xref: /openbmc/linux/net/bluetooth/mgmt.c (revision d9565bf4)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3 
4    Copyright (C) 2010  Nokia Corporation
5    Copyright (C) 2011-2012 Intel Corporation
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth HCI Management interface */
26 
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29 
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35 
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39 #include "mgmt_config.h"
40 #include "msft.h"
41 #include "eir.h"
42 #include "aosp.h"
43 
44 #define MGMT_VERSION	1
45 #define MGMT_REVISION	21
46 
47 static const u16 mgmt_commands[] = {
48 	MGMT_OP_READ_INDEX_LIST,
49 	MGMT_OP_READ_INFO,
50 	MGMT_OP_SET_POWERED,
51 	MGMT_OP_SET_DISCOVERABLE,
52 	MGMT_OP_SET_CONNECTABLE,
53 	MGMT_OP_SET_FAST_CONNECTABLE,
54 	MGMT_OP_SET_BONDABLE,
55 	MGMT_OP_SET_LINK_SECURITY,
56 	MGMT_OP_SET_SSP,
57 	MGMT_OP_SET_HS,
58 	MGMT_OP_SET_LE,
59 	MGMT_OP_SET_DEV_CLASS,
60 	MGMT_OP_SET_LOCAL_NAME,
61 	MGMT_OP_ADD_UUID,
62 	MGMT_OP_REMOVE_UUID,
63 	MGMT_OP_LOAD_LINK_KEYS,
64 	MGMT_OP_LOAD_LONG_TERM_KEYS,
65 	MGMT_OP_DISCONNECT,
66 	MGMT_OP_GET_CONNECTIONS,
67 	MGMT_OP_PIN_CODE_REPLY,
68 	MGMT_OP_PIN_CODE_NEG_REPLY,
69 	MGMT_OP_SET_IO_CAPABILITY,
70 	MGMT_OP_PAIR_DEVICE,
71 	MGMT_OP_CANCEL_PAIR_DEVICE,
72 	MGMT_OP_UNPAIR_DEVICE,
73 	MGMT_OP_USER_CONFIRM_REPLY,
74 	MGMT_OP_USER_CONFIRM_NEG_REPLY,
75 	MGMT_OP_USER_PASSKEY_REPLY,
76 	MGMT_OP_USER_PASSKEY_NEG_REPLY,
77 	MGMT_OP_READ_LOCAL_OOB_DATA,
78 	MGMT_OP_ADD_REMOTE_OOB_DATA,
79 	MGMT_OP_REMOVE_REMOTE_OOB_DATA,
80 	MGMT_OP_START_DISCOVERY,
81 	MGMT_OP_STOP_DISCOVERY,
82 	MGMT_OP_CONFIRM_NAME,
83 	MGMT_OP_BLOCK_DEVICE,
84 	MGMT_OP_UNBLOCK_DEVICE,
85 	MGMT_OP_SET_DEVICE_ID,
86 	MGMT_OP_SET_ADVERTISING,
87 	MGMT_OP_SET_BREDR,
88 	MGMT_OP_SET_STATIC_ADDRESS,
89 	MGMT_OP_SET_SCAN_PARAMS,
90 	MGMT_OP_SET_SECURE_CONN,
91 	MGMT_OP_SET_DEBUG_KEYS,
92 	MGMT_OP_SET_PRIVACY,
93 	MGMT_OP_LOAD_IRKS,
94 	MGMT_OP_GET_CONN_INFO,
95 	MGMT_OP_GET_CLOCK_INFO,
96 	MGMT_OP_ADD_DEVICE,
97 	MGMT_OP_REMOVE_DEVICE,
98 	MGMT_OP_LOAD_CONN_PARAM,
99 	MGMT_OP_READ_UNCONF_INDEX_LIST,
100 	MGMT_OP_READ_CONFIG_INFO,
101 	MGMT_OP_SET_EXTERNAL_CONFIG,
102 	MGMT_OP_SET_PUBLIC_ADDRESS,
103 	MGMT_OP_START_SERVICE_DISCOVERY,
104 	MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
105 	MGMT_OP_READ_EXT_INDEX_LIST,
106 	MGMT_OP_READ_ADV_FEATURES,
107 	MGMT_OP_ADD_ADVERTISING,
108 	MGMT_OP_REMOVE_ADVERTISING,
109 	MGMT_OP_GET_ADV_SIZE_INFO,
110 	MGMT_OP_START_LIMITED_DISCOVERY,
111 	MGMT_OP_READ_EXT_INFO,
112 	MGMT_OP_SET_APPEARANCE,
113 	MGMT_OP_GET_PHY_CONFIGURATION,
114 	MGMT_OP_SET_PHY_CONFIGURATION,
115 	MGMT_OP_SET_BLOCKED_KEYS,
116 	MGMT_OP_SET_WIDEBAND_SPEECH,
117 	MGMT_OP_READ_CONTROLLER_CAP,
118 	MGMT_OP_READ_EXP_FEATURES_INFO,
119 	MGMT_OP_SET_EXP_FEATURE,
120 	MGMT_OP_READ_DEF_SYSTEM_CONFIG,
121 	MGMT_OP_SET_DEF_SYSTEM_CONFIG,
122 	MGMT_OP_READ_DEF_RUNTIME_CONFIG,
123 	MGMT_OP_SET_DEF_RUNTIME_CONFIG,
124 	MGMT_OP_GET_DEVICE_FLAGS,
125 	MGMT_OP_SET_DEVICE_FLAGS,
126 	MGMT_OP_READ_ADV_MONITOR_FEATURES,
127 	MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
128 	MGMT_OP_REMOVE_ADV_MONITOR,
129 	MGMT_OP_ADD_EXT_ADV_PARAMS,
130 	MGMT_OP_ADD_EXT_ADV_DATA,
131 	MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
132 };
133 
134 static const u16 mgmt_events[] = {
135 	MGMT_EV_CONTROLLER_ERROR,
136 	MGMT_EV_INDEX_ADDED,
137 	MGMT_EV_INDEX_REMOVED,
138 	MGMT_EV_NEW_SETTINGS,
139 	MGMT_EV_CLASS_OF_DEV_CHANGED,
140 	MGMT_EV_LOCAL_NAME_CHANGED,
141 	MGMT_EV_NEW_LINK_KEY,
142 	MGMT_EV_NEW_LONG_TERM_KEY,
143 	MGMT_EV_DEVICE_CONNECTED,
144 	MGMT_EV_DEVICE_DISCONNECTED,
145 	MGMT_EV_CONNECT_FAILED,
146 	MGMT_EV_PIN_CODE_REQUEST,
147 	MGMT_EV_USER_CONFIRM_REQUEST,
148 	MGMT_EV_USER_PASSKEY_REQUEST,
149 	MGMT_EV_AUTH_FAILED,
150 	MGMT_EV_DEVICE_FOUND,
151 	MGMT_EV_DISCOVERING,
152 	MGMT_EV_DEVICE_BLOCKED,
153 	MGMT_EV_DEVICE_UNBLOCKED,
154 	MGMT_EV_DEVICE_UNPAIRED,
155 	MGMT_EV_PASSKEY_NOTIFY,
156 	MGMT_EV_NEW_IRK,
157 	MGMT_EV_NEW_CSRK,
158 	MGMT_EV_DEVICE_ADDED,
159 	MGMT_EV_DEVICE_REMOVED,
160 	MGMT_EV_NEW_CONN_PARAM,
161 	MGMT_EV_UNCONF_INDEX_ADDED,
162 	MGMT_EV_UNCONF_INDEX_REMOVED,
163 	MGMT_EV_NEW_CONFIG_OPTIONS,
164 	MGMT_EV_EXT_INDEX_ADDED,
165 	MGMT_EV_EXT_INDEX_REMOVED,
166 	MGMT_EV_LOCAL_OOB_DATA_UPDATED,
167 	MGMT_EV_ADVERTISING_ADDED,
168 	MGMT_EV_ADVERTISING_REMOVED,
169 	MGMT_EV_EXT_INFO_CHANGED,
170 	MGMT_EV_PHY_CONFIGURATION_CHANGED,
171 	MGMT_EV_EXP_FEATURE_CHANGED,
172 	MGMT_EV_DEVICE_FLAGS_CHANGED,
173 	MGMT_EV_ADV_MONITOR_ADDED,
174 	MGMT_EV_ADV_MONITOR_REMOVED,
175 	MGMT_EV_CONTROLLER_SUSPEND,
176 	MGMT_EV_CONTROLLER_RESUME,
177 };
178 
179 static const u16 mgmt_untrusted_commands[] = {
180 	MGMT_OP_READ_INDEX_LIST,
181 	MGMT_OP_READ_INFO,
182 	MGMT_OP_READ_UNCONF_INDEX_LIST,
183 	MGMT_OP_READ_CONFIG_INFO,
184 	MGMT_OP_READ_EXT_INDEX_LIST,
185 	MGMT_OP_READ_EXT_INFO,
186 	MGMT_OP_READ_CONTROLLER_CAP,
187 	MGMT_OP_READ_EXP_FEATURES_INFO,
188 	MGMT_OP_READ_DEF_SYSTEM_CONFIG,
189 	MGMT_OP_READ_DEF_RUNTIME_CONFIG,
190 };
191 
192 static const u16 mgmt_untrusted_events[] = {
193 	MGMT_EV_INDEX_ADDED,
194 	MGMT_EV_INDEX_REMOVED,
195 	MGMT_EV_NEW_SETTINGS,
196 	MGMT_EV_CLASS_OF_DEV_CHANGED,
197 	MGMT_EV_LOCAL_NAME_CHANGED,
198 	MGMT_EV_UNCONF_INDEX_ADDED,
199 	MGMT_EV_UNCONF_INDEX_REMOVED,
200 	MGMT_EV_NEW_CONFIG_OPTIONS,
201 	MGMT_EV_EXT_INDEX_ADDED,
202 	MGMT_EV_EXT_INDEX_REMOVED,
203 	MGMT_EV_EXT_INFO_CHANGED,
204 	MGMT_EV_EXP_FEATURE_CHANGED,
205 };
206 
207 #define CACHE_TIMEOUT	msecs_to_jiffies(2 * 1000)
208 
209 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
210 		 "\x00\x00\x00\x00\x00\x00\x00\x00"
211 
212 /* HCI to MGMT error code conversion table */
213 static const u8 mgmt_status_table[] = {
214 	MGMT_STATUS_SUCCESS,
215 	MGMT_STATUS_UNKNOWN_COMMAND,	/* Unknown Command */
216 	MGMT_STATUS_NOT_CONNECTED,	/* No Connection */
217 	MGMT_STATUS_FAILED,		/* Hardware Failure */
218 	MGMT_STATUS_CONNECT_FAILED,	/* Page Timeout */
219 	MGMT_STATUS_AUTH_FAILED,	/* Authentication Failed */
220 	MGMT_STATUS_AUTH_FAILED,	/* PIN or Key Missing */
221 	MGMT_STATUS_NO_RESOURCES,	/* Memory Full */
222 	MGMT_STATUS_TIMEOUT,		/* Connection Timeout */
223 	MGMT_STATUS_NO_RESOURCES,	/* Max Number of Connections */
224 	MGMT_STATUS_NO_RESOURCES,	/* Max Number of SCO Connections */
225 	MGMT_STATUS_ALREADY_CONNECTED,	/* ACL Connection Exists */
226 	MGMT_STATUS_BUSY,		/* Command Disallowed */
227 	MGMT_STATUS_NO_RESOURCES,	/* Rejected Limited Resources */
228 	MGMT_STATUS_REJECTED,		/* Rejected Security */
229 	MGMT_STATUS_REJECTED,		/* Rejected Personal */
230 	MGMT_STATUS_TIMEOUT,		/* Host Timeout */
231 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Feature */
232 	MGMT_STATUS_INVALID_PARAMS,	/* Invalid Parameters */
233 	MGMT_STATUS_DISCONNECTED,	/* OE User Ended Connection */
234 	MGMT_STATUS_NO_RESOURCES,	/* OE Low Resources */
235 	MGMT_STATUS_DISCONNECTED,	/* OE Power Off */
236 	MGMT_STATUS_DISCONNECTED,	/* Connection Terminated */
237 	MGMT_STATUS_BUSY,		/* Repeated Attempts */
238 	MGMT_STATUS_REJECTED,		/* Pairing Not Allowed */
239 	MGMT_STATUS_FAILED,		/* Unknown LMP PDU */
240 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Remote Feature */
241 	MGMT_STATUS_REJECTED,		/* SCO Offset Rejected */
242 	MGMT_STATUS_REJECTED,		/* SCO Interval Rejected */
243 	MGMT_STATUS_REJECTED,		/* Air Mode Rejected */
244 	MGMT_STATUS_INVALID_PARAMS,	/* Invalid LMP Parameters */
245 	MGMT_STATUS_FAILED,		/* Unspecified Error */
246 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported LMP Parameter Value */
247 	MGMT_STATUS_FAILED,		/* Role Change Not Allowed */
248 	MGMT_STATUS_TIMEOUT,		/* LMP Response Timeout */
249 	MGMT_STATUS_FAILED,		/* LMP Error Transaction Collision */
250 	MGMT_STATUS_FAILED,		/* LMP PDU Not Allowed */
251 	MGMT_STATUS_REJECTED,		/* Encryption Mode Not Accepted */
252 	MGMT_STATUS_FAILED,		/* Unit Link Key Used */
253 	MGMT_STATUS_NOT_SUPPORTED,	/* QoS Not Supported */
254 	MGMT_STATUS_TIMEOUT,		/* Instant Passed */
255 	MGMT_STATUS_NOT_SUPPORTED,	/* Pairing Not Supported */
256 	MGMT_STATUS_FAILED,		/* Transaction Collision */
257 	MGMT_STATUS_FAILED,		/* Reserved for future use */
258 	MGMT_STATUS_INVALID_PARAMS,	/* Unacceptable Parameter */
259 	MGMT_STATUS_REJECTED,		/* QoS Rejected */
260 	MGMT_STATUS_NOT_SUPPORTED,	/* Classification Not Supported */
261 	MGMT_STATUS_REJECTED,		/* Insufficient Security */
262 	MGMT_STATUS_INVALID_PARAMS,	/* Parameter Out Of Range */
263 	MGMT_STATUS_FAILED,		/* Reserved for future use */
264 	MGMT_STATUS_BUSY,		/* Role Switch Pending */
265 	MGMT_STATUS_FAILED,		/* Reserved for future use */
266 	MGMT_STATUS_FAILED,		/* Slot Violation */
267 	MGMT_STATUS_FAILED,		/* Role Switch Failed */
268 	MGMT_STATUS_INVALID_PARAMS,	/* EIR Too Large */
269 	MGMT_STATUS_NOT_SUPPORTED,	/* Simple Pairing Not Supported */
270 	MGMT_STATUS_BUSY,		/* Host Busy Pairing */
271 	MGMT_STATUS_REJECTED,		/* Rejected, No Suitable Channel */
272 	MGMT_STATUS_BUSY,		/* Controller Busy */
273 	MGMT_STATUS_INVALID_PARAMS,	/* Unsuitable Connection Interval */
274 	MGMT_STATUS_TIMEOUT,		/* Directed Advertising Timeout */
275 	MGMT_STATUS_AUTH_FAILED,	/* Terminated Due to MIC Failure */
276 	MGMT_STATUS_CONNECT_FAILED,	/* Connection Establishment Failed */
277 	MGMT_STATUS_CONNECT_FAILED,	/* MAC Connection Failed */
278 };
279 
280 static u8 mgmt_errno_status(int err)
281 {
282 	switch (err) {
283 	case 0:
284 		return MGMT_STATUS_SUCCESS;
285 	case -EPERM:
286 		return MGMT_STATUS_REJECTED;
287 	case -EINVAL:
288 		return MGMT_STATUS_INVALID_PARAMS;
289 	case -EOPNOTSUPP:
290 		return MGMT_STATUS_NOT_SUPPORTED;
291 	case -EBUSY:
292 		return MGMT_STATUS_BUSY;
293 	case -ETIMEDOUT:
294 		return MGMT_STATUS_AUTH_FAILED;
295 	case -ENOMEM:
296 		return MGMT_STATUS_NO_RESOURCES;
297 	case -EISCONN:
298 		return MGMT_STATUS_ALREADY_CONNECTED;
299 	case -ENOTCONN:
300 		return MGMT_STATUS_DISCONNECTED;
301 	}
302 
303 	return MGMT_STATUS_FAILED;
304 }
305 
306 static u8 mgmt_status(int err)
307 {
308 	if (err < 0)
309 		return mgmt_errno_status(err);
310 
311 	if (err < ARRAY_SIZE(mgmt_status_table))
312 		return mgmt_status_table[err];
313 
314 	return MGMT_STATUS_FAILED;
315 }
316 
317 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
318 			    u16 len, int flag)
319 {
320 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
321 			       flag, NULL);
322 }
323 
324 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
325 			      u16 len, int flag, struct sock *skip_sk)
326 {
327 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
328 			       flag, skip_sk);
329 }
330 
331 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
332 		      struct sock *skip_sk)
333 {
334 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
335 			       HCI_SOCK_TRUSTED, skip_sk);
336 }
337 
338 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
339 {
340 	return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
341 				   skip_sk);
342 }
343 
344 static u8 le_addr_type(u8 mgmt_addr_type)
345 {
346 	if (mgmt_addr_type == BDADDR_LE_PUBLIC)
347 		return ADDR_LE_DEV_PUBLIC;
348 	else
349 		return ADDR_LE_DEV_RANDOM;
350 }
351 
352 void mgmt_fill_version_info(void *ver)
353 {
354 	struct mgmt_rp_read_version *rp = ver;
355 
356 	rp->version = MGMT_VERSION;
357 	rp->revision = cpu_to_le16(MGMT_REVISION);
358 }
359 
360 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
361 			u16 data_len)
362 {
363 	struct mgmt_rp_read_version rp;
364 
365 	bt_dev_dbg(hdev, "sock %p", sk);
366 
367 	mgmt_fill_version_info(&rp);
368 
369 	return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
370 				 &rp, sizeof(rp));
371 }
372 
373 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
374 			 u16 data_len)
375 {
376 	struct mgmt_rp_read_commands *rp;
377 	u16 num_commands, num_events;
378 	size_t rp_size;
379 	int i, err;
380 
381 	bt_dev_dbg(hdev, "sock %p", sk);
382 
383 	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
384 		num_commands = ARRAY_SIZE(mgmt_commands);
385 		num_events = ARRAY_SIZE(mgmt_events);
386 	} else {
387 		num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
388 		num_events = ARRAY_SIZE(mgmt_untrusted_events);
389 	}
390 
391 	rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
392 
393 	rp = kmalloc(rp_size, GFP_KERNEL);
394 	if (!rp)
395 		return -ENOMEM;
396 
397 	rp->num_commands = cpu_to_le16(num_commands);
398 	rp->num_events = cpu_to_le16(num_events);
399 
400 	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
401 		__le16 *opcode = rp->opcodes;
402 
403 		for (i = 0; i < num_commands; i++, opcode++)
404 			put_unaligned_le16(mgmt_commands[i], opcode);
405 
406 		for (i = 0; i < num_events; i++, opcode++)
407 			put_unaligned_le16(mgmt_events[i], opcode);
408 	} else {
409 		__le16 *opcode = rp->opcodes;
410 
411 		for (i = 0; i < num_commands; i++, opcode++)
412 			put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
413 
414 		for (i = 0; i < num_events; i++, opcode++)
415 			put_unaligned_le16(mgmt_untrusted_events[i], opcode);
416 	}
417 
418 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
419 				rp, rp_size);
420 	kfree(rp);
421 
422 	return err;
423 }
424 
425 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
426 			   u16 data_len)
427 {
428 	struct mgmt_rp_read_index_list *rp;
429 	struct hci_dev *d;
430 	size_t rp_len;
431 	u16 count;
432 	int err;
433 
434 	bt_dev_dbg(hdev, "sock %p", sk);
435 
436 	read_lock(&hci_dev_list_lock);
437 
438 	count = 0;
439 	list_for_each_entry(d, &hci_dev_list, list) {
440 		if (d->dev_type == HCI_PRIMARY &&
441 		    !hci_dev_test_flag(d, HCI_UNCONFIGURED))
442 			count++;
443 	}
444 
445 	rp_len = sizeof(*rp) + (2 * count);
446 	rp = kmalloc(rp_len, GFP_ATOMIC);
447 	if (!rp) {
448 		read_unlock(&hci_dev_list_lock);
449 		return -ENOMEM;
450 	}
451 
452 	count = 0;
453 	list_for_each_entry(d, &hci_dev_list, list) {
454 		if (hci_dev_test_flag(d, HCI_SETUP) ||
455 		    hci_dev_test_flag(d, HCI_CONFIG) ||
456 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
457 			continue;
458 
459 		/* Devices marked as raw-only are neither configured
460 		 * nor unconfigured controllers.
461 		 */
462 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
463 			continue;
464 
465 		if (d->dev_type == HCI_PRIMARY &&
466 		    !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
467 			rp->index[count++] = cpu_to_le16(d->id);
468 			bt_dev_dbg(hdev, "Added hci%u", d->id);
469 		}
470 	}
471 
472 	rp->num_controllers = cpu_to_le16(count);
473 	rp_len = sizeof(*rp) + (2 * count);
474 
475 	read_unlock(&hci_dev_list_lock);
476 
477 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
478 				0, rp, rp_len);
479 
480 	kfree(rp);
481 
482 	return err;
483 }
484 
485 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
486 				  void *data, u16 data_len)
487 {
488 	struct mgmt_rp_read_unconf_index_list *rp;
489 	struct hci_dev *d;
490 	size_t rp_len;
491 	u16 count;
492 	int err;
493 
494 	bt_dev_dbg(hdev, "sock %p", sk);
495 
496 	read_lock(&hci_dev_list_lock);
497 
498 	count = 0;
499 	list_for_each_entry(d, &hci_dev_list, list) {
500 		if (d->dev_type == HCI_PRIMARY &&
501 		    hci_dev_test_flag(d, HCI_UNCONFIGURED))
502 			count++;
503 	}
504 
505 	rp_len = sizeof(*rp) + (2 * count);
506 	rp = kmalloc(rp_len, GFP_ATOMIC);
507 	if (!rp) {
508 		read_unlock(&hci_dev_list_lock);
509 		return -ENOMEM;
510 	}
511 
512 	count = 0;
513 	list_for_each_entry(d, &hci_dev_list, list) {
514 		if (hci_dev_test_flag(d, HCI_SETUP) ||
515 		    hci_dev_test_flag(d, HCI_CONFIG) ||
516 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
517 			continue;
518 
519 		/* Devices marked as raw-only are neither configured
520 		 * nor unconfigured controllers.
521 		 */
522 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
523 			continue;
524 
525 		if (d->dev_type == HCI_PRIMARY &&
526 		    hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
527 			rp->index[count++] = cpu_to_le16(d->id);
528 			bt_dev_dbg(hdev, "Added hci%u", d->id);
529 		}
530 	}
531 
532 	rp->num_controllers = cpu_to_le16(count);
533 	rp_len = sizeof(*rp) + (2 * count);
534 
535 	read_unlock(&hci_dev_list_lock);
536 
537 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
538 				MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
539 
540 	kfree(rp);
541 
542 	return err;
543 }
544 
545 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
546 			       void *data, u16 data_len)
547 {
548 	struct mgmt_rp_read_ext_index_list *rp;
549 	struct hci_dev *d;
550 	u16 count;
551 	int err;
552 
553 	bt_dev_dbg(hdev, "sock %p", sk);
554 
555 	read_lock(&hci_dev_list_lock);
556 
557 	count = 0;
558 	list_for_each_entry(d, &hci_dev_list, list) {
559 		if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
560 			count++;
561 	}
562 
563 	rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
564 	if (!rp) {
565 		read_unlock(&hci_dev_list_lock);
566 		return -ENOMEM;
567 	}
568 
569 	count = 0;
570 	list_for_each_entry(d, &hci_dev_list, list) {
571 		if (hci_dev_test_flag(d, HCI_SETUP) ||
572 		    hci_dev_test_flag(d, HCI_CONFIG) ||
573 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
574 			continue;
575 
576 		/* Devices marked as raw-only are neither configured
577 		 * nor unconfigured controllers.
578 		 */
579 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
580 			continue;
581 
582 		if (d->dev_type == HCI_PRIMARY) {
583 			if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
584 				rp->entry[count].type = 0x01;
585 			else
586 				rp->entry[count].type = 0x00;
587 		} else if (d->dev_type == HCI_AMP) {
588 			rp->entry[count].type = 0x02;
589 		} else {
590 			continue;
591 		}
592 
593 		rp->entry[count].bus = d->bus;
594 		rp->entry[count++].index = cpu_to_le16(d->id);
595 		bt_dev_dbg(hdev, "Added hci%u", d->id);
596 	}
597 
598 	rp->num_controllers = cpu_to_le16(count);
599 
600 	read_unlock(&hci_dev_list_lock);
601 
602 	/* If this command is called at least once, then all the
603 	 * default index and unconfigured index events are disabled
604 	 * and from now on only extended index events are used.
605 	 */
606 	hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
607 	hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
608 	hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
609 
610 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
611 				MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
612 				struct_size(rp, entry, count));
613 
614 	kfree(rp);
615 
616 	return err;
617 }
618 
619 static bool is_configured(struct hci_dev *hdev)
620 {
621 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
622 	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
623 		return false;
624 
625 	if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
626 	     test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
627 	    !bacmp(&hdev->public_addr, BDADDR_ANY))
628 		return false;
629 
630 	return true;
631 }
632 
633 static __le32 get_missing_options(struct hci_dev *hdev)
634 {
635 	u32 options = 0;
636 
637 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
638 	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
639 		options |= MGMT_OPTION_EXTERNAL_CONFIG;
640 
641 	if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
642 	     test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
643 	    !bacmp(&hdev->public_addr, BDADDR_ANY))
644 		options |= MGMT_OPTION_PUBLIC_ADDRESS;
645 
646 	return cpu_to_le32(options);
647 }
648 
649 static int new_options(struct hci_dev *hdev, struct sock *skip)
650 {
651 	__le32 options = get_missing_options(hdev);
652 
653 	return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
654 				  sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
655 }
656 
657 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
658 {
659 	__le32 options = get_missing_options(hdev);
660 
661 	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
662 				 sizeof(options));
663 }
664 
665 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
666 			    void *data, u16 data_len)
667 {
668 	struct mgmt_rp_read_config_info rp;
669 	u32 options = 0;
670 
671 	bt_dev_dbg(hdev, "sock %p", sk);
672 
673 	hci_dev_lock(hdev);
674 
675 	memset(&rp, 0, sizeof(rp));
676 	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
677 
678 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
679 		options |= MGMT_OPTION_EXTERNAL_CONFIG;
680 
681 	if (hdev->set_bdaddr)
682 		options |= MGMT_OPTION_PUBLIC_ADDRESS;
683 
684 	rp.supported_options = cpu_to_le32(options);
685 	rp.missing_options = get_missing_options(hdev);
686 
687 	hci_dev_unlock(hdev);
688 
689 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
690 				 &rp, sizeof(rp));
691 }
692 
693 static u32 get_supported_phys(struct hci_dev *hdev)
694 {
695 	u32 supported_phys = 0;
696 
697 	if (lmp_bredr_capable(hdev)) {
698 		supported_phys |= MGMT_PHY_BR_1M_1SLOT;
699 
700 		if (hdev->features[0][0] & LMP_3SLOT)
701 			supported_phys |= MGMT_PHY_BR_1M_3SLOT;
702 
703 		if (hdev->features[0][0] & LMP_5SLOT)
704 			supported_phys |= MGMT_PHY_BR_1M_5SLOT;
705 
706 		if (lmp_edr_2m_capable(hdev)) {
707 			supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
708 
709 			if (lmp_edr_3slot_capable(hdev))
710 				supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
711 
712 			if (lmp_edr_5slot_capable(hdev))
713 				supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
714 
715 			if (lmp_edr_3m_capable(hdev)) {
716 				supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
717 
718 				if (lmp_edr_3slot_capable(hdev))
719 					supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
720 
721 				if (lmp_edr_5slot_capable(hdev))
722 					supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
723 			}
724 		}
725 	}
726 
727 	if (lmp_le_capable(hdev)) {
728 		supported_phys |= MGMT_PHY_LE_1M_TX;
729 		supported_phys |= MGMT_PHY_LE_1M_RX;
730 
731 		if (hdev->le_features[1] & HCI_LE_PHY_2M) {
732 			supported_phys |= MGMT_PHY_LE_2M_TX;
733 			supported_phys |= MGMT_PHY_LE_2M_RX;
734 		}
735 
736 		if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
737 			supported_phys |= MGMT_PHY_LE_CODED_TX;
738 			supported_phys |= MGMT_PHY_LE_CODED_RX;
739 		}
740 	}
741 
742 	return supported_phys;
743 }
744 
745 static u32 get_selected_phys(struct hci_dev *hdev)
746 {
747 	u32 selected_phys = 0;
748 
749 	if (lmp_bredr_capable(hdev)) {
750 		selected_phys |= MGMT_PHY_BR_1M_1SLOT;
751 
752 		if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
753 			selected_phys |= MGMT_PHY_BR_1M_3SLOT;
754 
755 		if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
756 			selected_phys |= MGMT_PHY_BR_1M_5SLOT;
757 
758 		if (lmp_edr_2m_capable(hdev)) {
759 			if (!(hdev->pkt_type & HCI_2DH1))
760 				selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
761 
762 			if (lmp_edr_3slot_capable(hdev) &&
763 			    !(hdev->pkt_type & HCI_2DH3))
764 				selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
765 
766 			if (lmp_edr_5slot_capable(hdev) &&
767 			    !(hdev->pkt_type & HCI_2DH5))
768 				selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
769 
770 			if (lmp_edr_3m_capable(hdev)) {
771 				if (!(hdev->pkt_type & HCI_3DH1))
772 					selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
773 
774 				if (lmp_edr_3slot_capable(hdev) &&
775 				    !(hdev->pkt_type & HCI_3DH3))
776 					selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
777 
778 				if (lmp_edr_5slot_capable(hdev) &&
779 				    !(hdev->pkt_type & HCI_3DH5))
780 					selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
781 			}
782 		}
783 	}
784 
785 	if (lmp_le_capable(hdev)) {
786 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
787 			selected_phys |= MGMT_PHY_LE_1M_TX;
788 
789 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
790 			selected_phys |= MGMT_PHY_LE_1M_RX;
791 
792 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
793 			selected_phys |= MGMT_PHY_LE_2M_TX;
794 
795 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
796 			selected_phys |= MGMT_PHY_LE_2M_RX;
797 
798 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
799 			selected_phys |= MGMT_PHY_LE_CODED_TX;
800 
801 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
802 			selected_phys |= MGMT_PHY_LE_CODED_RX;
803 	}
804 
805 	return selected_phys;
806 }
807 
808 static u32 get_configurable_phys(struct hci_dev *hdev)
809 {
810 	return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
811 		~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
812 }
813 
814 static u32 get_supported_settings(struct hci_dev *hdev)
815 {
816 	u32 settings = 0;
817 
818 	settings |= MGMT_SETTING_POWERED;
819 	settings |= MGMT_SETTING_BONDABLE;
820 	settings |= MGMT_SETTING_DEBUG_KEYS;
821 	settings |= MGMT_SETTING_CONNECTABLE;
822 	settings |= MGMT_SETTING_DISCOVERABLE;
823 
824 	if (lmp_bredr_capable(hdev)) {
825 		if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
826 			settings |= MGMT_SETTING_FAST_CONNECTABLE;
827 		settings |= MGMT_SETTING_BREDR;
828 		settings |= MGMT_SETTING_LINK_SECURITY;
829 
830 		if (lmp_ssp_capable(hdev)) {
831 			settings |= MGMT_SETTING_SSP;
832 			if (IS_ENABLED(CONFIG_BT_HS))
833 				settings |= MGMT_SETTING_HS;
834 		}
835 
836 		if (lmp_sc_capable(hdev))
837 			settings |= MGMT_SETTING_SECURE_CONN;
838 
839 		if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
840 			     &hdev->quirks))
841 			settings |= MGMT_SETTING_WIDEBAND_SPEECH;
842 	}
843 
844 	if (lmp_le_capable(hdev)) {
845 		settings |= MGMT_SETTING_LE;
846 		settings |= MGMT_SETTING_SECURE_CONN;
847 		settings |= MGMT_SETTING_PRIVACY;
848 		settings |= MGMT_SETTING_STATIC_ADDRESS;
849 		settings |= MGMT_SETTING_ADVERTISING;
850 	}
851 
852 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
853 	    hdev->set_bdaddr)
854 		settings |= MGMT_SETTING_CONFIGURATION;
855 
856 	settings |= MGMT_SETTING_PHY_CONFIGURATION;
857 
858 	return settings;
859 }
860 
861 static u32 get_current_settings(struct hci_dev *hdev)
862 {
863 	u32 settings = 0;
864 
865 	if (hdev_is_powered(hdev))
866 		settings |= MGMT_SETTING_POWERED;
867 
868 	if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
869 		settings |= MGMT_SETTING_CONNECTABLE;
870 
871 	if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
872 		settings |= MGMT_SETTING_FAST_CONNECTABLE;
873 
874 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
875 		settings |= MGMT_SETTING_DISCOVERABLE;
876 
877 	if (hci_dev_test_flag(hdev, HCI_BONDABLE))
878 		settings |= MGMT_SETTING_BONDABLE;
879 
880 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
881 		settings |= MGMT_SETTING_BREDR;
882 
883 	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
884 		settings |= MGMT_SETTING_LE;
885 
886 	if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
887 		settings |= MGMT_SETTING_LINK_SECURITY;
888 
889 	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890 		settings |= MGMT_SETTING_SSP;
891 
892 	if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
893 		settings |= MGMT_SETTING_HS;
894 
895 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
896 		settings |= MGMT_SETTING_ADVERTISING;
897 
898 	if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
899 		settings |= MGMT_SETTING_SECURE_CONN;
900 
901 	if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
902 		settings |= MGMT_SETTING_DEBUG_KEYS;
903 
904 	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
905 		settings |= MGMT_SETTING_PRIVACY;
906 
907 	/* The current setting for static address has two purposes. The
908 	 * first is to indicate if the static address will be used and
909 	 * the second is to indicate if it is actually set.
910 	 *
911 	 * This means if the static address is not configured, this flag
912 	 * will never be set. If the address is configured, then if the
913 	 * address is actually used decides if the flag is set or not.
914 	 *
915 	 * For single mode LE only controllers and dual-mode controllers
916 	 * with BR/EDR disabled, the existence of the static address will
917 	 * be evaluated.
918 	 */
919 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
920 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
921 	    !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
922 		if (bacmp(&hdev->static_addr, BDADDR_ANY))
923 			settings |= MGMT_SETTING_STATIC_ADDRESS;
924 	}
925 
926 	if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
927 		settings |= MGMT_SETTING_WIDEBAND_SPEECH;
928 
929 	return settings;
930 }
931 
932 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
933 {
934 	return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
935 }
936 
937 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
938 {
939 	struct mgmt_pending_cmd *cmd;
940 
941 	/* If there's a pending mgmt command the flags will not yet have
942 	 * their final values, so check for this first.
943 	 */
944 	cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
945 	if (cmd) {
946 		struct mgmt_mode *cp = cmd->param;
947 		if (cp->val == 0x01)
948 			return LE_AD_GENERAL;
949 		else if (cp->val == 0x02)
950 			return LE_AD_LIMITED;
951 	} else {
952 		if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
953 			return LE_AD_LIMITED;
954 		else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
955 			return LE_AD_GENERAL;
956 	}
957 
958 	return 0;
959 }
960 
961 bool mgmt_get_connectable(struct hci_dev *hdev)
962 {
963 	struct mgmt_pending_cmd *cmd;
964 
965 	/* If there's a pending mgmt command the flag will not yet have
966 	 * it's final value, so check for this first.
