310
6311static u32 get_supported_adv_flags(struct hci_dev *hdev)
6312{
6313	u32 flags = 0;
6314
6315	flags |= MGMT_ADV_FLAG_CONNECTABLE;
6316	flags |= MGMT_ADV_FLAG_DISCOV;
6317	flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6318	flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6319	flags |= MGMT_ADV_FLAG_APPEARANCE;
6320	flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6321
6322	/* In extended adv TX_POWER returned from Set Adv Param
6323	 * will be always valid.
6324	 */
6325	if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6326	    ext_adv_capable(hdev))
6327		flags |= MGMT_ADV_FLAG_TX_POWER;
6328
6329	if (ext_adv_capable(hdev)) {
6330		flags |= MGMT_ADV_FLAG_SEC_1M;
6331
6332		if (hdev->le_features[1] & HCI_LE_PHY_2M)
6333			flags |= MGMT_ADV_FLAG_SEC_2M;
6334
6335		if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6336			flags |= MGMT_ADV_FLAG_SEC_CODED;
6337	}
6338
6339	return flags;
6340}
6341
6342static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6343			     void *data, u16 data_len)
6344{
6345	struct mgmt_rp_read_adv_features *rp;
6346	size_t rp_len;
6347	int err;
6348	struct adv_info *adv_instance;
6349	u32 supported_flags;
6350	u8 *instance;
6351
6352	BT_DBG("%s", hdev->name);
6353
6354	if (!lmp_le_capable(hdev))
6355		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6356				       MGMT_STATUS_REJECTED);
6357
6358	hci_dev_lock(hdev);
6359
6360	rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6361	rp = kmalloc(rp_len, GFP_ATOMIC);
6362	if (!rp) {
6363		hci_dev_unlock(hdev);
6364		return -ENOMEM;
6365	}
6366
6367	supported_flags = get_supported_adv_flags(hdev);
6368
6369	rp->supported_flags = cpu_to_le32(supported_flags);
6370	rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6371	rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6372	rp->max_instances = HCI_MAX_ADV_INSTANCES;
6373	rp->num_instances = hdev->adv_instance_cnt;
6374
6375	instance = rp->instance;
6376	list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6377		*instance = adv_instance->instance;
6378		instance++;
6379	}
6380
6381	hci_dev_unlock(hdev);
6382
6383	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6384				MGMT_STATUS_SUCCESS, rp, rp_len);
6385
6386	kfree(rp);
6387
6388	return err;
6389}
6390
6391static u8 calculate_name_len(struct hci_dev *hdev)
6392{
6393	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6394
6395	return append_local_name(hdev, buf, 0);
6396}
6397
6398static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6399			   bool is_adv_data)
6400{
6401	u8 max_len = HCI_MAX_AD_LENGTH;
6402
6403	if (is_adv_data) {
6404		if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6405				 MGMT_ADV_FLAG_LIMITED_DISCOV |
6406				 MGMT_ADV_FLAG_MANAGED_FLAGS))
6407			max_len -= 3;
6408
6409		if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6410			max_len -= 3;
6411	} else {
6412		if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6413			max_len -= calculate_name_len(hdev);
6414
6415		if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6416			max_len -= 4;
6417	}
6418
6419	return max_len;
6420}
6421
6422static bool flags_managed(u32 adv_flags)
6423{
6424	return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6425			    MGMT_ADV_FLAG_LIMITED_DISCOV |
6426			    MGMT_ADV_FLAG_MANAGED_FLAGS);
6427}
6428
6429static bool tx_power_managed(u32 adv_flags)
6430{
6431	return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6432}
6433
6434static bool name_managed(u32 adv_flags)
6435{
6436	return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6437}
6438
6439static bool appearance_managed(u32 adv_flags)
6440{
6441	return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6442}
6443
6444static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6445			      u8 len, bool is_adv_data)
6446{
6447	int i, cur_len;
6448	u8 max_len;
6449
6450	max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6451
6452	if (len > max_len)
6453		return false;
6454
6455	/* Make sure that the data is correctly formatted. */
6456	for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6457		cur_len = data[i];
6458
6459		if (data[i + 1] == EIR_FLAGS &&
6460		    (!is_adv_data || flags_managed(adv_flags)))
6461			return false;
6462
6463		if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6464			return false;
6465
6466		if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6467			return false;
6468
6469		if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6470			return false;
6471
6472		if (data[i + 1] == EIR_APPEARANCE &&
6473		    appearance_managed(adv_flags))
6474			return false;
6475
6476		/* If the current field length would exceed the total data
6477		 * length, then it's invalid.
6478		 */
6479		if (i + cur_len >= len)
6480			return false;
6481	}
6482
6483	return true;
6484}
6485
6486static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6487				     u16 opcode)
6488{
6489	struct mgmt_pending_cmd *cmd;
6490	struct mgmt_cp_add_advertising *cp;
6491	struct mgmt_rp_add_advertising rp;
6492	struct adv_info *adv_instance, *n;
6493	u8 instance;
6494
6495	BT_DBG("status %d", status);
6496
6497	hci_dev_lock(hdev);
6498
6499	cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6500
6501	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6502		if (!adv_instance->pending)
6503			continue;
6504
6505		if (!status) {
6506			adv_instance->pending = false;
6507			continue;
6508		}
6509
6510		instance = adv_instance->instance;
6511
6512		if (hdev->cur_adv_instance == instance)
6513			cancel_adv_timeout(hdev);
6514
6515		hci_remove_adv_instance(hdev, instance);
6516		mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6517	}
6518
6519	if (!cmd)
6520		goto unlock;
6521
6522	cp = cmd->param;
6523	rp.instance = cp->instance;
6524
6525	if (status)
6526		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6527				mgmt_status(status));
6528	else
6529		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6530				  mgmt_status(status), &rp, sizeof(rp));
6531
6532	mgmt_pending_remove(cmd);
6533
6534unlock:
6535	hci_dev_unlock(hdev);
6536}
6537
6538static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6539			   void *data, u16 data_len)
6540{
6541	struct mgmt_cp_add_advertising *cp = data;
6542	struct mgmt_rp_add_advertising rp;
6543	u32 flags;
6544	u32 supported_flags, phy_flags;
6545	u8 status;
6546	u16 timeout, duration;
6547	unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6548	u8 schedule_instance = 0;
6549	struct adv_info *next_instance;
6550	int err;
6551	struct mgmt_pending_cmd *cmd;
6552	struct hci_request req;
6553
6554	BT_DBG("%s", hdev->name);
6555
6556	status = mgmt_le_support(hdev);
6557	if (status)
6558		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6559				       status);
6560
6561	if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6562		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6563				       MGMT_STATUS_INVALID_PARAMS);
6564
6565	if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6566		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6567				       MGMT_STATUS_INVALID_PARAMS);
6568
6569	flags = __le32_to_cpu(cp->flags);
6570	timeout = __le16_to_cpu(cp->timeout);
6571	duration = __le16_to_cpu(cp->duration);
6572
6573	/* The current implementation only supports a subset of the specified
6574	 * flags. Also need to check mutual exclusiveness of sec flags.