967 	 */
968 	cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
969 	if (cmd) {
970 		struct mgmt_mode *cp = cmd->param;
971 
972 		return cp->val;
973 	}
974 
975 	return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
976 }
977 
978 static int service_cache_sync(struct hci_dev *hdev, void *data)
979 {
980 	hci_update_eir_sync(hdev);
981 	hci_update_class_sync(hdev);
982 
983 	return 0;
984 }
985 
986 static void service_cache_off(struct work_struct *work)
987 {
988 	struct hci_dev *hdev = container_of(work, struct hci_dev,
989 					    service_cache.work);
990 
991 	if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
992 		return;
993 
994 	hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
995 }
996 
997 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
998 {
999 	/* The generation of a new RPA and programming it into the
1000 	 * controller happens in the hci_req_enable_advertising()
1001 	 * function.
1002 	 */
1003 	if (ext_adv_capable(hdev))
1004 		return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1005 	else
1006 		return hci_enable_advertising_sync(hdev);
1007 }
1008 
1009 static void rpa_expired(struct work_struct *work)
1010 {
1011 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1012 					    rpa_expired.work);
1013 
1014 	bt_dev_dbg(hdev, "");
1015 
1016 	hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1017 
1018 	if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1019 		return;
1020 
1021 	hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1022 }
1023 
1024 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1025 {
1026 	if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1027 		return;
1028 
1029 	INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1030 	INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1031 
1032 	/* Non-mgmt controlled devices get this bit set
1033 	 * implicitly so that pairing works for them, however
1034 	 * for mgmt we require user-space to explicitly enable
1035 	 * it
1036 	 */
1037 	hci_dev_clear_flag(hdev, HCI_BONDABLE);
1038 }
1039 
1040 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1041 				void *data, u16 data_len)
1042 {
1043 	struct mgmt_rp_read_info rp;
1044 
1045 	bt_dev_dbg(hdev, "sock %p", sk);
1046 
1047 	hci_dev_lock(hdev);
1048 
1049 	memset(&rp, 0, sizeof(rp));
1050 
1051 	bacpy(&rp.bdaddr, &hdev->bdaddr);
1052 
1053 	rp.version = hdev->hci_ver;
1054 	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1055 
1056 	rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1057 	rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1058 
1059 	memcpy(rp.dev_class, hdev->dev_class, 3);
1060 
1061 	memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1062 	memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1063 
1064 	hci_dev_unlock(hdev);
1065 
1066 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1067 				 sizeof(rp));
1068 }
1069 
1070 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1071 {
1072 	u16 eir_len = 0;
1073 	size_t name_len;
1074 
1075 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1076 		eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1077 					  hdev->dev_class, 3);
1078 
1079 	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1080 		eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1081 					  hdev->appearance);
1082 
1083 	name_len = strlen(hdev->dev_name);
1084 	eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1085 				  hdev->dev_name, name_len);
1086 
1087 	name_len = strlen(hdev->short_name);
1088 	eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1089 				  hdev->short_name, name_len);
1090 
1091 	return eir_len;
1092 }
1093 
1094 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1095 				    void *data, u16 data_len)
1096 {
1097 	char buf[512];
1098 	struct mgmt_rp_read_ext_info *rp = (void *)buf;
1099 	u16 eir_len;
1100 
1101 	bt_dev_dbg(hdev, "sock %p", sk);
1102 
1103 	memset(&buf, 0, sizeof(buf));
1104 
1105 	hci_dev_lock(hdev);
1106 
1107 	bacpy(&rp->bdaddr, &hdev->bdaddr);
1108 
1109 	rp->version = hdev->hci_ver;
1110 	rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1111 
1112 	rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1113 	rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1114 
1115 
1116 	eir_len = append_eir_data_to_buf(hdev, rp->eir);
1117 	rp->eir_len = cpu_to_le16(eir_len);
1118 
1119 	hci_dev_unlock(hdev);
1120 
1121 	/* If this command is called at least once, then the events
1122 	 * for class of device and local name changes are disabled
1123 	 * and only the new extended controller information event
1124 	 * is used.
1125 	 */
1126 	hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1127 	hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1128 	hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1129 
1130 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1131 				 sizeof(*rp) + eir_len);
1132 }
1133 
1134 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1135 {
1136 	char buf[512];
1137 	struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1138 	u16 eir_len;
1139 
1140 	memset(buf, 0, sizeof(buf));
1141 
1142 	eir_len = append_eir_data_to_buf(hdev, ev->eir);
1143 	ev->eir_len = cpu_to_le16(eir_len);
1144 
1145 	return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1146 				  sizeof(*ev) + eir_len,
1147 				  HCI_MGMT_EXT_INFO_EVENTS, skip);
1148 }
1149 
1150 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1151 {
1152 	__le32 settings = cpu_to_le32(get_current_settings(hdev));
1153 
1154 	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1155 				 sizeof(settings));
1156 }
1157 
1158 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1159 {
1160 	struct mgmt_ev_advertising_added ev;
1161 
1162 	ev.instance = instance;
1163 
1164 	mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1165 }
1166 
1167 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1168 			      u8 instance)
1169 {
1170 	struct mgmt_ev_advertising_removed ev;
1171 
1172 	ev.instance = instance;
1173 
1174 	mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1175 }
1176 
1177 static void cancel_adv_timeout(struct hci_dev *hdev)
1178 {
1179 	if (hdev->adv_instance_timeout) {
1180 		hdev->adv_instance_timeout = 0;
1181 		cancel_delayed_work(&hdev->adv_instance_expire);
1182 	}
1183 }
1184 
1185 /* This function requires the caller holds hdev->lock */
1186 static void restart_le_actions(struct hci_dev *hdev)
1187 {
1188 	struct hci_conn_params *p;
1189 
1190 	list_for_each_entry(p, &hdev->le_conn_params, list) {
1191 		/* Needed for AUTO_OFF case where might not "really"
1192 		 * have been powered off.
1193 		 */
1194 		list_del_init(&p->action);
1195 
1196 		switch (p->auto_connect) {
1197 		case HCI_AUTO_CONN_DIRECT:
1198 		case HCI_AUTO_CONN_ALWAYS:
1199 			list_add(&p->action, &hdev->pend_le_conns);
1200 			break;
1201 		case HCI_AUTO_CONN_REPORT:
1202 			list_add(&p->action, &hdev->pend_le_reports);
1203 			break;
1204 		default:
1205 			break;
1206 		}
1207 	}
1208 }
1209 
1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212 	__le32 ev = cpu_to_le32(get_current_settings(hdev));
1213 
1214 	return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215 				  sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217 
1218 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1219 {
1220 	struct mgmt_pending_cmd *cmd = data;
1221 	struct mgmt_mode *cp = cmd->param;
1222 
1223 	bt_dev_dbg(hdev, "err %d", err);
1224 
1225 	if (!err) {
1226 		if (cp->val) {
1227 			hci_dev_lock(hdev);
1228 			restart_le_actions(hdev);
1229 			hci_update_passive_scan(hdev);
1230 			hci_dev_unlock(hdev);
1231 		}
1232 
1233 		send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1234 
1235 		/* Only call new_setting for power on as power off is deferred
1236 		 * to hdev->power_off work which does call hci_dev_do_close.
1237 		 */
1238 		if (cp->val)
1239 			new_settings(hdev, cmd->sk);
1240 	} else {
1241 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1242 				mgmt_status(err));
1243 	}
1244 
1245 	mgmt_pending_free(cmd);
1246 }
1247 
1248 static int set_powered_sync(struct hci_dev *hdev, void *data)
1249 {
1250 	struct mgmt_pending_cmd *cmd = data;
1251 	struct mgmt_mode *cp = cmd->param;
1252 
1253 	BT_DBG("%s", hdev->name);
1254 
1255 	return hci_set_powered_sync(hdev, cp->val);
1256 }
1257 
1258 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1259 		       u16 len)
1260 {
1261 	struct mgmt_mode *cp = data;
1262 	struct mgmt_pending_cmd *cmd;
1263 	int err;
1264 
1265 	bt_dev_dbg(hdev, "sock %p", sk);
1266 
1267 	if (cp->val != 0x00 && cp->val != 0x01)
1268 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1269 				       MGMT_STATUS_INVALID_PARAMS);
1270 
1271 	hci_dev_lock(hdev);
1272 
1273 	if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1274 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1275 				      MGMT_STATUS_BUSY);
1276 		goto failed;
1277 	}
1278 
1279 	if (!!cp->val == hdev_is_powered(hdev)) {
1280 		err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1281 		goto failed;
1282 	}
1283 
1284 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1285 	if (!cmd) {
1286 		err = -ENOMEM;
1287 		goto failed;
1288 	}
1289 
1290 	err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1291 				 mgmt_set_powered_complete);
1292 
1293 failed:
1294 	hci_dev_unlock(hdev);
1295 	return err;
1296 }
1297 
1298 int mgmt_new_settings(struct hci_dev *hdev)
1299 {
1300 	return new_settings(hdev, NULL);
1301 }
1302 
1303 struct cmd_lookup {
1304 	struct sock *sk;
1305 	struct hci_dev *hdev;
1306 	u8 mgmt_status;
1307 };
1308 
1309 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1310 {
1311 	struct cmd_lookup *match = data;
1312 
1313 	send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1314 
1315 	list_del(&cmd->list);
1316 
1317 	if (match->sk == NULL) {
1318 		match->sk = cmd->sk;
1319 		sock_hold(match->sk);
1320 	}
1321 
1322 	mgmt_pending_free(cmd);
1323 }
1324 
1325 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1326 {
1327 	u8 *status = data;
1328 
1329 	mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1330 	mgmt_pending_remove(cmd);
1331 }
1332 
1333 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1334 {
1335 	if (cmd->cmd_complete) {
1336 		u8 *status = data;
1337 
1338 		cmd->cmd_complete(cmd, *status);
1339 		mgmt_pending_remove(cmd);
1340 
1341 		return;
1342 	}
1343 
1344 	cmd_status_rsp(cmd, data);
1345 }
1346 
1347 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1348 {
1349 	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1350 				 cmd->param, cmd->param_len);
1351 }
1352 
1353 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1354 {
1355 	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1356 				 cmd->param, sizeof(struct mgmt_addr_info));
1357 }
1358 
1359 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1360 {
1361 	if (!lmp_bredr_capable(hdev))
1362 		return MGMT_STATUS_NOT_SUPPORTED;
1363 	else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1364 		return MGMT_STATUS_REJECTED;
1365 	else
1366 		return MGMT_STATUS_SUCCESS;
1367 }
1368 
1369 static u8 mgmt_le_support(struct hci_dev *hdev)
1370 {
1371 	if (!lmp_le_capable(hdev))
1372 		return MGMT_STATUS_NOT_SUPPORTED;
1373 	else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1374 		return MGMT_STATUS_REJECTED;
1375 	else
1376 		return MGMT_STATUS_SUCCESS;
1377 }
1378 
1379 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1380 					   int err)
1381 {
1382 	struct mgmt_pending_cmd *cmd = data;
1383 
1384 	bt_dev_dbg(hdev, "err %d", err);
1385 
1386 	hci_dev_lock(hdev);
1387 
1388 	if (err) {
1389 		u8 mgmt_err = mgmt_status(err);
1390 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1391 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1392 		goto done;
1393 	}
1394 
1395 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1396 	    hdev->discov_timeout > 0) {
1397 		int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1398 		queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1399 	}
1400 
1401 	send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1402 	new_settings(hdev, cmd->sk);
1403 
1404 done:
1405 	mgmt_pending_free(cmd);
1406 	hci_dev_unlock(hdev);
1407 }
1408 
1409 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1410 {
1411 	BT_DBG("%s", hdev->name);
1412 
1413 	return hci_update_discoverable_sync(hdev);
1414 }
1415 
1416 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1417 			    u16 len)
1418 {
1419 	struct mgmt_cp_set_discoverable *cp = data;
1420 	struct mgmt_pending_cmd *cmd;
1421 	u16 timeout;
1422 	int err;
1423 
1424 	bt_dev_dbg(hdev, "sock %p", sk);
1425 
1426 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1427 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1428 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1429 				       MGMT_STATUS_REJECTED);
1430 
1431 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1432 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433 				       MGMT_STATUS_INVALID_PARAMS);
1434 
1435 	timeout = __le16_to_cpu(cp->timeout);
1436 
1437 	/* Disabling discoverable requires that no timeout is set,
1438 	 * and enabling limited discoverable requires a timeout.
1439 	 */
1440 	if ((cp->val == 0x00 && timeout > 0) ||
1441 	    (cp->val == 0x02 && timeout == 0))
1442 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1443 				       MGMT_STATUS_INVALID_PARAMS);
1444 
1445 	hci_dev_lock(hdev);
1446 
1447 	if (!hdev_is_powered(hdev) && timeout > 0) {
1448 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1449 				      MGMT_STATUS_NOT_POWERED);
1450 		goto failed;
1451 	}
1452 
1453 	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1454 	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1455 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1456 				      MGMT_STATUS_BUSY);
1457 		goto failed;
1458 	}
1459 
1460 	if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1461 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1462 				      MGMT_STATUS_REJECTED);
1463 		goto failed;
1464 	}
1465 
1466 	if (hdev->advertising_paused) {
1467 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1468 				      MGMT_STATUS_BUSY);
1469 		goto failed;
1470 	}
1471 
1472 	if (!hdev_is_powered(hdev)) {
1473 		bool changed = false;
1474 
1475 		/* Setting limited discoverable when powered off is
1476 		 * not a valid operation since it requires a timeout
1477 		 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1478 		 */
1479 		if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1480 			hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1481 			changed = true;
1482 		}
1483 
1484 		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1485 		if (err < 0)
1486 			goto failed;
1487 
1488 		if (changed)
1489 			err = new_settings(hdev, sk);
1490 
1491 		goto failed;
1492 	}
1493 
1494 	/* If the current mode is the same, then just update the timeout
1495 	 * value with the new value. And if only the timeout gets updated,
1496 	 * then no need for any HCI transactions.
1497 	 */
1498 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1499 	    (cp->val == 0x02) == hci_dev_test_flag(hdev,
1500 						   HCI_LIMITED_DISCOVERABLE)) {
1501 		cancel_delayed_work(&hdev->discov_off);
1502 		hdev->discov_timeout = timeout;
1503 
1504 		if (cp->val && hdev->discov_timeout > 0) {
1505 			int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1506 			queue_delayed_work(hdev->req_workqueue,
1507 					   &hdev->discov_off, to);
1508 		}
1509 
1510 		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1511 		goto failed;
1512 	}
1513 
1514 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1515 	if (!cmd) {
1516 		err = -ENOMEM;
1517 		goto failed;
1518 	}
1519 
1520 	/* Cancel any potential discoverable timeout that might be
1521 	 * still active and store new timeout value. The arming of
1522 	 * the timeout happens in the complete handler.
1523 	 */
1524 	cancel_delayed_work(&hdev->discov_off);
1525 	hdev->discov_timeout = timeout;
1526 
1527 	if (cp->val)
1528 		hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1529 	else
1530 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1531 
1532 	/* Limited discoverable mode */
1533 	if (cp->val == 0x02)
1534 		hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1535 	else
1536 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1537 
1538 	err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1539 				 mgmt_set_discoverable_complete);
1540 
1541 failed:
1542 	hci_dev_unlock(hdev);
1543 	return err;
1544 }
1545 
1546 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1547 					  int err)
1548 {
1549 	struct mgmt_pending_cmd *cmd = data;
1550 
1551 	bt_dev_dbg(hdev, "err %d", err);
1552 
1553 	hci_dev_lock(hdev);
1554 
1555 	if (err) {
1556 		u8 mgmt_err = mgmt_status(err);
1557 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1558 		goto done;
1559 	}
1560 
1561 	send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562 	new_settings(hdev, cmd->sk);
1563 
1564 done:
1565 	mgmt_pending_free(cmd);
1566 	hci_dev_unlock(hdev);
1567 }
1568 
1569 static int set_connectable_update_settings(struct hci_dev *hdev,
1570 					   struct sock *sk, u8 val)
1571 {
1572 	bool changed = false;
1573 	int err;
1574 
1575 	if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1576 		changed = true;
1577 
1578 	if (val) {
1579 		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1580 	} else {
1581 		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1582 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1583 	}
1584 
1585 	err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1586 	if (err < 0)
1587 		return err;
1588 
1589 	if (changed) {
1590 		hci_req_update_scan(hdev);
1591 		hci_update_passive_scan(hdev);
1592 		return new_settings(hdev, sk);
1593 	}
1594 
1595 	return 0;
1596 }
1597 
1598 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1599 {
1600 	BT_DBG("%s", hdev->name);
1601 
1602 	return hci_update_connectable_sync(hdev);
1603 }
1604 
1605 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1606 			   u16 len)
1607 {
1608 	struct mgmt_mode *cp = data;
1609 	struct mgmt_pending_cmd *cmd;
1610 	int err;
1611 
1612 	bt_dev_dbg(hdev, "sock %p", sk);
1613 
1614 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1615 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1616 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1617 				       MGMT_STATUS_REJECTED);
1618 
1619 	if (cp->val != 0x00 && cp->val != 0x01)
1620 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1621 				       MGMT_STATUS_INVALID_PARAMS);
1622 
1623 	hci_dev_lock(hdev);
1624 
1625 	if (!hdev_is_powered(hdev)) {
1626 		err = set_connectable_update_settings(hdev, sk, cp->val);
1627 		goto failed;
1628 	}
1629 
1630 	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1631 	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1632 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1633 				      MGMT_STATUS_BUSY);
1634 		goto failed;
1635 	}
1636 
1637 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1638 	if (!cmd) {
1639 		err = -ENOMEM;
1640 		goto failed;
1641 	}
1642 
1643 	if (cp->val) {
1644 		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1645 	} else {
1646 		if (hdev->discov_timeout > 0)
1647 			cancel_delayed_work(&hdev->discov_off);
1648 
1649 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1650 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1651 		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1652 	}
1653 
1654 	err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1655 				 mgmt_set_connectable_complete);
1656 
1657 failed:
1658 	hci_dev_unlock(hdev);
1659 	return err;
1660 }
1661 
1662 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1663 			u16 len)
1664 {
1665 	struct mgmt_mode *cp = data;
1666 	bool changed;
1667 	int err;
1668 
1669 	bt_dev_dbg(hdev, "sock %p", sk);
1670 
1671 	if (cp->val != 0x00 && cp->val != 0x01)
1672 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1673 				       MGMT_STATUS_INVALID_PARAMS);
1674 
1675 	hci_dev_lock(hdev);
1676 
1677 	if (cp->val)
1678 		changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1679 	else
1680 		changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1681 
1682 	err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1683 	if (err < 0)
1684 		goto unlock;
1685 
1686 	if (changed) {
1687 		/* In limited privacy mode the change of bondable mode
1688 		 * may affect the local advertising address.
1689 		 */
1690 		hci_update_discoverable(hdev);
1691 
1692 		err = new_settings(hdev, sk);
1693 	}
1694 
1695 unlock:
1696 	hci_dev_unlock(hdev);
1697 	return err;
1698 }
1699 
1700 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1701 			     u16 len)
1702 {
1703 	struct mgmt_mode *cp = data;
1704 	struct mgmt_pending_cmd *cmd;
1705 	u8 val, status;
1706 	int err;
1707 
1708 	bt_dev_dbg(hdev, "sock %p", sk);
1709 
1710 	status = mgmt_bredr_support(hdev);
1711 	if (status)
1712 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1713 				       status);
1714 
1715 	if (cp->val != 0x00 && cp->val != 0x01)
1716 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1717 				       MGMT_STATUS_INVALID_PARAMS);
1718 
1719 	hci_dev_lock(hdev);
1720 
1721 	if (!hdev_is_powered(hdev)) {
1722 		bool changed = false;
1723 
1724 		if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1725 			hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1726 			changed = true;
1727 		}
1728 
1729 		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1730 		if (err < 0)
1731 			goto failed;
1732 
1733 		if (changed)
1734 			err = new_settings(hdev, sk);
1735 
1736 		goto failed;
1737 	}
1738 
1739 	if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1740 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1741 				      MGMT_STATUS_BUSY);
1742 		goto failed;
1743 	}
1744 
1745 	val = !!cp->val;
1746 
1747 	if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1748 		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1749 		goto failed;
1750 	}
1751 
1752 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1753 	if (!cmd) {
1754 		err = -ENOMEM;
1755 		goto failed;
1756 	}
1757 
1758 	err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1759 	if (err < 0) {
1760 		mgmt_pending_remove(cmd);
1761 		goto failed;
1762 	}
1763 
1764 failed:
1765 	hci_dev_unlock(hdev);
1766 	return err;
1767 }
1768 
1769 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1770 {
1771 	struct cmd_lookup match = { NULL, hdev };
1772 	struct mgmt_pending_cmd *cmd = data;
1773 	struct mgmt_mode *cp = cmd->param;
1774 	u8 enable = cp->val;
1775 	bool changed;
1776 
1777 	if (err) {
1778 		u8 mgmt_err = mgmt_status(err);
1779 
1780 		if (enable && hci_dev_test_and_clear_flag(hdev,
1781 							  HCI_SSP_ENABLED)) {
1782 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1783 			new_settings(hdev, NULL);
1784 		}
1785 
1786 		mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1787 				     &mgmt_err);
1788 		return;
1789 	}
1790 
1791 	if (enable) {
1792 		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1793 	} else {
1794 		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1795 
1796 		if (!changed)
1797 			changed = hci_dev_test_and_clear_flag(hdev,
1798 							      HCI_HS_ENABLED);
1799 		else
1800 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1801 	}
1802 
1803 	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1804 
1805 	if (changed)
1806 		new_settings(hdev, match.sk);
1807 
1808 	if (match.sk)
1809 		sock_put(match.sk);
1810 
1811 	hci_update_eir_sync(hdev);
1812 }
1813 
1814 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1815 {
1816 	struct mgmt_pending_cmd *cmd = data;
1817 	struct mgmt_mode *cp = cmd->param;
1818 	bool changed = false;
1819 	int err;
1820 
1821 	if (cp->val)
1822 		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1823 
1824 	err = hci_write_ssp_mode_sync(hdev, cp->val);
1825 
1826 	if (!err && changed)
1827 		hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1828 
1829 	return err;
1830 }
1831 
1832 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1833 {
1834 	struct mgmt_mode *cp = data;
1835 	struct mgmt_pending_cmd *cmd;
1836 	u8 status;
1837 	int err;
1838 
1839 	bt_dev_dbg(hdev, "sock %p", sk);
1840 
1841 	status = mgmt_bredr_support(hdev);
1842 	if (status)
1843 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1844 
1845 	if (!lmp_ssp_capable(hdev))
1846 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1847 				       MGMT_STATUS_NOT_SUPPORTED);
1848 
1849 	if (cp->val != 0x00 && cp->val != 0x01)
1850 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1851 				       MGMT_STATUS_INVALID_PARAMS);
1852 
1853 	hci_dev_lock(hdev);
1854 
1855 	if (!hdev_is_powered(hdev)) {
1856 		bool changed;
1857 
1858 		if (cp->val) {
1859 			changed = !hci_dev_test_and_set_flag(hdev,
1860 							     HCI_SSP_ENABLED);
1861 		} else {
1862 			changed = hci_dev_test_and_clear_flag(hdev,
1863 							      HCI_SSP_ENABLED);
1864 			if (!changed)
1865 				changed = hci_dev_test_and_clear_flag(hdev,
1866 								      HCI_HS_ENABLED);
1867 			else
1868 				hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1869 		}
1870 
1871 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1872 		if (err < 0)
1873 			goto failed;
1874 
1875 		if (changed)
1876 			err = new_settings(hdev, sk);
1877 
1878 		goto failed;
1879 	}
1880 
1881 	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1882 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1883 				      MGMT_STATUS_BUSY);
1884 		goto failed;
1885 	}
1886 
1887 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1888 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1889 		goto failed;
1890 	}
1891 
1892 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1893 	if (!cmd)
1894 		err = -ENOMEM;
1895 	else
1896 		err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
1897 					 set_ssp_complete);
1898 
1899 	if (err < 0) {
1900 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1901 				      MGMT_STATUS_FAILED);
1902 
1903 		if (cmd)
1904 			mgmt_pending_remove(cmd);
1905 	}
1906 
1907 failed:
1908 	hci_dev_unlock(hdev);
1909 	return err;
1910 }
1911 
1912 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1913 {
1914 	struct mgmt_mode *cp = data;
1915 	bool changed;
1916 	u8 status;
1917 	int err;
1918 
1919 	bt_dev_dbg(hdev, "sock %p", sk);
1920 
1921 	if (!IS_ENABLED(CONFIG_BT_HS))
1922 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1923 				       MGMT_STATUS_NOT_SUPPORTED);
1924 
1925 	status = mgmt_bredr_support(hdev);
1926 	if (status)
1927 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1928 
1929 	if (!lmp_ssp_capable(hdev))
1930 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1931 				       MGMT_STATUS_NOT_SUPPORTED);
1932 
1933 	if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1934 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1935 				       MGMT_STATUS_REJECTED);
1936 
1937 	if (cp->val != 0x00 && cp->val != 0x01)
1938 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1939 				       MGMT_STATUS_INVALID_PARAMS);
1940 
1941 	hci_dev_lock(hdev);
1942 
1943 	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1944 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1945 				      MGMT_STATUS_BUSY);
1946 		goto unlock;
1947 	}
1948 
1949 	if (cp->val) {
1950 		changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1951 	} else {
1952 		if (hdev_is_powered(hdev)) {
1953 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1954 					      MGMT_STATUS_REJECTED);
1955 			goto unlock;
1956 		}
1957 
1958 		changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1959 	}
1960 
1961 	err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1962 	if (err < 0)
1963 		goto unlock;
1964 
1965 	if (changed)
1966 		err = new_settings(hdev, sk);
1967 
1968 unlock:
1969 	hci_dev_unlock(hdev);
1970 	return err;
1971 }
1972 
1973 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
1974 {
1975 	struct cmd_lookup match = { NULL, hdev };
1976 	u8 status = mgmt_status(err);
1977 
1978 	bt_dev_dbg(hdev, "err %d", err);
1979 
1980 	if (status) {
1981 		mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1982 							&status);
1983 		return;
1984 	}
1985 
1986 	mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1987 
1988 	new_settings(hdev, match.sk);
1989 
1990 	if (match.sk)
1991 		sock_put(match.sk);
1992 }
1993 
1994 static int set_le_sync(struct hci_dev *hdev, void *data)
1995 {
1996 	struct mgmt_pending_cmd *cmd = data;
1997 	struct mgmt_mode *cp = cmd->param;
1998 	u8 val = !!cp->val;
1999 	int err;
2000 
2001 	if (!val) {
2002 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2003 			hci_disable_advertising_sync(hdev);
2004 
2005 		if (ext_adv_capable(hdev))
2006 			hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2007 	} else {
2008 		hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2009 	}
2010 
2011 	err = hci_write_le_host_supported_sync(hdev, val, 0);
2012 
2013 	/* Make sure the controller has a good default for
2014 	 * advertising data. Restrict the update to when LE
2015 	 * has actually been enabled. During power on, the
2016 	 * update in powered_update_hci will take care of it.
2017 	 */
2018 	if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2019 		if (ext_adv_capable(hdev)) {
2020 			int status;
2021 
2022 			status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2023 			if (!status)
2024 				hci_update_scan_rsp_data_sync(hdev, 0x00);
2025 		} else {
2026 			hci_update_adv_data_sync(hdev, 0x00);
2027 			hci_update_scan_rsp_data_sync(hdev, 0x00);
2028 		}
2029 
2030 		hci_update_passive_scan(hdev);
2031 	}
2032 
2033 	return err;
2034 }
2035 
2036 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2037 {
2038 	struct mgmt_mode *cp = data;
2039 	struct mgmt_pending_cmd *cmd;
2040 	int err;
2041 	u8 val, enabled;
2042 
2043 	bt_dev_dbg(hdev, "sock %p", sk);
2044 
2045 	if (!lmp_le_capable(hdev))
2046 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2047 				       MGMT_STATUS_NOT_SUPPORTED);
2048 
2049 	if (cp->val != 0x00 && cp->val != 0x01)
2050 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2051 				       MGMT_STATUS_INVALID_PARAMS);
2052 
2053 	/* Bluetooth single mode LE only controllers or dual-mode
2054 	 * controllers configured as LE only devices, do not allow
2055 	 * switching LE off. These have either LE enabled explicitly
2056 	 * or BR/EDR has been previously switched off.
2057 	 *
2058 	 * When trying to enable an already enabled LE, then gracefully
2059 	 * send a positive response. Trying to disable it however will
2060 	 * result into rejection.
2061 	 */
2062 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2063 		if (cp->val == 0x01)
2064 			return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2065 
2066 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2067 				       MGMT_STATUS_REJECTED);
2068 	}
2069 
2070 	hci_dev_lock(hdev);
2071 
2072 	val = !!cp->val;
2073 	enabled = lmp_host_le_capable(hdev);
2074 
2075 	if (!val)
2076 		hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
2077 
2078 	if (!hdev_is_powered(hdev) || val == enabled) {
2079 		bool changed = false;
2080 
2081 		if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2082 			hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2083 			changed = true;
2084 		}
2085 
2086 		if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2087 			hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2088 			changed = true;
2089 		}
2090 
2091 		err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2092 		if (err < 0)
2093 			goto unlock;
2094 
2095 		if (changed)
2096 			err = new_settings(hdev, sk);
2097 
2098 		goto unlock;
2099 	}
2100 
2101 	if (pending_find(MGMT_OP_SET_LE, hdev) ||
2102 	    pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2103 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2104 				      MGMT_STATUS_BUSY);
2105 		goto unlock;
2106 	}
2107 
2108 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2109 	if (!cmd)
2110 		err = -ENOMEM;
2111 	else
2112 		err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2113 					 set_le_complete);
2114 
2115 	if (err < 0) {
2116 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2117 				      MGMT_STATUS_FAILED);
2118 
2119 		if (cmd)
2120 			mgmt_pending_remove(cmd);
2121 	}
2122 
2123 unlock:
2124 	hci_dev_unlock(hdev);
2125 	return err;
2126 }
2127 
2128 /* This is a helper function to test for pending mgmt commands that can
2129  * cause CoD or EIR HCI commands. We can only allow one such pending
2130  * mgmt command at a time since otherwise we cannot easily track what
2131  * the current values are, will be, and based on that calculate if a new
2132  * HCI command needs to be sent and if yes with what value.
2133  */
2134 static bool pending_eir_or_class(struct hci_dev *hdev)
2135 {
2136 	struct mgmt_pending_cmd *cmd;
2137 
2138 	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2139 		switch (cmd->opcode) {
2140 		case MGMT_OP_ADD_UUID:
2141 		case MGMT_OP_REMOVE_UUID:
2142 		case MGMT_OP_SET_DEV_CLASS:
2143 		case MGMT_OP_SET_POWERED:
2144 			return true;
2145 		}
2146 	}
2147 
2148 	return false;
2149 }
2150 
2151 static const u8 bluetooth_base_uuid[] = {
2152 			0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2153 			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2154 };
2155 
2156 static u8 get_uuid_size(const u8 *uuid)
2157 {
2158 	u32 val;
2159 
2160 	if (memcmp(uuid, bluetooth_base_uuid, 12))
2161 		return 128;
2162 
2163 	val = get_unaligned_le32(&uuid[12]);
2164 	if (val > 0xffff)
2165 		return 32;
2166 
2167 	return 16;
2168 }
2169 
2170 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2171 {
2172 	struct mgmt_pending_cmd *cmd = data;
2173 
2174 	bt_dev_dbg(hdev, "err %d", err);
2175 
2176 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2177 			  mgmt_status(err), hdev->dev_class, 3);
2178 
2179 	mgmt_pending_free(cmd);
2180 }
2181 
2182 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2183 {
2184 	int err;
2185 
2186 	err = hci_update_class_sync(hdev);
2187 	if (err)
2188 		return err;
2189 
2190 	return hci_update_eir_sync(hdev);
2191 }
2192 
2193 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2194 {
2195 	struct mgmt_cp_add_uuid *cp = data;
2196 	struct mgmt_pending_cmd *cmd;
2197 	struct bt_uuid *uuid;
2198 	int err;
2199 
2200 	bt_dev_dbg(hdev, "sock %p", sk);
2201 
2202 	hci_dev_lock(hdev);
2203 
2204 	if (pending_eir_or_class(hdev)) {
2205 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2206 				      MGMT_STATUS_BUSY);
2207 		goto failed;
2208 	}
2209 
2210 	uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2211 	if (!uuid) {
2212 		err = -ENOMEM;
2213 		goto failed;
2214 	}
2215 
2216 	memcpy(uuid->uuid, cp->uuid, 16);
2217 	uuid->svc_hint = cp->svc_hint;
2218 	uuid->size = get_uuid_size(cp->uuid);
2219 
2220 	list_add_tail(&uuid->list, &hdev->uuids);
2221 
2222 	cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2223 	if (!cmd) {
2224 		err = -ENOMEM;
2225 		goto failed;
2226 	}
2227 
2228 	err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2229 	if (err < 0) {
2230 		mgmt_pending_free(cmd);
2231 		goto failed;
2232 	}
2233 
2234 failed:
2235 	hci_dev_unlock(hdev);
2236 	return err;
2237 }
2238 
2239 static bool enable_service_cache(struct hci_dev *hdev)
2240 {
2241 	if (!hdev_is_powered(hdev))
2242 		return false;
2243 
2244 	if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2245 		queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2246 				   CACHE_TIMEOUT);
2247 		return true;
2248 	}
2249 
2250 	return false;
2251 }
2252 
2253 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2254 {
2255 	int err;
2256 
2257 	err = hci_update_class_sync(hdev);
2258 	if (err)
2259 		return err;
2260 
2261 	return hci_update_eir_sync(hdev);
2262 }
2263 
2264 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2265 		       u16 len)
2266 {
2267 	struct mgmt_cp_remove_uuid *cp = data;
2268 	struct mgmt_pending_cmd *cmd;
2269 	struct bt_uuid *match, *tmp;
2270 	u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2271 	int err, found;
2272 
2273 	bt_dev_dbg(hdev, "sock %p", sk);
2274 
2275 	hci_dev_lock(hdev);
2276 
2277 	if (pending_eir_or_class(hdev)) {
2278 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2279 				      MGMT_STATUS_BUSY);
2280 		goto unlock;
2281 	}
2282 
2283 	if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2284 		hci_uuids_clear(hdev);
2285 
2286 		if (enable_service_cache(hdev)) {
2287 			err = mgmt_cmd_complete(sk, hdev->id,
2288 						MGMT_OP_REMOVE_UUID,
2289 						0, hdev->dev_class, 3);
2290 			goto unlock;
2291 		}
2292 
2293 		goto update_class;
2294 	}
2295 
2296 	found = 0;
2297 
2298 	list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2299 		if (memcmp(match->uuid, cp->uuid, 16) != 0)
2300 			continue;
2301 
2302 		list_del(&match->list);
2303 		kfree(match);
2304 		found++;
2305 	}
2306 
2307 	if (found == 0) {
2308 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2309 				      MGMT_STATUS_INVALID_PARAMS);
2310 		goto unlock;
2311 	}
2312 
2313 update_class:
2314 	cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2315 	if (!cmd) {
2316 		err = -ENOMEM;
2317 		goto unlock;
2318 	}
2319 
2320 	err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2321 				 mgmt_class_complete);
2322 	if (err < 0)
2323 		mgmt_pending_free(cmd);
2324 
2325 unlock:
2326 	hci_dev_unlock(hdev);
2327 	return err;
2328 }
2329 
2330 static int set_class_sync(struct hci_dev *hdev, void *data)
2331 {
2332 	int err = 0;
2333 
2334 	if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2335 		cancel_delayed_work_sync(&hdev->service_cache);
2336 		err = hci_update_eir_sync(hdev);
2337 	}
2338 
2339 	if (err)
2340 		return err;
2341 
2342 	return hci_update_class_sync(hdev);
2343 }
2344 
2345 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2346 			 u16 len)
2347 {
2348 	struct mgmt_cp_set_dev_class *cp = data;
2349 	struct mgmt_pending_cmd *cmd;
2350 	int err;
2351 
2352 	bt_dev_dbg(hdev, "sock %p", sk);
2353 
2354 	if (!lmp_bredr_capable(hdev))
2355 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2356 				       MGMT_STATUS_NOT_SUPPORTED);
2357 
2358 	hci_dev_lock(hdev);
2359 
2360 	if (pending_eir_or_class(hdev)) {
2361 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2362 				      MGMT_STATUS_BUSY);
2363 		goto unlock;
2364 	}
2365 
2366 	if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2367 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2368 				      MGMT_STATUS_INVALID_PARAMS);
2369 		goto unlock;
2370 	}
2371 
2372 	hdev->major_class = cp->major;
2373 	hdev->minor_class = cp->minor;
2374 
2375 	if (!hdev_is_powered(hdev)) {
2376 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2377 					hdev->dev_class, 3);
2378 		goto unlock;
2379 	}
2380 
2381 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2382 	if (!cmd) {
2383 		err = -ENOMEM;
2384 		goto unlock;
2385 	}
2386 
2387 	err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2388 				 mgmt_class_complete);
2389 	if (err < 0)
2390 		mgmt_pending_free(cmd);
2391 
2392 unlock:
2393 	hci_dev_unlock(hdev);
2394 	return err;
2395 }
2396 
2397 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2398 			  u16 len)
2399 {
2400 	struct mgmt_cp_load_link_keys *cp = data;
2401 	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2402 				   sizeof(struct mgmt_link_key_info));
2403 	u16 key_count, expected_len;
2404 	bool changed;
2405 	int i;
2406 
2407 	bt_dev_dbg(hdev, "sock %p", sk);
2408 
2409 	if (!lmp_bredr_capable(hdev))
2410 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2411 				       MGMT_STATUS_NOT_SUPPORTED);
2412 
2413 	key_count = __le16_to_cpu(cp->key_count);
2414 	if (key_count > max_key_count) {
2415 		bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2416 			   key_count);
2417 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2418 				       MGMT_STATUS_INVALID_PARAMS);
2419 	}
2420 
2421 	expected_len = struct_size(cp, keys, key_count);
2422 	if (expected_len != len) {
2423 		bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2424 			   expected_len, len);
2425 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2426 				       MGMT_STATUS_INVALID_PARAMS);
2427 	}
2428 
2429 	if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2430 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2431 				       MGMT_STATUS_INVALID_PARAMS);
2432 
2433 	bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2434 		   key_count);
2435 
2436 	for (i = 0; i < key_count; i++) {
2437 		struct mgmt_link_key_info *key = &cp->keys[i];
2438 
2439 		if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2440 			return mgmt_cmd_status(sk, hdev->id,
2441 					       MGMT_OP_LOAD_LINK_KEYS,
2442 					       MGMT_STATUS_INVALID_PARAMS);
2443 	}
2444 
2445 	hci_dev_lock(hdev);
2446 
2447 	hci_link_keys_clear(hdev);
2448 
2449 	if (cp->debug_keys)
2450 		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2451 	else
2452 		changed = hci_dev_test_and_clear_flag(hdev,
2453 						      HCI_KEEP_DEBUG_KEYS);
2454 
2455 	if (changed)
2456 		new_settings(hdev, NULL);
2457 
2458 	for (i = 0; i < key_count; i++) {
2459 		struct mgmt_link_key_info *key = &cp->keys[i];
2460 
2461 		if (hci_is_blocked_key(hdev,
2462 				       HCI_BLOCKED_KEY_TYPE_LINKKEY,
2463 				       key->val)) {
2464 			bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2465 				    &key->addr.bdaddr);
2466 			continue;
2467 		}
2468 
2469 		/* Always ignore debug keys and require a new pairing if
2470 		 * the user wants to use them.
2471 		 */
2472 		if (key->type == HCI_LK_DEBUG_COMBINATION)
2473 			continue;
2474 
2475 		hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2476 				 key->type, key->pin_len, NULL);
2477 	}
2478 
2479 	mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2480 
2481 	hci_dev_unlock(hdev);
2482 
2483 	return 0;
2484 }
2485 
2486 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2487 			   u8 addr_type, struct sock *skip_sk)
2488 {
2489 	struct mgmt_ev_device_unpaired ev;
2490 
2491 	bacpy(&ev.addr.bdaddr, bdaddr);
2492 	ev.addr.type = addr_type;
2493 
2494 	return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2495 			  skip_sk);
2496 }
2497 
2498 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2499 			 u16 len)
2500 {
2501 	struct mgmt_cp_unpair_device *cp = data;
2502 	struct mgmt_rp_unpair_device rp;
2503 	struct hci_conn_params *params;
2504 	struct mgmt_pending_cmd *cmd;
2505 	struct hci_conn *conn;
2506 	u8 addr_type;
2507 	int err;
2508 
2509 	memset(&rp, 0, sizeof(rp));
2510 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2511 	rp.addr.type = cp->addr.type;
2512 
2513 	if (!bdaddr_type_is_valid(cp->addr.type))
2514 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2515 					 MGMT_STATUS_INVALID_PARAMS,
2516 					 &rp, sizeof(rp));
2517 
2518 	if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2519 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2520 					 MGMT_STATUS_INVALID_PARAMS,
2521 					 &rp, sizeof(rp));
2522 
2523 	hci_dev_lock(hdev);
2524 
2525 	if (!hdev_is_powered(hdev)) {
2526 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2527 					MGMT_STATUS_NOT_POWERED, &rp,
2528 					sizeof(rp));
2529 		goto unlock;
2530 	}
2531 
2532 	if (cp->addr.type == BDADDR_BREDR) {
2533 		/* If disconnection is requested, then look up the
2534 		 * connection. If the remote device is connected, it
2535 		 * will be later used to terminate the link.
2536 		 *
2537 		 * Setting it to NULL explicitly will cause no
2538 		 * termination of the link.
2539 		 */
2540 		if (cp->disconnect)
2541 			conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2542 						       &cp->addr.bdaddr);
2543 		else
2544 			conn = NULL;
2545 
2546 		err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2547 		if (err < 0) {
2548 			err = mgmt_cmd_complete(sk, hdev->id,
2549 						MGMT_OP_UNPAIR_DEVICE,
2550 						MGMT_STATUS_NOT_PAIRED, &rp,
2551 						sizeof(rp));
2552 			goto unlock;
2553 		}
2554 
2555 		goto done;
2556 	}
2557 
2558 	/* LE address type */
2559 	addr_type = le_addr_type(cp->addr.type);
2560 
2561 	/* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2562 	err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2563 	if (err < 0) {
2564 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2565 					MGMT_STATUS_NOT_PAIRED, &rp,
2566 					sizeof(rp));
2567 		goto unlock;
2568 	}
2569 
2570 	conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2571 	if (!conn) {
2572 		hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2573 		goto done;
2574 	}
2575 
2576 
2577 	/* Defer clearing up the connection parameters until closing to
2578 	 * give a chance of keeping them if a repairing happens.
2579 	 */
2580 	set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2581 
2582 	/* Disable auto-connection parameters if present */
2583 	params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2584 	if (params) {
2585 		if (params->explicit_connect)
2586 			params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2587 		else
2588 			params->auto_connect = HCI_AUTO_CONN_DISABLED;
2589 	}
2590 
2591 	/* If disconnection is not requested, then clear the connection
2592 	 * variable so that the link is not terminated.
2593 	 */
2594 	if (!cp->disconnect)
2595 		conn = NULL;
2596 
2597 done:
2598 	/* If the connection variable is set, then termination of the
2599 	 * link is requested.
2600 	 */
2601 	if (!conn) {
2602 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2603 					&rp, sizeof(rp));
2604 		device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2605 		goto unlock;
2606 	}
2607 
2608 	cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2609 			       sizeof(*cp));
2610 	if (!cmd) {
2611 		err = -ENOMEM;
2612 		goto unlock;
2613 	}
2614 
2615 	cmd->cmd_complete = addr_cmd_complete;
2616 
2617 	err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2618 	if (err < 0)
2619 		mgmt_pending_remove(cmd);
2620 
2621 unlock:
2622 	hci_dev_unlock(hdev);
2623 	return err;
2624 }
2625 
2626 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2627 		      u16 len)
2628 {
2629 	struct mgmt_cp_disconnect *cp = data;
2630 	struct mgmt_rp_disconnect rp;
2631 	struct mgmt_pending_cmd *cmd;
2632 	struct hci_conn *conn;
2633 	int err;
2634 
2635 	bt_dev_dbg(hdev, "sock %p", sk);
2636 
2637 	memset(&rp, 0, sizeof(rp));
2638 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2639 	rp.addr.type = cp->addr.type;
2640 
2641 	if (!bdaddr_type_is_valid(cp->addr.type))
2642 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2643 					 MGMT_STATUS_INVALID_PARAMS,
2644 					 &rp, sizeof(rp));
2645 
2646 	hci_dev_lock(hdev);
2647 
2648 	if (!test_bit(HCI_UP, &hdev->flags)) {
2649 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2650 					MGMT_STATUS_NOT_POWERED, &rp,
2651 					sizeof(rp));
2652 		goto failed;
2653 	}
2654 
2655 	if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2656 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2657 					MGMT_STATUS_BUSY, &rp, sizeof(rp));
2658 		goto failed;
2659 	}
2660 
2661 	if (cp->addr.type == BDADDR_BREDR)
2662 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2663 					       &cp->addr.bdaddr);
2664 	else
2665 		conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2666 					       le_addr_type(cp->addr.type));
2667 
2668 	if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2669 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2670 					MGMT_STATUS_NOT_CONNECTED, &rp,
2671 					sizeof(rp));
2672 		goto failed;
2673 	}
2674 
2675 	cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2676 	if (!cmd) {
2677 		err = -ENOMEM;
2678 		goto failed;
2679 	}
2680 
2681 	cmd->cmd_complete = generic_cmd_complete;
2682 
2683 	err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2684 	if (err < 0)
2685 		mgmt_pending_remove(cmd);
2686 
2687 failed:
2688 	hci_dev_unlock(hdev);
2689 	return err;
2690 }
2691 
2692 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2693 {
2694 	switch (link_type) {
2695 	case LE_LINK:
2696 		switch (addr_type) {
2697 		case ADDR_LE_DEV_PUBLIC:
2698 			return BDADDR_LE_PUBLIC;
2699 
2700 		default:
2701 			/* Fallback to LE Random address type */
2702 			return BDADDR_LE_RANDOM;
2703 		}
2704 
2705 	default:
2706 		/* Fallback to BR/EDR type */
2707 		return BDADDR_BREDR;
2708 	}
2709 }
2710 
2711 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2712 			   u16 data_len)
2713 {
2714 	struct mgmt_rp_get_connections *rp;
2715 	struct hci_conn *c;
2716 	int err;
2717 	u16 i;
2718 
2719 	bt_dev_dbg(hdev, "sock %p", sk);
2720 
2721 	hci_dev_lock(hdev);
2722 
2723 	if (!hdev_is_powered(hdev)) {
2724 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2725 				      MGMT_STATUS_NOT_POWERED);
2726 		goto unlock;
2727 	}
2728 
2729 	i = 0;
2730 	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2731 		if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2732 			i++;
2733 	}
2734 
2735 	rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2736 	if (!rp) {
2737 		err = -ENOMEM;
2738 		goto unlock;
2739 	}
2740 
2741 	i = 0;
2742 	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2743 		if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2744 			continue;
2745 		bacpy(&rp->addr[i].bdaddr, &c->dst);
2746 		rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2747 		if (c->type == SCO_LINK || c->type == ESCO_LINK)
2748 			continue;
2749 		i++;
2750 	}
2751 
2752 	rp->conn_count = cpu_to_le16(i);
2753 
2754 	/* Recalculate length in case of filtered SCO connections, etc */
2755 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2756 				struct_size(rp, addr, i));
2757 
2758 	kfree(rp);
2759 
2760 unlock:
2761 	hci_dev_unlock(hdev);
2762 	return err;
2763 }
2764 
2765 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2766 				   struct mgmt_cp_pin_code_neg_reply *cp)
2767 {
2768 	struct mgmt_pending_cmd *cmd;
2769 	int err;
2770 
2771 	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2772 			       sizeof(*cp));
2773 	if (!cmd)
2774 		return -ENOMEM;
2775 
2776 	cmd->cmd_complete = addr_cmd_complete;
2777 
2778 	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2779 			   sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2780 	if (err < 0)
2781 		mgmt_pending_remove(cmd);
2782 
2783 	return err;
2784 }
2785 
2786 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2787 			  u16 len)
2788 {
2789 	struct hci_conn *conn;
2790 	struct mgmt_cp_pin_code_reply *cp = data;
2791 	struct hci_cp_pin_code_reply reply;
2792 	struct mgmt_pending_cmd *cmd;
2793 	int err;
2794 
2795 	bt_dev_dbg(hdev, "sock %p", sk);
2796 
2797 	hci_dev_lock(hdev);
2798 
2799 	if (!hdev_is_powered(hdev)) {
2800 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2801 				      MGMT_STATUS_NOT_POWERED);
2802 		goto failed;
2803 	}
2804 
2805 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2806 	if (!conn) {
2807 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2808 				      MGMT_STATUS_NOT_CONNECTED);
2809 		goto failed;
2810 	}
2811 
2812 	if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2813 		struct mgmt_cp_pin_code_neg_reply ncp;
2814 
2815 		memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2816 
2817 		bt_dev_err(hdev, "PIN code is not 16 bytes long");
2818 
2819 		err = send_pin_code_neg_reply(sk, hdev, &ncp);
2820 		if (err >= 0)
2821 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2822 					      MGMT_STATUS_INVALID_PARAMS);
2823 
2824 		goto failed;
2825 	}
2826 
2827 	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2828 	if (!cmd) {
2829 		err = -ENOMEM;
2830 		goto failed;
2831 	}
2832 
2833 	cmd->cmd_complete = addr_cmd_complete;
2834 
2835 	bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2836 	reply.pin_len = cp->pin_len;
2837 	memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2838 
2839 	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2840 	if (err < 0)
2841 		mgmt_pending_remove(cmd);
2842 
2843 failed:
2844 	hci_dev_unlock(hdev);
2845 	return err;
2846 }
2847 
2848 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2849 			     u16 len)
2850 {
2851 	struct mgmt_cp_set_io_capability *cp = data;
2852 
2853 	bt_dev_dbg(hdev, "sock %p", sk);
2854 
2855 	if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2856 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2857 				       MGMT_STATUS_INVALID_PARAMS);
2858 
2859 	hci_dev_lock(hdev);
2860 
2861 	hdev->io_capability = cp->io_capability;
2862 
2863 	bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2864 
2865 	hci_dev_unlock(hdev);
2866 
2867 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2868 				 NULL, 0);
2869 }
2870 
2871 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2872 {
2873 	struct hci_dev *hdev = conn->hdev;
2874 	struct mgmt_pending_cmd *cmd;
2875 
2876 	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2877 		if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2878 			continue;
2879 
2880 		if (cmd->user_data != conn)
2881 			continue;
2882 
2883 		return cmd;
2884 	}
2885 
2886 	return NULL;
2887 }
2888 
2889 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2890 {
2891 	struct mgmt_rp_pair_device rp;
2892 	struct hci_conn *conn = cmd->user_data;
2893 	int err;
2894 
2895 	bacpy(&rp.addr.bdaddr, &conn->dst);
2896 	rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2897 
2898 	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2899 				status, &rp, sizeof(rp));
2900 
2901 	/* So we don't get further callbacks for this connection */
2902 	conn->connect_cfm_cb = NULL;
2903 	conn->security_cfm_cb = NULL;
2904 	conn->disconn_cfm_cb = NULL;
2905 
2906 	hci_conn_drop(conn);
2907 
2908 	/* The device is paired so there is no need to remove
2909 	 * its connection parameters anymore.
2910 	 */
2911 	clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2912 
2913 	hci_conn_put(conn);
2914 
2915 	return err;
2916 }
2917 
2918 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2919 {
2920 	u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2921 	struct mgmt_pending_cmd *cmd;
2922 
2923 	cmd = find_pairing(conn);
2924 	if (cmd) {
2925 		cmd->cmd_complete(cmd, status);
2926 		mgmt_pending_remove(cmd);
2927 	}
2928 }
2929 
2930 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2931 {
2932 	struct mgmt_pending_cmd *cmd;
2933 
2934 	BT_DBG("status %u", status);
2935 
2936 	cmd = find_pairing(conn);
2937 	if (!cmd) {
2938 		BT_DBG("Unable to find a pending command");
2939 		return;
2940 	}
2941 
2942 	cmd->cmd_complete(cmd, mgmt_status(status));
2943 	mgmt_pending_remove(cmd);
2944 }
2945 
2946 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2947 {
2948 	struct mgmt_pending_cmd *cmd;
2949 
2950 	BT_DBG("status %u", status);
2951 
2952 	if (!status)
2953 		return;
2954 
2955 	cmd = find_pairing(conn);
2956 	if (!cmd) {
2957 		BT_DBG("Unable to find a pending command");
2958 		return;
2959 	}
2960 
2961 	cmd->cmd_complete(cmd, mgmt_status(status));
2962 	mgmt_pending_remove(cmd);
2963 }
2964 
2965 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2966 		       u16 len)
2967 {
2968 	struct mgmt_cp_pair_device *cp = data;
2969 	struct mgmt_rp_pair_device rp;
2970 	struct mgmt_pending_cmd *cmd;
2971 	u8 sec_level, auth_type;
2972 	struct hci_conn *conn;
2973 	int err;
2974 
2975 	bt_dev_dbg(hdev, "sock %p", sk);
2976 
2977 	memset(&rp, 0, sizeof(rp));
2978 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2979 	rp.addr.type = cp->addr.type;
2980 
2981 	if (!bdaddr_type_is_valid(cp->addr.type))
2982 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2983 					 MGMT_STATUS_INVALID_PARAMS,
2984 					 &rp, sizeof(rp));
2985 
2986 	if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2987 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2988 					 MGMT_STATUS_INVALID_PARAMS,
2989 					 &rp, sizeof(rp));
2990 
2991 	hci_dev_lock(hdev);
2992 
2993 	if (!hdev_is_powered(hdev)) {
2994 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995 					MGMT_STATUS_NOT_POWERED, &rp,
2996 					sizeof(rp));
2997 		goto unlock;
2998 	}
2999 
3000 	if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3001 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002 					MGMT_STATUS_ALREADY_PAIRED, &rp,
3003 					sizeof(rp));
3004 		goto unlock;
3005 	}
3006 
3007 	sec_level = BT_SECURITY_MEDIUM;
3008 	auth_type = HCI_AT_DEDICATED_BONDING;
3009 
3010 	if (cp->addr.type == BDADDR_BREDR) {
3011 		conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3012 				       auth_type, CONN_REASON_PAIR_DEVICE);
3013 	} else {
3014 		u8 addr_type = le_addr_type(cp->addr.type);
3015 		struct hci_conn_params *p;
3016 
3017 		/* When pairing a new device, it is expected to remember
3018 		 * this device for future connections. Adding the connection
3019 		 * parameter information ahead of time allows tracking
3020 		 * of the peripheral preferred values and will speed up any
3021 		 * further connection establishment.
3022 		 *
3023 		 * If connection parameters already exist, then they
3024 		 * will be kept and this function does nothing.
3025 		 */
3026 		p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3027 
3028 		if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3029 			p->auto_connect = HCI_AUTO_CONN_DISABLED;
3030 
3031 		conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3032 					   sec_level, HCI_LE_CONN_TIMEOUT,
3033 					   CONN_REASON_PAIR_DEVICE);
3034 	}
3035 
3036 	if (IS_ERR(conn)) {
3037 		int status;
3038 
3039 		if (PTR_ERR(conn) == -EBUSY)
3040 			status = MGMT_STATUS_BUSY;
3041 		else if (PTR_ERR(conn) == -EOPNOTSUPP)
3042 			status = MGMT_STATUS_NOT_SUPPORTED;
3043 		else if (PTR_ERR(conn) == -ECONNREFUSED)
3044 			status = MGMT_STATUS_REJECTED;
3045 		else
3046 			status = MGMT_STATUS_CONNECT_FAILED;
3047 
3048 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3049 					status, &rp, sizeof(rp));
3050 		goto unlock;
3051 	}
3052 
3053 	if (conn->connect_cfm_cb) {
3054 		hci_conn_drop(conn);
3055 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3056 					MGMT_STATUS_BUSY, &rp, sizeof(rp));
3057 		goto unlock;
3058 	}
3059 
3060 	cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3061 	if (!cmd) {
3062 		err = -ENOMEM;
3063 		hci_conn_drop(conn);
3064 		goto unlock;
3065 	}
3066 
3067 	cmd->cmd_complete = pairing_complete;
3068 
3069 	/* For LE, just connecting isn't a proof that the pairing finished */
3070 	if (cp->addr.type == BDADDR_BREDR) {
3071 		conn->connect_cfm_cb = pairing_complete_cb;
3072 		conn->security_cfm_cb = pairing_complete_cb;
3073 		conn->disconn_cfm_cb = pairing_complete_cb;
3074 	} else {
3075 		conn->connect_cfm_cb = le_pairing_complete_cb;
3076 		conn->security_cfm_cb = le_pairing_complete_cb;
3077 		conn->disconn_cfm_cb = le_pairing_complete_cb;
3078 	}
3079 
3080 	conn->io_capability = cp->io_cap;
3081 	cmd->user_data = hci_conn_get(conn);
3082 
3083 	if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3084 	    hci_conn_security(conn, sec_level, auth_type, true)) {
3085 		cmd->cmd_complete(cmd, 0);
3086 		mgmt_pending_remove(cmd);
3087 	}
3088 
3089 	err = 0;
3090 
3091 unlock:
3092 	hci_dev_unlock(hdev);
3093 	return err;
3094 }
3095 
3096 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3097 			      u16 len)
3098 {
3099 	struct mgmt_addr_info *addr = data;
3100 	struct mgmt_pending_cmd *cmd;
3101 	struct hci_conn *conn;
3102 	int err;
3103 
3104 	bt_dev_dbg(hdev, "sock %p", sk);
3105 
3106 	hci_dev_lock(hdev);
3107 
3108 	if (!hdev_is_powered(hdev)) {
3109 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3110 				      MGMT_STATUS_NOT_POWERED);
3111 		goto unlock;
3112 	}
3113 
3114 	cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3115 	if (!cmd) {
3116 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3117 				      MGMT_STATUS_INVALID_PARAMS);
3118 		goto unlock;
3119 	}
3120 
3121 	conn = cmd->user_data;
3122 
3123 	if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3124 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3125 				      MGMT_STATUS_INVALID_PARAMS);
3126 		goto unlock;
3127 	}
3128 
3129 	cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3130 	mgmt_pending_remove(cmd);
3131 
3132 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3133 				addr, sizeof(*addr));
3134 
3135 	/* Since user doesn't want to proceed with the connection, abort any
3136 	 * ongoing pairing and then terminate the link if it was created
3137 	 * because of the pair device action.
3138 	 */
3139 	if (addr->type == BDADDR_BREDR)
3140 		hci_remove_link_key(hdev, &addr->bdaddr);
3141 	else
3142 		smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3143 					      le_addr_type(addr->type));
3144 
3145 	if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3146 		hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3147 
3148 unlock:
3149 	hci_dev_unlock(hdev);
3150 	return err;
3151 }
3152 
3153 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3154 			     struct mgmt_addr_info *addr, u16 mgmt_op,
3155 			     u16 hci_op, __le32 passkey)
3156 {
3157 	struct mgmt_pending_cmd *cmd;
3158 	struct hci_conn *conn;
3159 	int err;
3160 
3161 	hci_dev_lock(hdev);
3162 
3163 	if (!hdev_is_powered(hdev)) {
3164 		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3165 					MGMT_STATUS_NOT_POWERED, addr,
3166 					sizeof(*addr));
3167 		goto done;
3168 	}
3169 
3170 	if (addr->type == BDADDR_BREDR)
3171 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3172 	else
3173 		conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3174 					       le_addr_type(addr->type));
3175 
3176 	if (!conn) {
3177 		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3178 					MGMT_STATUS_NOT_CONNECTED, addr,
3179 					sizeof(*addr));
3180 		goto done;
3181 	}
3182 
3183 	if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3184 		err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3185 		if (!err)
3186 			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3187 						MGMT_STATUS_SUCCESS, addr,
3188 						sizeof(*addr));
3189 		else
3190 			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3191 						MGMT_STATUS_FAILED, addr,
3192 						sizeof(*addr));
3193 
3194 		goto done;
3195 	}
3196 
3197 	cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3198 	if (!cmd) {
3199 		err = -ENOMEM;
3200 		goto done;
3201 	}
3202 
3203 	cmd->cmd_complete = addr_cmd_complete;
3204 
3205 	/* Continue with pairing via HCI */
3206 	if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3207 		struct hci_cp_user_passkey_reply cp;
3208 
3209 		bacpy(&cp.bdaddr, &addr->bdaddr);
3210 		cp.passkey = passkey;
3211 		err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3212 	} else
3213 		err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3214 				   &addr->bdaddr);
3215 
3216 	if (err < 0)
3217 		mgmt_pending_remove(cmd);
3218 
3219 done:
3220 	hci_dev_unlock(hdev);
3221 	return err;
3222 }
3223 
3224 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3225 			      void *data, u16 len)
3226 {
3227 	struct mgmt_cp_pin_code_neg_reply *cp = data;
3228 
3229 	bt_dev_dbg(hdev, "sock %p", sk);
3230 
3231 	return user_pairing_resp(sk, hdev, &cp->addr,
3232 				MGMT_OP_PIN_CODE_NEG_REPLY,
3233 				HCI_OP_PIN_CODE_NEG_REPLY, 0);
3234 }
3235 
3236 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3237 			      u16 len)
3238 {
3239 	struct mgmt_cp_user_confirm_reply *cp = data;
3240 
3241 	bt_dev_dbg(hdev, "sock %p", sk);
3242 
3243 	if (len != sizeof(*cp))
3244 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3245 				       MGMT_STATUS_INVALID_PARAMS);
3246 
3247 	return user_pairing_resp(sk, hdev, &cp->addr,
3248 				 MGMT_OP_USER_CONFIRM_REPLY,
3249 				 HCI_OP_USER_CONFIRM_REPLY, 0);
3250 }
3251 
3252 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3253 				  void *data, u16 len)
3254 {
3255 	struct mgmt_cp_user_confirm_neg_reply *cp = data;
3256 
3257 	bt_dev_dbg(hdev, "sock %p", sk);
3258 
3259 	return user_pairing_resp(sk, hdev, &cp->addr,
3260 				 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3261 				 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3262 }
3263 
3264 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3265 			      u16 len)
3266 {
3267 	struct mgmt_cp_user_passkey_reply *cp = data;
3268 
3269 	bt_dev_dbg(hdev, "sock %p", sk);
3270 
3271 	return user_pairing_resp(sk, hdev, &cp->addr,
3272 				 MGMT_OP_USER_PASSKEY_REPLY,
3273 				 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3274 }
3275 
3276 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3277 				  void *data, u16 len)
3278 {
3279 	struct mgmt_cp_user_passkey_neg_reply *cp = data;
3280 
3281 	bt_dev_dbg(hdev, "sock %p", sk);
3282 
3283 	return user_pairing_resp(sk, hdev, &cp->addr,
3284 				 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3285 				 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3286 }
3287 
3288 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3289 {
3290 	struct adv_info *adv_instance;
3291 
3292 	adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3293 	if (!adv_instance)
3294 		return 0;
3295 
3296 	/* stop if current instance doesn't need to be changed */
3297 	if (!(adv_instance->flags & flags))
3298 		return 0;
3299 
3300 	cancel_adv_timeout(hdev);
3301 
3302 	adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3303 	if (!adv_instance)
3304 		return 0;
3305 
3306 	hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3307 
3308 	return 0;
3309 }
3310 
3311 static int name_changed_sync(struct hci_dev *hdev, void *data)
3312 {
3313 	return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3314 }
3315 
3316 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3317 {
3318 	struct mgmt_pending_cmd *cmd = data;
3319 	struct mgmt_cp_set_local_name *cp = cmd->param;
3320 	u8 status = mgmt_status(err);
3321 
3322 	bt_dev_dbg(hdev, "err %d", err);
3323 
3324 	if (status) {
3325 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3326 				status);
3327 	} else {
3328 		mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3329 				  cp, sizeof(*cp));
3330 
3331 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3332 			hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3333 	}
3334 
3335 	mgmt_pending_remove(cmd);
3336 }
3337 
3338 static int set_name_sync(struct hci_dev *hdev, void *data)
3339 {
3340 	if (lmp_bredr_capable(hdev)) {
3341 		hci_update_name_sync(hdev);
3342 		hci_update_eir_sync(hdev);
3343 	}
3344 
3345 	/* The name is stored in the scan response data and so
3346 	 * no need to update the advertising data here.
3347 	 */
3348 	if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3349 		hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3350 
3351 	return 0;
3352 }
3353 
3354 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3355 			  u16 len)
3356 {
3357 	struct mgmt_cp_set_local_name *cp = data;
3358 	struct mgmt_pending_cmd *cmd;
3359 	int err;
3360 
3361 	bt_dev_dbg(hdev, "sock %p", sk);
3362 
3363 	hci_dev_lock(hdev);
3364 
3365 	/* If the old values are the same as the new ones just return a
3366 	 * direct command complete event.
3367 	 */
3368 	if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3369 	    !memcmp(hdev->short_name, cp->short_name,
3370 		    sizeof(hdev->short_name))) {
3371 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3372 					data, len);
3373 		goto failed;
3374 	}
3375 
3376 	memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3377 
3378 	if (!hdev_is_powered(hdev)) {
3379 		memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3380 
3381 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3382 					data, len);
3383 		if (err < 0)
3384 			goto failed;
3385 
3386 		err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3387 					 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3388 		ext_info_changed(hdev, sk);
3389 
3390 		goto failed;
3391 	}
3392 
3393 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3394 	if (!cmd)
3395 		err = -ENOMEM;
3396 	else
3397 		err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3398 					 set_name_complete);
3399 
3400 	if (err < 0) {
3401 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3402 				      MGMT_STATUS_FAILED);
3403 
3404 		if (cmd)
3405 			mgmt_pending_remove(cmd);
3406 
3407 		goto failed;
3408 	}
3409 
3410 	memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3411 
3412 failed:
3413 	hci_dev_unlock(hdev);
3414 	return err;
3415 }
3416 
3417 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3418 {
3419 	return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3420 }
3421 
3422 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3423 			  u16 len)
3424 {
3425 	struct mgmt_cp_set_appearance *cp = data;
3426 	u16 appearance;
3427 	int err;
3428 
3429 	bt_dev_dbg(hdev, "sock %p", sk);
3430 
3431 	if (!lmp_le_capable(hdev))
3432 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3433 				       MGMT_STATUS_NOT_SUPPORTED);
3434 
3435 	appearance = le16_to_cpu(cp->appearance);
3436 
3437 	hci_dev_lock(hdev);
3438 
3439 	if (hdev->appearance != appearance) {
3440 		hdev->appearance = appearance;
3441 
3442 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3443 			hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3444 					   NULL);
3445 
3446 		ext_info_changed(hdev, sk);
3447 	}
3448 
3449 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3450 				0);
3451 
3452 	hci_dev_unlock(hdev);
3453 
3454 	return err;
3455 }
3456 
3457 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3458 				 void *data, u16 len)
3459 {
3460 	struct mgmt_rp_get_phy_configuration rp;
3461 
3462 	bt_dev_dbg(hdev, "sock %p", sk);
3463 
3464 	hci_dev_lock(hdev);
3465 
3466 	memset(&rp, 0, sizeof(rp));
3467 
3468 	rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3469 	rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3470 	rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3471 
3472 	hci_dev_unlock(hdev);
3473 
3474 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3475 				 &rp, sizeof(rp));
3476 }
3477 
3478 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3479 {
3480 	struct mgmt_ev_phy_configuration_changed ev;
3481 
3482 	memset(&ev, 0, sizeof(ev));
3483 
3484 	ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3485 
3486 	return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3487 			  sizeof(ev), skip);
3488 }
3489 
3490 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3491 {
3492 	struct mgmt_pending_cmd *cmd = data;
3493 	struct sk_buff *skb = cmd->skb;
3494 	u8 status = mgmt_status(err);
3495 
3496 	if (!status) {
3497 		if (!skb)
3498 			status = MGMT_STATUS_FAILED;
3499 		else if (IS_ERR(skb))
3500 			status = mgmt_status(PTR_ERR(skb));
3501 		else
3502 			status = mgmt_status(skb->data[0]);
3503 	}
3504 
3505 	bt_dev_dbg(hdev, "status %d", status);
3506 
3507 	if (status) {
3508 		mgmt_cmd_status(cmd->sk, hdev->id,
3509 				MGMT_OP_SET_PHY_CONFIGURATION, status);
3510 	} else {
3511 		mgmt_cmd_complete(cmd->sk, hdev->id,
3512 				  MGMT_OP_SET_PHY_CONFIGURATION, 0,
3513 				  NULL, 0);
3514 
3515 		mgmt_phy_configuration_changed(hdev, cmd->sk);
3516 	}
3517 
3518 	if (skb && !IS_ERR(skb))
3519 		kfree_skb(skb);
3520 
3521 	mgmt_pending_remove(cmd);
3522 }
3523 
3524 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
3525 {
3526 	struct mgmt_pending_cmd *cmd = data;
3527 	struct mgmt_cp_set_phy_configuration *cp = cmd->param;
3528 	struct hci_cp_le_set_default_phy cp_phy;
3529 	u32 selected_phys = __le32_to_cpu(cp->selected_phys);
3530 
3531 	memset(&cp_phy, 0, sizeof(cp_phy));
3532 
3533 	if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3534 		cp_phy.all_phys |= 0x01;
3535 
3536 	if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3537 		cp_phy.all_phys |= 0x02;
3538 
3539 	if (selected_phys & MGMT_PHY_LE_1M_TX)
3540 		cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3541 
3542 	if (selected_phys & MGMT_PHY_LE_2M_TX)
3543 		cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3544 
3545 	if (selected_phys & MGMT_PHY_LE_CODED_TX)
3546 		cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3547 
3548 	if (selected_phys & MGMT_PHY_LE_1M_RX)
3549 		cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3550 
3551 	if (selected_phys & MGMT_PHY_LE_2M_RX)
3552 		cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3553 
3554 	if (selected_phys & MGMT_PHY_LE_CODED_RX)
3555 		cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3556 
3557 	cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
3558 				   sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
3559 
3560 	return 0;
3561 }
3562 
3563 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3564 				 void *data, u16 len)
3565 {
3566 	struct mgmt_cp_set_phy_configuration *cp = data;
3567 	struct mgmt_pending_cmd *cmd;
3568 	u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3569 	u16 pkt_type = (HCI_DH1 | HCI_DM1);
3570 	bool changed = false;
3571 	int err;
3572 
3573 	bt_dev_dbg(hdev, "sock %p", sk);
3574 
3575 	configurable_phys = get_configurable_phys(hdev);
3576 	supported_phys = get_supported_phys(hdev);
3577 	selected_phys = __le32_to_cpu(cp->selected_phys);
3578 
3579 	if (selected_phys & ~supported_phys)
3580 		return mgmt_cmd_status(sk, hdev->id,
3581 				       MGMT_OP_SET_PHY_CONFIGURATION,
3582 				       MGMT_STATUS_INVALID_PARAMS);
3583 
3584 	unconfigure_phys = supported_phys & ~configurable_phys;
3585 
3586 	if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3587 		return mgmt_cmd_status(sk, hdev->id,
3588 				       MGMT_OP_SET_PHY_CONFIGURATION,
3589 				       MGMT_STATUS_INVALID_PARAMS);
3590 
3591 	if (selected_phys == get_selected_phys(hdev))
3592 		return mgmt_cmd_complete(sk, hdev->id,
3593 					 MGMT_OP_SET_PHY_CONFIGURATION,
3594 					 0, NULL, 0);
3595 
3596 	hci_dev_lock(hdev);
3597 
3598 	if (!hdev_is_powered(hdev)) {
3599 		err = mgmt_cmd_status(sk, hdev->id,
3600 				      MGMT_OP_SET_PHY_CONFIGURATION,
3601 				      MGMT_STATUS_REJECTED);
3602 		goto unlock;
3603 	}
3604 
3605 	if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3606 		err = mgmt_cmd_status(sk, hdev->id,
3607 				      MGMT_OP_SET_PHY_CONFIGURATION,
3608 				      MGMT_STATUS_BUSY);
3609 		goto unlock;
3610 	}
3611 
3612 	if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3613 		pkt_type |= (HCI_DH3 | HCI_DM3);
3614 	else
3615 		pkt_type &= ~(HCI_DH3 | HCI_DM3);
3616 
3617 	if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3618 		pkt_type |= (HCI_DH5 | HCI_DM5);
3619 	else
3620 		pkt_type &= ~(HCI_DH5 | HCI_DM5);
3621 
3622 	if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3623 		pkt_type &= ~HCI_2DH1;
3624 	else
3625 		pkt_type |= HCI_2DH1;
3626 
3627 	if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3628 		pkt_type &= ~HCI_2DH3;
3629 	else
3630 		pkt_type |= HCI_2DH3;
3631 
3632 	if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3633 		pkt_type &= ~HCI_2DH5;
3634 	else
3635 		pkt_type |= HCI_2DH5;
3636 
3637 	if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3638 		pkt_type &= ~HCI_3DH1;
3639 	else
3640 		pkt_type |= HCI_3DH1;
3641 
3642 	if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3643 		pkt_type &= ~HCI_3DH3;
3644 	else
3645 		pkt_type |= HCI_3DH3;
3646 
3647 	if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3648 		pkt_type &= ~HCI_3DH5;
3649 	else
3650 		pkt_type |= HCI_3DH5;
3651 
3652 	if (pkt_type != hdev->pkt_type) {
3653 		hdev->pkt_type = pkt_type;
3654 		changed = true;
3655 	}
3656 
3657 	if ((selected_phys & MGMT_PHY_LE_MASK) ==
3658 	    (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3659 		if (changed)
3660 			mgmt_phy_configuration_changed(hdev, sk);
3661 
3662 		err = mgmt_cmd_complete(sk, hdev->id,
3663 					MGMT_OP_SET_PHY_CONFIGURATION,
3664 					0, NULL, 0);
3665 
3666 		goto unlock;
3667 	}
3668 
3669 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3670 			       len);
3671 	if (!cmd)
3672 		err = -ENOMEM;
3673 	else
3674 		err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
3675 					 set_default_phy_complete);
3676 
3677 	if (err < 0) {
3678 		err = mgmt_cmd_status(sk, hdev->id,
3679 				      MGMT_OP_SET_PHY_CONFIGURATION,
3680 				      MGMT_STATUS_FAILED);
3681 
3682 		if (cmd)
3683 			mgmt_pending_remove(cmd);
3684 	}
3685 
3686 unlock:
3687 	hci_dev_unlock(hdev);
3688 
3689 	return err;
3690 }
3691 
3692 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3693 			    u16 len)
3694 {
3695 	int err = MGMT_STATUS_SUCCESS;
3696 	struct mgmt_cp_set_blocked_keys *keys = data;
3697 	const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3698 				   sizeof(struct mgmt_blocked_key_info));
3699 	u16 key_count, expected_len;
3700 	int i;
3701 
3702 	bt_dev_dbg(hdev, "sock %p", sk);
3703 
3704 	key_count = __le16_to_cpu(keys->key_count);
3705 	if (key_count > max_key_count) {
3706 		bt_dev_err(hdev, "too big key_count value %u", key_count);
3707 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3708 				       MGMT_STATUS_INVALID_PARAMS);
3709 	}
3710 
3711 	expected_len = struct_size(keys, keys, key_count);
3712 	if (expected_len != len) {
3713 		bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3714 			   expected_len, len);
3715 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3716 				       MGMT_STATUS_INVALID_PARAMS);
3717 	}
3718 
3719 	hci_dev_lock(hdev);
3720 
3721 	hci_blocked_keys_clear(hdev);
3722 
3723 	for (i = 0; i < keys->key_count; ++i) {
3724 		struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3725 
3726 		if (!b) {
3727 			err = MGMT_STATUS_NO_RESOURCES;
3728 			break;
3729 		}
3730 
3731 		b->type = keys->keys[i].type;
3732 		memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3733 		list_add_rcu(&b->list, &hdev->blocked_keys);
3734 	}
3735 	hci_dev_unlock(hdev);
3736 
3737 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3738 				err, NULL, 0);
3739 }
3740 
3741 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3742 			       void *data, u16 len)
3743 {
3744 	struct mgmt_mode *cp = data;
3745 	int err;
3746 	bool changed = false;
3747 
3748 	bt_dev_dbg(hdev, "sock %p", sk);
3749 
3750 	if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3751 		return mgmt_cmd_status(sk, hdev->id,
3752 				       MGMT_OP_SET_WIDEBAND_SPEECH,
3753 				       MGMT_STATUS_NOT_SUPPORTED);
3754 
3755 	if (cp->val != 0x00 && cp->val != 0x01)
3756 		return mgmt_cmd_status(sk, hdev->id,
3757 				       MGMT_OP_SET_WIDEBAND_SPEECH,
3758 				       MGMT_STATUS_INVALID_PARAMS);
3759 
3760 	hci_dev_lock(hdev);
3761 
3762 	if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3763 		err = mgmt_cmd_status(sk, hdev->id,
3764 				      MGMT_OP_SET_WIDEBAND_SPEECH,
3765 				      MGMT_STATUS_BUSY);
3766 		goto unlock;
3767 	}
3768 
3769 	if (hdev_is_powered(hdev) &&
3770 	    !!cp->val != hci_dev_test_flag(hdev,
3771 					   HCI_WIDEBAND_SPEECH_ENABLED)) {
3772 		err = mgmt_cmd_status(sk, hdev->id,
3773 				      MGMT_OP_SET_WIDEBAND_SPEECH,
3774 				      MGMT_STATUS_REJECTED);
3775 		goto unlock;
3776 	}
3777 
3778 	if (cp->val)
3779 		changed = !hci_dev_test_and_set_flag(hdev,
3780 						   HCI_WIDEBAND_SPEECH_ENABLED);
3781 	else
3782 		changed = hci_dev_test_and_clear_flag(hdev,
3783 						   HCI_WIDEBAND_SPEECH_ENABLED);
3784 
3785 	err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3786 	if (err < 0)
3787 		goto unlock;
3788 
3789 	if (changed)
3790 		err = new_settings(hdev, sk);
3791 
3792 unlock:
3793 	hci_dev_unlock(hdev);
3794 	return err;
3795 }
3796 
3797 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3798 			       void *data, u16 data_len)
3799 {
3800 	char buf[20];
3801 	struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3802 	u16 cap_len = 0;
3803 	u8 flags = 0;
3804 	u8 tx_power_range[2];
3805 
3806 	bt_dev_dbg(hdev, "sock %p", sk);
3807 
3808 	memset(&buf, 0, sizeof(buf));
3809 
3810 	hci_dev_lock(hdev);
3811 
3812 	/* When the Read Simple Pairing Options command is supported, then
3813 	 * the remote public key validation is supported.