6575	 */
6576	supported_flags = get_supported_adv_flags(hdev);
6577	phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6578	if (flags & ~supported_flags ||
6579	    ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6580		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6581				       MGMT_STATUS_INVALID_PARAMS);
6582
6583	hci_dev_lock(hdev);
6584
6585	if (timeout && !hdev_is_powered(hdev)) {
6586		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6587				      MGMT_STATUS_REJECTED);
6588		goto unlock;
6589	}
6590
6591	if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6592	    pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6593	    pending_find(MGMT_OP_SET_LE, hdev)) {
6594		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6595				      MGMT_STATUS_BUSY);
6596		goto unlock;
6597	}
6598
6599	if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6600	    !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6601			       cp->scan_rsp_len, false)) {
6602		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6603				      MGMT_STATUS_INVALID_PARAMS);
6604		goto unlock;
6605	}
6606
6607	err = hci_add_adv_instance(hdev, cp->instance, flags,
6608				   cp->adv_data_len, cp->data,
6609				   cp->scan_rsp_len,
6610				   cp->data + cp->adv_data_len,
6611				   timeout, duration);
6612	if (err < 0) {
6613		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6614				      MGMT_STATUS_FAILED);
6615		goto unlock;
6616	}
6617
6618	/* Only trigger an advertising added event if a new instance was
6619	 * actually added.
6620	 */
6621	if (hdev->adv_instance_cnt > prev_instance_cnt)
6622		mgmt_advertising_added(sk, hdev, cp->instance);
6623
6624	if (hdev->cur_adv_instance == cp->instance) {
6625		/* If the currently advertised instance is being changed then
6626		 * cancel the current advertising and schedule the next
6627		 * instance. If there is only one instance then the overridden
6628		 * advertising data will be visible right away.
6629		 */
6630		cancel_adv_timeout(hdev);
6631
6632		next_instance = hci_get_next_instance(hdev, cp->instance);
6633		if (next_instance)
6634			schedule_instance = next_instance->instance;
6635	} else if (!hdev->adv_instance_timeout) {
6636		/* Immediately advertise the new instance if no other
6637		 * instance is currently being advertised.
6638		 */
6639		schedule_instance = cp->instance;
6640	}
6641
6642	/* If the HCI_ADVERTISING flag is set or the device isn't powered or
6643	 * there is no instance to be advertised then we have no HCI
6644	 * communication to make. Simply return.
6645	 */
6646	if (!hdev_is_powered(hdev) ||
6647	    hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6648	    !schedule_instance) {
6649		rp.instance = cp->instance;
6650		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6651					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6652		goto unlock;
6653	}
6654
6655	/* We're good to go, update advertising data, parameters, and start
6656	 * advertising.
6657	 */
6658	cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6659			       data_len);
6660	if (!cmd) {
6661		err = -ENOMEM;
6662		goto unlock;
6663	}
6664
6665	hci_req_init(&req, hdev);
6666
6667	err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6668
6669	if (!err)
6670		err = hci_req_run(&req, add_advertising_complete);
6671
6672	if (err < 0)
6673		mgmt_pending_remove(cmd);
6674
6675unlock:
6676	hci_dev_unlock(hdev);
6677
6678	return err;
6679}
6680
6681static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6682					u16 opcode)
6683{
6684	struct mgmt_pending_cmd *cmd;
6685	struct mgmt_cp_remove_advertising *cp;
6686	struct mgmt_rp_remove_advertising rp;
6687
6688	BT_DBG("status %d", status);
6689
6690	hci_dev_lock(hdev);
6691
6692	/* A failure status here only means that we failed to disable
6693	 * advertising. Otherwise, the advertising instance has been removed,
6694	 * so report success.
6695	 */
6696	cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6697	if (!cmd)
6698		goto unlock;
6699
6700	cp = cmd->param;
6701	rp.instance = cp->instance;
6702
6703	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6704			  &rp, sizeof(rp));
6705	mgmt_pending_remove(cmd);
6706
6707unlock:
6708	hci_dev_unlock(hdev);
6709}
6710
6711static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6712			      void *data, u16 data_len)
6713{
6714	struct mgmt_cp_remove_advertising *cp = data;
6715	struct mgmt_rp_remove_advertising rp;
6716	struct mgmt_pending_cmd *cmd;
6717	struct hci_request req;
6718	int err;
6719
6720	BT_DBG("%s", hdev->name);
6721
6722	hci_dev_lock(hdev);
6723
6724	if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6725		err = mgmt_cmd_status(sk, hdev->id,
6726				      MGMT_OP_REMOVE_ADVERTISING,
6727				      MGMT_STATUS_INVALID_PARAMS);
6728		goto unlock;
6729	}
6730
6731	if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6732	    pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6733	    pending_find(MGMT_OP_SET_LE, hdev)) {
6734		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6735				      MGMT_STATUS_BUSY);
6736		goto unlock;
6737	}
6738
6739	if (list_empty(&hdev->adv_instances)) {
6740		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6741				      MGMT_STATUS_INVALID_PARAMS);
6742		goto unlock;
6743	}
6744
6745	hci_req_init(&req, hdev);
6746
6747	hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6748
6749	if (list_empty(&hdev->adv_instances))
6750		__hci_req_disable_advertising(&req);
6751
6752	/* If no HCI commands have been collected so far or the HCI_ADVERTISING
6753	 * flag is set or the device isn't powered then we have no HCI
6754	 * communication to make. Simply return.
6755	 */
6756	if (skb_queue_empty(&req.cmd_q) ||
6757	    !hdev_is_powered(hdev) ||
6758	    hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6759		hci_req_purge(&req);
6760		rp.instance = cp->instance;
6761		err = mgmt_cmd_complete(sk, hdev->id,
6762					MGMT_OP_REMOVE_ADVERTISING,
6763					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6764		goto unlock;
6765	}
6766
6767	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6768			       data_len);
6769	if (!cmd) {
6770		err = -ENOMEM;
6771		goto unlock;
6772	}
6773
6774	err = hci_req_run(&req, remove_advertising_complete);
6775	if (err < 0)
6776		mgmt_pending_remove(cmd);
6777
6778unlock:
6779	hci_dev_unlock(hdev);
6780
6781	return err;
6782}
6783
6784static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6785			     void *data, u16 data_len)
6786{
6787	struct mgmt_cp_get_adv_size_info *cp = data;
6788	struct mgmt_rp_get_adv_size_info rp;
6789	u32 flags, supported_flags;
6790	int err;
6791
6792	BT_DBG("%s", hdev->name);
6793
6794	if (!lmp_le_capable(hdev))
6795		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6796				       MGMT_STATUS_REJECTED);
6797
6798	if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6799		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6800				       MGMT_STATUS_INVALID_PARAMS);
6801
6802	flags = __le32_to_cpu(cp->flags);
6803
6804	/* The current implementation only supports a subset of the specified
6805	 * flags.
6806	 */
6807	supported_flags = get_supported_adv_flags(hdev);
6808	if (flags & ~supported_flags)
6809		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6810				       MGMT_STATUS_INVALID_PARAMS);
6811
6812	rp.instance = cp->instance;
6813	rp.flags = cp->flags;
6814	rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6815	rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6816
6817	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6818				MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6819
6820	return err;
6821}
6822
6823static const struct hci_mgmt_handler mgmt_handlers[] = {
6824	{ NULL }, /* 0x0000 (no command) */
6825	{ read_version,            MGMT_READ_VERSION_SIZE,
6826						HCI_MGMT_NO_HDEV |
6827						HCI_MGMT_UNTRUSTED },
6828	{ read_commands,           MGMT_READ_COMMANDS_SIZE,
6829						HCI_MGMT_NO_HDEV |
6830						HCI_MGMT_UNTRUSTED },
6831	{ read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6832						HCI_MGMT_NO_HDEV |
6833						HCI_MGMT_UNTRUSTED },
6834	{ read_controller_info,    MGMT_READ_INFO_SIZE,
6835						HCI_MGMT_UNTRUSTED },
6836	{ set_powered,             MGMT_SETTING_SIZE },
6837	{ set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6838	{ set_connectable,         MGMT_SETTING_SIZE },
6839	{ set_fast_connectable,    MGMT_SETTING_SIZE },
6840	{ set_bondable,            MGMT_SETTING_SIZE },
6841	{ set_link_security,       MGMT_SETTING_SIZE },
6842	{ set_ssp,                 MGMT_SETTING_SIZE },
6843	{ set_hs,                  MGMT_SETTING_SIZE },
6844	{ set_le,                  MGMT_SETTING_SIZE },
6845	{ set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6846	{ set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6847	{ add_uuid,                MGMT_ADD_UUID_SIZE },
6848	{ remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6849	{ load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6850						HCI_MGMT_VAR_LEN },
6851	{ load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6852						HCI_MGMT_VAR_LEN },
6853	{ disconnect,              MGMT_DISCONNECT_SIZE },
6854	{ get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6855	{ pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6856	{ pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6857	{ set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6858	{ pair_device,             MGMT_PAIR_DEVICE_SIZE },
6859	{ cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6860	{ unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6861	{ user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6862	{ user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6863	{ user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6864	{ user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6865	{ read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6866	{ add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6867						HCI_MGMT_VAR_LEN },
6868	{ remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6869	{ start_discovery,         MGMT_START_DISCOVERY_SIZE },
6870	{ stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6871	{ confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6872	{ block_device,            MGMT_BLOCK_DEVICE_SIZE },
6873	{ unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6874	{ set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6875	{ set_advertising,         MGMT_SETTING_SIZE },
6876	{ set_bredr,               MGMT_SETTING_SIZE },
6877	{ set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6878	{ set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6879	{ set_secure_conn,         MGMT_SETTING_SIZE },
6880	{ set_debug_keys,          MGMT_SETTING_SIZE },
6881	{ set_privacy,             MGMT_SET_PRIVACY_SIZE },
6882	{ load_irks,               MGMT_LOAD_IRKS_SIZE,
6883						HCI_MGMT_VAR_LEN },
6884	{ get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6885	{ get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6886	{ add_device,              MGMT_ADD_DEVICE_SIZE },
6887	{ remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6888	{ load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6889						HCI_MGMT_VAR_LEN },
6890	{ read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6891						HCI_MGMT_NO_HDEV |
6892						HCI_MGMT_UNTRUSTED },
6893	{ read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6894						HCI_MGMT_UNCONFIGURED |
6895						HCI_MGMT_UNTRUSTED },
6896	{ set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6897						HCI_MGMT_UNCONFIGURED },
6898	{ set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6899						HCI_MGMT_UNCONFIGURED },
6900	{ start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6901						HCI_MGMT_VAR_LEN },
6902	{ read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6903	{ read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6904						HCI_MGMT_NO_HDEV |
6905						HCI_MGMT_UNTRUSTED },
6906	{ read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6907	{ add_advertising,	   MGMT_ADD_ADVERTISING_SIZE,