3814 	 *
3815 	 * Alternatively, when Microsoft extensions are available, they can
3816 	 * indicate support for public key validation as well.
3817 	 */
3818 	if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3819 		flags |= 0x01;	/* Remote public key validation (BR/EDR) */
3820 
3821 	flags |= 0x02;		/* Remote public key validation (LE) */
3822 
3823 	/* When the Read Encryption Key Size command is supported, then the
3824 	 * encryption key size is enforced.
3825 	 */
3826 	if (hdev->commands[20] & 0x10)
3827 		flags |= 0x04;	/* Encryption key size enforcement (BR/EDR) */
3828 
3829 	flags |= 0x08;		/* Encryption key size enforcement (LE) */
3830 
3831 	cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3832 				  &flags, 1);
3833 
3834 	/* When the Read Simple Pairing Options command is supported, then
3835 	 * also max encryption key size information is provided.
3836 	 */
3837 	if (hdev->commands[41] & 0x08)
3838 		cap_len = eir_append_le16(rp->cap, cap_len,
3839 					  MGMT_CAP_MAX_ENC_KEY_SIZE,
3840 					  hdev->max_enc_key_size);
3841 
3842 	cap_len = eir_append_le16(rp->cap, cap_len,
3843 				  MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3844 				  SMP_MAX_ENC_KEY_SIZE);
3845 
3846 	/* Append the min/max LE tx power parameters if we were able to fetch
3847 	 * it from the controller
3848 	 */
3849 	if (hdev->commands[38] & 0x80) {
3850 		memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3851 		memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3852 		cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3853 					  tx_power_range, 2);
3854 	}
3855 
3856 	rp->cap_len = cpu_to_le16(cap_len);
3857 
3858 	hci_dev_unlock(hdev);
3859 
3860 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3861 				 rp, sizeof(*rp) + cap_len);
3862 }
3863 
3864 #ifdef CONFIG_BT_FEATURE_DEBUG
3865 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3866 static const u8 debug_uuid[16] = {
3867 	0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3868 	0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3869 };
3870 #endif
3871 
3872 /* 330859bc-7506-492d-9370-9a6f0614037f */
3873 static const u8 quality_report_uuid[16] = {
3874 	0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
3875 	0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
3876 };
3877 
3878 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
3879 static const u8 offload_codecs_uuid[16] = {
3880 	0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
3881 	0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
3882 };
3883 
3884 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3885 static const u8 le_simultaneous_roles_uuid[16] = {
3886 	0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3887 	0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3888 };
3889 
3890 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3891 static const u8 rpa_resolution_uuid[16] = {
3892 	0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3893 	0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3894 };
3895 
3896 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3897 				  void *data, u16 data_len)
3898 {
3899 	char buf[102];   /* Enough space for 5 features: 2 + 20 * 5 */
3900 	struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3901 	u16 idx = 0;
3902 	u32 flags;
3903 
3904 	bt_dev_dbg(hdev, "sock %p", sk);
3905 
3906 	memset(&buf, 0, sizeof(buf));
3907 
3908 #ifdef CONFIG_BT_FEATURE_DEBUG
3909 	if (!hdev) {
3910 		flags = bt_dbg_get() ? BIT(0) : 0;
3911 
3912 		memcpy(rp->features[idx].uuid, debug_uuid, 16);
3913 		rp->features[idx].flags = cpu_to_le32(flags);
3914 		idx++;
3915 	}
3916 #endif
3917 
3918 	if (hdev && hci_dev_le_state_simultaneous(hdev)) {
3919 		if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
3920 			flags = BIT(0);
3921 		else
3922 			flags = 0;
3923 
3924 		memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
3925 		rp->features[idx].flags = cpu_to_le32(flags);
3926 		idx++;
3927 	}
3928 
3929 	if (hdev && ll_privacy_capable(hdev)) {
3930 		if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3931 			flags = BIT(0) | BIT(1);
3932 		else
3933 			flags = BIT(1);
3934 
3935 		memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3936 		rp->features[idx].flags = cpu_to_le32(flags);
3937 		idx++;
3938 	}
3939 
3940 	if (hdev && (aosp_has_quality_report(hdev) ||
3941 		     hdev->set_quality_report)) {
3942 		if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
3943 			flags = BIT(0);
3944 		else
3945 			flags = 0;
3946 
3947 		memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
3948 		rp->features[idx].flags = cpu_to_le32(flags);
3949 		idx++;
3950 	}
3951 
3952 	if (hdev && hdev->get_data_path_id) {
3953 		if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
3954 			flags = BIT(0);
3955 		else
3956 			flags = 0;
3957 
3958 		memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
3959 		rp->features[idx].flags = cpu_to_le32(flags);
3960 		idx++;
3961 	}
3962 
3963 	rp->feature_count = cpu_to_le16(idx);
3964 
3965 	/* After reading the experimental features information, enable
3966 	 * the events to update client on any future change.
3967 	 */
3968 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3969 
3970 	return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3971 				 MGMT_OP_READ_EXP_FEATURES_INFO,
3972 				 0, rp, sizeof(*rp) + (20 * idx));
3973 }
3974 
3975 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3976 					  struct sock *skip)
3977 {
3978 	struct mgmt_ev_exp_feature_changed ev;
3979 
3980 	memset(&ev, 0, sizeof(ev));
3981 	memcpy(ev.uuid, rpa_resolution_uuid, 16);
3982 	ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3983 
3984 	if (enabled && privacy_mode_capable(hdev))
3985 		set_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags);
3986 	else
3987 		clear_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags);
3988 
3989 	return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3990 				  &ev, sizeof(ev),
3991 				  HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3992 
3993 }
3994 
3995 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
3996 			       bool enabled, struct sock *skip)
3997 {
3998 	struct mgmt_ev_exp_feature_changed ev;
3999 
4000 	memset(&ev, 0, sizeof(ev));
4001 	memcpy(ev.uuid, uuid, 16);
4002 	ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4003 
4004 	return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4005 				  &ev, sizeof(ev),
4006 				  HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4007 }
4008 
4009 #define EXP_FEAT(_uuid, _set_func)	\
4010 {					\
4011 	.uuid = _uuid,			\
4012 	.set_func = _set_func,		\
4013 }
4014 
4015 /* The zero key uuid is special. Multiple exp features are set through it. */
4016 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4017 			     struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4018 {
4019 	struct mgmt_rp_set_exp_feature rp;
4020 
4021 	memset(rp.uuid, 0, 16);
4022 	rp.flags = cpu_to_le32(0);
4023 
4024 #ifdef CONFIG_BT_FEATURE_DEBUG
4025 	if (!hdev) {
4026 		bool changed = bt_dbg_get();
4027 
4028 		bt_dbg_set(false);
4029 
4030 		if (changed)
4031 			exp_feature_changed(NULL, ZERO_KEY, false, sk);
4032 	}
4033 #endif
4034 
4035 	if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4036 		bool changed;
4037 
4038 		changed = hci_dev_test_and_clear_flag(hdev,
4039 						      HCI_ENABLE_LL_PRIVACY);
4040 		if (changed)
4041 			exp_feature_changed(hdev, rpa_resolution_uuid, false,
4042 					    sk);
4043 	}
4044 
4045 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4046 
4047 	return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4048 				 MGMT_OP_SET_EXP_FEATURE, 0,
4049 				 &rp, sizeof(rp));
4050 }
4051 
4052 #ifdef CONFIG_BT_FEATURE_DEBUG
4053 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4054 			  struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4055 {
4056 	struct mgmt_rp_set_exp_feature rp;
4057 
4058 	bool val, changed;
4059 	int err;
4060 
4061 	/* Command requires to use the non-controller index */
4062 	if (hdev)
4063 		return mgmt_cmd_status(sk, hdev->id,
4064 				       MGMT_OP_SET_EXP_FEATURE,
4065 				       MGMT_STATUS_INVALID_INDEX);
4066 
4067 	/* Parameters are limited to a single octet */
4068 	if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4069 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4070 				       MGMT_OP_SET_EXP_FEATURE,
4071 				       MGMT_STATUS_INVALID_PARAMS);
4072 
4073 	/* Only boolean on/off is supported */
4074 	if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4075 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4076 				       MGMT_OP_SET_EXP_FEATURE,
4077 				       MGMT_STATUS_INVALID_PARAMS);
4078 
4079 	val = !!cp->param[0];
4080 	changed = val ? !bt_dbg_get() : bt_dbg_get();
4081 	bt_dbg_set(val);
4082 
4083 	memcpy(rp.uuid, debug_uuid, 16);
4084 	rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4085 
4086 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4087 
4088 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4089 				MGMT_OP_SET_EXP_FEATURE, 0,
4090 				&rp, sizeof(rp));
4091 
4092 	if (changed)
4093 		exp_feature_changed(hdev, debug_uuid, val, sk);
4094 
4095 	return err;
4096 }
4097 #endif
4098 
4099 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4100 				   struct mgmt_cp_set_exp_feature *cp,
4101 				   u16 data_len)
4102 {
4103 	struct mgmt_rp_set_exp_feature rp;
4104 	bool val, changed;
4105 	int err;
4106 	u32 flags;
4107 
4108 	/* Command requires to use the controller index */
4109 	if (!hdev)
4110 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4111 				       MGMT_OP_SET_EXP_FEATURE,
4112 				       MGMT_STATUS_INVALID_INDEX);
4113 
4114 	/* Changes can only be made when controller is powered down */
4115 	if (hdev_is_powered(hdev))
4116 		return mgmt_cmd_status(sk, hdev->id,
4117 				       MGMT_OP_SET_EXP_FEATURE,
4118 				       MGMT_STATUS_REJECTED);
4119 
4120 	/* Parameters are limited to a single octet */
4121 	if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4122 		return mgmt_cmd_status(sk, hdev->id,
4123 				       MGMT_OP_SET_EXP_FEATURE,
4124 				       MGMT_STATUS_INVALID_PARAMS);
4125 
4126 	/* Only boolean on/off is supported */
4127 	if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4128 		return mgmt_cmd_status(sk, hdev->id,
4129 				       MGMT_OP_SET_EXP_FEATURE,
4130 				       MGMT_STATUS_INVALID_PARAMS);
4131 
4132 	val = !!cp->param[0];
4133 
4134 	if (val) {
4135 		changed = !hci_dev_test_and_set_flag(hdev,
4136 						     HCI_ENABLE_LL_PRIVACY);
4137 		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4138 
4139 		/* Enable LL privacy + supported settings changed */
4140 		flags = BIT(0) | BIT(1);
4141 	} else {
4142 		changed = hci_dev_test_and_clear_flag(hdev,
4143 						      HCI_ENABLE_LL_PRIVACY);
4144 
4145 		/* Disable LL privacy + supported settings changed */
4146 		flags = BIT(1);
4147 	}
4148 
4149 	memcpy(rp.uuid, rpa_resolution_uuid, 16);
4150 	rp.flags = cpu_to_le32(flags);
4151 
4152 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4153 
4154 	err = mgmt_cmd_complete(sk, hdev->id,
4155 				MGMT_OP_SET_EXP_FEATURE, 0,
4156 				&rp, sizeof(rp));
4157 
4158 	if (changed)
4159 		exp_ll_privacy_feature_changed(val, hdev, sk);
4160 
4161 	return err;
4162 }
4163 
4164 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4165 				   struct mgmt_cp_set_exp_feature *cp,
4166 				   u16 data_len)
4167 {
4168 	struct mgmt_rp_set_exp_feature rp;
4169 	bool val, changed;
4170 	int err;
4171 
4172 	/* Command requires to use a valid controller index */
4173 	if (!hdev)
4174 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4175 				       MGMT_OP_SET_EXP_FEATURE,
4176 				       MGMT_STATUS_INVALID_INDEX);
4177 
4178 	/* Parameters are limited to a single octet */
4179 	if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4180 		return mgmt_cmd_status(sk, hdev->id,
4181 				       MGMT_OP_SET_EXP_FEATURE,
4182 				       MGMT_STATUS_INVALID_PARAMS);
4183 
4184 	/* Only boolean on/off is supported */
4185 	if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4186 		return mgmt_cmd_status(sk, hdev->id,
4187 				       MGMT_OP_SET_EXP_FEATURE,
4188 				       MGMT_STATUS_INVALID_PARAMS);
4189 
4190 	hci_req_sync_lock(hdev);
4191 
4192 	val = !!cp->param[0];
4193 	changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4194 
4195 	if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4196 		err = mgmt_cmd_status(sk, hdev->id,
4197 				      MGMT_OP_SET_EXP_FEATURE,
4198 				      MGMT_STATUS_NOT_SUPPORTED);
4199 		goto unlock_quality_report;
4200 	}
4201 
4202 	if (changed) {
4203 		if (hdev->set_quality_report)
4204 			err = hdev->set_quality_report(hdev, val);
4205 		else
4206 			err = aosp_set_quality_report(hdev, val);
4207 
4208 		if (err) {
4209 			err = mgmt_cmd_status(sk, hdev->id,
4210 					      MGMT_OP_SET_EXP_FEATURE,
4211 					      MGMT_STATUS_FAILED);
4212 			goto unlock_quality_report;
4213 		}
4214 
4215 		if (val)
4216 			hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4217 		else
4218 			hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4219 	}
4220 
4221 	bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4222 
4223 	memcpy(rp.uuid, quality_report_uuid, 16);
4224 	rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4225 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4226 
4227 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4228 				&rp, sizeof(rp));
4229 
4230 	if (changed)
4231 		exp_feature_changed(hdev, quality_report_uuid, val, sk);
4232 
4233 unlock_quality_report:
4234 	hci_req_sync_unlock(hdev);
4235 	return err;
4236 }
4237 
4238 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4239 				  struct mgmt_cp_set_exp_feature *cp,
4240 				  u16 data_len)
4241 {
4242 	bool val, changed;
4243 	int err;
4244 	struct mgmt_rp_set_exp_feature rp;
4245 
4246 	/* Command requires to use a valid controller index */
4247 	if (!hdev)
4248 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4249 				       MGMT_OP_SET_EXP_FEATURE,
4250 				       MGMT_STATUS_INVALID_INDEX);
4251 
4252 	/* Parameters are limited to a single octet */
4253 	if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4254 		return mgmt_cmd_status(sk, hdev->id,
4255 				       MGMT_OP_SET_EXP_FEATURE,
4256 				       MGMT_STATUS_INVALID_PARAMS);
4257 
4258 	/* Only boolean on/off is supported */
4259 	if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4260 		return mgmt_cmd_status(sk, hdev->id,
4261 				       MGMT_OP_SET_EXP_FEATURE,
4262 				       MGMT_STATUS_INVALID_PARAMS);
4263 
4264 	val = !!cp->param[0];
4265 	changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4266 
4267 	if (!hdev->get_data_path_id) {
4268 		return mgmt_cmd_status(sk, hdev->id,
4269 				       MGMT_OP_SET_EXP_FEATURE,
4270 				       MGMT_STATUS_NOT_SUPPORTED);
4271 	}
4272 
4273 	if (changed) {
4274 		if (val)
4275 			hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4276 		else
4277 			hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4278 	}
4279 
4280 	bt_dev_info(hdev, "offload codecs enable %d changed %d",
4281 		    val, changed);
4282 
4283 	memcpy(rp.uuid, offload_codecs_uuid, 16);
4284 	rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4285 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4286 	err = mgmt_cmd_complete(sk, hdev->id,
4287 				MGMT_OP_SET_EXP_FEATURE, 0,
4288 				&rp, sizeof(rp));
4289 
4290 	if (changed)
4291 		exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4292 
4293 	return err;
4294 }
4295 
4296 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4297 					  struct mgmt_cp_set_exp_feature *cp,
4298 					  u16 data_len)
4299 {
4300 	bool val, changed;
4301 	int err;
4302 	struct mgmt_rp_set_exp_feature rp;
4303 
4304 	/* Command requires to use a valid controller index */
4305 	if (!hdev)
4306 		return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4307 				       MGMT_OP_SET_EXP_FEATURE,
4308 				       MGMT_STATUS_INVALID_INDEX);
4309 
4310 	/* Parameters are limited to a single octet */
4311 	if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4312 		return mgmt_cmd_status(sk, hdev->id,
4313 				       MGMT_OP_SET_EXP_FEATURE,
4314 				       MGMT_STATUS_INVALID_PARAMS);
4315 
4316 	/* Only boolean on/off is supported */
4317 	if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4318 		return mgmt_cmd_status(sk, hdev->id,
4319 				       MGMT_OP_SET_EXP_FEATURE,
4320 				       MGMT_STATUS_INVALID_PARAMS);
4321 
4322 	val = !!cp->param[0];
4323 	changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4324 
4325 	if (!hci_dev_le_state_simultaneous(hdev)) {
4326 		return mgmt_cmd_status(sk, hdev->id,
4327 				       MGMT_OP_SET_EXP_FEATURE,
4328 				       MGMT_STATUS_NOT_SUPPORTED);
4329 	}
4330 
4331 	if (changed) {
4332 		if (val)
4333 			hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4334 		else
4335 			hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4336 	}
4337 
4338 	bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4339 		    val, changed);
4340 
4341 	memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4342 	rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4343 	hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4344 	err = mgmt_cmd_complete(sk, hdev->id,
4345 				MGMT_OP_SET_EXP_FEATURE, 0,
4346 				&rp, sizeof(rp));
4347 
4348 	if (changed)
4349 		exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4350 
4351 	return err;
4352 }
4353 
4354 static const struct mgmt_exp_feature {
4355 	const u8 *uuid;
4356 	int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4357 			struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4358 } exp_features[] = {
4359 	EXP_FEAT(ZERO_KEY, set_zero_key_func),
4360 #ifdef CONFIG_BT_FEATURE_DEBUG
4361 	EXP_FEAT(debug_uuid, set_debug_func),
4362 #endif
4363 	EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4364 	EXP_FEAT(quality_report_uuid, set_quality_report_func),
4365 	EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
4366 	EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
4367 
4368 	/* end with a null feature */
4369 	EXP_FEAT(NULL, NULL)
4370 };
4371 
4372 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4373 			   void *data, u16 data_len)
4374 {
4375 	struct mgmt_cp_set_exp_feature *cp = data;
4376 	size_t i = 0;
4377 
4378 	bt_dev_dbg(hdev, "sock %p", sk);
4379 
4380 	for (i = 0; exp_features[i].uuid; i++) {
4381 		if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4382 			return exp_features[i].set_func(sk, hdev, cp, data_len);
4383 	}
4384 
4385 	return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4386 			       MGMT_OP_SET_EXP_FEATURE,
4387 			       MGMT_STATUS_NOT_SUPPORTED);
4388 }
4389 
4390 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4391 			    u16 data_len)
4392 {
4393 	struct mgmt_cp_get_device_flags *cp = data;
4394 	struct mgmt_rp_get_device_flags rp;
4395 	struct bdaddr_list_with_flags *br_params;
4396 	struct hci_conn_params *params;
4397 	u32 supported_flags;
4398 	u32 current_flags = 0;
4399 	u8 status = MGMT_STATUS_INVALID_PARAMS;
4400 
4401 	bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4402 		   &cp->addr.bdaddr, cp->addr.type);
4403 
4404 	hci_dev_lock(hdev);
4405 
4406 	bitmap_to_arr32(&supported_flags, hdev->conn_flags,
4407 			__HCI_CONN_NUM_FLAGS);
4408 
4409 	memset(&rp, 0, sizeof(rp));
4410 
4411 	if (cp->addr.type == BDADDR_BREDR) {
4412 		br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4413 							      &cp->addr.bdaddr,
4414 							      cp->addr.type);
4415 		if (!br_params)
4416 			goto done;
4417 
4418 		bitmap_to_arr32(&current_flags, br_params->flags,
4419 				__HCI_CONN_NUM_FLAGS);
4420 	} else {
4421 		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4422 						le_addr_type(cp->addr.type));
4423 
4424 		if (!params)
4425 			goto done;
4426 
4427 		bitmap_to_arr32(&current_flags, params->flags,
4428 				__HCI_CONN_NUM_FLAGS);
4429 	}
4430 
4431 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4432 	rp.addr.type = cp->addr.type;
4433 	rp.supported_flags = cpu_to_le32(supported_flags);
4434 	rp.current_flags = cpu_to_le32(current_flags);
4435 
4436 	status = MGMT_STATUS_SUCCESS;
4437 
4438 done:
4439 	hci_dev_unlock(hdev);
4440 
4441 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4442 				&rp, sizeof(rp));
4443 }
4444 
4445 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4446 				 bdaddr_t *bdaddr, u8 bdaddr_type,
4447 				 u32 supported_flags, u32 current_flags)
4448 {
4449 	struct mgmt_ev_device_flags_changed ev;
4450 
4451 	bacpy(&ev.addr.bdaddr, bdaddr);
4452 	ev.addr.type = bdaddr_type;
4453 	ev.supported_flags = cpu_to_le32(supported_flags);
4454 	ev.current_flags = cpu_to_le32(current_flags);
4455 
4456 	mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4457 }
4458 
4459 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4460 			    u16 len)
4461 {
4462 	struct mgmt_cp_set_device_flags *cp = data;
4463 	struct bdaddr_list_with_flags *br_params;
4464 	struct hci_conn_params *params;
4465 	u8 status = MGMT_STATUS_INVALID_PARAMS;
4466 	u32 supported_flags;
4467 	u32 current_flags = __le32_to_cpu(cp->current_flags);
4468 
4469 	bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4470 		   &cp->addr.bdaddr, cp->addr.type,
4471 		   __le32_to_cpu(current_flags));
4472 
4473 	bitmap_to_arr32(&supported_flags, hdev->conn_flags,
4474 			__HCI_CONN_NUM_FLAGS);
4475 
4476 	if ((supported_flags | current_flags) != supported_flags) {
4477 		bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4478 			    current_flags, supported_flags);
4479 		goto done;
4480 	}
4481 
4482 	hci_dev_lock(hdev);
4483 
4484 	if (cp->addr.type == BDADDR_BREDR) {
4485 		br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4486 							      &cp->addr.bdaddr,
4487 							      cp->addr.type);
4488 
4489 		if (br_params) {
4490 			bitmap_from_u64(br_params->flags, current_flags);
4491 			status = MGMT_STATUS_SUCCESS;
4492 		} else {
4493 			bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4494 				    &cp->addr.bdaddr, cp->addr.type);
4495 		}
4496 	} else {
4497 		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4498 						le_addr_type(cp->addr.type));
4499 		if (params) {
4500 			bitmap_from_u64(params->flags, current_flags);
4501 			status = MGMT_STATUS_SUCCESS;
4502 
4503 			/* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
4504 			 * has been set.
4505 			 */
4506 			if (test_bit(HCI_CONN_FLAG_DEVICE_PRIVACY,
4507 				     params->flags))
4508 				hci_update_passive_scan(hdev);
4509 		} else {
4510 			bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4511 				    &cp->addr.bdaddr,
4512 				    le_addr_type(cp->addr.type));
4513 		}
4514 	}
4515 
4516 done:
4517 	hci_dev_unlock(hdev);
4518 
4519 	if (status == MGMT_STATUS_SUCCESS)
4520 		device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4521 				     supported_flags, current_flags);
4522 
4523 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4524 				 &cp->addr, sizeof(cp->addr));
4525 }
4526 
4527 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4528 				   u16 handle)
4529 {
4530 	struct mgmt_ev_adv_monitor_added ev;
4531 
4532 	ev.monitor_handle = cpu_to_le16(handle);
4533 
4534 	mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4535 }
4536 
4537 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4538 {
4539 	struct mgmt_ev_adv_monitor_removed ev;
4540 	struct mgmt_pending_cmd *cmd;
4541 	struct sock *sk_skip = NULL;
4542 	struct mgmt_cp_remove_adv_monitor *cp;
4543 
4544 	cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4545 	if (cmd) {
4546 		cp = cmd->param;
4547 
4548 		if (cp->monitor_handle)
4549 			sk_skip = cmd->sk;
4550 	}
4551 
4552 	ev.monitor_handle = cpu_to_le16(handle);
4553 
4554 	mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4555 }
4556 
4557 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4558 				 void *data, u16 len)
4559 {
4560 	struct adv_monitor *monitor = NULL;
4561 	struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4562 	int handle, err;
4563 	size_t rp_size = 0;
4564 	__u32 supported = 0;
4565 	__u32 enabled = 0;
4566 	__u16 num_handles = 0;
4567 	__u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4568 
4569 	BT_DBG("request for %s", hdev->name);
4570 
4571 	hci_dev_lock(hdev);
4572 
4573 	if (msft_monitor_supported(hdev))
4574 		supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4575 
4576 	idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4577 		handles[num_handles++] = monitor->handle;
4578 
4579 	hci_dev_unlock(hdev);
4580 
4581 	rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4582 	rp = kmalloc(rp_size, GFP_KERNEL);
4583 	if (!rp)
4584 		return -ENOMEM;
4585 
4586 	/* All supported features are currently enabled */
4587 	enabled = supported;
4588 
4589 	rp->supported_features = cpu_to_le32(supported);
4590 	rp->enabled_features = cpu_to_le32(enabled);
4591 	rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4592 	rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4593 	rp->num_handles = cpu_to_le16(num_handles);
4594 	if (num_handles)
4595 		memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4596 
4597 	err = mgmt_cmd_complete(sk, hdev->id,
4598 				MGMT_OP_READ_ADV_MONITOR_FEATURES,
4599 				MGMT_STATUS_SUCCESS, rp, rp_size);
4600 
4601 	kfree(rp);
4602 
4603 	return err;
4604 }
4605 
4606 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4607 {
4608 	struct mgmt_rp_add_adv_patterns_monitor rp;
4609 	struct mgmt_pending_cmd *cmd;
4610 	struct adv_monitor *monitor;
4611 	int err = 0;
4612 
4613 	hci_dev_lock(hdev);
4614 
4615 	cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4616 	if (!cmd) {
4617 		cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4618 		if (!cmd)
4619 			goto done;
4620 	}
4621 
4622 	monitor = cmd->user_data;
4623 	rp.monitor_handle = cpu_to_le16(monitor->handle);
4624 
4625 	if (!status) {
4626 		mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4627 		hdev->adv_monitors_cnt++;
4628 		if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4629 			monitor->state = ADV_MONITOR_STATE_REGISTERED;
4630 		hci_update_passive_scan(hdev);
4631 	}
4632 
4633 	err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4634 				mgmt_status(status), &rp, sizeof(rp));
4635 	mgmt_pending_remove(cmd);
4636 
4637 done:
4638 	hci_dev_unlock(hdev);
4639 	bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4640 		   rp.monitor_handle, status);
4641 
4642 	return err;
4643 }
4644 
4645 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4646 				      struct adv_monitor *m, u8 status,
4647 				      void *data, u16 len, u16 op)
4648 {
4649 	struct mgmt_rp_add_adv_patterns_monitor rp;
4650 	struct mgmt_pending_cmd *cmd;
4651 	int err;
4652 	bool pending;
4653 
4654 	hci_dev_lock(hdev);
4655 
4656 	if (status)
4657 		goto unlock;
4658 
4659 	if (pending_find(MGMT_OP_SET_LE, hdev) ||
4660 	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4661 	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4662 	    pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4663 		status = MGMT_STATUS_BUSY;
4664 		goto unlock;
4665 	}
4666 
4667 	cmd = mgmt_pending_add(sk, op, hdev, data, len);
4668 	if (!cmd) {
4669 		status = MGMT_STATUS_NO_RESOURCES;
4670 		goto unlock;
4671 	}
4672 
4673 	cmd->user_data = m;
4674 	pending = hci_add_adv_monitor(hdev, m, &err);
4675 	if (err) {
4676 		if (err == -ENOSPC || err == -ENOMEM)
4677 			status = MGMT_STATUS_NO_RESOURCES;
4678 		else if (err == -EINVAL)
4679 			status = MGMT_STATUS_INVALID_PARAMS;
4680 		else
4681 			status = MGMT_STATUS_FAILED;
4682 
4683 		mgmt_pending_remove(cmd);
4684 		goto unlock;
4685 	}
4686 
4687 	if (!pending) {
4688 		mgmt_pending_remove(cmd);
4689 		rp.monitor_handle = cpu_to_le16(m->handle);
4690 		mgmt_adv_monitor_added(sk, hdev, m->handle);
4691 		m->state = ADV_MONITOR_STATE_REGISTERED;
4692 		hdev->adv_monitors_cnt++;
4693 
4694 		hci_dev_unlock(hdev);
4695 		return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4696 					 &rp, sizeof(rp));
4697 	}
4698 
4699 	hci_dev_unlock(hdev);
4700 
4701 	return 0;
4702 
4703 unlock:
4704 	hci_free_adv_monitor(hdev, m);
4705 	hci_dev_unlock(hdev);
4706 	return mgmt_cmd_status(sk, hdev->id, op, status);
4707 }
4708 
4709 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4710 				   struct mgmt_adv_rssi_thresholds *rssi)
4711 {
4712 	if (rssi) {
4713 		m->rssi.low_threshold = rssi->low_threshold;
4714 		m->rssi.low_threshold_timeout =
4715 		    __le16_to_cpu(rssi->low_threshold_timeout);
4716 		m->rssi.high_threshold = rssi->high_threshold;
4717 		m->rssi.high_threshold_timeout =
4718 		    __le16_to_cpu(rssi->high_threshold_timeout);
4719 		m->rssi.sampling_period = rssi->sampling_period;
4720 	} else {
4721 		/* Default values. These numbers are the least constricting
4722 		 * parameters for MSFT API to work, so it behaves as if there
4723 		 * are no rssi parameter to consider. May need to be changed
4724 		 * if other API are to be supported.
4725 		 */
4726 		m->rssi.low_threshold = -127;
4727 		m->rssi.low_threshold_timeout = 60;
4728 		m->rssi.high_threshold = -127;
4729 		m->rssi.high_threshold_timeout = 0;
4730 		m->rssi.sampling_period = 0;
4731 	}
4732 }
4733 
4734 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4735 				    struct mgmt_adv_pattern *patterns)
4736 {
4737 	u8 offset = 0, length = 0;
4738 	struct adv_pattern *p = NULL;
4739 	int i;
4740 
4741 	for (i = 0; i < pattern_count; i++) {
4742 		offset = patterns[i].offset;
4743 		length = patterns[i].length;
4744 		if (offset >= HCI_MAX_AD_LENGTH ||
4745 		    length > HCI_MAX_AD_LENGTH ||
4746 		    (offset + length) > HCI_MAX_AD_LENGTH)
4747 			return MGMT_STATUS_INVALID_PARAMS;
4748 
4749 		p = kmalloc(sizeof(*p), GFP_KERNEL);
4750 		if (!p)
4751 			return MGMT_STATUS_NO_RESOURCES;
4752 
4753 		p->ad_type = patterns[i].ad_type;
4754 		p->offset = patterns[i].offset;
4755 		p->length = patterns[i].length;
4756 		memcpy(p->value, patterns[i].value, p->length);
4757 
4758 		INIT_LIST_HEAD(&p->list);
4759 		list_add(&p->list, &m->patterns);
4760 	}
4761 
4762 	return MGMT_STATUS_SUCCESS;
4763 }
4764 
4765 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4766 				    void *data, u16 len)
4767 {
4768 	struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4769 	struct adv_monitor *m = NULL;
4770 	u8 status = MGMT_STATUS_SUCCESS;
4771 	size_t expected_size = sizeof(*cp);
4772 
4773 	BT_DBG("request for %s", hdev->name);
4774 
4775 	if (len <= sizeof(*cp)) {
4776 		status = MGMT_STATUS_INVALID_PARAMS;
4777 		goto done;
4778 	}
4779 
4780 	expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4781 	if (len != expected_size) {
4782 		status = MGMT_STATUS_INVALID_PARAMS;
4783 		goto done;
4784 	}
4785 
4786 	m = kzalloc(sizeof(*m), GFP_KERNEL);
4787 	if (!m) {
4788 		status = MGMT_STATUS_NO_RESOURCES;
4789 		goto done;
4790 	}
4791 
4792 	INIT_LIST_HEAD(&m->patterns);
4793 
4794 	parse_adv_monitor_rssi(m, NULL);
4795 	status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4796 
4797 done:
4798 	return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4799 					  MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4800 }
4801 
4802 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4803 					 void *data, u16 len)
4804 {
4805 	struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4806 	struct adv_monitor *m = NULL;
4807 	u8 status = MGMT_STATUS_SUCCESS;
4808 	size_t expected_size = sizeof(*cp);
4809 
4810 	BT_DBG("request for %s", hdev->name);
4811 
4812 	if (len <= sizeof(*cp)) {
4813 		status = MGMT_STATUS_INVALID_PARAMS;
4814 		goto done;
4815 	}
4816 
4817 	expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4818 	if (len != expected_size) {
4819 		status = MGMT_STATUS_INVALID_PARAMS;
4820 		goto done;
4821 	}
4822 
4823 	m = kzalloc(sizeof(*m), GFP_KERNEL);
4824 	if (!m) {
4825 		status = MGMT_STATUS_NO_RESOURCES;
4826 		goto done;
4827 	}
4828 
4829 	INIT_LIST_HEAD(&m->patterns);
4830 
4831 	parse_adv_monitor_rssi(m, &cp->rssi);
4832 	status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4833 
4834 done:
4835 	return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4836 					 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4837 }
4838 
4839 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4840 {
4841 	struct mgmt_rp_remove_adv_monitor rp;
4842 	struct mgmt_cp_remove_adv_monitor *cp;
4843 	struct mgmt_pending_cmd *cmd;
4844 	int err = 0;
4845 
4846 	hci_dev_lock(hdev);
4847 
4848 	cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4849 	if (!cmd)
4850 		goto done;
4851 
4852 	cp = cmd->param;
4853 	rp.monitor_handle = cp->monitor_handle;
4854 
4855 	if (!status)
4856 		hci_update_passive_scan(hdev);
4857 
4858 	err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4859 				mgmt_status(status), &rp, sizeof(rp));
4860 	mgmt_pending_remove(cmd);
4861 
4862 done:
4863 	hci_dev_unlock(hdev);
4864 	bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4865 		   rp.monitor_handle, status);
4866 
4867 	return err;
4868 }
4869 
4870 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4871 			      void *data, u16 len)
4872 {
4873 	struct mgmt_cp_remove_adv_monitor *cp = data;
4874 	struct mgmt_rp_remove_adv_monitor rp;
4875 	struct mgmt_pending_cmd *cmd;
4876 	u16 handle = __le16_to_cpu(cp->monitor_handle);
4877 	int err, status;
4878 	bool pending;
4879 
4880 	BT_DBG("request for %s", hdev->name);
4881 	rp.monitor_handle = cp->monitor_handle;
4882 
4883 	hci_dev_lock(hdev);
4884 
4885 	if (pending_find(MGMT_OP_SET_LE, hdev) ||
4886 	    pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4887 	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4888 	    pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4889 		status = MGMT_STATUS_BUSY;
4890 		goto unlock;
4891 	}
4892 
4893 	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4894 	if (!cmd) {
4895 		status = MGMT_STATUS_NO_RESOURCES;
4896 		goto unlock;
4897 	}
4898 
4899 	if (handle)
4900 		pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4901 	else
4902 		pending = hci_remove_all_adv_monitor(hdev, &err);
4903 
4904 	if (err) {
4905 		mgmt_pending_remove(cmd);
4906 
4907 		if (err == -ENOENT)
4908 			status = MGMT_STATUS_INVALID_INDEX;
4909 		else
4910 			status = MGMT_STATUS_FAILED;
4911 
4912 		goto unlock;
4913 	}
4914 
4915 	/* monitor can be removed without forwarding request to controller */
4916 	if (!pending) {
4917 		mgmt_pending_remove(cmd);
4918 		hci_dev_unlock(hdev);
4919 
4920 		return mgmt_cmd_complete(sk, hdev->id,
4921 					 MGMT_OP_REMOVE_ADV_MONITOR,
4922 					 MGMT_STATUS_SUCCESS,
4923 					 &rp, sizeof(rp));
4924 	}
4925 
4926 	hci_dev_unlock(hdev);
4927 	return 0;
4928 
4929 unlock:
4930 	hci_dev_unlock(hdev);
4931 	return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4932 			       status);
4933 }
4934 
4935 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
4936 {
4937 	struct mgmt_rp_read_local_oob_data mgmt_rp;
4938 	size_t rp_size = sizeof(mgmt_rp);
4939 	struct mgmt_pending_cmd *cmd = data;
4940 	struct sk_buff *skb = cmd->skb;
4941 	u8 status = mgmt_status(err);
4942 
4943 	if (!status) {
4944 		if (!skb)
4945 			status = MGMT_STATUS_FAILED;
4946 		else if (IS_ERR(skb))
4947 			status = mgmt_status(PTR_ERR(skb));
4948 		else
4949 			status = mgmt_status(skb->data[0]);
4950 	}
4951 
4952 	bt_dev_dbg(hdev, "status %d", status);
4953 
4954 	if (status) {
4955 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
4956 		goto remove;
4957 	}
4958 
4959 	memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4960 
4961 	if (!bredr_sc_enabled(hdev)) {
4962 		struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4963 
4964 		if (skb->len < sizeof(*rp)) {
4965 			mgmt_cmd_status(cmd->sk, hdev->id,
4966 					MGMT_OP_READ_LOCAL_OOB_DATA,
4967 					MGMT_STATUS_FAILED);
4968 			goto remove;
4969 		}
4970 
4971 		memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4972 		memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4973 
4974 		rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4975 	} else {
4976 		struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4977 
4978 		if (skb->len < sizeof(*rp)) {
4979 			mgmt_cmd_status(cmd->sk, hdev->id,
4980 					MGMT_OP_READ_LOCAL_OOB_DATA,
4981 					MGMT_STATUS_FAILED);
4982 			goto remove;
4983 		}
4984 
4985 		memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4986 		memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4987 
4988 		memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4989 		memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4990 	}
4991 
4992 	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4993 			  MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4994 
4995 remove:
4996 	if (skb && !IS_ERR(skb))
4997 		kfree_skb(skb);
4998 
4999 	mgmt_pending_free(cmd);
5000 }
5001 
5002 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5003 {
5004 	struct mgmt_pending_cmd *cmd = data;
5005 
5006 	if (bredr_sc_enabled(hdev))
5007 		cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5008 	else
5009 		cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5010 
5011 	if (IS_ERR(cmd->skb))
5012 		return PTR_ERR(cmd->skb);
5013 	else
5014 		return 0;
5015 }
5016 
5017 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5018 			       void *data, u16 data_len)
5019 {
5020 	struct mgmt_pending_cmd *cmd;
5021 	int err;
5022 
5023 	bt_dev_dbg(hdev, "sock %p", sk);
5024 
5025 	hci_dev_lock(hdev);
5026 
5027 	if (!hdev_is_powered(hdev)) {
5028 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5029 				      MGMT_STATUS_NOT_POWERED);
5030 		goto unlock;
5031 	}
5032 
5033 	if (!lmp_ssp_capable(hdev)) {
5034 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5035 				      MGMT_STATUS_NOT_SUPPORTED);
5036 		goto unlock;
5037 	}
5038 
5039 	if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
5040 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5041 				      MGMT_STATUS_BUSY);
5042 		goto unlock;
5043 	}
5044 
5045 	cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5046 	if (!cmd)
5047 		err = -ENOMEM;
5048 	else
5049 		err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5050 					 read_local_oob_data_complete);
5051 
5052 	if (err < 0) {
5053 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5054 				      MGMT_STATUS_FAILED);
5055 
5056 		if (cmd)
5057 			mgmt_pending_free(cmd);
5058 	}
5059 
5060 unlock:
5061 	hci_dev_unlock(hdev);
5062 	return err;
5063 }
5064 
5065 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5066 			       void *data, u16 len)
5067 {
5068 	struct mgmt_addr_info *addr = data;
5069 	int err;
5070 
5071 	bt_dev_dbg(hdev, "sock %p", sk);
5072 
5073 	if (!bdaddr_type_is_valid(addr->type))
5074 		return mgmt_cmd_complete(sk, hdev->id,
5075 					 MGMT_OP_ADD_REMOTE_OOB_DATA,
5076 					 MGMT_STATUS_INVALID_PARAMS,
5077 					 addr, sizeof(*addr));
5078 
5079 	hci_dev_lock(hdev);
5080 
5081 	if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5082 		struct mgmt_cp_add_remote_oob_data *cp = data;
5083 		u8 status;
5084 
5085 		if (cp->addr.type != BDADDR_BREDR) {
5086 			err = mgmt_cmd_complete(sk, hdev->id,
5087 						MGMT_OP_ADD_REMOTE_OOB_DATA,
5088 						MGMT_STATUS_INVALID_PARAMS,
5089 						&cp->addr, sizeof(cp->addr));
5090 			goto unlock;
5091 		}
5092 
5093 		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5094 					      cp->addr.type, cp->hash,
5095 					      cp->rand, NULL, NULL);
5096 		if (err < 0)
5097 			status = MGMT_STATUS_FAILED;
5098 		else
5099 			status = MGMT_STATUS_SUCCESS;
5100 
5101 		err = mgmt_cmd_complete(sk, hdev->id,
5102 					MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5103 					&cp->addr, sizeof(cp->addr));
5104 	} else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5105 		struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5106 		u8 *rand192, *hash192, *rand256, *hash256;
5107 		u8 status;
5108 
5109 		if (bdaddr_type_is_le(cp->addr.type)) {
5110 			/* Enforce zero-valued 192-bit parameters as
5111 			 * long as legacy SMP OOB isn't implemented.
5112 			 */
5113 			if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5114 			    memcmp(cp->hash192, ZERO_KEY, 16)) {
5115 				err = mgmt_cmd_complete(sk, hdev->id,
5116 							MGMT_OP_ADD_REMOTE_OOB_DATA,
5117 							MGMT_STATUS_INVALID_PARAMS,
5118 							addr, sizeof(*addr));
5119 				goto unlock;
5120 			}
5121 
5122 			rand192 = NULL;
5123 			hash192 = NULL;
5124 		} else {
5125 			/* In case one of the P-192 values is set to zero,
5126 			 * then just disable OOB data for P-192.
5127 			 */
5128 			if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5129 			    !memcmp(cp->hash192, ZERO_KEY, 16)) {
5130 				rand192 = NULL;
5131 				hash192 = NULL;
5132 			} else {
5133 				rand192 = cp->rand192;
5134 				hash192 = cp->hash192;
5135 			}
5136 		}
5137 
5138 		/* In case one of the P-256 values is set to zero, then just
5139 		 * disable OOB data for P-256.
5140 		 */
5141 		if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5142 		    !memcmp(cp->hash256, ZERO_KEY, 16)) {
5143 			rand256 = NULL;
5144 			hash256 = NULL;
5145 		} else {
5146 			rand256 = cp->rand256;
5147 			hash256 = cp->hash256;
5148 		}
5149 
5150 		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5151 					      cp->addr.type, hash192, rand192,
5152 					      hash256, rand256);
5153 		if (err < 0)
5154 			status = MGMT_STATUS_FAILED;
5155 		else
5156 			status = MGMT_STATUS_SUCCESS;
5157 
5158 		err = mgmt_cmd_complete(sk, hdev->id,
5159 					MGMT_OP_ADD_REMOTE_OOB_DATA,
5160 					status, &cp->addr, sizeof(cp->addr));
5161 	} else {
5162 		bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5163 			   len);
5164 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5165 				      MGMT_STATUS_INVALID_PARAMS);
5166 	}
5167 
5168 unlock:
5169 	hci_dev_unlock(hdev);
5170 	return err;
5171 }
5172 
5173 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5174 				  void *data, u16 len)
5175 {
5176 	struct mgmt_cp_remove_remote_oob_data *cp = data;
5177 	u8 status;
5178 	int err;
5179 
5180 	bt_dev_dbg(hdev, "sock %p", sk);
5181 
5182 	if (cp->addr.type != BDADDR_BREDR)
5183 		return mgmt_cmd_complete(sk, hdev->id,
5184 					 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5185 					 MGMT_STATUS_INVALID_PARAMS,
5186 					 &cp->addr, sizeof(cp->addr));
5187 
5188 	hci_dev_lock(hdev);
5189 
5190 	if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5191 		hci_remote_oob_data_clear(hdev);
5192 		status = MGMT_STATUS_SUCCESS;
5193 		goto done;
5194 	}
5195 
5196 	err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5197 	if (err < 0)
5198 		status = MGMT_STATUS_INVALID_PARAMS;
5199 	else
5200 		status = MGMT_STATUS_SUCCESS;
5201 
5202 done:
5203 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5204 				status, &cp->addr, sizeof(cp->addr));
5205 
5206 	hci_dev_unlock(hdev);
5207 	return err;
5208 }
5209 
5210 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5211 {
5212 	struct mgmt_pending_cmd *cmd;
5213 
5214 	bt_dev_dbg(hdev, "status %u", status);
5215 
5216 	hci_dev_lock(hdev);
5217 
5218 	cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5219 	if (!cmd)
5220 		cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5221 
5222 	if (!cmd)
5223 		cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5224 
5225 	if (cmd) {
5226 		cmd->cmd_complete(cmd, mgmt_status(status));
5227 		mgmt_pending_remove(cmd);
5228 	}
5229 
5230 	hci_dev_unlock(hdev);
5231 }
5232 
5233 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5234 				    uint8_t *mgmt_status)
5235 {
5236 	switch (type) {
5237 	case DISCOV_TYPE_LE:
5238 		*mgmt_status = mgmt_le_support(hdev);
5239 		if (*mgmt_status)
5240 			return false;
5241 		break;
5242 	case DISCOV_TYPE_INTERLEAVED:
5243 		*mgmt_status = mgmt_le_support(hdev);
5244 		if (*mgmt_status)
5245 			return false;
5246 		fallthrough;
5247 	case DISCOV_TYPE_BREDR:
5248 		*mgmt_status = mgmt_bredr_support(hdev);
5249 		if (*mgmt_status)
5250 			return false;
5251 		break;
5252 	default:
5253 		*mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5254 		return false;
5255 	}
5256 
5257 	return true;
5258 }
5259 
5260 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5261 {
5262 	struct mgmt_pending_cmd *cmd = data;
5263 
5264 	bt_dev_dbg(hdev, "err %d", err);
5265 
5266 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5267 			  cmd->param, 1);
5268 	mgmt_pending_free(cmd);
5269 
5270 	hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5271 				DISCOVERY_FINDING);
5272 }
5273 
5274 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5275 {
5276 	return hci_start_discovery_sync(hdev);
5277 }
5278 
5279 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5280 				    u16 op, void *data, u16 len)
5281 {
5282 	struct mgmt_cp_start_discovery *cp = data;
5283 	struct mgmt_pending_cmd *cmd;
5284 	u8 status;
5285 	int err;
5286 
5287 	bt_dev_dbg(hdev, "sock %p", sk);
5288 
5289 	hci_dev_lock(hdev);
5290 
5291 	if (!hdev_is_powered(hdev)) {
5292 		err = mgmt_cmd_complete(sk, hdev->id, op,
5293 					MGMT_STATUS_NOT_POWERED,
5294 					&cp->type, sizeof(cp->type));
5295 		goto failed;
5296 	}
5297 
5298 	if (hdev->discovery.state != DISCOVERY_STOPPED ||
5299 	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5300 		err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5301 					&cp->type, sizeof(cp->type));
5302 		goto failed;
5303 	}
5304 
5305 	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5306 		err = mgmt_cmd_complete(sk, hdev->id, op, status,
5307 					&cp->type, sizeof(cp->type));
5308 		goto failed;
5309 	}
5310 
5311 	/* Can't start discovery when it is paused */
5312 	if (hdev->discovery_paused) {
5313 		err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5314 					&cp->type, sizeof(cp->type));
5315 		goto failed;
5316 	}
5317 
5318 	/* Clear the discovery filter first to free any previously
5319 	 * allocated memory for the UUID list.
5320 	 */
5321 	hci_discovery_filter_clear(hdev);
5322 
5323 	hdev->discovery.type = cp->type;
5324 	hdev->discovery.report_invalid_rssi = false;
5325 	if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5326 		hdev->discovery.limited = true;
5327 	else
5328 		hdev->discovery.limited = false;
5329 
5330 	cmd = mgmt_pending_new(sk, op, hdev, data, len);
5331 	if (!cmd) {
5332 		err = -ENOMEM;
5333 		goto failed;
5334 	}
5335 
5336 	err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5337 				 start_discovery_complete);
5338 	if (err < 0) {
5339 		mgmt_pending_free(cmd);
5340 		goto failed;
5341 	}
5342 
5343 	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5344 
5345 failed:
5346 	hci_dev_unlock(hdev);
5347 	return err;
5348 }
5349 
5350 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5351 			   void *data, u16 len)
5352 {
5353 	return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5354 					data, len);
5355 }
5356 
5357 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5358 				   void *data, u16 len)
5359 {
5360 	return start_discovery_internal(sk, hdev,
5361 					MGMT_OP_START_LIMITED_DISCOVERY,
5362 					data, len);
5363 }
5364 
5365 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5366 				   void *data, u16 len)
5367 {
5368 	struct mgmt_cp_start_service_discovery *cp = data;
5369 	struct mgmt_pending_cmd *cmd;
5370 	const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5371 	u16 uuid_count, expected_len;
5372 	u8 status;
5373 	int err;
5374 
5375 	bt_dev_dbg(hdev, "sock %p", sk);
5376 
5377 	hci_dev_lock(hdev);
5378 
5379 	if (!hdev_is_powered(hdev)) {
5380 		err = mgmt_cmd_complete(sk, hdev->id,
5381 					MGMT_OP_START_SERVICE_DISCOVERY,
5382 					MGMT_STATUS_NOT_POWERED,
5383 					&cp->type, sizeof(cp->type));
5384 		goto failed;
5385 	}
5386 
5387 	if (hdev->discovery.state != DISCOVERY_STOPPED ||
5388 	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5389 		err = mgmt_cmd_complete(sk, hdev->id,
5390 					MGMT_OP_START_SERVICE_DISCOVERY,
5391 					MGMT_STATUS_BUSY, &cp->type,
5392 					sizeof(cp->type));
5393 		goto failed;
5394 	}
5395 
5396 	if (hdev->discovery_paused) {
5397 		err = mgmt_cmd_complete(sk, hdev->id,
5398 					MGMT_OP_START_SERVICE_DISCOVERY,
5399 					MGMT_STATUS_BUSY, &cp->type,
5400 					sizeof(cp->type));
5401 		goto failed;
5402 	}
5403 
5404 	uuid_count = __le16_to_cpu(cp->uuid_count);
5405 	if (uuid_count > max_uuid_count) {
5406 		bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5407 			   uuid_count);
5408 		err = mgmt_cmd_complete(sk, hdev->id,
5409 					MGMT_OP_START_SERVICE_DISCOVERY,
5410 					MGMT_STATUS_INVALID_PARAMS, &cp->type,
5411 					sizeof(cp->type));
5412 		goto failed;
5413 	}
5414 
5415 	expected_len = sizeof(*cp) + uuid_count * 16;
5416 	if (expected_len != len) {
5417 		bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5418 			   expected_len, len);
5419 		err = mgmt_cmd_complete(sk, hdev->id,
5420 					MGMT_OP_START_SERVICE_DISCOVERY,
5421 					MGMT_STATUS_INVALID_PARAMS, &cp->type,
5422 					sizeof(cp->type));
5423 		goto failed;
5424 	}
5425 
5426 	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5427 		err = mgmt_cmd_complete(sk, hdev->id,
5428 					MGMT_OP_START_SERVICE_DISCOVERY,
5429 					status, &cp->type, sizeof(cp->type));
5430 		goto failed;
5431 	}
5432 
5433 	cmd = mgmt_pending_new(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5434 			       hdev, data, len);
5435 	if (!cmd) {
5436 		err = -ENOMEM;
5437 		goto failed;
5438 	}
5439 
5440 	/* Clear the discovery filter first to free any previously
5441 	 * allocated memory for the UUID list.
5442 	 */
5443 	hci_discovery_filter_clear(hdev);
5444 
5445 	hdev->discovery.result_filtering = true;
5446 	hdev->discovery.type = cp->type;
5447 	hdev->discovery.rssi = cp->rssi;
5448 	hdev->discovery.uuid_count = uuid_count;
5449 
5450 	if (uuid_count > 0) {
5451 		hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5452 						GFP_KERNEL);
5453 		if (!hdev->discovery.uuids) {
5454 			err = mgmt_cmd_complete(sk, hdev->id,
5455 						MGMT_OP_START_SERVICE_DISCOVERY,
5456 						MGMT_STATUS_FAILED,
5457 						&cp->type, sizeof(cp->type));
5458 			mgmt_pending_remove(cmd);
5459 			goto failed;
5460 		}
5461 	}
5462 
5463 	err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5464 				 start_discovery_complete);
5465 	if (err < 0) {
5466 		mgmt_pending_free(cmd);
5467 		goto failed;
5468 	}
5469 
5470 	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5471 
5472 failed:
5473 	hci_dev_unlock(hdev);
5474 	return err;
5475 }
5476 
5477 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5478 {
5479 	struct mgmt_pending_cmd *cmd;
5480 
5481 	bt_dev_dbg(hdev, "status %u", status);
5482 
5483 	hci_dev_lock(hdev);
5484 
5485 	cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5486 	if (cmd) {
5487 		cmd->cmd_complete(cmd, mgmt_status(status));
5488 		mgmt_pending_remove(cmd);
5489 	}
5490 
5491 	hci_dev_unlock(hdev);
5492 }
5493 
5494 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
5495 {
5496 	struct mgmt_pending_cmd *cmd = data;
5497 
5498 	bt_dev_dbg(hdev, "err %d", err);
5499 
5500 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5501 			  cmd->param, 1);
5502 	mgmt_pending_free(cmd);
5503 
5504 	if (!err)
5505 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
5506 }
5507 
5508 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
5509 {
5510 	return hci_stop_discovery_sync(hdev);
5511 }
5512 
5513 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5514 			  u16 len)
5515 {
5516 	struct mgmt_cp_stop_discovery *mgmt_cp = data;
5517 	struct mgmt_pending_cmd *cmd;
5518 	int err;
5519 
5520 	bt_dev_dbg(hdev, "sock %p", sk);
5521 
5522 	hci_dev_lock(hdev);
5523 
5524 	if (!hci_discovery_active(hdev)) {
5525 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5526 					MGMT_STATUS_REJECTED, &mgmt_cp->type,
5527 					sizeof(mgmt_cp->type));
5528 		goto unlock;
5529 	}
5530 
5531 	if (hdev->discovery.type != mgmt_cp->type) {
5532 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5533 					MGMT_STATUS_INVALID_PARAMS,
5534 					&mgmt_cp->type, sizeof(mgmt_cp->type));
5535 		goto unlock;
5536 	}
5537 
5538 	cmd = mgmt_pending_new(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5539 	if (!cmd) {
5540 		err = -ENOMEM;
5541 		goto unlock;
5542 	}
5543 
5544 	err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
5545 				 stop_discovery_complete);
5546 	if (err < 0) {
5547 		mgmt_pending_free(cmd);
5548 		goto unlock;
5549 	}
5550 
5551 	hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5552 
5553 unlock:
5554 	hci_dev_unlock(hdev);
5555 	return err;
5556 }
5557 
5558 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5559 			u16 len)
5560 {
5561 	struct mgmt_cp_confirm_name *cp = data;
5562 	struct inquiry_entry *e;
5563 	int err;
5564 
5565 	bt_dev_dbg(hdev, "sock %p", sk);
5566 
5567 	hci_dev_lock(hdev);
5568 
5569 	if (!hci_discovery_active(hdev)) {
5570 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5571 					MGMT_STATUS_FAILED, &cp->addr,
5572 					sizeof(cp->addr));
5573 		goto failed;
5574 	}
5575 
5576 	e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5577 	if (!e) {
5578 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5579 					MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5580 					sizeof(cp->addr));
5581 		goto failed;
5582 	}
5583 
5584 	if (cp->name_known) {
5585 		e->name_state = NAME_KNOWN;
5586 		list_del(&e->list);
5587 	} else {
5588 		e->name_state = NAME_NEEDED;
5589 		hci_inquiry_cache_update_resolve(hdev, e);
5590 	}
5591 
5592 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5593 				&cp->addr, sizeof(cp->addr));
5594 
5595 failed:
5596 	hci_dev_unlock(hdev);
5597 	return err;
5598 }
5599 
5600 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5601 			u16 len)
5602 {
5603 	struct mgmt_cp_block_device *cp = data;
5604 	u8 status;
5605 	int err;
5606 
5607 	bt_dev_dbg(hdev, "sock %p", sk);
5608 
5609 	if (!bdaddr_type_is_valid(cp->addr.type))
5610 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5611 					 MGMT_STATUS_INVALID_PARAMS,
5612 					 &cp->addr, sizeof(cp->addr));
5613 
5614 	hci_dev_lock(hdev);
5615 
5616 	err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5617 				  cp->addr.type);
5618 	if (err < 0) {
5619 		status = MGMT_STATUS_FAILED;
5620 		goto done;
5621 	}
5622 
5623 	mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5624 		   sk);
5625 	status = MGMT_STATUS_SUCCESS;
5626 
5627 done:
5628 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5629 				&cp->addr, sizeof(cp->addr));
5630 
5631 	hci_dev_unlock(hdev);
5632 
5633 	return err;
5634 }
5635 
5636 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5637 			  u16 len)
5638 {
5639 	struct mgmt_cp_unblock_device *cp = data;
5640 	u8 status;
5641 	int err;
5642 
5643 	bt_dev_dbg(hdev, "sock %p", sk);
5644 
5645 	if (!bdaddr_type_is_valid(cp->addr.type))
5646 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5647 					 MGMT_STATUS_INVALID_PARAMS,
5648 					 &cp->addr, sizeof(cp->addr));
5649 
5650 	hci_dev_lock(hdev);
5651 
5652 	err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5653 				  cp->addr.type);
5654 	if (err < 0) {
5655 		status = MGMT_STATUS_INVALID_PARAMS;
5656 		goto done;
5657 	}
5658 
5659 	mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5660 		   sk);
5661 	status = MGMT_STATUS_SUCCESS;
5662 
5663 done:
5664 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5665 				&cp->addr, sizeof(cp->addr));
5666 
5667 	hci_dev_unlock(hdev);
5668 
5669 	return err;
5670 }
5671 
5672 static int set_device_id_sync(struct hci_dev *hdev, void *data)
5673 {
5674 	return hci_update_eir_sync(hdev);
5675 }
5676 
5677 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5678 			 u16 len)
5679 {
5680 	struct mgmt_cp_set_device_id *cp = data;
5681 	int err;
5682 	__u16 source;
5683 
5684 	bt_dev_dbg(hdev, "sock %p", sk);
5685 
5686 	source = __le16_to_cpu(cp->source);
5687 
5688 	if (source > 0x0002)
5689 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5690 				       MGMT_STATUS_INVALID_PARAMS);
5691 
5692 	hci_dev_lock(hdev);
5693 
5694 	hdev->devid_source = source;
5695 	hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5696 	hdev->devid_product = __le16_to_cpu(cp->product);
5697 	hdev->devid_version = __le16_to_cpu(cp->version);
5698 
5699 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5700 				NULL, 0);
5701 
5702 	hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
5703 
5704 	hci_dev_unlock(hdev);
5705 
5706 	return err;
5707 }
5708 
5709 static void enable_advertising_instance(struct hci_dev *hdev, int err)
5710 {
5711 	if (err)
5712 		bt_dev_err(hdev, "failed to re-configure advertising %d", err);
5713 	else
5714 		bt_dev_dbg(hdev, "status %d", err);
5715 }
5716 
5717 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
5718 {
5719 	struct cmd_lookup match = { NULL, hdev };
5720 	u8 instance;
5721 	struct adv_info *adv_instance;
5722 	u8 status = mgmt_status(err);
5723 
5724 	if (status) {
5725 		mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5726 				     cmd_status_rsp, &status);
5727 		return;
5728 	}
5729 
5730 	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5731 		hci_dev_set_flag(hdev, HCI_ADVERTISING);
5732 	else
5733 		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5734 
5735 	mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5736 			     &match);
5737 
5738 	new_settings(hdev, match.sk);
5739 
5740 	if (match.sk)
5741 		sock_put(match.sk);
5742 
5743 	/* If "Set Advertising" was just disabled and instance advertising was
5744 	 * set up earlier, then re-enable multi-instance advertising.
5745 	 */
5746 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5747 	    list_empty(&hdev->adv_instances))
5748 		return;
5749 
5750 	instance = hdev->cur_adv_instance;
5751 	if (!instance) {
5752 		adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5753 							struct adv_info, list);
5754 		if (!adv_instance)
5755 			return;
5756 
5757 		instance = adv_instance->instance;
5758 	}
5759 
5760 	err = hci_schedule_adv_instance_sync(hdev, instance, true);
5761 
5762 	enable_advertising_instance(hdev, err);
5763 }
5764 
5765 static int set_adv_sync(struct hci_dev *hdev, void *data)
5766 {
5767 	struct mgmt_pending_cmd *cmd = data;
5768 	struct mgmt_mode *cp = cmd->param;
5769 	u8 val = !!cp->val;
5770 
5771 	if (cp->val == 0x02)
5772 		hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5773 	else
5774 		hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5775 
5776 	cancel_adv_timeout(hdev);
5777 
5778 	if (val) {
5779 		/* Switch to instance "0" for the Set Advertising setting.
5780 		 * We cannot use update_[adv|scan_rsp]_data() here as the
5781 		 * HCI_ADVERTISING flag is not yet set.
5782 		 */
5783 		hdev->cur_adv_instance = 0x00;
5784 
5785 		if (ext_adv_capable(hdev)) {
5786 			hci_start_ext_adv_sync(hdev, 0x00);
5787 		} else {
5788 			hci_update_adv_data_sync(hdev, 0x00);
5789 			hci_update_scan_rsp_data_sync(hdev, 0x00);
5790 			hci_enable_advertising_sync(hdev);
5791 		}
5792 	} else {
5793 		hci_disable_advertising_sync(hdev);
5794 	}
5795 
5796 	return 0;
5797 }
5798 
5799 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5800 			   u16 len)
5801 {
5802 	struct mgmt_mode *cp = data;
5803 	struct mgmt_pending_cmd *cmd;
5804 	u8 val, status;
5805 	int err;
5806 
5807 	bt_dev_dbg(hdev, "sock %p", sk);
5808 
5809 	status = mgmt_le_support(hdev);
5810 	if (status)
5811 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5812 				       status);
5813 
5814 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5815 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5816 				       MGMT_STATUS_INVALID_PARAMS);
5817 
5818 	if (hdev->advertising_paused)
5819 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5820 				       MGMT_STATUS_BUSY);
5821 
5822 	hci_dev_lock(hdev);
5823 
5824 	val = !!cp->val;
5825 
5826 	/* The following conditions are ones which mean that we should
5827 	 * not do any HCI communication but directly send a mgmt
5828 	 * response to user space (after toggling the flag if
5829 	 * necessary).
5830 	 */
5831 	if (!hdev_is_powered(hdev) ||
5832 	    (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5833 	     (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5834 	    hci_conn_num(hdev, LE_LINK) > 0 ||
5835 	    (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5836 	     hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5837 		bool changed;
5838 
5839 		if (cp->val) {
5840 			hdev->cur_adv_instance = 0x00;
5841 			changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5842 			if (cp->val == 0x02)
5843 				hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5844 			else
5845 				hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5846 		} else {
5847 			changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5848 			hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5849 		}
5850 
5851 		err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5852 		if (err < 0)
5853 			goto unlock;
5854 
5855 		if (changed)
5856 			err = new_settings(hdev, sk);
5857 
5858 		goto unlock;
5859 	}
5860 
5861 	if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5862 	    pending_find(MGMT_OP_SET_LE, hdev)) {
5863 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5864 				      MGMT_STATUS_BUSY);
5865 		goto unlock;
5866 	}
5867 
5868 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5869 	if (!cmd)
5870 		err = -ENOMEM;
5871 	else
5872 		err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
5873 					 set_advertising_complete);
5874 
5875 	if (err < 0 && cmd)
5876 		mgmt_pending_remove(cmd);
5877 
5878 unlock:
5879 	hci_dev_unlock(hdev);
5880 	return err;
5881 }
5882 
5883 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5884 			      void *data, u16 len)
5885 {
5886 	struct mgmt_cp_set_static_address *cp = data;
5887 	int err;
5888 
5889 	bt_dev_dbg(hdev, "sock %p", sk);
5890 
5891 	if (!lmp_le_capable(hdev))
5892 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5893 				       MGMT_STATUS_NOT_SUPPORTED);
5894 
5895 	if (hdev_is_powered(hdev))
5896 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5897 				       MGMT_STATUS_REJECTED);
5898 
5899 	if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5900 		if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5901 			return mgmt_cmd_status(sk, hdev->id,
5902 					       MGMT_OP_SET_STATIC_ADDRESS,
5903 					       MGMT_STATUS_INVALID_PARAMS);
5904 
5905 		/* Two most significant bits shall be set */
5906 		if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5907 			return mgmt_cmd_status(sk, hdev->id,
5908 					       MGMT_OP_SET_STATIC_ADDRESS,
5909 					       MGMT_STATUS_INVALID_PARAMS);
5910 	}
5911 
5912 	hci_dev_lock(hdev);
5913 
5914 	bacpy(&hdev->static_addr, &cp->bdaddr);
5915 
5916 	err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5917 	if (err < 0)
5918 		goto unlock;
5919 
5920 	err = new_settings(hdev, sk);
5921 
5922 unlock:
5923 	hci_dev_unlock(hdev);
5924 	return err;
5925 }
5926 
5927 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5928 			   void *data, u16 len)
5929 {
5930 	struct mgmt_cp_set_scan_params *cp = data;
5931 	__u16 interval, window;
5932 	int err;
5933 
5934 	bt_dev_dbg(hdev, "sock %p", sk);
5935 
5936 	if (!lmp_le_capable(hdev))
5937 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5938 				       MGMT_STATUS_NOT_SUPPORTED);
5939 
5940 	interval = __le16_to_cpu(cp->interval);
5941 
5942 	if (interval < 0x0004 || interval > 0x4000)
5943 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5944 				       MGMT_STATUS_INVALID_PARAMS);
5945 
5946 	window = __le16_to_cpu(cp->window);
5947 
5948 	if (window < 0x0004 || window > 0x4000)
5949 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5950 				       MGMT_STATUS_INVALID_PARAMS);
5951 
5952 	if (window > interval)
5953 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5954 				       MGMT_STATUS_INVALID_PARAMS);
5955 
5956 	hci_dev_lock(hdev);
5957 
5958 	hdev->le_scan_interval = interval;
5959 	hdev->le_scan_window = window;
5960 
5961 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5962 				NULL, 0);
5963 
5964 	/* If background scan is running, restart it so new parameters are
5965 	 * loaded.