6908						HCI_MGMT_VAR_LEN },
6909	{ remove_advertising,	   MGMT_REMOVE_ADVERTISING_SIZE },
6910	{ get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6911	{ start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6912	{ read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6913						HCI_MGMT_UNTRUSTED },
6914	{ set_appearance,	   MGMT_SET_APPEARANCE_SIZE },
6915	{ get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6916	{ set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6917};
6918
6919void mgmt_index_added(struct hci_dev *hdev)
6920{
6921	struct mgmt_ev_ext_index ev;
6922
6923	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6924		return;
6925
6926	switch (hdev->dev_type) {
6927	case HCI_PRIMARY:
6928		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6929			mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6930					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6931			ev.type = 0x01;
6932		} else {
6933			mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6934					 HCI_MGMT_INDEX_EVENTS);
6935			ev.type = 0x00;
6936		}
6937		break;
6938	case HCI_AMP:
6939		ev.type = 0x02;
6940		break;
6941	default:
6942		return;
6943	}
6944
6945	ev.bus = hdev->bus;
6946
6947	mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6948			 HCI_MGMT_EXT_INDEX_EVENTS);
6949}
6950
6951void mgmt_index_removed(struct hci_dev *hdev)
6952{
6953	struct mgmt_ev_ext_index ev;
6954	u8 status = MGMT_STATUS_INVALID_INDEX;
6955
6956	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6957		return;
6958
6959	switch (hdev->dev_type) {
6960	case HCI_PRIMARY:
6961		mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6962
6963		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6964			mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6965					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6966			ev.type = 0x01;
6967		} else {
6968			mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6969					 HCI_MGMT_INDEX_EVENTS);
6970			ev.type = 0x00;
6971		}
6972		break;
6973	case HCI_AMP:
6974		ev.type = 0x02;
6975		break;
6976	default:
6977		return;
6978	}
6979
6980	ev.bus = hdev->bus;
6981
6982	mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6983			 HCI_MGMT_EXT_INDEX_EVENTS);
6984}
6985
6986/* This function requires the caller holds hdev->lock */
6987static void restart_le_actions(struct hci_dev *hdev)
6988{
6989	struct hci_conn_params *p;
6990
6991	list_for_each_entry(p, &hdev->le_conn_params, list) {
6992		/* Needed for AUTO_OFF case where might not "really"
6993		 * have been powered off.
6994		 */
6995		list_del_init(&p->action);
6996
6997		switch (p->auto_connect) {
6998		case HCI_AUTO_CONN_DIRECT:
6999		case HCI_AUTO_CONN_ALWAYS:
7000			list_add(&p->action, &hdev->pend_le_conns);
7001			break;
7002		case HCI_AUTO_CONN_REPORT:
7003			list_add(&p->action, &hdev->pend_le_reports);
7004			break;
7005		default:
7006			break;
7007		}
7008	}
7009}
7010
7011void mgmt_power_on(struct hci_dev *hdev, int err)
7012{
7013	struct cmd_lookup match = { NULL, hdev };
7014
7015	BT_DBG("err %d", err);
7016
7017	hci_dev_lock(hdev);
7018
7019	if (!err) {
7020		restart_le_actions(hdev);
7021		hci_update_background_scan(hdev);
7022	}
7023
7024	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7025
7026	new_settings(hdev, match.sk);
7027
7028	if (match.sk)
7029		sock_put(match.sk);
7030
7031	hci_dev_unlock(hdev);
7032}
7033
7034void __mgmt_power_off(struct hci_dev *hdev)
7035{
7036	struct cmd_lookup match = { NULL, hdev };
7037	u8 status, zero_cod[] = { 0, 0, 0 };
7038
7039	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7040
7041	/* If the power off is because of hdev unregistration let
7042	 * use the appropriate INVALID_INDEX status. Otherwise use
7043	 * NOT_POWERED. We cover both scenarios here since later in
7044	 * mgmt_index_removed() any hci_conn callbacks will have already
7045	 * been triggered, potentially causing misleading DISCONNECTED
7046	 * status responses.
7047	 */
7048	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7049		status = MGMT_STATUS_INVALID_INDEX;
7050	else
7051		status = MGMT_STATUS_NOT_POWERED;
7052
7053	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7054
7055	if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7056		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7057				   zero_cod, sizeof(zero_cod),
7058				   HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7059		ext_info_changed(hdev, NULL);
7060	}
7061
7062	new_settings(hdev, match.sk);
7063
7064	if (match.sk)
7065		sock_put(match.sk);
7066}
7067
7068void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7069{
7070	struct mgmt_pending_cmd *cmd;
7071	u8 status;
7072
7073	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7074	if (!cmd)
7075		return;
7076
7077	if (err == -ERFKILL)
7078		status = MGMT_STATUS_RFKILLED;
7079	else
7080		status = MGMT_STATUS_FAILED;
7081
7082	mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7083
7084	mgmt_pending_remove(cmd);
7085}
7086
7087void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7088		       bool persistent)
7089{
7090	struct mgmt_ev_new_link_key ev;
7091
7092	memset(&ev, 0, sizeof(ev));
7093
7094	ev.store_hint = persistent;
7095	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7096	ev.key.addr.type = BDADDR_BREDR;
7097	ev.key.type = key->type;
7098	memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7099	ev.key.pin_len = key->pin_len;
7100
7101	mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7102}
7103
7104static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7105{
7106	switch (ltk->type) {
7107	case SMP_LTK:
7108	case SMP_LTK_SLAVE:
7109		if (ltk->authenticated)
7110			return MGMT_LTK_AUTHENTICATED;
7111		return MGMT_LTK_UNAUTHENTICATED;
7112	case SMP_LTK_P256:
7113		if (ltk->authenticated)
7114			return MGMT_LTK_P256_AUTH;
7115		return MGMT_LTK_P256_UNAUTH;
7116	case SMP_LTK_P256_DEBUG:
7117		return MGMT_LTK_P256_DEBUG;
7118	}
7119
7120	return MGMT_LTK_UNAUTHENTICATED;
7121}
7122
7123void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7124{
7125	struct mgmt_ev_new_long_term_key ev;
7126
7127	memset(&ev, 0, sizeof(ev));
7128
7129	/* Devices using resolvable or non-resolvable random addresses
7130	 * without providing an identity resolving key don't require
7131	 * to store long term keys. Their addresses will change the
7132	 * next time around.