5966 	 */
5967 	if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5968 	    hdev->discovery.state == DISCOVERY_STOPPED)
5969 		hci_update_passive_scan(hdev);
5970 
5971 	hci_dev_unlock(hdev);
5972 
5973 	return err;
5974 }
5975 
5976 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
5977 {
5978 	struct mgmt_pending_cmd *cmd = data;
5979 
5980 	bt_dev_dbg(hdev, "err %d", err);
5981 
5982 	if (err) {
5983 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5984 				mgmt_status(err));
5985 	} else {
5986 		struct mgmt_mode *cp = cmd->param;
5987 
5988 		if (cp->val)
5989 			hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5990 		else
5991 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5992 
5993 		send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5994 		new_settings(hdev, cmd->sk);
5995 	}
5996 
5997 	mgmt_pending_free(cmd);
5998 }
5999 
6000 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6001 {
6002 	struct mgmt_pending_cmd *cmd = data;
6003 	struct mgmt_mode *cp = cmd->param;
6004 
6005 	return hci_write_fast_connectable_sync(hdev, cp->val);
6006 }
6007 
6008 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6009 				void *data, u16 len)
6010 {
6011 	struct mgmt_mode *cp = data;
6012 	struct mgmt_pending_cmd *cmd;
6013 	int err;
6014 
6015 	bt_dev_dbg(hdev, "sock %p", sk);
6016 
6017 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6018 	    hdev->hci_ver < BLUETOOTH_VER_1_2)
6019 		return mgmt_cmd_status(sk, hdev->id,
6020 				       MGMT_OP_SET_FAST_CONNECTABLE,
6021 				       MGMT_STATUS_NOT_SUPPORTED);
6022 
6023 	if (cp->val != 0x00 && cp->val != 0x01)
6024 		return mgmt_cmd_status(sk, hdev->id,
6025 				       MGMT_OP_SET_FAST_CONNECTABLE,
6026 				       MGMT_STATUS_INVALID_PARAMS);
6027 
6028 	hci_dev_lock(hdev);
6029 
6030 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6031 		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6032 		goto unlock;
6033 	}
6034 
6035 	if (!hdev_is_powered(hdev)) {
6036 		hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6037 		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6038 		new_settings(hdev, sk);
6039 		goto unlock;
6040 	}
6041 
6042 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6043 			       len);
6044 	if (!cmd)
6045 		err = -ENOMEM;
6046 	else
6047 		err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6048 					 fast_connectable_complete);
6049 
6050 	if (err < 0) {
6051 		mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6052 				MGMT_STATUS_FAILED);
6053 
6054 		if (cmd)
6055 			mgmt_pending_free(cmd);
6056 	}
6057 
6058 unlock:
6059 	hci_dev_unlock(hdev);
6060 
6061 	return err;
6062 }
6063 
6064 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6065 {
6066 	struct mgmt_pending_cmd *cmd = data;
6067 
6068 	bt_dev_dbg(hdev, "err %d", err);
6069 
6070 	if (err) {
6071 		u8 mgmt_err = mgmt_status(err);
6072 
6073 		/* We need to restore the flag if related HCI commands
6074 		 * failed.
6075 		 */
6076 		hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6077 
6078 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6079 	} else {
6080 		send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6081 		new_settings(hdev, cmd->sk);
6082 	}
6083 
6084 	mgmt_pending_free(cmd);
6085 }
6086 
6087 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6088 {
6089 	int status;
6090 
6091 	status = hci_write_fast_connectable_sync(hdev, false);
6092 
6093 	if (!status)
6094 		status = hci_update_scan_sync(hdev);
6095 
6096 	/* Since only the advertising data flags will change, there
6097 	 * is no need to update the scan response data.
6098 	 */
6099 	if (!status)
6100 		status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6101 
6102 	return status;
6103 }
6104 
6105 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6106 {
6107 	struct mgmt_mode *cp = data;
6108 	struct mgmt_pending_cmd *cmd;
6109 	int err;
6110 
6111 	bt_dev_dbg(hdev, "sock %p", sk);
6112 
6113 	if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6114 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6115 				       MGMT_STATUS_NOT_SUPPORTED);
6116 
6117 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6118 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6119 				       MGMT_STATUS_REJECTED);
6120 
6121 	if (cp->val != 0x00 && cp->val != 0x01)
6122 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6123 				       MGMT_STATUS_INVALID_PARAMS);
6124 
6125 	hci_dev_lock(hdev);
6126 
6127 	if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6128 		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6129 		goto unlock;
6130 	}
6131 
6132 	if (!hdev_is_powered(hdev)) {
6133 		if (!cp->val) {
6134 			hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6135 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6136 			hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6137 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6138 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6139 		}
6140 
6141 		hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6142 
6143 		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6144 		if (err < 0)
6145 			goto unlock;
6146 
6147 		err = new_settings(hdev, sk);
6148 		goto unlock;
6149 	}
6150 
6151 	/* Reject disabling when powered on */
6152 	if (!cp->val) {
6153 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6154 				      MGMT_STATUS_REJECTED);
6155 		goto unlock;
6156 	} else {
6157 		/* When configuring a dual-mode controller to operate
6158 		 * with LE only and using a static address, then switching
6159 		 * BR/EDR back on is not allowed.
6160 		 *
6161 		 * Dual-mode controllers shall operate with the public
6162 		 * address as its identity address for BR/EDR and LE. So
6163 		 * reject the attempt to create an invalid configuration.
6164 		 *
6165 		 * The same restrictions applies when secure connections
6166 		 * has been enabled. For BR/EDR this is a controller feature
6167 		 * while for LE it is a host stack feature. This means that
6168 		 * switching BR/EDR back on when secure connections has been
6169 		 * enabled is not a supported transaction.
6170 		 */
6171 		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6172 		    (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6173 		     hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6174 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6175 					      MGMT_STATUS_REJECTED);
6176 			goto unlock;
6177 		}
6178 	}
6179 
6180 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6181 	if (!cmd)
6182 		err = -ENOMEM;
6183 	else
6184 		err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6185 					 set_bredr_complete);
6186 
6187 	if (err < 0) {
6188 		mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6189 				MGMT_STATUS_FAILED);
6190 		if (cmd)
6191 			mgmt_pending_free(cmd);
6192 
6193 		goto unlock;
6194 	}
6195 
6196 	/* We need to flip the bit already here so that
6197 	 * hci_req_update_adv_data generates the correct flags.
6198 	 */
6199 	hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6200 
6201 unlock:
6202 	hci_dev_unlock(hdev);
6203 	return err;
6204 }
6205 
6206 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6207 {
6208 	struct mgmt_pending_cmd *cmd = data;
6209 	struct mgmt_mode *cp;
6210 
6211 	bt_dev_dbg(hdev, "err %d", err);
6212 
6213 	if (err) {
6214 		u8 mgmt_err = mgmt_status(err);
6215 
6216 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6217 		goto done;
6218 	}
6219 
6220 	cp = cmd->param;
6221 
6222 	switch (cp->val) {
6223 	case 0x00:
6224 		hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6225 		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6226 		break;
6227 	case 0x01:
6228 		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6229 		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6230 		break;
6231 	case 0x02:
6232 		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6233 		hci_dev_set_flag(hdev, HCI_SC_ONLY);
6234 		break;
6235 	}
6236 
6237 	send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6238 	new_settings(hdev, cmd->sk);
6239 
6240 done:
6241 	mgmt_pending_free(cmd);
6242 }
6243 
6244 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6245 {
6246 	struct mgmt_pending_cmd *cmd = data;
6247 	struct mgmt_mode *cp = cmd->param;
6248 	u8 val = !!cp->val;
6249 
6250 	/* Force write of val */
6251 	hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6252 
6253 	return hci_write_sc_support_sync(hdev, val);
6254 }
6255 
6256 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6257 			   void *data, u16 len)
6258 {
6259 	struct mgmt_mode *cp = data;
6260 	struct mgmt_pending_cmd *cmd;
6261 	u8 val;
6262 	int err;
6263 
6264 	bt_dev_dbg(hdev, "sock %p", sk);
6265 
6266 	if (!lmp_sc_capable(hdev) &&
6267 	    !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6268 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6269 				       MGMT_STATUS_NOT_SUPPORTED);
6270 
6271 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6272 	    lmp_sc_capable(hdev) &&
6273 	    !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6274 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6275 				       MGMT_STATUS_REJECTED);
6276 
6277 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6278 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6279 				       MGMT_STATUS_INVALID_PARAMS);
6280 
6281 	hci_dev_lock(hdev);
6282 
6283 	if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6284 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6285 		bool changed;
6286 
6287 		if (cp->val) {
6288 			changed = !hci_dev_test_and_set_flag(hdev,
6289 							     HCI_SC_ENABLED);
6290 			if (cp->val == 0x02)
6291 				hci_dev_set_flag(hdev, HCI_SC_ONLY);
6292 			else
6293 				hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6294 		} else {
6295 			changed = hci_dev_test_and_clear_flag(hdev,
6296 							      HCI_SC_ENABLED);
6297 			hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6298 		}
6299 
6300 		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6301 		if (err < 0)
6302 			goto failed;
6303 
6304 		if (changed)
6305 			err = new_settings(hdev, sk);
6306 
6307 		goto failed;
6308 	}
6309 
6310 	val = !!cp->val;
6311 
6312 	if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6313 	    (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6314 		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6315 		goto failed;
6316 	}
6317 
6318 	cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6319 	if (!cmd)
6320 		err = -ENOMEM;
6321 	else
6322 		err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6323 					 set_secure_conn_complete);
6324 
6325 	if (err < 0) {
6326 		mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6327 				MGMT_STATUS_FAILED);
6328 		if (cmd)
6329 			mgmt_pending_free(cmd);
6330 	}
6331 
6332 failed:
6333 	hci_dev_unlock(hdev);
6334 	return err;
6335 }
6336 
6337 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6338 			  void *data, u16 len)
6339 {
6340 	struct mgmt_mode *cp = data;
6341 	bool changed, use_changed;
6342 	int err;
6343 
6344 	bt_dev_dbg(hdev, "sock %p", sk);
6345 
6346 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6347 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6348 				       MGMT_STATUS_INVALID_PARAMS);
6349 
6350 	hci_dev_lock(hdev);
6351 
6352 	if (cp->val)
6353 		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6354 	else
6355 		changed = hci_dev_test_and_clear_flag(hdev,
6356 						      HCI_KEEP_DEBUG_KEYS);
6357 
6358 	if (cp->val == 0x02)
6359 		use_changed = !hci_dev_test_and_set_flag(hdev,
6360 							 HCI_USE_DEBUG_KEYS);
6361 	else
6362 		use_changed = hci_dev_test_and_clear_flag(hdev,
6363 							  HCI_USE_DEBUG_KEYS);
6364 
6365 	if (hdev_is_powered(hdev) && use_changed &&
6366 	    hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6367 		u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6368 		hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6369 			     sizeof(mode), &mode);
6370 	}
6371 
6372 	err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6373 	if (err < 0)
6374 		goto unlock;
6375 
6376 	if (changed)
6377 		err = new_settings(hdev, sk);
6378 
6379 unlock:
6380 	hci_dev_unlock(hdev);
6381 	return err;
6382 }
6383 
6384 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6385 		       u16 len)
6386 {
6387 	struct mgmt_cp_set_privacy *cp = cp_data;
6388 	bool changed;
6389 	int err;
6390 
6391 	bt_dev_dbg(hdev, "sock %p", sk);
6392 
6393 	if (!lmp_le_capable(hdev))
6394 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6395 				       MGMT_STATUS_NOT_SUPPORTED);
6396 
6397 	if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6398 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6399 				       MGMT_STATUS_INVALID_PARAMS);
6400 
6401 	if (hdev_is_powered(hdev))
6402 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6403 				       MGMT_STATUS_REJECTED);
6404 
6405 	hci_dev_lock(hdev);
6406 
6407 	/* If user space supports this command it is also expected to
6408 	 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6409 	 */
6410 	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6411 
6412 	if (cp->privacy) {
6413 		changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6414 		memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6415 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6416 		hci_adv_instances_set_rpa_expired(hdev, true);
6417 		if (cp->privacy == 0x02)
6418 			hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6419 		else
6420 			hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6421 	} else {
6422 		changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6423 		memset(hdev->irk, 0, sizeof(hdev->irk));
6424 		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6425 		hci_adv_instances_set_rpa_expired(hdev, false);
6426 		hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6427 	}
6428 
6429 	err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6430 	if (err < 0)
6431 		goto unlock;
6432 
6433 	if (changed)
6434 		err = new_settings(hdev, sk);
6435 
6436 unlock:
6437 	hci_dev_unlock(hdev);
6438 	return err;
6439 }
6440 
6441 static bool irk_is_valid(struct mgmt_irk_info *irk)
6442 {
6443 	switch (irk->addr.type) {
6444 	case BDADDR_LE_PUBLIC:
6445 		return true;
6446 
6447 	case BDADDR_LE_RANDOM:
6448 		/* Two most significant bits shall be set */
6449 		if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6450 			return false;
6451 		return true;
6452 	}
6453 
6454 	return false;
6455 }
6456 
6457 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6458 		     u16 len)
6459 {
6460 	struct mgmt_cp_load_irks *cp = cp_data;
6461 	const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6462 				   sizeof(struct mgmt_irk_info));
6463 	u16 irk_count, expected_len;
6464 	int i, err;
6465 
6466 	bt_dev_dbg(hdev, "sock %p", sk);
6467 
6468 	if (!lmp_le_capable(hdev))
6469 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6470 				       MGMT_STATUS_NOT_SUPPORTED);
6471 
6472 	irk_count = __le16_to_cpu(cp->irk_count);
6473 	if (irk_count > max_irk_count) {
6474 		bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6475 			   irk_count);
6476 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6477 				       MGMT_STATUS_INVALID_PARAMS);
6478 	}
6479 
6480 	expected_len = struct_size(cp, irks, irk_count);
6481 	if (expected_len != len) {
6482 		bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6483 			   expected_len, len);
6484 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6485 				       MGMT_STATUS_INVALID_PARAMS);
6486 	}
6487 
6488 	bt_dev_dbg(hdev, "irk_count %u", irk_count);
6489 
6490 	for (i = 0; i < irk_count; i++) {
6491 		struct mgmt_irk_info *key = &cp->irks[i];
6492 
6493 		if (!irk_is_valid(key))
6494 			return mgmt_cmd_status(sk, hdev->id,
6495 					       MGMT_OP_LOAD_IRKS,
6496 					       MGMT_STATUS_INVALID_PARAMS);
6497 	}
6498 
6499 	hci_dev_lock(hdev);
6500 
6501 	hci_smp_irks_clear(hdev);
6502 
6503 	for (i = 0; i < irk_count; i++) {
6504 		struct mgmt_irk_info *irk = &cp->irks[i];
6505 
6506 		if (hci_is_blocked_key(hdev,
6507 				       HCI_BLOCKED_KEY_TYPE_IRK,
6508 				       irk->val)) {
6509 			bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6510 				    &irk->addr.bdaddr);
6511 			continue;
6512 		}
6513 
6514 		hci_add_irk(hdev, &irk->addr.bdaddr,
6515 			    le_addr_type(irk->addr.type), irk->val,
6516 			    BDADDR_ANY);
6517 	}
6518 
6519 	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6520 
6521 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6522 
6523 	hci_dev_unlock(hdev);
6524 
6525 	return err;
6526 }
6527 
6528 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6529 {
6530 	if (key->initiator != 0x00 && key->initiator != 0x01)
6531 		return false;
6532 
6533 	switch (key->addr.type) {
6534 	case BDADDR_LE_PUBLIC:
6535 		return true;
6536 
6537 	case BDADDR_LE_RANDOM:
6538 		/* Two most significant bits shall be set */
6539 		if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6540 			return false;
6541 		return true;
6542 	}
6543 
6544 	return false;
6545 }
6546 
6547 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6548 			       void *cp_data, u16 len)
6549 {
6550 	struct mgmt_cp_load_long_term_keys *cp = cp_data;
6551 	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6552 				   sizeof(struct mgmt_ltk_info));
6553 	u16 key_count, expected_len;
6554 	int i, err;
6555 
6556 	bt_dev_dbg(hdev, "sock %p", sk);
6557 
6558 	if (!lmp_le_capable(hdev))
6559 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6560 				       MGMT_STATUS_NOT_SUPPORTED);
6561 
6562 	key_count = __le16_to_cpu(cp->key_count);
6563 	if (key_count > max_key_count) {
6564 		bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6565 			   key_count);
6566 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6567 				       MGMT_STATUS_INVALID_PARAMS);
6568 	}
6569 
6570 	expected_len = struct_size(cp, keys, key_count);
6571 	if (expected_len != len) {
6572 		bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6573 			   expected_len, len);
6574 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6575 				       MGMT_STATUS_INVALID_PARAMS);
6576 	}
6577 
6578 	bt_dev_dbg(hdev, "key_count %u", key_count);
6579 
6580 	for (i = 0; i < key_count; i++) {
6581 		struct mgmt_ltk_info *key = &cp->keys[i];
6582 
6583 		if (!ltk_is_valid(key))
6584 			return mgmt_cmd_status(sk, hdev->id,
6585 					       MGMT_OP_LOAD_LONG_TERM_KEYS,
6586 					       MGMT_STATUS_INVALID_PARAMS);
6587 	}
6588 
6589 	hci_dev_lock(hdev);
6590 
6591 	hci_smp_ltks_clear(hdev);
6592 
6593 	for (i = 0; i < key_count; i++) {
6594 		struct mgmt_ltk_info *key = &cp->keys[i];
6595 		u8 type, authenticated;
6596 
6597 		if (hci_is_blocked_key(hdev,
6598 				       HCI_BLOCKED_KEY_TYPE_LTK,
6599 				       key->val)) {
6600 			bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6601 				    &key->addr.bdaddr);
6602 			continue;
6603 		}
6604 
6605 		switch (key->type) {
6606 		case MGMT_LTK_UNAUTHENTICATED:
6607 			authenticated = 0x00;
6608 			type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6609 			break;
6610 		case MGMT_LTK_AUTHENTICATED:
6611 			authenticated = 0x01;
6612 			type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6613 			break;
6614 		case MGMT_LTK_P256_UNAUTH:
6615 			authenticated = 0x00;
6616 			type = SMP_LTK_P256;
6617 			break;
6618 		case MGMT_LTK_P256_AUTH:
6619 			authenticated = 0x01;
6620 			type = SMP_LTK_P256;
6621 			break;
6622 		case MGMT_LTK_P256_DEBUG:
6623 			authenticated = 0x00;
6624 			type = SMP_LTK_P256_DEBUG;
6625 			fallthrough;
6626 		default:
6627 			continue;
6628 		}
6629 
6630 		hci_add_ltk(hdev, &key->addr.bdaddr,
6631 			    le_addr_type(key->addr.type), type, authenticated,
6632 			    key->val, key->enc_size, key->ediv, key->rand);
6633 	}
6634 
6635 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6636 			   NULL, 0);
6637 
6638 	hci_dev_unlock(hdev);
6639 
6640 	return err;
6641 }
6642 
6643 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
6644 {
6645 	struct mgmt_pending_cmd *cmd = data;
6646 	struct hci_conn *conn = cmd->user_data;
6647 	struct mgmt_cp_get_conn_info *cp = cmd->param;
6648 	struct mgmt_rp_get_conn_info rp;
6649 	u8 status;
6650 
6651 	bt_dev_dbg(hdev, "err %d", err);
6652 
6653 	memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
6654 
6655 	status = mgmt_status(err);
6656 	if (status == MGMT_STATUS_SUCCESS) {
6657 		rp.rssi = conn->rssi;
6658 		rp.tx_power = conn->tx_power;
6659 		rp.max_tx_power = conn->max_tx_power;
6660 	} else {
6661 		rp.rssi = HCI_RSSI_INVALID;
6662 		rp.tx_power = HCI_TX_POWER_INVALID;
6663 		rp.max_tx_power = HCI_TX_POWER_INVALID;
6664 	}
6665 
6666 	mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
6667 			  &rp, sizeof(rp));
6668 
6669 	if (conn) {
6670 		hci_conn_drop(conn);
6671 		hci_conn_put(conn);
6672 	}
6673 
6674 	mgmt_pending_free(cmd);
6675 }
6676 
6677 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
6678 {
6679 	struct mgmt_pending_cmd *cmd = data;
6680 	struct mgmt_cp_get_conn_info *cp = cmd->param;
6681 	struct hci_conn *conn;
6682 	int err;
6683 	__le16   handle;
6684 
6685 	/* Make sure we are still connected */
6686 	if (cp->addr.type == BDADDR_BREDR)
6687 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6688 					       &cp->addr.bdaddr);
6689 	else
6690 		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6691 
6692 	if (!conn || conn != cmd->user_data || conn->state != BT_CONNECTED) {
6693 		if (cmd->user_data) {
6694 			hci_conn_drop(cmd->user_data);
6695 			hci_conn_put(cmd->user_data);
6696 			cmd->user_data = NULL;
6697 		}
6698 		return MGMT_STATUS_NOT_CONNECTED;
6699 	}
6700 
6701 	handle = cpu_to_le16(conn->handle);
6702 
6703 	/* Refresh RSSI each time */
6704 	err = hci_read_rssi_sync(hdev, handle);
6705 
6706 	/* For LE links TX power does not change thus we don't need to
6707 	 * query for it once value is known.
6708 	 */
6709 	if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
6710 		     conn->tx_power == HCI_TX_POWER_INVALID))
6711 		err = hci_read_tx_power_sync(hdev, handle, 0x00);
6712 
6713 	/* Max TX power needs to be read only once per connection */
6714 	if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
6715 		err = hci_read_tx_power_sync(hdev, handle, 0x01);
6716 
6717 	return err;
6718 }
6719 
6720 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6721 			 u16 len)
6722 {
6723 	struct mgmt_cp_get_conn_info *cp = data;
6724 	struct mgmt_rp_get_conn_info rp;
6725 	struct hci_conn *conn;
6726 	unsigned long conn_info_age;
6727 	int err = 0;
6728 
6729 	bt_dev_dbg(hdev, "sock %p", sk);
6730 
6731 	memset(&rp, 0, sizeof(rp));
6732 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6733 	rp.addr.type = cp->addr.type;
6734 
6735 	if (!bdaddr_type_is_valid(cp->addr.type))
6736 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6737 					 MGMT_STATUS_INVALID_PARAMS,
6738 					 &rp, sizeof(rp));
6739 
6740 	hci_dev_lock(hdev);
6741 
6742 	if (!hdev_is_powered(hdev)) {
6743 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6744 					MGMT_STATUS_NOT_POWERED, &rp,
6745 					sizeof(rp));
6746 		goto unlock;
6747 	}
6748 
6749 	if (cp->addr.type == BDADDR_BREDR)
6750 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6751 					       &cp->addr.bdaddr);
6752 	else
6753 		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6754 
6755 	if (!conn || conn->state != BT_CONNECTED) {
6756 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6757 					MGMT_STATUS_NOT_CONNECTED, &rp,
6758 					sizeof(rp));
6759 		goto unlock;
6760 	}
6761 
6762 	/* To avoid client trying to guess when to poll again for information we
6763 	 * calculate conn info age as random value between min/max set in hdev.
6764 	 */
6765 	conn_info_age = hdev->conn_info_min_age +
6766 			prandom_u32_max(hdev->conn_info_max_age -
6767 					hdev->conn_info_min_age);
6768 
6769 	/* Query controller to refresh cached values if they are too old or were
6770 	 * never read.
6771 	 */
6772 	if (time_after(jiffies, conn->conn_info_timestamp +
6773 		       msecs_to_jiffies(conn_info_age)) ||
6774 	    !conn->conn_info_timestamp) {
6775 		struct mgmt_pending_cmd *cmd;
6776 
6777 		cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
6778 				       len);
6779 		if (!cmd)
6780 			err = -ENOMEM;
6781 		else
6782 			err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
6783 						 cmd, get_conn_info_complete);
6784 
6785 		if (err < 0) {
6786 			mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6787 					  MGMT_STATUS_FAILED, &rp, sizeof(rp));
6788 
6789 			if (cmd)
6790 				mgmt_pending_free(cmd);
6791 
6792 			goto unlock;
6793 		}
6794 
6795 		hci_conn_hold(conn);
6796 		cmd->user_data = hci_conn_get(conn);
6797 
6798 		conn->conn_info_timestamp = jiffies;
6799 	} else {
6800 		/* Cache is valid, just reply with values cached in hci_conn */
6801 		rp.rssi = conn->rssi;
6802 		rp.tx_power = conn->tx_power;
6803 		rp.max_tx_power = conn->max_tx_power;
6804 
6805 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6806 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6807 	}
6808 
6809 unlock:
6810 	hci_dev_unlock(hdev);
6811 	return err;
6812 }
6813 
6814 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
6815 {
6816 	struct mgmt_pending_cmd *cmd = data;
6817 	struct mgmt_cp_get_clock_info *cp = cmd->param;
6818 	struct mgmt_rp_get_clock_info rp;
6819 	struct hci_conn *conn = cmd->user_data;
6820 	u8 status = mgmt_status(err);
6821 
6822 	bt_dev_dbg(hdev, "err %d", err);
6823 
6824 	memset(&rp, 0, sizeof(rp));
6825 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6826 	rp.addr.type = cp->addr.type;
6827 
6828 	if (err)
6829 		goto complete;
6830 
6831 	rp.local_clock = cpu_to_le32(hdev->clock);
6832 
6833 	if (conn) {
6834 		rp.piconet_clock = cpu_to_le32(conn->clock);
6835 		rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6836 		hci_conn_drop(conn);
6837 		hci_conn_put(conn);
6838 	}
6839 
6840 complete:
6841 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6842 			  sizeof(rp));
6843 
6844 	mgmt_pending_free(cmd);
6845 }
6846 
6847 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
6848 {
6849 	struct mgmt_pending_cmd *cmd = data;
6850 	struct mgmt_cp_get_clock_info *cp = cmd->param;
6851 	struct hci_cp_read_clock hci_cp;
6852 	struct hci_conn *conn = cmd->user_data;
6853 	int err;
6854 
6855 	memset(&hci_cp, 0, sizeof(hci_cp));
6856 	err = hci_read_clock_sync(hdev, &hci_cp);
6857 
6858 	if (conn) {
6859 		/* Make sure connection still exists */
6860 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6861 					       &cp->addr.bdaddr);
6862 
6863 		if (conn && conn == cmd->user_data &&
6864 		    conn->state == BT_CONNECTED) {
6865 			hci_cp.handle = cpu_to_le16(conn->handle);
6866 			hci_cp.which = 0x01; /* Piconet clock */
6867 			err = hci_read_clock_sync(hdev, &hci_cp);
6868 		} else if (cmd->user_data) {
6869 			hci_conn_drop(cmd->user_data);
6870 			hci_conn_put(cmd->user_data);
6871 			cmd->user_data = NULL;
6872 		}
6873 	}
6874 
6875 	return err;
6876 }
6877 
6878 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6879 								u16 len)
6880 {
6881 	struct mgmt_cp_get_clock_info *cp = data;
6882 	struct mgmt_rp_get_clock_info rp;
6883 	struct mgmt_pending_cmd *cmd;
6884 	struct hci_conn *conn;
6885 	int err;
6886 
6887 	bt_dev_dbg(hdev, "sock %p", sk);
6888 
6889 	memset(&rp, 0, sizeof(rp));
6890 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6891 	rp.addr.type = cp->addr.type;
6892 
6893 	if (cp->addr.type != BDADDR_BREDR)
6894 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6895 					 MGMT_STATUS_INVALID_PARAMS,
6896 					 &rp, sizeof(rp));
6897 
6898 	hci_dev_lock(hdev);
6899 
6900 	if (!hdev_is_powered(hdev)) {
6901 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6902 					MGMT_STATUS_NOT_POWERED, &rp,
6903 					sizeof(rp));
6904 		goto unlock;
6905 	}
6906 
6907 	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6908 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6909 					       &cp->addr.bdaddr);
6910 		if (!conn || conn->state != BT_CONNECTED) {
6911 			err = mgmt_cmd_complete(sk, hdev->id,
6912 						MGMT_OP_GET_CLOCK_INFO,
6913 						MGMT_STATUS_NOT_CONNECTED,
6914 						&rp, sizeof(rp));
6915 			goto unlock;
6916 		}
6917 	} else {
6918 		conn = NULL;
6919 	}
6920 
6921 	cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6922 	if (!cmd)
6923 		err = -ENOMEM;
6924 	else
6925 		err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
6926 					 get_clock_info_complete);
6927 
6928 	if (err < 0) {
6929 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6930 					MGMT_STATUS_FAILED, &rp, sizeof(rp));
6931 
6932 		if (cmd)
6933 			mgmt_pending_free(cmd);
6934 
6935 	} else if (conn) {
6936 		hci_conn_hold(conn);
6937 		cmd->user_data = hci_conn_get(conn);
6938 	}
6939 
6940 
6941 unlock:
6942 	hci_dev_unlock(hdev);
6943 	return err;
6944 }
6945 
6946 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6947 {
6948 	struct hci_conn *conn;
6949 
6950 	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6951 	if (!conn)
6952 		return false;
6953 
6954 	if (conn->dst_type != type)
6955 		return false;
6956 
6957 	if (conn->state != BT_CONNECTED)
6958 		return false;
6959 
6960 	return true;
6961 }
6962 
6963 /* This function requires the caller holds hdev->lock */
6964 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6965 			       u8 addr_type, u8 auto_connect)
6966 {
6967 	struct hci_conn_params *params;
6968 
6969 	params = hci_conn_params_add(hdev, addr, addr_type);
6970 	if (!params)
6971 		return -EIO;
6972 
6973 	if (params->auto_connect == auto_connect)
6974 		return 0;
6975 
6976 	list_del_init(&params->action);
6977 
6978 	switch (auto_connect) {
6979 	case HCI_AUTO_CONN_DISABLED:
6980 	case HCI_AUTO_CONN_LINK_LOSS:
6981 		/* If auto connect is being disabled when we're trying to
6982 		 * connect to device, keep connecting.
6983 		 */
6984 		if (params->explicit_connect)
6985 			list_add(&params->action, &hdev->pend_le_conns);
6986 		break;
6987 	case HCI_AUTO_CONN_REPORT:
6988 		if (params->explicit_connect)
6989 			list_add(&params->action, &hdev->pend_le_conns);
6990 		else
6991 			list_add(&params->action, &hdev->pend_le_reports);
6992 		break;
6993 	case HCI_AUTO_CONN_DIRECT:
6994 	case HCI_AUTO_CONN_ALWAYS:
6995 		if (!is_connected(hdev, addr, addr_type))
6996 			list_add(&params->action, &hdev->pend_le_conns);
6997 		break;
6998 	}
6999 
7000 	params->auto_connect = auto_connect;
7001 
7002 	bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
7003 		   addr, addr_type, auto_connect);
7004 
7005 	return 0;
7006 }
7007 
7008 static void device_added(struct sock *sk, struct hci_dev *hdev,
7009 			 bdaddr_t *bdaddr, u8 type, u8 action)
7010 {
7011 	struct mgmt_ev_device_added ev;
7012 
7013 	bacpy(&ev.addr.bdaddr, bdaddr);
7014 	ev.addr.type = type;
7015 	ev.action = action;
7016 
7017 	mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7018 }
7019 
7020 static int add_device_sync(struct hci_dev *hdev, void *data)
7021 {
7022 	return hci_update_passive_scan_sync(hdev);
7023 }
7024 
7025 static int add_device(struct sock *sk, struct hci_dev *hdev,
7026 		      void *data, u16 len)
7027 {
7028 	struct mgmt_cp_add_device *cp = data;
7029 	u8 auto_conn, addr_type;
7030 	struct hci_conn_params *params;
7031 	int err;
7032 	u32 current_flags = 0;
7033 	u32 supported_flags;
7034 
7035 	bt_dev_dbg(hdev, "sock %p", sk);
7036 
7037 	if (!bdaddr_type_is_valid(cp->addr.type) ||
7038 	    !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7039 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7040 					 MGMT_STATUS_INVALID_PARAMS,
7041 					 &cp->addr, sizeof(cp->addr));
7042 
7043 	if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7044 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7045 					 MGMT_STATUS_INVALID_PARAMS,
7046 					 &cp->addr, sizeof(cp->addr));
7047 
7048 	hci_dev_lock(hdev);
7049 
7050 	if (cp->addr.type == BDADDR_BREDR) {
7051 		/* Only incoming connections action is supported for now */
7052 		if (cp->action != 0x01) {
7053 			err = mgmt_cmd_complete(sk, hdev->id,
7054 						MGMT_OP_ADD_DEVICE,
7055 						MGMT_STATUS_INVALID_PARAMS,
7056 						&cp->addr, sizeof(cp->addr));
7057 			goto unlock;
7058 		}
7059 
7060 		err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7061 						     &cp->addr.bdaddr,
7062 						     cp->addr.type, 0);
7063 		if (err)
7064 			goto unlock;
7065 
7066 		hci_req_update_scan(hdev);
7067 
7068 		goto added;
7069 	}
7070 
7071 	addr_type = le_addr_type(cp->addr.type);
7072 
7073 	if (cp->action == 0x02)
7074 		auto_conn = HCI_AUTO_CONN_ALWAYS;
7075 	else if (cp->action == 0x01)
7076 		auto_conn = HCI_AUTO_CONN_DIRECT;
7077 	else
7078 		auto_conn = HCI_AUTO_CONN_REPORT;
7079 
7080 	/* Kernel internally uses conn_params with resolvable private
7081 	 * address, but Add Device allows only identity addresses.
7082 	 * Make sure it is enforced before calling
7083 	 * hci_conn_params_lookup.
7084 	 */
7085 	if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7086 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7087 					MGMT_STATUS_INVALID_PARAMS,
7088 					&cp->addr, sizeof(cp->addr));
7089 		goto unlock;
7090 	}
7091 
7092 	/* If the connection parameters don't exist for this device,
7093 	 * they will be created and configured with defaults.