7133	 *
7134	 * Only when a remote device provides an identity address
7135	 * make sure the long term key is stored. If the remote
7136	 * identity is known, the long term keys are internally
7137	 * mapped to the identity address. So allow static random
7138	 * and public addresses here.
7139	 */
7140	if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7141	    (key->bdaddr.b[5] & 0xc0) != 0xc0)
7142		ev.store_hint = 0x00;
7143	else
7144		ev.store_hint = persistent;
7145
7146	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7147	ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7148	ev.key.type = mgmt_ltk_type(key);
7149	ev.key.enc_size = key->enc_size;
7150	ev.key.ediv = key->ediv;
7151	ev.key.rand = key->rand;
7152
7153	if (key->type == SMP_LTK)
7154		ev.key.master = 1;
7155
7156	/* Make sure we copy only the significant bytes based on the
7157	 * encryption key size, and set the rest of the value to zeroes.
7158	 */
7159	memcpy(ev.key.val, key->val, key->enc_size);
7160	memset(ev.key.val + key->enc_size, 0,
7161	       sizeof(ev.key.val) - key->enc_size);
7162
7163	mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7164}
7165
7166void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7167{
7168	struct mgmt_ev_new_irk ev;
7169
7170	memset(&ev, 0, sizeof(ev));
7171
7172	ev.store_hint = persistent;
7173
7174	bacpy(&ev.rpa, &irk->rpa);
7175	bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7176	ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7177	memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7178
7179	mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7180}
7181
7182void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7183		   bool persistent)
7184{
7185	struct mgmt_ev_new_csrk ev;
7186
7187	memset(&ev, 0, sizeof(ev));
7188
7189	/* Devices using resolvable or non-resolvable random addresses
7190	 * without providing an identity resolving key don't require
7191	 * to store signature resolving keys. Their addresses will change
7192	 * the next time around.
7193	 *
7194	 * Only when a remote device provides an identity address
7195	 * make sure the signature resolving key is stored. So allow
7196	 * static random and public addresses here.
7197	 */
7198	if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7199	    (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7200		ev.store_hint = 0x00;
7201	else
7202		ev.store_hint = persistent;
7203
7204	bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7205	ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7206	ev.key.type = csrk->type;
7207	memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7208
7209	mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7210}
7211
7212void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7213			 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7214			 u16 max_interval, u16 latency, u16 timeout)
7215{
7216	struct mgmt_ev_new_conn_param ev;
7217
7218	if (!hci_is_identity_address(bdaddr, bdaddr_type))
7219		return;
7220
7221	memset(&ev, 0, sizeof(ev));
7222	bacpy(&ev.addr.bdaddr, bdaddr);
7223	ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7224	ev.store_hint = store_hint;
7225	ev.min_interval = cpu_to_le16(min_interval);
7226	ev.max_interval = cpu_to_le16(max_interval);
7227	ev.latency = cpu_to_le16(latency);
7228	ev.timeout = cpu_to_le16(timeout);
7229
7230	mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7231}
7232
7233void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7234			   u32 flags, u8 *name, u8 name_len)
7235{
7236	char buf[512];
7237	struct mgmt_ev_device_connected *ev = (void *) buf;
7238	u16 eir_len = 0;
7239
7240	bacpy(&ev->addr.bdaddr, &conn->dst);
7241	ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7242
7243	ev->flags = __cpu_to_le32(flags);
7244
7245	/* We must ensure that the EIR Data fields are ordered and
7246	 * unique. Keep it simple for now and avoid the problem by not
7247	 * adding any BR/EDR data to the LE adv.
7248	 */
7249	if (conn->le_adv_data_len > 0) {
7250		memcpy(&ev->eir[eir_len],
7251		       conn->le_adv_data, conn->le_adv_data_len);
7252		eir_len = conn->le_adv_data_len;
7253	} else {
7254		if (name_len > 0)
7255			eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7256						  name, name_len);
7257
7258		if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7259			eir_len = eir_append_data(ev->eir, eir_len,
7260						  EIR_CLASS_OF_DEV,
7261						  conn->dev_class, 3);
7262	}
7263
7264	ev->eir_len = cpu_to_le16(eir_len);
7265
7266	mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7267		    sizeof(*ev) + eir_len, NULL);
7268}
7269
7270static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7271{
7272	struct sock **sk = data;
7273
7274	cmd->cmd_complete(cmd, 0);
7275
7276	*sk = cmd->sk;
7277	sock_hold(*sk);
7278
7279	mgmt_pending_remove(cmd);
7280}
7281
7282static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7283{
7284	struct hci_dev *hdev = data;
7285	struct mgmt_cp_unpair_device *cp = cmd->param;
7286
7287	device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7288
7289	cmd->cmd_complete(cmd, 0);
7290	mgmt_pending_remove(cmd);
7291}
7292
7293bool mgmt_powering_down(struct hci_dev *hdev)
7294{
7295	struct mgmt_pending_cmd *cmd;
7296	struct mgmt_mode *cp;
7297
7298	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7299	if (!cmd)
7300		return false;
7301
7302	cp = cmd->param;
7303	if (!cp->val)
7304		return true;
7305
7306	return false;
7307}
7308
7309void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7310			      u8 link_type, u8 addr_type, u8 reason,
7311			      bool mgmt_connected)
7312{
7313	struct mgmt_ev_device_disconnected ev;
7314	struct sock *sk = NULL;
7315
7316	/* The connection is still in hci_conn_hash so test for 1
7317	 * instead of 0 to know if this is the last one.