7094 	 */
7095 	if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7096 				auto_conn) < 0) {
7097 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7098 					MGMT_STATUS_FAILED, &cp->addr,
7099 					sizeof(cp->addr));
7100 		goto unlock;
7101 	} else {
7102 		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7103 						addr_type);
7104 		if (params)
7105 			bitmap_to_arr32(&current_flags, params->flags,
7106 					__HCI_CONN_NUM_FLAGS);
7107 	}
7108 
7109 	err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
7110 	if (err < 0)
7111 		goto unlock;
7112 
7113 added:
7114 	device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7115 	bitmap_to_arr32(&supported_flags, hdev->conn_flags,
7116 			__HCI_CONN_NUM_FLAGS);
7117 	device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7118 			     supported_flags, current_flags);
7119 
7120 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7121 				MGMT_STATUS_SUCCESS, &cp->addr,
7122 				sizeof(cp->addr));
7123 
7124 unlock:
7125 	hci_dev_unlock(hdev);
7126 	return err;
7127 }
7128 
7129 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7130 			   bdaddr_t *bdaddr, u8 type)
7131 {
7132 	struct mgmt_ev_device_removed ev;
7133 
7134 	bacpy(&ev.addr.bdaddr, bdaddr);
7135 	ev.addr.type = type;
7136 
7137 	mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7138 }
7139 
7140 static int remove_device_sync(struct hci_dev *hdev, void *data)
7141 {
7142 	return hci_update_passive_scan_sync(hdev);
7143 }
7144 
7145 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7146 			 void *data, u16 len)
7147 {
7148 	struct mgmt_cp_remove_device *cp = data;
7149 	int err;
7150 
7151 	bt_dev_dbg(hdev, "sock %p", sk);
7152 
7153 	hci_dev_lock(hdev);
7154 
7155 	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7156 		struct hci_conn_params *params;
7157 		u8 addr_type;
7158 
7159 		if (!bdaddr_type_is_valid(cp->addr.type)) {
7160 			err = mgmt_cmd_complete(sk, hdev->id,
7161 						MGMT_OP_REMOVE_DEVICE,
7162 						MGMT_STATUS_INVALID_PARAMS,
7163 						&cp->addr, sizeof(cp->addr));
7164 			goto unlock;
7165 		}
7166 
7167 		if (cp->addr.type == BDADDR_BREDR) {
7168 			err = hci_bdaddr_list_del(&hdev->accept_list,
7169 						  &cp->addr.bdaddr,
7170 						  cp->addr.type);
7171 			if (err) {
7172 				err = mgmt_cmd_complete(sk, hdev->id,
7173 							MGMT_OP_REMOVE_DEVICE,
7174 							MGMT_STATUS_INVALID_PARAMS,
7175 							&cp->addr,
7176 							sizeof(cp->addr));
7177 				goto unlock;
7178 			}
7179 
7180 			hci_req_update_scan(hdev);
7181 
7182 			device_removed(sk, hdev, &cp->addr.bdaddr,
7183 				       cp->addr.type);
7184 			goto complete;
7185 		}
7186 
7187 		addr_type = le_addr_type(cp->addr.type);
7188 
7189 		/* Kernel internally uses conn_params with resolvable private
7190 		 * address, but Remove Device allows only identity addresses.
7191 		 * Make sure it is enforced before calling
7192 		 * hci_conn_params_lookup.
7193 		 */
7194 		if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7195 			err = mgmt_cmd_complete(sk, hdev->id,
7196 						MGMT_OP_REMOVE_DEVICE,
7197 						MGMT_STATUS_INVALID_PARAMS,
7198 						&cp->addr, sizeof(cp->addr));
7199 			goto unlock;
7200 		}
7201 
7202 		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7203 						addr_type);
7204 		if (!params) {
7205 			err = mgmt_cmd_complete(sk, hdev->id,
7206 						MGMT_OP_REMOVE_DEVICE,
7207 						MGMT_STATUS_INVALID_PARAMS,
7208 						&cp->addr, sizeof(cp->addr));
7209 			goto unlock;
7210 		}
7211 
7212 		if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7213 		    params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7214 			err = mgmt_cmd_complete(sk, hdev->id,
7215 						MGMT_OP_REMOVE_DEVICE,
7216 						MGMT_STATUS_INVALID_PARAMS,
7217 						&cp->addr, sizeof(cp->addr));
7218 			goto unlock;
7219 		}
7220 
7221 		list_del(&params->action);
7222 		list_del(&params->list);
7223 		kfree(params);
7224 
7225 		device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7226 	} else {
7227 		struct hci_conn_params *p, *tmp;
7228 		struct bdaddr_list *b, *btmp;
7229 
7230 		if (cp->addr.type) {
7231 			err = mgmt_cmd_complete(sk, hdev->id,
7232 						MGMT_OP_REMOVE_DEVICE,
7233 						MGMT_STATUS_INVALID_PARAMS,
7234 						&cp->addr, sizeof(cp->addr));
7235 			goto unlock;
7236 		}
7237 
7238 		list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
7239 			device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7240 			list_del(&b->list);
7241 			kfree(b);
7242 		}
7243 
7244 		hci_req_update_scan(hdev);
7245 
7246 		list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7247 			if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7248 				continue;
7249 			device_removed(sk, hdev, &p->addr, p->addr_type);
7250 			if (p->explicit_connect) {
7251 				p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
7252 				continue;
7253 			}
7254 			list_del(&p->action);
7255 			list_del(&p->list);
7256 			kfree(p);
7257 		}
7258 
7259 		bt_dev_dbg(hdev, "All LE connection parameters were removed");
7260 	}
7261 
7262 	hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
7263 
7264 complete:
7265 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
7266 				MGMT_STATUS_SUCCESS, &cp->addr,
7267 				sizeof(cp->addr));
7268 unlock:
7269 	hci_dev_unlock(hdev);
7270 	return err;
7271 }
7272 
7273 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7274 			   u16 len)
7275 {
7276 	struct mgmt_cp_load_conn_param *cp = data;
7277 	const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7278 				     sizeof(struct mgmt_conn_param));
7279 	u16 param_count, expected_len;
7280 	int i;
7281 
7282 	if (!lmp_le_capable(hdev))
7283 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7284 				       MGMT_STATUS_NOT_SUPPORTED);
7285 
7286 	param_count = __le16_to_cpu(cp->param_count);
7287 	if (param_count > max_param_count) {
7288 		bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
7289 			   param_count);
7290 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7291 				       MGMT_STATUS_INVALID_PARAMS);
7292 	}
7293 
7294 	expected_len = struct_size(cp, params, param_count);
7295 	if (expected_len != len) {
7296 		bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7297 			   expected_len, len);
7298 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7299 				       MGMT_STATUS_INVALID_PARAMS);
7300 	}
7301 
7302 	bt_dev_dbg(hdev, "param_count %u", param_count);
7303 
7304 	hci_dev_lock(hdev);
7305 
7306 	hci_conn_params_clear_disabled(hdev);
7307 
7308 	for (i = 0; i < param_count; i++) {
7309 		struct mgmt_conn_param *param = &cp->params[i];
7310 		struct hci_conn_params *hci_param;
7311 		u16 min, max, latency, timeout;
7312 		u8 addr_type;
7313 
7314 		bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7315 			   param->addr.type);
7316 
7317 		if (param->addr.type == BDADDR_LE_PUBLIC) {
7318 			addr_type = ADDR_LE_DEV_PUBLIC;
7319 		} else if (param->addr.type == BDADDR_LE_RANDOM) {
7320 			addr_type = ADDR_LE_DEV_RANDOM;
7321 		} else {
7322 			bt_dev_err(hdev, "ignoring invalid connection parameters");
7323 			continue;
7324 		}
7325 
7326 		min = le16_to_cpu(param->min_interval);
7327 		max = le16_to_cpu(param->max_interval);
7328 		latency = le16_to_cpu(param->latency);
7329 		timeout = le16_to_cpu(param->timeout);
7330 
7331 		bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7332 			   min, max, latency, timeout);
7333 
7334 		if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7335 			bt_dev_err(hdev, "ignoring invalid connection parameters");
7336 			continue;
7337 		}
7338 
7339 		hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7340 						addr_type);
7341 		if (!hci_param) {
7342 			bt_dev_err(hdev, "failed to add connection parameters");
7343 			continue;
7344 		}
7345 
7346 		hci_param->conn_min_interval = min;
7347 		hci_param->conn_max_interval = max;
7348 		hci_param->conn_latency = latency;
7349 		hci_param->supervision_timeout = timeout;
7350 	}
7351 
7352 	hci_dev_unlock(hdev);
7353 
7354 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7355 				 NULL, 0);
7356 }
7357 
7358 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7359 			       void *data, u16 len)
7360 {
7361 	struct mgmt_cp_set_external_config *cp = data;
7362 	bool changed;
7363 	int err;
7364 
7365 	bt_dev_dbg(hdev, "sock %p", sk);
7366 
7367 	if (hdev_is_powered(hdev))
7368 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7369 				       MGMT_STATUS_REJECTED);
7370 
7371 	if (cp->config != 0x00 && cp->config != 0x01)
7372 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7373 				         MGMT_STATUS_INVALID_PARAMS);
7374 
7375 	if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7376 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7377 				       MGMT_STATUS_NOT_SUPPORTED);
7378 
7379 	hci_dev_lock(hdev);
7380 
7381 	if (cp->config)
7382 		changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7383 	else
7384 		changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7385 
7386 	err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7387 	if (err < 0)
7388 		goto unlock;
7389 
7390 	if (!changed)
7391 		goto unlock;
7392 
7393 	err = new_options(hdev, sk);
7394 
7395 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7396 		mgmt_index_removed(hdev);
7397 
7398 		if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7399 			hci_dev_set_flag(hdev, HCI_CONFIG);
7400 			hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7401 
7402 			queue_work(hdev->req_workqueue, &hdev->power_on);
7403 		} else {
7404 			set_bit(HCI_RAW, &hdev->flags);
7405 			mgmt_index_added(hdev);
7406 		}
7407 	}
7408 
7409 unlock:
7410 	hci_dev_unlock(hdev);
7411 	return err;
7412 }
7413 
7414 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7415 			      void *data, u16 len)
7416 {
7417 	struct mgmt_cp_set_public_address *cp = data;
7418 	bool changed;
7419 	int err;
7420 
7421 	bt_dev_dbg(hdev, "sock %p", sk);
7422 
7423 	if (hdev_is_powered(hdev))
7424 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7425 				       MGMT_STATUS_REJECTED);
7426 
7427 	if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7428 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7429 				       MGMT_STATUS_INVALID_PARAMS);
7430 
7431 	if (!hdev->set_bdaddr)
7432 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7433 				       MGMT_STATUS_NOT_SUPPORTED);
7434 
7435 	hci_dev_lock(hdev);
7436 
7437 	changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7438 	bacpy(&hdev->public_addr, &cp->bdaddr);
7439 
7440 	err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7441 	if (err < 0)
7442 		goto unlock;
7443 
7444 	if (!changed)
7445 		goto unlock;
7446 
7447 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7448 		err = new_options(hdev, sk);
7449 
7450 	if (is_configured(hdev)) {
7451 		mgmt_index_removed(hdev);
7452 
7453 		hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7454 
7455 		hci_dev_set_flag(hdev, HCI_CONFIG);
7456 		hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7457 
7458 		queue_work(hdev->req_workqueue, &hdev->power_on);
7459 	}
7460 
7461 unlock:
7462 	hci_dev_unlock(hdev);
7463 	return err;
7464 }
7465 
7466 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
7467 					     int err)
7468 {
7469 	const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7470 	struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7471 	u8 *h192, *r192, *h256, *r256;
7472 	struct mgmt_pending_cmd *cmd = data;
7473 	struct sk_buff *skb = cmd->skb;
7474 	u8 status = mgmt_status(err);
7475 	u16 eir_len;
7476 
7477 	if (!status) {
7478 		if (!skb)
7479 			status = MGMT_STATUS_FAILED;
7480 		else if (IS_ERR(skb))
7481 			status = mgmt_status(PTR_ERR(skb));
7482 		else
7483 			status = mgmt_status(skb->data[0]);
7484 	}
7485 
7486 	bt_dev_dbg(hdev, "status %u", status);
7487 
7488 	mgmt_cp = cmd->param;
7489 
7490 	if (status) {
7491 		status = mgmt_status(status);
7492 		eir_len = 0;
7493 
7494 		h192 = NULL;
7495 		r192 = NULL;
7496 		h256 = NULL;
7497 		r256 = NULL;
7498 	} else if (!bredr_sc_enabled(hdev)) {
7499 		struct hci_rp_read_local_oob_data *rp;
7500 
7501 		if (skb->len != sizeof(*rp)) {
7502 			status = MGMT_STATUS_FAILED;
7503 			eir_len = 0;
7504 		} else {
7505 			status = MGMT_STATUS_SUCCESS;
7506 			rp = (void *)skb->data;
7507 
7508 			eir_len = 5 + 18 + 18;
7509 			h192 = rp->hash;
7510 			r192 = rp->rand;
7511 			h256 = NULL;
7512 			r256 = NULL;
7513 		}
7514 	} else {
7515 		struct hci_rp_read_local_oob_ext_data *rp;
7516 
7517 		if (skb->len != sizeof(*rp)) {
7518 			status = MGMT_STATUS_FAILED;
7519 			eir_len = 0;
7520 		} else {
7521 			status = MGMT_STATUS_SUCCESS;
7522 			rp = (void *)skb->data;
7523 
7524 			if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7525 				eir_len = 5 + 18 + 18;
7526 				h192 = NULL;
7527 				r192 = NULL;
7528 			} else {
7529 				eir_len = 5 + 18 + 18 + 18 + 18;
7530 				h192 = rp->hash192;
7531 				r192 = rp->rand192;
7532 			}
7533 
7534 			h256 = rp->hash256;
7535 			r256 = rp->rand256;
7536 		}
7537 	}
7538 
7539 	mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7540 	if (!mgmt_rp)
7541 		goto done;
7542 
7543 	if (eir_len == 0)
7544 		goto send_rsp;
7545 
7546 	eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7547 				  hdev->dev_class, 3);
7548 
7549 	if (h192 && r192) {
7550 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7551 					  EIR_SSP_HASH_C192, h192, 16);
7552 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7553 					  EIR_SSP_RAND_R192, r192, 16);
7554 	}
7555 
7556 	if (h256 && r256) {
7557 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7558 					  EIR_SSP_HASH_C256, h256, 16);
7559 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7560 					  EIR_SSP_RAND_R256, r256, 16);
7561 	}
7562 
7563 send_rsp:
7564 	mgmt_rp->type = mgmt_cp->type;
7565 	mgmt_rp->eir_len = cpu_to_le16(eir_len);
7566 
7567 	err = mgmt_cmd_complete(cmd->sk, hdev->id,
7568 				MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7569 				mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7570 	if (err < 0 || status)
7571 		goto done;
7572 
7573 	hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7574 
7575 	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7576 				 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7577 				 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7578 done:
7579 	if (skb && !IS_ERR(skb))
7580 		kfree_skb(skb);
7581 
7582 	kfree(mgmt_rp);
7583 	mgmt_pending_remove(cmd);
7584 }
7585 
7586 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7587 				  struct mgmt_cp_read_local_oob_ext_data *cp)
7588 {
7589 	struct mgmt_pending_cmd *cmd;
7590 	int err;
7591 
7592 	cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7593 			       cp, sizeof(*cp));
7594 	if (!cmd)
7595 		return -ENOMEM;
7596 
7597 	err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
7598 				 read_local_oob_ext_data_complete);
7599 
7600 	if (err < 0) {
7601 		mgmt_pending_remove(cmd);
7602 		return err;
7603 	}
7604 
7605 	return 0;
7606 }
7607 
7608 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7609 				   void *data, u16 data_len)
7610 {
7611 	struct mgmt_cp_read_local_oob_ext_data *cp = data;
7612 	struct mgmt_rp_read_local_oob_ext_data *rp;
7613 	size_t rp_len;
7614 	u16 eir_len;
7615 	u8 status, flags, role, addr[7], hash[16], rand[16];
7616 	int err;
7617 
7618 	bt_dev_dbg(hdev, "sock %p", sk);
7619 
7620 	if (hdev_is_powered(hdev)) {
7621 		switch (cp->type) {
7622 		case BIT(BDADDR_BREDR):
7623 			status = mgmt_bredr_support(hdev);
7624 			if (status)
7625 				eir_len = 0;
7626 			else
7627 				eir_len = 5;
7628 			break;
7629 		case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7630 			status = mgmt_le_support(hdev);
7631 			if (status)
7632 				eir_len = 0;
7633 			else
7634 				eir_len = 9 + 3 + 18 + 18 + 3;
7635 			break;
7636 		default:
7637 			status = MGMT_STATUS_INVALID_PARAMS;
7638 			eir_len = 0;
7639 			break;
7640 		}
7641 	} else {
7642 		status = MGMT_STATUS_NOT_POWERED;
7643 		eir_len = 0;
7644 	}
7645 
7646 	rp_len = sizeof(*rp) + eir_len;
7647 	rp = kmalloc(rp_len, GFP_ATOMIC);
7648 	if (!rp)
7649 		return -ENOMEM;
7650 
7651 	if (!status && !lmp_ssp_capable(hdev)) {
7652 		status = MGMT_STATUS_NOT_SUPPORTED;
7653 		eir_len = 0;
7654 	}
7655 
7656 	if (status)
7657 		goto complete;
7658 
7659 	hci_dev_lock(hdev);
7660 
7661 	eir_len = 0;
7662 	switch (cp->type) {
7663 	case BIT(BDADDR_BREDR):
7664 		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7665 			err = read_local_ssp_oob_req(hdev, sk, cp);
7666 			hci_dev_unlock(hdev);
7667 			if (!err)
7668 				goto done;
7669 
7670 			status = MGMT_STATUS_FAILED;
7671 			goto complete;
7672 		} else {
7673 			eir_len = eir_append_data(rp->eir, eir_len,
7674 						  EIR_CLASS_OF_DEV,
7675 						  hdev->dev_class, 3);
7676 		}
7677 		break;
7678 	case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7679 		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7680 		    smp_generate_oob(hdev, hash, rand) < 0) {
7681 			hci_dev_unlock(hdev);
7682 			status = MGMT_STATUS_FAILED;
7683 			goto complete;
7684 		}
7685 
7686 		/* This should return the active RPA, but since the RPA
7687 		 * is only programmed on demand, it is really hard to fill
7688 		 * this in at the moment. For now disallow retrieving
7689 		 * local out-of-band data when privacy is in use.
7690 		 *
7691 		 * Returning the identity address will not help here since
7692 		 * pairing happens before the identity resolving key is
7693 		 * known and thus the connection establishment happens
7694 		 * based on the RPA and not the identity address.
7695 		 */
7696 		if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7697 			hci_dev_unlock(hdev);
7698 			status = MGMT_STATUS_REJECTED;
7699 			goto complete;
7700 		}
7701 
7702 		if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7703 		   !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7704 		   (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7705 		    bacmp(&hdev->static_addr, BDADDR_ANY))) {
7706 			memcpy(addr, &hdev->static_addr, 6);
7707 			addr[6] = 0x01;
7708 		} else {
7709 			memcpy(addr, &hdev->bdaddr, 6);
7710 			addr[6] = 0x00;
7711 		}
7712 
7713 		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7714 					  addr, sizeof(addr));
7715 
7716 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7717 			role = 0x02;
7718 		else
7719 			role = 0x01;
7720 
7721 		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7722 					  &role, sizeof(role));
7723 
7724 		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7725 			eir_len = eir_append_data(rp->eir, eir_len,
7726 						  EIR_LE_SC_CONFIRM,
7727 						  hash, sizeof(hash));
7728 
7729 			eir_len = eir_append_data(rp->eir, eir_len,
7730 						  EIR_LE_SC_RANDOM,
7731 						  rand, sizeof(rand));
7732 		}
7733 
7734 		flags = mgmt_get_adv_discov_flags(hdev);
7735 
7736 		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7737 			flags |= LE_AD_NO_BREDR;
7738 
7739 		eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7740 					  &flags, sizeof(flags));
7741 		break;
7742 	}
7743 
7744 	hci_dev_unlock(hdev);
7745 
7746 	hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7747 
7748 	status = MGMT_STATUS_SUCCESS;
7749 
7750 complete:
7751 	rp->type = cp->type;
7752 	rp->eir_len = cpu_to_le16(eir_len);
7753 
7754 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7755 				status, rp, sizeof(*rp) + eir_len);
7756 	if (err < 0 || status)
7757 		goto done;
7758 
7759 	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7760 				 rp, sizeof(*rp) + eir_len,
7761 				 HCI_MGMT_OOB_DATA_EVENTS, sk);
7762 
7763 done:
7764 	kfree(rp);
7765 
7766 	return err;
7767 }
7768 
7769 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7770 {
7771 	u32 flags = 0;
7772 
7773 	flags |= MGMT_ADV_FLAG_CONNECTABLE;
7774 	flags |= MGMT_ADV_FLAG_DISCOV;
7775 	flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7776 	flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7777 	flags |= MGMT_ADV_FLAG_APPEARANCE;
7778 	flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7779 	flags |= MGMT_ADV_PARAM_DURATION;
7780 	flags |= MGMT_ADV_PARAM_TIMEOUT;
7781 	flags |= MGMT_ADV_PARAM_INTERVALS;
7782 	flags |= MGMT_ADV_PARAM_TX_POWER;
7783 	flags |= MGMT_ADV_PARAM_SCAN_RSP;
7784 
7785 	/* In extended adv TX_POWER returned from Set Adv Param
7786 	 * will be always valid.
7787 	 */
7788 	if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7789 	    ext_adv_capable(hdev))
7790 		flags |= MGMT_ADV_FLAG_TX_POWER;
7791 
7792 	if (ext_adv_capable(hdev)) {
7793 		flags |= MGMT_ADV_FLAG_SEC_1M;
7794 		flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7795 		flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7796 
7797 		if (hdev->le_features[1] & HCI_LE_PHY_2M)
7798 			flags |= MGMT_ADV_FLAG_SEC_2M;
7799 
7800 		if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7801 			flags |= MGMT_ADV_FLAG_SEC_CODED;
7802 	}
7803 
7804 	return flags;
7805 }
7806 
7807 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7808 			     void *data, u16 data_len)
7809 {
7810 	struct mgmt_rp_read_adv_features *rp;
7811 	size_t rp_len;
7812 	int err;
7813 	struct adv_info *adv_instance;
7814 	u32 supported_flags;
7815 	u8 *instance;
7816 
7817 	bt_dev_dbg(hdev, "sock %p", sk);
7818 
7819 	if (!lmp_le_capable(hdev))
7820 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7821 				       MGMT_STATUS_REJECTED);
7822 
7823 	hci_dev_lock(hdev);
7824 
7825 	rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7826 	rp = kmalloc(rp_len, GFP_ATOMIC);
7827 	if (!rp) {
7828 		hci_dev_unlock(hdev);
7829 		return -ENOMEM;
7830 	}
7831 
7832 	supported_flags = get_supported_adv_flags(hdev);
7833 
7834 	rp->supported_flags = cpu_to_le32(supported_flags);
7835 	rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7836 	rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7837 	rp->max_instances = hdev->le_num_of_adv_sets;
7838 	rp->num_instances = hdev->adv_instance_cnt;
7839 
7840 	instance = rp->instance;
7841 	list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7842 		*instance = adv_instance->instance;
7843 		instance++;
7844 	}
7845 
7846 	hci_dev_unlock(hdev);
7847 
7848 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7849 				MGMT_STATUS_SUCCESS, rp, rp_len);
7850 
7851 	kfree(rp);
7852 
7853 	return err;
7854 }
7855 
7856 static u8 calculate_name_len(struct hci_dev *hdev)
7857 {
7858 	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7859 
7860 	return eir_append_local_name(hdev, buf, 0);
7861 }
7862 
7863 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7864 			   bool is_adv_data)
7865 {
7866 	u8 max_len = HCI_MAX_AD_LENGTH;
7867 
7868 	if (is_adv_data) {
7869 		if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7870 				 MGMT_ADV_FLAG_LIMITED_DISCOV |
7871 				 MGMT_ADV_FLAG_MANAGED_FLAGS))
7872 			max_len -= 3;
7873 
7874 		if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7875 			max_len -= 3;
7876 	} else {
7877 		if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7878 			max_len -= calculate_name_len(hdev);
7879 
7880 		if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7881 			max_len -= 4;
7882 	}
7883 
7884 	return max_len;
7885 }
7886 
7887 static bool flags_managed(u32 adv_flags)
7888 {
7889 	return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7890 			    MGMT_ADV_FLAG_LIMITED_DISCOV |
7891 			    MGMT_ADV_FLAG_MANAGED_FLAGS);
7892 }
7893 
7894 static bool tx_power_managed(u32 adv_flags)
7895 {
7896 	return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7897 }
7898 
7899 static bool name_managed(u32 adv_flags)
7900 {
7901 	return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7902 }
7903 
7904 static bool appearance_managed(u32 adv_flags)
7905 {
7906 	return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7907 }
7908 
7909 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7910 			      u8 len, bool is_adv_data)
7911 {
7912 	int i, cur_len;
7913 	u8 max_len;
7914 
7915 	max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7916 
7917 	if (len > max_len)
7918 		return false;
7919 
7920 	/* Make sure that the data is correctly formatted. */
7921 	for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7922 		cur_len = data[i];
7923 
7924 		if (!cur_len)
7925 			continue;
7926 
7927 		if (data[i + 1] == EIR_FLAGS &&
7928 		    (!is_adv_data || flags_managed(adv_flags)))
7929 			return false;
7930 
7931 		if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7932 			return false;
7933 
7934 		if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7935 			return false;
7936 
7937 		if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7938 			return false;
7939 
7940 		if (data[i + 1] == EIR_APPEARANCE &&
7941 		    appearance_managed(adv_flags))
7942 			return false;
7943 
7944 		/* If the current field length would exceed the total data
7945 		 * length, then it's invalid.
7946 		 */
7947 		if (i + cur_len >= len)
7948 			return false;
7949 	}
7950 
7951 	return true;
7952 }
7953 
7954 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7955 {
7956 	u32 supported_flags, phy_flags;
7957 
7958 	/* The current implementation only supports a subset of the specified
7959 	 * flags. Also need to check mutual exclusiveness of sec flags.
7960 	 */
7961 	supported_flags = get_supported_adv_flags(hdev);
7962 	phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7963 	if (adv_flags & ~supported_flags ||
7964 	    ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7965 		return false;
7966 
7967 	return true;
7968 }
7969 
7970 static bool adv_busy(struct hci_dev *hdev)
7971 {
7972 	return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7973 		pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7974 		pending_find(MGMT_OP_SET_LE, hdev) ||
7975 		pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7976 		pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7977 }
7978 
7979 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
7980 			     int err)
7981 {
7982 	struct adv_info *adv, *n;
7983 
7984 	bt_dev_dbg(hdev, "err %d", err);
7985 
7986 	hci_dev_lock(hdev);
7987 
7988 	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
7989 		u8 instance;
7990 
7991 		if (!adv->pending)
7992 			continue;
7993 
7994 		if (!err) {
7995 			adv->pending = false;
7996 			continue;
7997 		}
7998 
7999 		instance = adv->instance;
8000 
8001 		if (hdev->cur_adv_instance == instance)
8002 			cancel_adv_timeout(hdev);
8003 
8004 		hci_remove_adv_instance(hdev, instance);
8005 		mgmt_advertising_removed(sk, hdev, instance);
8006 	}
8007 
8008 	hci_dev_unlock(hdev);
8009 }
8010 
8011 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8012 {
8013 	struct mgmt_pending_cmd *cmd = data;
8014 	struct mgmt_cp_add_advertising *cp = cmd->param;
8015 	struct mgmt_rp_add_advertising rp;
8016 
8017 	memset(&rp, 0, sizeof(rp));
8018 
8019 	rp.instance = cp->instance;
8020 
8021 	if (err)
8022 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8023 				mgmt_status(err));
8024 	else
8025 		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8026 				  mgmt_status(err), &rp, sizeof(rp));
8027 
8028 	add_adv_complete(hdev, cmd->sk, cp->instance, err);
8029 
8030 	mgmt_pending_free(cmd);
8031 }
8032 
8033 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8034 {
8035 	struct mgmt_pending_cmd *cmd = data;
8036 	struct mgmt_cp_add_advertising *cp = cmd->param;
8037 
8038 	return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8039 }
8040 
8041 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8042 			   void *data, u16 data_len)
8043 {
8044 	struct mgmt_cp_add_advertising *cp = data;
8045 	struct mgmt_rp_add_advertising rp;
8046 	u32 flags;
8047 	u8 status;
8048 	u16 timeout, duration;
8049 	unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
8050 	u8 schedule_instance = 0;
8051 	struct adv_info *next_instance;
8052 	int err;
8053 	struct mgmt_pending_cmd *cmd;
8054 
8055 	bt_dev_dbg(hdev, "sock %p", sk);
8056 
8057 	status = mgmt_le_support(hdev);
8058 	if (status)
8059 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8060 				       status);
8061 
8062 	if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8063 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8064 				       MGMT_STATUS_INVALID_PARAMS);
8065 
8066 	if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
8067 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8068 				       MGMT_STATUS_INVALID_PARAMS);
8069 
8070 	flags = __le32_to_cpu(cp->flags);
8071 	timeout = __le16_to_cpu(cp->timeout);
8072 	duration = __le16_to_cpu(cp->duration);
8073 
8074 	if (!requested_adv_flags_are_valid(hdev, flags))
8075 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8076 				       MGMT_STATUS_INVALID_PARAMS);
8077 
8078 	hci_dev_lock(hdev);
8079 
8080 	if (timeout && !hdev_is_powered(hdev)) {
8081 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8082 				      MGMT_STATUS_REJECTED);
8083 		goto unlock;
8084 	}
8085 
8086 	if (adv_busy(hdev)) {
8087 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8088 				      MGMT_STATUS_BUSY);
8089 		goto unlock;
8090 	}
8091 
8092 	if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
8093 	    !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
8094 			       cp->scan_rsp_len, false)) {
8095 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8096 				      MGMT_STATUS_INVALID_PARAMS);
8097 		goto unlock;
8098 	}
8099 
8100 	err = hci_add_adv_instance(hdev, cp->instance, flags,
8101 				   cp->adv_data_len, cp->data,
8102 				   cp->scan_rsp_len,
8103 				   cp->data + cp->adv_data_len,
8104 				   timeout, duration,
8105 				   HCI_ADV_TX_POWER_NO_PREFERENCE,
8106 				   hdev->le_adv_min_interval,
8107 				   hdev->le_adv_max_interval);
8108 	if (err < 0) {
8109 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8110 				      MGMT_STATUS_FAILED);
8111 		goto unlock;
8112 	}
8113 
8114 	/* Only trigger an advertising added event if a new instance was
8115 	 * actually added.
8116 	 */
8117 	if (hdev->adv_instance_cnt > prev_instance_cnt)
8118 		mgmt_advertising_added(sk, hdev, cp->instance);
8119 
8120 	if (hdev->cur_adv_instance == cp->instance) {
8121 		/* If the currently advertised instance is being changed then
8122 		 * cancel the current advertising and schedule the next
8123 		 * instance. If there is only one instance then the overridden
8124 		 * advertising data will be visible right away.
8125 		 */
8126 		cancel_adv_timeout(hdev);
8127 
8128 		next_instance = hci_get_next_instance(hdev, cp->instance);
8129 		if (next_instance)
8130 			schedule_instance = next_instance->instance;
8131 	} else if (!hdev->adv_instance_timeout) {
8132 		/* Immediately advertise the new instance if no other
8133 		 * instance is currently being advertised.
8134 		 */
8135 		schedule_instance = cp->instance;
8136 	}
8137 
8138 	/* If the HCI_ADVERTISING flag is set or the device isn't powered or
8139 	 * there is no instance to be advertised then we have no HCI
8140 	 * communication to make. Simply return.
8141 	 */
8142 	if (!hdev_is_powered(hdev) ||
8143 	    hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8144 	    !schedule_instance) {
8145 		rp.instance = cp->instance;
8146 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8147 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8148 		goto unlock;
8149 	}
8150 
8151 	/* We're good to go, update advertising data, parameters, and start
8152 	 * advertising.
8153 	 */
8154 	cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
8155 			       data_len);
8156 	if (!cmd) {
8157 		err = -ENOMEM;
8158 		goto unlock;
8159 	}
8160 
8161 	cp->instance = schedule_instance;
8162 
8163 	err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
8164 				 add_advertising_complete);
8165 	if (err < 0)
8166 		mgmt_pending_free(cmd);
8167 
8168 unlock:
8169 	hci_dev_unlock(hdev);
8170 
8171 	return err;
8172 }
8173 
8174 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
8175 					int err)
8176 {
8177 	struct mgmt_pending_cmd *cmd = data;
8178 	struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8179 	struct mgmt_rp_add_ext_adv_params rp;
8180 	struct adv_info *adv;
8181 	u32 flags;
8182 
8183 	BT_DBG("%s", hdev->name);
8184 
8185 	hci_dev_lock(hdev);
8186 
8187 	adv = hci_find_adv_instance(hdev, cp->instance);
8188 	if (!adv)
8189 		goto unlock;
8190 
8191 	rp.instance = cp->instance;
8192 	rp.tx_power = adv->tx_power;
8193 
8194 	/* While we're at it, inform userspace of the available space for this
8195 	 * advertisement, given the flags that will be used.
8196 	 */
8197 	flags = __le32_to_cpu(cp->flags);
8198 	rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8199 	rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8200 
8201 	if (err) {
8202 		/* If this advertisement was previously advertising and we
8203 		 * failed to update it, we signal that it has been removed and
8204 		 * delete its structure
8205 		 */
8206 		if (!adv->pending)
8207 			mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
8208 
8209 		hci_remove_adv_instance(hdev, cp->instance);
8210 
8211 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8212 				mgmt_status(err));
8213 	} else {
8214 		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8215 				  mgmt_status(err), &rp, sizeof(rp));
8216 	}
8217 
8218 unlock:
8219 	if (cmd)
8220 		mgmt_pending_free(cmd);
8221 
8222 	hci_dev_unlock(hdev);
8223 }
8224 
8225 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
8226 {
8227 	struct mgmt_pending_cmd *cmd = data;
8228 	struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
8229 
8230 	return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
8231 }
8232 
8233 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
8234 			      void *data, u16 data_len)
8235 {
8236 	struct mgmt_cp_add_ext_adv_params *cp = data;
8237 	struct mgmt_rp_add_ext_adv_params rp;
8238 	struct mgmt_pending_cmd *cmd = NULL;
8239 	u32 flags, min_interval, max_interval;
8240 	u16 timeout, duration;
8241 	u8 status;
8242 	s8 tx_power;
8243 	int err;
8244 
8245 	BT_DBG("%s", hdev->name);
8246 
8247 	status = mgmt_le_support(hdev);
8248 	if (status)
8249 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8250 				       status);
8251 
8252 	if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8253 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8254 				       MGMT_STATUS_INVALID_PARAMS);
8255 
8256 	/* The purpose of breaking add_advertising into two separate MGMT calls
8257 	 * for params and data is to allow more parameters to be added to this
8258 	 * structure in the future. For this reason, we verify that we have the
8259 	 * bare minimum structure we know of when the interface was defined. Any
8260 	 * extra parameters we don't know about will be ignored in this request.