7318	 */
7319	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7320		cancel_delayed_work(&hdev->power_off);
7321		queue_work(hdev->req_workqueue, &hdev->power_off.work);
7322	}
7323
7324	if (!mgmt_connected)
7325		return;
7326
7327	if (link_type != ACL_LINK && link_type != LE_LINK)
7328		return;
7329
7330	mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7331
7332	bacpy(&ev.addr.bdaddr, bdaddr);
7333	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7334	ev.reason = reason;
7335
7336	mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7337
7338	if (sk)
7339		sock_put(sk);
7340
7341	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7342			     hdev);
7343}
7344
7345void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7346			    u8 link_type, u8 addr_type, u8 status)
7347{
7348	u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7349	struct mgmt_cp_disconnect *cp;
7350	struct mgmt_pending_cmd *cmd;
7351
7352	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7353			     hdev);
7354
7355	cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7356	if (!cmd)
7357		return;
7358
7359	cp = cmd->param;
7360
7361	if (bacmp(bdaddr, &cp->addr.bdaddr))
7362		return;
7363
7364	if (cp->addr.type != bdaddr_type)
7365		return;
7366
7367	cmd->cmd_complete(cmd, mgmt_status(status));
7368	mgmt_pending_remove(cmd);
7369}
7370
7371void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7372			 u8 addr_type, u8 status)
7373{
7374	struct mgmt_ev_connect_failed ev;
7375
7376	/* The connection is still in hci_conn_hash so test for 1
7377	 * instead of 0 to know if this is the last one.
7378	 */
7379	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7380		cancel_delayed_work(&hdev->power_off);
7381		queue_work(hdev->req_workqueue, &hdev->power_off.work);
7382	}
7383
7384	bacpy(&ev.addr.bdaddr, bdaddr);
7385	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7386	ev.status = mgmt_status(status);
7387
7388	mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7389}
7390
7391void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7392{
7393	struct mgmt_ev_pin_code_request ev;
7394
7395	bacpy(&ev.addr.bdaddr, bdaddr);
7396	ev.addr.type = BDADDR_BREDR;
7397	ev.secure = secure;
7398
7399	mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7400}
7401
7402void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7403				  u8 status)
7404{
7405	struct mgmt_pending_cmd *cmd;
7406
7407	cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7408	if (!cmd)
7409		return;
7410
7411	cmd->cmd_complete(cmd, mgmt_status(status));
7412	mgmt_pending_remove(cmd);
7413}
7414
7415void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7416				      u8 status)
7417{
7418	struct mgmt_pending_cmd *cmd;
7419
7420	cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7421	if (!cmd)
7422		return;
7423
7424	cmd->cmd_complete(cmd, mgmt_status(status));
7425	mgmt_pending_remove(cmd);
7426}
7427
7428int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7429			      u8 link_type, u8 addr_type, u32 value,
7430			      u8 confirm_hint)
7431{
7432	struct mgmt_ev_user_confirm_request ev;
7433
7434	BT_DBG("%s", hdev->name);
7435
7436	bacpy(&ev.addr.bdaddr, bdaddr);
7437	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7438	ev.confirm_hint = confirm_hint;
7439	ev.value = cpu_to_le32(value);
7440
7441	return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7442			  NULL);
7443}
7444
7445int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7446			      u8 link_type, u8 addr_type)
7447{
7448	struct mgmt_ev_user_passkey_request ev;
7449
7450	BT_DBG("%s", hdev->name);
7451
7452	bacpy(&ev.addr.bdaddr, bdaddr);
7453	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7454
7455	return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7456			  NULL);
7457}
7458
7459static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7460				      u8 link_type, u8 addr_type, u8 status,
7461				      u8 opcode)
7462{
7463	struct mgmt_pending_cmd *cmd;
7464
7465	cmd = pending_find(opcode, hdev);
7466	if (!cmd)
7467		return -ENOENT;
7468
7469	cmd->cmd_complete(cmd, mgmt_status(status));
7470	mgmt_pending_remove(cmd);
7471
7472	return 0;
7473}
7474
7475int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7476				     u8 link_type, u8 addr_type, u8 status)
7477{
7478	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7479					  status, MGMT_OP_USER_CONFIRM_REPLY);
7480}
7481
7482int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7483					 u8 link_type, u8 addr_type, u8 status)
7484{
7485	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7486					  status,
7487					  MGMT_OP_USER_CONFIRM_NEG_REPLY);
7488}
7489
7490int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7491				     u8 link_type, u8 addr_type, u8 status)
7492{
7493	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7494					  status, MGMT_OP_USER_PASSKEY_REPLY);
7495}
7496
7497int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7498					 u8 link_type, u8 addr_type, u8 status)
7499{
7500	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7501					  status,
7502					  MGMT_OP_USER_PASSKEY_NEG_REPLY);
7503}
7504
7505int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7506			     u8 link_type, u8 addr_type, u32 passkey,
7507			     u8 entered)
7508{
7509	struct mgmt_ev_passkey_notify ev;
7510
7511	BT_DBG("%s", hdev->name);
7512
7513	bacpy(&ev.addr.bdaddr, bdaddr);
7514	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7515	ev.passkey = __cpu_to_le32(passkey);
7516	ev.entered = entered;
7517
7518	return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7519}
7520
7521void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7522{
7523	struct mgmt_ev_auth_failed ev;
7524	struct mgmt_pending_cmd *cmd;
7525	u8 status = mgmt_status(hci_status);
7526
7527	bacpy(&ev.addr.bdaddr, &conn->dst);
7528	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7529	ev.status = status;
7530
7531	cmd = find_pairing(conn);
7532
7533	mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7534		    cmd ? cmd->sk : NULL);
7535
7536	if (cmd) {
7537		cmd->cmd_complete(cmd, status);
7538		mgmt_pending_remove(cmd);
7539	}
7540}
7541
7542void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7543{
7544	struct cmd_lookup match = { NULL, hdev };
7545	bool changed;
7546
7547	if (status) {
7548		u8 mgmt_err = mgmt_status(status);
7549		mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7550				     cmd_status_rsp, &mgmt_err);
7551		return;
7552	}
7553
7554	if (test_bit(HCI_AUTH, &hdev->flags))
7555		changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7556	else
7557		changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7558
7559	mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7560			     &match);
7561
7562	if (changed)
7563		new_settings(hdev, match.sk);
7564
7565	if (match.sk)
7566		sock_put(match.sk);
7567}
7568
7569static void clear_eir(struct hci_request *req)
7570{
7571	struct hci_dev *hdev = req->hdev;
7572	struct hci_cp_write_eir cp;
7573
7574	if (!lmp_ext_inq_capable(hdev))
7575		return;
7576
7577	memset(hdev->eir, 0, sizeof(hdev->eir));
7578
7579	memset(&cp, 0, sizeof(cp));
7580
7581	hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7582}
7583
7584void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7585{
7586	struct cmd_lookup match = { NULL, hdev };
7587	struct hci_request req;
7588	bool changed = false;
7589
7590	if (status) {
7591		u8 mgmt_err = mgmt_status(status);
7592
7593		if (enable && hci_dev_test_and_clear_flag(hdev,
7594							  HCI_SSP_ENABLED)) {
7595			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7596			new_settings(hdev, NULL);
7597		}
7598
7599		mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7600				     &mgmt_err);
7601		return;
7602	}
7603
7604	if (enable) {
7605		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7606	} else {
7607		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7608		if (!changed)
7609			changed = hci_dev_test_and_clear_flag(hdev,
7610							      HCI_HS_ENABLED);
7611		else
7612			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7613	}
7614
7615	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7616
7617	if (changed)
7618		new_settings(hdev, match.sk);
7619
7620	if (match.sk)
7621		sock_put(match.sk);
7622
7623	hci_req_init(&req, hdev);
7624
7625	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7626		if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7627			hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7628				    sizeof(enable), &enable);
7629		__hci_req_update_eir(&req);
7630	} else {
7631		clear_eir(&req);
7632	}
7633
7634	hci_req_run(&req, NULL);
7635}
7636
7637static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7638{
7639	struct cmd_lookup *match = data;
7640
7641	if (match->sk == NULL) {
7642		match->sk = cmd->sk;
7643		sock_hold(match->sk);
7644	}
7645}
7646
7647void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7648				    u8 status)
7649{
7650	struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7651
7652	mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7653	mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7654	mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7655
7656	if (!status) {
7657		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7658				   3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7659		ext_info_changed(hdev, NULL);
7660	}
7661
7662	if (match.sk)
7663		sock_put(match.sk);
7664}
7665
7666void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7667{
7668	struct mgmt_cp_set_local_name ev;
7669	struct mgmt_pending_cmd *cmd;
7670
7671	if (status)
7672		return;
7673
7674	memset(&ev, 0, sizeof(ev));
7675	memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7676	memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7677
7678	cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7679	if (!cmd) {
7680		memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7681
7682		/* If this is a HCI command related to powering on the
7683		 * HCI dev don't send any mgmt signals.
7684		 */
7685		if (pending_find(MGMT_OP_SET_POWERED, hdev))
7686			return;
7687	}
7688
7689	mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7690			   HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7691	ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7692}
7693
7694static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7695{
7696	int i;
7697
7698	for (i = 0; i < uuid_count; i++) {
7699		if (!memcmp(uuid, uuids[i], 16))
7700			return true;
7701	}
7702
7703	return false;
7704}
7705
7706static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7707{
7708	u16 parsed = 0;
7709
7710	while (parsed < eir_len) {
7711		u8 field_len = eir[0];
7712		u8 uuid[16];
7713		int i;
7714
7715		if (field_len == 0)
7716			break;
7717
7718		if (eir_len - parsed < field_len + 1)
7719			break;
7720
7721		switch (eir[1]) {
7722		case EIR_UUID16_ALL:
7723		case EIR_UUID16_SOME:
7724			for (i = 0; i + 3 <= field_len; i += 2) {
7725				memcpy(uuid, bluetooth_base_uuid, 16);
7726				uuid[13] = eir[i + 3];
7727				uuid[12] = eir[i + 2];
7728				if (has_uuid(uuid, uuid_count, uuids))
7729					return true;
7730			}
7731			break;
7732		case EIR_UUID32_ALL:
7733		case EIR_UUID32_SOME:
7734			for (i = 0; i + 5 <= field_len; i += 4) {
7735				memcpy(uuid, bluetooth_base_uuid, 16);
7736				uuid[15] = eir[i + 5];
7737				uuid[14] = eir[i + 4];
7738				uuid[13] = eir[i + 3];
7739				uuid[12] = eir[i + 2];
7740				if (has_uuid(uuid, uuid_count, uuids))
7741					return true;
7742			}
7743			break;
7744		case EIR_UUID128_ALL:
7745		case EIR_UUID128_SOME:
7746			for (i = 0; i + 17 <= field_len; i += 16) {
7747				memcpy(uuid, eir + i + 2, 16);
7748				if (has_uuid(uuid, uuid_count, uuids))
7749					return true;
7750			}
7751			break;
7752		}
7753
7754		parsed += field_len + 1;
7755		eir += field_len + 1;
7756	}
7757
7758	return false;
7759}
7760
7761static void restart_le_scan(struct hci_dev *hdev)
7762{
7763	/* If controller is not scanning we are done. */
7764	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7765		return;
7766
7767	if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7768		       hdev->discovery.scan_start +
7769		       hdev->discovery.scan_duration))
7770		return;
7771
7772	queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7773			   DISCOV_LE_RESTART_DELAY);
7774}
7775
7776static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7777			    u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7778{
7779	/* If a RSSI threshold has been specified, and
7780	 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7781	 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7782	 * is set, let it through for further processing, as we might need to
7783	 * restart the scan.
7784	 *
7785	 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7786	 * the results are also dropped.
7787	 */
7788	if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7789	    (rssi == HCI_RSSI_INVALID ||
7790	    (rssi < hdev->discovery.rssi &&
7791	     !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7792		return  false;
7793
7794	if (hdev->discovery.uuid_count != 0) {
7795		/* If a list of UUIDs is provided in filter, results with no
7796		 * matching UUID should be dropped.
7797		 */
7798		if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7799				   hdev->discovery.uuids) &&
7800		    !eir_has_uuids(scan_rsp, scan_rsp_len,
7801				   hdev->discovery.uuid_count,
7802				   hdev->discovery.uuids))
7803			return false;
7804	}
7805
7806	/* If duplicate filtering does not report RSSI changes, then restart
7807	 * scanning to ensure updated result with updated RSSI values.
7808	 */
7809	if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7810		restart_le_scan(hdev);
7811
7812		/* Validate RSSI value against the RSSI threshold once more. */
7813		if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7814		    rssi < hdev->discovery.rssi)
7815			return false;
7816	}
7817
7818	return true;
7819}
7820
7821void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7822		       u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7823		       u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7824{
7825	char buf[512];
7826	struct mgmt_ev_device_found *ev = (void *)buf;
7827	size_t ev_size;
7828
7829	/* Don't send events for a non-kernel initiated discovery. With
7830	 * LE one exception is if we have pend_le_reports > 0 in which
7831	 * case we're doing passive scanning and want these events.
7832	 */
7833	if (!hci_discovery_active(hdev)) {
7834		if (link_type == ACL_LINK)
7835			return;
7836		if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7837			return;
7838	}
7839
7840	if (hdev->discovery.result_filtering) {
7841		/* We are using service discovery */
7842		if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7843				     scan_rsp_len))
7844			return;
7845	}
7846
7847	if (hdev->discovery.limited) {
7848		/* Check for limited discoverable bit */
7849		if (dev_class) {
7850			if (!(dev_class[1] & 0x20))
7851				return;
7852		} else {
7853			u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7854			if (!flags || !(flags[0] & LE_AD_LIMITED))
7855				return;
7856		}
7857	}
7858
7859	/* Make sure that the buffer is big enough. The 5 extra bytes
7860	 * are for the potential CoD field.
7861	 */
7862	if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7863		return;
7864
7865	memset(buf, 0, sizeof(buf));
7866
7867	/* In case of device discovery with BR/EDR devices (pre 1.2), the
7868	 * RSSI value was reported as 0 when not available. This behavior
7869	 * is kept when using device discovery. This is required for full
7870	 * backwards compatibility with the API.
7871	 *
7872	 * However when using service discovery, the value 127 will be
7873	 * returned when the RSSI is not available.
7874	 */
7875	if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7876	    link_type == ACL_LINK)
7877		rssi = 0;
7878
7879	bacpy(&ev->addr.bdaddr, bdaddr);
7880	ev->addr.type = link_to_bdaddr(link_type, addr_type);
7881	ev->rssi = rssi;
7882	ev->flags = cpu_to_le32(flags);
7883
7884	if (eir_len > 0)
7885		/* Copy EIR or advertising data into event */
7886		memcpy(ev->eir, eir, eir_len);
7887
7888	if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7889				       NULL))
7890		eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7891					  dev_class, 3);
7892
7893	if (scan_rsp_len > 0)
7894		/* Append scan response data to event */
7895		memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7896
7897	ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7898	ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7899
7900	mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7901}
7902
7903void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7904		      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7905{
7906	struct mgmt_ev_device_found *ev;
7907	char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7908	u16 eir_len;
7909
7910	ev = (struct mgmt_ev_device_found *) buf;
7911
7912	memset(buf, 0, sizeof(buf));
7913
7914	bacpy(&ev->addr.bdaddr, bdaddr);
7915	ev->addr.type = link_to_bdaddr(link_type, addr_type);
7916	ev->rssi = rssi;
7917
7918	eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7919				  name_len);
7920
7921	ev->eir_len = cpu_to_le16(eir_len);
7922
7923	mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7924}
7925
7926void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7927{
7928	struct mgmt_ev_discovering ev;
7929
7930	BT_DBG("%s discovering %u", hdev->name, discovering);
7931
7932	memset(&ev, 0, sizeof(ev));
7933	ev.type = hdev->discovery.type;
7934	ev.discovering = discovering;
7935
7936	mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7937}
7938
7939static struct hci_mgmt_chan chan = {
7940	.channel	= HCI_CHANNEL_CONTROL,
7941	.handler_count	= ARRAY_SIZE(mgmt_handlers),
7942	.handlers	= mgmt_handlers,
7943	.hdev_init	= mgmt_init_hdev,
7944};
7945
7946int mgmt_init(void)
7947{
7948	return hci_mgmt_chan_register(&chan);
7949}
7950
7951void mgmt_exit(void)
7952{
7953	hci_mgmt_chan_unregister(&chan);
7954}