8261 	 */
8262 	if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
8263 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
8264 				       MGMT_STATUS_INVALID_PARAMS);
8265 
8266 	flags = __le32_to_cpu(cp->flags);
8267 
8268 	if (!requested_adv_flags_are_valid(hdev, flags))
8269 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8270 				       MGMT_STATUS_INVALID_PARAMS);
8271 
8272 	hci_dev_lock(hdev);
8273 
8274 	/* In new interface, we require that we are powered to register */
8275 	if (!hdev_is_powered(hdev)) {
8276 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8277 				      MGMT_STATUS_REJECTED);
8278 		goto unlock;
8279 	}
8280 
8281 	if (adv_busy(hdev)) {
8282 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8283 				      MGMT_STATUS_BUSY);
8284 		goto unlock;
8285 	}
8286 
8287 	/* Parse defined parameters from request, use defaults otherwise */
8288 	timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8289 		  __le16_to_cpu(cp->timeout) : 0;
8290 
8291 	duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8292 		   __le16_to_cpu(cp->duration) :
8293 		   hdev->def_multi_adv_rotation_duration;
8294 
8295 	min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8296 		       __le32_to_cpu(cp->min_interval) :
8297 		       hdev->le_adv_min_interval;
8298 
8299 	max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8300 		       __le32_to_cpu(cp->max_interval) :
8301 		       hdev->le_adv_max_interval;
8302 
8303 	tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8304 		   cp->tx_power :
8305 		   HCI_ADV_TX_POWER_NO_PREFERENCE;
8306 
8307 	/* Create advertising instance with no advertising or response data */
8308 	err = hci_add_adv_instance(hdev, cp->instance, flags,
8309 				   0, NULL, 0, NULL, timeout, duration,
8310 				   tx_power, min_interval, max_interval);
8311 
8312 	if (err < 0) {
8313 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8314 				      MGMT_STATUS_FAILED);
8315 		goto unlock;
8316 	}
8317 
8318 	/* Submit request for advertising params if ext adv available */
8319 	if (ext_adv_capable(hdev)) {
8320 		cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
8321 				       data, data_len);
8322 		if (!cmd) {
8323 			err = -ENOMEM;
8324 			hci_remove_adv_instance(hdev, cp->instance);
8325 			goto unlock;
8326 		}
8327 
8328 		err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
8329 					 add_ext_adv_params_complete);
8330 		if (err < 0)
8331 			mgmt_pending_free(cmd);
8332 	} else {
8333 		rp.instance = cp->instance;
8334 		rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8335 		rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8336 		rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8337 		err = mgmt_cmd_complete(sk, hdev->id,
8338 					MGMT_OP_ADD_EXT_ADV_PARAMS,
8339 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8340 	}
8341 
8342 unlock:
8343 	hci_dev_unlock(hdev);
8344 
8345 	return err;
8346 }
8347 
8348 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
8349 {
8350 	struct mgmt_pending_cmd *cmd = data;
8351 	struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8352 	struct mgmt_rp_add_advertising rp;
8353 
8354 	add_adv_complete(hdev, cmd->sk, cp->instance, err);
8355 
8356 	memset(&rp, 0, sizeof(rp));
8357 
8358 	rp.instance = cp->instance;
8359 
8360 	if (err)
8361 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8362 				mgmt_status(err));
8363 	else
8364 		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8365 				  mgmt_status(err), &rp, sizeof(rp));
8366 
8367 	mgmt_pending_free(cmd);
8368 }
8369 
8370 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
8371 {
8372 	struct mgmt_pending_cmd *cmd = data;
8373 	struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
8374 	int err;
8375 
8376 	if (ext_adv_capable(hdev)) {
8377 		err = hci_update_adv_data_sync(hdev, cp->instance);
8378 		if (err)
8379 			return err;
8380 
8381 		err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
8382 		if (err)
8383 			return err;
8384 
8385 		return hci_enable_ext_advertising_sync(hdev, cp->instance);
8386 	}
8387 
8388 	return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8389 }
8390 
8391 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8392 			    u16 data_len)
8393 {
8394 	struct mgmt_cp_add_ext_adv_data *cp = data;
8395 	struct mgmt_rp_add_ext_adv_data rp;
8396 	u8 schedule_instance = 0;
8397 	struct adv_info *next_instance;
8398 	struct adv_info *adv_instance;
8399 	int err = 0;
8400 	struct mgmt_pending_cmd *cmd;
8401 
8402 	BT_DBG("%s", hdev->name);
8403 
8404 	hci_dev_lock(hdev);
8405 
8406 	adv_instance = hci_find_adv_instance(hdev, cp->instance);
8407 
8408 	if (!adv_instance) {
8409 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8410 				      MGMT_STATUS_INVALID_PARAMS);
8411 		goto unlock;
8412 	}
8413 
8414 	/* In new interface, we require that we are powered to register */
8415 	if (!hdev_is_powered(hdev)) {
8416 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8417 				      MGMT_STATUS_REJECTED);
8418 		goto clear_new_instance;
8419 	}
8420 
8421 	if (adv_busy(hdev)) {
8422 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8423 				      MGMT_STATUS_BUSY);
8424 		goto clear_new_instance;
8425 	}
8426 
8427 	/* Validate new data */
8428 	if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8429 			       cp->adv_data_len, true) ||
8430 	    !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8431 			       cp->adv_data_len, cp->scan_rsp_len, false)) {
8432 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8433 				      MGMT_STATUS_INVALID_PARAMS);
8434 		goto clear_new_instance;
8435 	}
8436 
8437 	/* Set the data in the advertising instance */
8438 	hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8439 				  cp->data, cp->scan_rsp_len,
8440 				  cp->data + cp->adv_data_len);
8441 
8442 	/* If using software rotation, determine next instance to use */
8443 	if (hdev->cur_adv_instance == cp->instance) {
8444 		/* If the currently advertised instance is being changed
8445 		 * then cancel the current advertising and schedule the
8446 		 * next instance. If there is only one instance then the
8447 		 * overridden advertising data will be visible right
8448 		 * away
8449 		 */
8450 		cancel_adv_timeout(hdev);
8451 
8452 		next_instance = hci_get_next_instance(hdev, cp->instance);
8453 		if (next_instance)
8454 			schedule_instance = next_instance->instance;
8455 	} else if (!hdev->adv_instance_timeout) {
8456 		/* Immediately advertise the new instance if no other
8457 		 * instance is currently being advertised.
8458 		 */
8459 		schedule_instance = cp->instance;
8460 	}
8461 
8462 	/* If the HCI_ADVERTISING flag is set or there is no instance to
8463 	 * be advertised then we have no HCI communication to make.
8464 	 * Simply return.
8465 	 */
8466 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
8467 		if (adv_instance->pending) {
8468 			mgmt_advertising_added(sk, hdev, cp->instance);
8469 			adv_instance->pending = false;
8470 		}
8471 		rp.instance = cp->instance;
8472 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8473 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8474 		goto unlock;
8475 	}
8476 
8477 	cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8478 			       data_len);
8479 	if (!cmd) {
8480 		err = -ENOMEM;
8481 		goto clear_new_instance;
8482 	}
8483 
8484 	err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
8485 				 add_ext_adv_data_complete);
8486 	if (err < 0) {
8487 		mgmt_pending_free(cmd);
8488 		goto clear_new_instance;
8489 	}
8490 
8491 	/* We were successful in updating data, so trigger advertising_added
8492 	 * event if this is an instance that wasn't previously advertising. If
8493 	 * a failure occurs in the requests we initiated, we will remove the
8494 	 * instance again in add_advertising_complete
8495 	 */
8496 	if (adv_instance->pending)
8497 		mgmt_advertising_added(sk, hdev, cp->instance);
8498 
8499 	goto unlock;
8500 
8501 clear_new_instance:
8502 	hci_remove_adv_instance(hdev, cp->instance);
8503 
8504 unlock:
8505 	hci_dev_unlock(hdev);
8506 
8507 	return err;
8508 }
8509 
8510 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
8511 					int err)
8512 {
8513 	struct mgmt_pending_cmd *cmd = data;
8514 	struct mgmt_cp_remove_advertising *cp = cmd->param;
8515 	struct mgmt_rp_remove_advertising rp;
8516 
8517 	bt_dev_dbg(hdev, "err %d", err);
8518 
8519 	memset(&rp, 0, sizeof(rp));
8520 	rp.instance = cp->instance;
8521 
8522 	if (err)
8523 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
8524 				mgmt_status(err));
8525 	else
8526 		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
8527 				  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8528 
8529 	mgmt_pending_free(cmd);
8530 }
8531 
8532 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
8533 {
8534 	struct mgmt_pending_cmd *cmd = data;
8535 	struct mgmt_cp_remove_advertising *cp = cmd->param;
8536 	int err;
8537 
8538 	err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
8539 	if (err)
8540 		return err;
8541 
8542 	if (list_empty(&hdev->adv_instances))
8543 		err = hci_disable_advertising_sync(hdev);
8544 
8545 	return err;
8546 }
8547 
8548 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8549 			      void *data, u16 data_len)
8550 {
8551 	struct mgmt_cp_remove_advertising *cp = data;
8552 	struct mgmt_pending_cmd *cmd;
8553 	int err;
8554 
8555 	bt_dev_dbg(hdev, "sock %p", sk);
8556 
8557 	hci_dev_lock(hdev);
8558 
8559 	if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8560 		err = mgmt_cmd_status(sk, hdev->id,
8561 				      MGMT_OP_REMOVE_ADVERTISING,
8562 				      MGMT_STATUS_INVALID_PARAMS);
8563 		goto unlock;
8564 	}
8565 
8566 	if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8567 	    pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8568 	    pending_find(MGMT_OP_SET_LE, hdev)) {
8569 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8570 				      MGMT_STATUS_BUSY);
8571 		goto unlock;
8572 	}
8573 
8574 	if (list_empty(&hdev->adv_instances)) {
8575 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8576 				      MGMT_STATUS_INVALID_PARAMS);
8577 		goto unlock;
8578 	}
8579 
8580 	cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8581 			       data_len);
8582 	if (!cmd) {
8583 		err = -ENOMEM;
8584 		goto unlock;
8585 	}
8586 
8587 	err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
8588 				 remove_advertising_complete);
8589 	if (err < 0)
8590 		mgmt_pending_free(cmd);
8591 
8592 unlock:
8593 	hci_dev_unlock(hdev);
8594 
8595 	return err;
8596 }
8597 
8598 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8599 			     void *data, u16 data_len)
8600 {
8601 	struct mgmt_cp_get_adv_size_info *cp = data;
8602 	struct mgmt_rp_get_adv_size_info rp;
8603 	u32 flags, supported_flags;
8604 	int err;
8605 
8606 	bt_dev_dbg(hdev, "sock %p", sk);
8607 
8608 	if (!lmp_le_capable(hdev))
8609 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8610 				       MGMT_STATUS_REJECTED);
8611 
8612 	if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8613 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8614 				       MGMT_STATUS_INVALID_PARAMS);
8615 
8616 	flags = __le32_to_cpu(cp->flags);
8617 
8618 	/* The current implementation only supports a subset of the specified
8619 	 * flags.
8620 	 */
8621 	supported_flags = get_supported_adv_flags(hdev);
8622 	if (flags & ~supported_flags)
8623 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8624 				       MGMT_STATUS_INVALID_PARAMS);
8625 
8626 	rp.instance = cp->instance;
8627 	rp.flags = cp->flags;
8628 	rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8629 	rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8630 
8631 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8632 				MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8633 
8634 	return err;
8635 }
8636 
8637 static const struct hci_mgmt_handler mgmt_handlers[] = {
8638 	{ NULL }, /* 0x0000 (no command) */
8639 	{ read_version,            MGMT_READ_VERSION_SIZE,
8640 						HCI_MGMT_NO_HDEV |
8641 						HCI_MGMT_UNTRUSTED },
8642 	{ read_commands,           MGMT_READ_COMMANDS_SIZE,
8643 						HCI_MGMT_NO_HDEV |
8644 						HCI_MGMT_UNTRUSTED },
8645 	{ read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8646 						HCI_MGMT_NO_HDEV |
8647 						HCI_MGMT_UNTRUSTED },
8648 	{ read_controller_info,    MGMT_READ_INFO_SIZE,
8649 						HCI_MGMT_UNTRUSTED },
8650 	{ set_powered,             MGMT_SETTING_SIZE },
8651 	{ set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8652 	{ set_connectable,         MGMT_SETTING_SIZE },
8653 	{ set_fast_connectable,    MGMT_SETTING_SIZE },
8654 	{ set_bondable,            MGMT_SETTING_SIZE },
8655 	{ set_link_security,       MGMT_SETTING_SIZE },
8656 	{ set_ssp,                 MGMT_SETTING_SIZE },
8657 	{ set_hs,                  MGMT_SETTING_SIZE },
8658 	{ set_le,                  MGMT_SETTING_SIZE },
8659 	{ set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8660 	{ set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8661 	{ add_uuid,                MGMT_ADD_UUID_SIZE },
8662 	{ remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8663 	{ load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8664 						HCI_MGMT_VAR_LEN },
8665 	{ load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8666 						HCI_MGMT_VAR_LEN },
8667 	{ disconnect,              MGMT_DISCONNECT_SIZE },
8668 	{ get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8669 	{ pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8670 	{ pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8671 	{ set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8672 	{ pair_device,             MGMT_PAIR_DEVICE_SIZE },
8673 	{ cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8674 	{ unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8675 	{ user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8676 	{ user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8677 	{ user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8678 	{ user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8679 	{ read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8680 	{ add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8681 						HCI_MGMT_VAR_LEN },
8682 	{ remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8683 	{ start_discovery,         MGMT_START_DISCOVERY_SIZE },
8684 	{ stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8685 	{ confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8686 	{ block_device,            MGMT_BLOCK_DEVICE_SIZE },
8687 	{ unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8688 	{ set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8689 	{ set_advertising,         MGMT_SETTING_SIZE },
8690 	{ set_bredr,               MGMT_SETTING_SIZE },
8691 	{ set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8692 	{ set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8693 	{ set_secure_conn,         MGMT_SETTING_SIZE },
8694 	{ set_debug_keys,          MGMT_SETTING_SIZE },
8695 	{ set_privacy,             MGMT_SET_PRIVACY_SIZE },
8696 	{ load_irks,               MGMT_LOAD_IRKS_SIZE,
8697 						HCI_MGMT_VAR_LEN },
8698 	{ get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8699 	{ get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8700 	{ add_device,              MGMT_ADD_DEVICE_SIZE },
8701 	{ remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8702 	{ load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8703 						HCI_MGMT_VAR_LEN },
8704 	{ read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8705 						HCI_MGMT_NO_HDEV |
8706 						HCI_MGMT_UNTRUSTED },
8707 	{ read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8708 						HCI_MGMT_UNCONFIGURED |
8709 						HCI_MGMT_UNTRUSTED },
8710 	{ set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8711 						HCI_MGMT_UNCONFIGURED },
8712 	{ set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8713 						HCI_MGMT_UNCONFIGURED },
8714 	{ start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8715 						HCI_MGMT_VAR_LEN },
8716 	{ read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8717 	{ read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8718 						HCI_MGMT_NO_HDEV |
8719 						HCI_MGMT_UNTRUSTED },
8720 	{ read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8721 	{ add_advertising,	   MGMT_ADD_ADVERTISING_SIZE,
8722 						HCI_MGMT_VAR_LEN },
8723 	{ remove_advertising,	   MGMT_REMOVE_ADVERTISING_SIZE },
8724 	{ get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8725 	{ start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8726 	{ read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8727 						HCI_MGMT_UNTRUSTED },
8728 	{ set_appearance,	   MGMT_SET_APPEARANCE_SIZE },
8729 	{ get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8730 	{ set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8731 	{ set_blocked_keys,	   MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8732 						HCI_MGMT_VAR_LEN },
8733 	{ set_wideband_speech,	   MGMT_SETTING_SIZE },
8734 	{ read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8735 						HCI_MGMT_UNTRUSTED },
8736 	{ read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8737 						HCI_MGMT_UNTRUSTED |
8738 						HCI_MGMT_HDEV_OPTIONAL },
8739 	{ set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8740 						HCI_MGMT_VAR_LEN |
8741 						HCI_MGMT_HDEV_OPTIONAL },
8742 	{ read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8743 						HCI_MGMT_UNTRUSTED },
8744 	{ set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8745 						HCI_MGMT_VAR_LEN },
8746 	{ read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8747 						HCI_MGMT_UNTRUSTED },
8748 	{ set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8749 						HCI_MGMT_VAR_LEN },
8750 	{ get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8751 	{ set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8752 	{ read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8753 	{ add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8754 						HCI_MGMT_VAR_LEN },
8755 	{ remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8756 	{ add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8757 						HCI_MGMT_VAR_LEN },
8758 	{ add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8759 						HCI_MGMT_VAR_LEN },
8760 	{ add_adv_patterns_monitor_rssi,
8761 				   MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8762 						HCI_MGMT_VAR_LEN },
8763 };
8764 
8765 void mgmt_index_added(struct hci_dev *hdev)
8766 {
8767 	struct mgmt_ev_ext_index ev;
8768 
8769 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8770 		return;
8771 
8772 	switch (hdev->dev_type) {
8773 	case HCI_PRIMARY:
8774 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8775 			mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8776 					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8777 			ev.type = 0x01;
8778 		} else {
8779 			mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8780 					 HCI_MGMT_INDEX_EVENTS);
8781 			ev.type = 0x00;
8782 		}
8783 		break;
8784 	case HCI_AMP:
8785 		ev.type = 0x02;
8786 		break;
8787 	default:
8788 		return;
8789 	}
8790 
8791 	ev.bus = hdev->bus;
8792 
8793 	mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8794 			 HCI_MGMT_EXT_INDEX_EVENTS);
8795 }
8796 
8797 void mgmt_index_removed(struct hci_dev *hdev)
8798 {
8799 	struct mgmt_ev_ext_index ev;
8800 	u8 status = MGMT_STATUS_INVALID_INDEX;
8801 
8802 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8803 		return;
8804 
8805 	switch (hdev->dev_type) {
8806 	case HCI_PRIMARY:
8807 		mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8808 
8809 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8810 			mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8811 					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8812 			ev.type = 0x01;
8813 		} else {
8814 			mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8815 					 HCI_MGMT_INDEX_EVENTS);
8816 			ev.type = 0x00;
8817 		}
8818 		break;
8819 	case HCI_AMP:
8820 		ev.type = 0x02;
8821 		break;
8822 	default:
8823 		return;
8824 	}
8825 
8826 	ev.bus = hdev->bus;
8827 
8828 	mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8829 			 HCI_MGMT_EXT_INDEX_EVENTS);
8830 }
8831 
8832 void mgmt_power_on(struct hci_dev *hdev, int err)
8833 {
8834 	struct cmd_lookup match = { NULL, hdev };
8835 
8836 	bt_dev_dbg(hdev, "err %d", err);
8837 
8838 	hci_dev_lock(hdev);
8839 
8840 	if (!err) {
8841 		restart_le_actions(hdev);
8842 		hci_update_passive_scan(hdev);
8843 	}
8844 
8845 	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8846 
8847 	new_settings(hdev, match.sk);
8848 
8849 	if (match.sk)
8850 		sock_put(match.sk);
8851 
8852 	hci_dev_unlock(hdev);
8853 }
8854 
8855 void __mgmt_power_off(struct hci_dev *hdev)
8856 {
8857 	struct cmd_lookup match = { NULL, hdev };
8858 	u8 status, zero_cod[] = { 0, 0, 0 };
8859 
8860 	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8861 
8862 	/* If the power off is because of hdev unregistration let
8863 	 * use the appropriate INVALID_INDEX status. Otherwise use
8864 	 * NOT_POWERED. We cover both scenarios here since later in
8865 	 * mgmt_index_removed() any hci_conn callbacks will have already
8866 	 * been triggered, potentially causing misleading DISCONNECTED
8867 	 * status responses.
8868 	 */
8869 	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8870 		status = MGMT_STATUS_INVALID_INDEX;
8871 	else
8872 		status = MGMT_STATUS_NOT_POWERED;
8873 
8874 	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8875 
8876 	if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8877 		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8878 				   zero_cod, sizeof(zero_cod),
8879 				   HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8880 		ext_info_changed(hdev, NULL);
8881 	}
8882 
8883 	new_settings(hdev, match.sk);
8884 
8885 	if (match.sk)
8886 		sock_put(match.sk);
8887 }
8888 
8889 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8890 {
8891 	struct mgmt_pending_cmd *cmd;
8892 	u8 status;
8893 
8894 	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8895 	if (!cmd)
8896 		return;
8897 
8898 	if (err == -ERFKILL)
8899 		status = MGMT_STATUS_RFKILLED;
8900 	else
8901 		status = MGMT_STATUS_FAILED;
8902 
8903 	mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8904 
8905 	mgmt_pending_remove(cmd);
8906 }
8907 
8908 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8909 		       bool persistent)
8910 {
8911 	struct mgmt_ev_new_link_key ev;
8912 
8913 	memset(&ev, 0, sizeof(ev));
8914 
8915 	ev.store_hint = persistent;
8916 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8917 	ev.key.addr.type = BDADDR_BREDR;
8918 	ev.key.type = key->type;
8919 	memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8920 	ev.key.pin_len = key->pin_len;
8921 
8922 	mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8923 }
8924 
8925 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8926 {
8927 	switch (ltk->type) {
8928 	case SMP_LTK:
8929 	case SMP_LTK_RESPONDER:
8930 		if (ltk->authenticated)
8931 			return MGMT_LTK_AUTHENTICATED;
8932 		return MGMT_LTK_UNAUTHENTICATED;
8933 	case SMP_LTK_P256:
8934 		if (ltk->authenticated)
8935 			return MGMT_LTK_P256_AUTH;
8936 		return MGMT_LTK_P256_UNAUTH;
8937 	case SMP_LTK_P256_DEBUG:
8938 		return MGMT_LTK_P256_DEBUG;
8939 	}
8940 
8941 	return MGMT_LTK_UNAUTHENTICATED;
8942 }
8943 
8944 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8945 {
8946 	struct mgmt_ev_new_long_term_key ev;
8947 
8948 	memset(&ev, 0, sizeof(ev));
8949 
8950 	/* Devices using resolvable or non-resolvable random addresses
8951 	 * without providing an identity resolving key don't require
8952 	 * to store long term keys. Their addresses will change the
8953 	 * next time around.
8954 	 *
8955 	 * Only when a remote device provides an identity address
8956 	 * make sure the long term key is stored. If the remote
8957 	 * identity is known, the long term keys are internally
8958 	 * mapped to the identity address. So allow static random
8959 	 * and public addresses here.
8960 	 */
8961 	if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8962 	    (key->bdaddr.b[5] & 0xc0) != 0xc0)
8963 		ev.store_hint = 0x00;
8964 	else
8965 		ev.store_hint = persistent;
8966 
8967 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8968 	ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8969 	ev.key.type = mgmt_ltk_type(key);
8970 	ev.key.enc_size = key->enc_size;
8971 	ev.key.ediv = key->ediv;
8972 	ev.key.rand = key->rand;
8973 
8974 	if (key->type == SMP_LTK)
8975 		ev.key.initiator = 1;
8976 
8977 	/* Make sure we copy only the significant bytes based on the
8978 	 * encryption key size, and set the rest of the value to zeroes.
8979 	 */
8980 	memcpy(ev.key.val, key->val, key->enc_size);
8981 	memset(ev.key.val + key->enc_size, 0,
8982 	       sizeof(ev.key.val) - key->enc_size);
8983 
8984 	mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8985 }
8986 
8987 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8988 {
8989 	struct mgmt_ev_new_irk ev;
8990 
8991 	memset(&ev, 0, sizeof(ev));
8992 
8993 	ev.store_hint = persistent;
8994 
8995 	bacpy(&ev.rpa, &irk->rpa);
8996 	bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8997 	ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8998 	memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8999 
9000 	mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9001 }
9002 
9003 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9004 		   bool persistent)
9005 {
9006 	struct mgmt_ev_new_csrk ev;
9007 
9008 	memset(&ev, 0, sizeof(ev));
9009 
9010 	/* Devices using resolvable or non-resolvable random addresses
9011 	 * without providing an identity resolving key don't require
9012 	 * to store signature resolving keys. Their addresses will change
9013 	 * the next time around.
9014 	 *
9015 	 * Only when a remote device provides an identity address
9016 	 * make sure the signature resolving key is stored. So allow
9017 	 * static random and public addresses here.
9018 	 */
9019 	if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9020 	    (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9021 		ev.store_hint = 0x00;
9022 	else
9023 		ev.store_hint = persistent;
9024 
9025 	bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9026 	ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9027 	ev.key.type = csrk->type;
9028 	memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9029 
9030 	mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9031 }
9032 
9033 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9034 			 u8 bdaddr_type, u8 store_hint, u16 min_interval,
9035 			 u16 max_interval, u16 latency, u16 timeout)
9036 {
9037 	struct mgmt_ev_new_conn_param ev;
9038 
9039 	if (!hci_is_identity_address(bdaddr, bdaddr_type))
9040 		return;
9041 
9042 	memset(&ev, 0, sizeof(ev));
9043 	bacpy(&ev.addr.bdaddr, bdaddr);
9044 	ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9045 	ev.store_hint = store_hint;
9046 	ev.min_interval = cpu_to_le16(min_interval);
9047 	ev.max_interval = cpu_to_le16(max_interval);
9048 	ev.latency = cpu_to_le16(latency);
9049 	ev.timeout = cpu_to_le16(timeout);
9050 
9051 	mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9052 }
9053 
9054 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9055 			   u8 *name, u8 name_len)
9056 {
9057 	struct sk_buff *skb;
9058 	struct mgmt_ev_device_connected *ev;
9059 	u16 eir_len = 0;
9060 	u32 flags = 0;
9061 
9062 	if (conn->le_adv_data_len > 0)
9063 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9064 				     conn->le_adv_data_len);
9065 	else
9066 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
9067 				     2 + name_len + 5);
9068 
9069 	ev = skb_put(skb, sizeof(*ev));
9070 	bacpy(&ev->addr.bdaddr, &conn->dst);
9071 	ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9072 
9073 	if (conn->out)
9074 		flags |= MGMT_DEV_FOUND_INITIATED_CONN;
9075 
9076 	ev->flags = __cpu_to_le32(flags);
9077 
9078 	/* We must ensure that the EIR Data fields are ordered and
9079 	 * unique. Keep it simple for now and avoid the problem by not
9080 	 * adding any BR/EDR data to the LE adv.
9081 	 */
9082 	if (conn->le_adv_data_len > 0) {
9083 		skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
9084 		eir_len = conn->le_adv_data_len;
9085 	} else {
9086 		if (name_len > 0) {
9087 			eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
9088 						  name, name_len);
9089 			skb_put(skb, eir_len);
9090 		}
9091 
9092 		if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) {
9093 			eir_len = eir_append_data(ev->eir, eir_len,
9094 						  EIR_CLASS_OF_DEV,
9095 						  conn->dev_class, 3);
9096 			skb_put(skb, 5);
9097 		}
9098 	}
9099 
9100 	ev->eir_len = cpu_to_le16(eir_len);
9101 
9102 	mgmt_event_skb(skb, NULL);
9103 }
9104 
9105 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9106 {
9107 	struct sock **sk = data;
9108 
9109 	cmd->cmd_complete(cmd, 0);
9110 
9111 	*sk = cmd->sk;
9112 	sock_hold(*sk);
9113 
9114 	mgmt_pending_remove(cmd);
9115 }
9116 
9117 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9118 {
9119 	struct hci_dev *hdev = data;
9120 	struct mgmt_cp_unpair_device *cp = cmd->param;
9121 
9122 	device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9123 
9124 	cmd->cmd_complete(cmd, 0);
9125 	mgmt_pending_remove(cmd);
9126 }
9127 
9128 bool mgmt_powering_down(struct hci_dev *hdev)
9129 {
9130 	struct mgmt_pending_cmd *cmd;
9131 	struct mgmt_mode *cp;
9132 
9133 	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9134 	if (!cmd)
9135 		return false;
9136 
9137 	cp = cmd->param;
9138 	if (!cp->val)
9139 		return true;
9140 
9141 	return false;
9142 }
9143 
9144 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9145 			      u8 link_type, u8 addr_type, u8 reason,
9146 			      bool mgmt_connected)
9147 {
9148 	struct mgmt_ev_device_disconnected ev;
9149 	struct sock *sk = NULL;
9150 
9151 	/* The connection is still in hci_conn_hash so test for 1
9152 	 * instead of 0 to know if this is the last one.
9153 	 */
9154 	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9155 		cancel_delayed_work(&hdev->power_off);
9156 		queue_work(hdev->req_workqueue, &hdev->power_off.work);
9157 	}
9158 
9159 	if (!mgmt_connected)
9160 		return;
9161 
9162 	if (link_type != ACL_LINK && link_type != LE_LINK)
9163 		return;
9164 
9165 	mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9166 
9167 	bacpy(&ev.addr.bdaddr, bdaddr);
9168 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
9169 	ev.reason = reason;
9170 
9171 	/* Report disconnects due to suspend */
9172 	if (hdev->suspended)
9173 		ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
9174 
9175 	mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9176 
9177 	if (sk)
9178 		sock_put(sk);
9179 
9180 	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9181 			     hdev);
9182 }
9183 
9184 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9185 			    u8 link_type, u8 addr_type, u8 status)
9186 {
9187 	u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9188 	struct mgmt_cp_disconnect *cp;
9189 	struct mgmt_pending_cmd *cmd;
9190 
9191 	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9192 			     hdev);
9193 
9194 	cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
9195 	if (!cmd)
9196 		return;
9197 
9198 	cp = cmd->param;
9199 
9200 	if (bacmp(bdaddr, &cp->addr.bdaddr))
9201 		return;
9202 
9203 	if (cp->addr.type != bdaddr_type)
9204 		return;
9205 
9206 	cmd->cmd_complete(cmd, mgmt_status(status));
9207 	mgmt_pending_remove(cmd);
9208 }
9209 
9210 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9211 			 u8 addr_type, u8 status)
9212 {
9213 	struct mgmt_ev_connect_failed ev;
9214 
9215 	/* The connection is still in hci_conn_hash so test for 1
9216 	 * instead of 0 to know if this is the last one.
9217 	 */
9218 	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9219 		cancel_delayed_work(&hdev->power_off);
9220 		queue_work(hdev->req_workqueue, &hdev->power_off.work);
9221 	}
9222 
9223 	bacpy(&ev.addr.bdaddr, bdaddr);
9224 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
9225 	ev.status = mgmt_status(status);
9226 
9227 	mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9228 }
9229 
9230 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9231 {
9232 	struct mgmt_ev_pin_code_request ev;
9233 
9234 	bacpy(&ev.addr.bdaddr, bdaddr);
9235 	ev.addr.type = BDADDR_BREDR;
9236 	ev.secure = secure;
9237 
9238 	mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9239 }
9240 
9241 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9242 				  u8 status)
9243 {
9244 	struct mgmt_pending_cmd *cmd;
9245 
9246 	cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9247 	if (!cmd)
9248 		return;
9249 
9250 	cmd->cmd_complete(cmd, mgmt_status(status));
9251 	mgmt_pending_remove(cmd);
9252 }
9253 
9254 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9255 				      u8 status)
9256 {
9257 	struct mgmt_pending_cmd *cmd;
9258 
9259 	cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9260 	if (!cmd)
9261 		return;
9262 
9263 	cmd->cmd_complete(cmd, mgmt_status(status));
9264 	mgmt_pending_remove(cmd);
9265 }
9266 
9267 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9268 			      u8 link_type, u8 addr_type, u32 value,
9269 			      u8 confirm_hint)
9270 {
9271 	struct mgmt_ev_user_confirm_request ev;
9272 
9273 	bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9274 
9275 	bacpy(&ev.addr.bdaddr, bdaddr);
9276 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
9277 	ev.confirm_hint = confirm_hint;
9278 	ev.value = cpu_to_le32(value);
9279 
9280 	return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9281 			  NULL);
9282 }
9283 
9284 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9285 			      u8 link_type, u8 addr_type)
9286 {
9287 	struct mgmt_ev_user_passkey_request ev;
9288 
9289 	bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9290 
9291 	bacpy(&ev.addr.bdaddr, bdaddr);
9292 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
9293 
9294 	return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9295 			  NULL);
9296 }
9297 
9298 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9299 				      u8 link_type, u8 addr_type, u8 status,
9300 				      u8 opcode)
9301 {
9302 	struct mgmt_pending_cmd *cmd;
9303 
9304 	cmd = pending_find(opcode, hdev);
9305 	if (!cmd)
9306 		return -ENOENT;
9307 
9308 	cmd->cmd_complete(cmd, mgmt_status(status));
9309 	mgmt_pending_remove(cmd);
9310 
9311 	return 0;
9312 }
9313 
9314 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9315 				     u8 link_type, u8 addr_type, u8 status)
9316 {
9317 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9318 					  status, MGMT_OP_USER_CONFIRM_REPLY);
9319 }
9320 
9321 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9322 					 u8 link_type, u8 addr_type, u8 status)
9323 {
9324 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9325 					  status,
9326 					  MGMT_OP_USER_CONFIRM_NEG_REPLY);
9327 }
9328 
9329 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9330 				     u8 link_type, u8 addr_type, u8 status)
9331 {
9332 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9333 					  status, MGMT_OP_USER_PASSKEY_REPLY);
9334 }
9335 
9336 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9337 					 u8 link_type, u8 addr_type, u8 status)
9338 {
9339 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9340 					  status,
9341 					  MGMT_OP_USER_PASSKEY_NEG_REPLY);
9342 }
9343 
9344 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9345 			     u8 link_type, u8 addr_type, u32 passkey,
9346 			     u8 entered)
9347 {
9348 	struct mgmt_ev_passkey_notify ev;
9349 
9350 	bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9351 
9352 	bacpy(&ev.addr.bdaddr, bdaddr);
9353 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
9354 	ev.passkey = __cpu_to_le32(passkey);
9355 	ev.entered = entered;
9356 
9357 	return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9358 }
9359 
9360 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9361 {
9362 	struct mgmt_ev_auth_failed ev;
9363 	struct mgmt_pending_cmd *cmd;
9364 	u8 status = mgmt_status(hci_status);
9365 
9366 	bacpy(&ev.addr.bdaddr, &conn->dst);
9367 	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9368 	ev.status = status;
9369 
9370 	cmd = find_pairing(conn);
9371 
9372 	mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9373 		    cmd ? cmd->sk : NULL);
9374 
9375 	if (cmd) {
9376 		cmd->cmd_complete(cmd, status);
9377 		mgmt_pending_remove(cmd);
9378 	}
9379 }
9380 
9381 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9382 {
9383 	struct cmd_lookup match = { NULL, hdev };
9384 	bool changed;
9385 
9386 	if (status) {
9387 		u8 mgmt_err = mgmt_status(status);
9388 		mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9389 				     cmd_status_rsp, &mgmt_err);
9390 		return;
9391 	}
9392 
9393 	if (test_bit(HCI_AUTH, &hdev->flags))
9394 		changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9395 	else
9396 		changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9397 
9398 	mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9399 			     &match);
9400 
9401 	if (changed)
9402 		new_settings(hdev, match.sk);
9403 
9404 	if (match.sk)
9405 		sock_put(match.sk);
9406 }
9407 
9408 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9409 {
9410 	struct cmd_lookup *match = data;
9411 
9412 	if (match->sk == NULL) {
9413 		match->sk = cmd->sk;
9414 		sock_hold(match->sk);
9415 	}
9416 }
9417 
9418 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9419 				    u8 status)
9420 {
9421 	struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9422 
9423 	mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9424 	mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9425 	mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9426 
9427 	if (!status) {
9428 		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9429 				   3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9430 		ext_info_changed(hdev, NULL);
9431 	}
9432 
9433 	if (match.sk)
9434 		sock_put(match.sk);
9435 }
9436 
9437 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9438 {
9439 	struct mgmt_cp_set_local_name ev;
9440 	struct mgmt_pending_cmd *cmd;
9441 
9442 	if (status)
9443 		return;
9444 
9445 	memset(&ev, 0, sizeof(ev));
9446 	memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9447 	memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9448 
9449 	cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9450 	if (!cmd) {
9451 		memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9452 
9453 		/* If this is a HCI command related to powering on the
9454 		 * HCI dev don't send any mgmt signals.
9455 		 */
9456 		if (pending_find(MGMT_OP_SET_POWERED, hdev))
9457 			return;
9458 	}
9459 
9460 	mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9461 			   HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9462 	ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9463 }
9464 
9465 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9466 {
9467 	int i;
9468 
9469 	for (i = 0; i < uuid_count; i++) {
9470 		if (!memcmp(uuid, uuids[i], 16))
9471 			return true;
9472 	}
9473 
9474 	return false;
9475 }
9476 
9477 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9478 {
9479 	u16 parsed = 0;
9480 
9481 	while (parsed < eir_len) {
9482 		u8 field_len = eir[0];
9483 		u8 uuid[16];
9484 		int i;
9485 
9486 		if (field_len == 0)
9487 			break;
9488 
9489 		if (eir_len - parsed < field_len + 1)
9490 			break;
9491 
9492 		switch (eir[1]) {
9493 		case EIR_UUID16_ALL:
9494 		case EIR_UUID16_SOME:
9495 			for (i = 0; i + 3 <= field_len; i += 2) {
9496 				memcpy(uuid, bluetooth_base_uuid, 16);
9497 				uuid[13] = eir[i + 3];
9498 				uuid[12] = eir[i + 2];
9499 				if (has_uuid(uuid, uuid_count, uuids))
9500 					return true;
9501 			}
9502 			break;
9503 		case EIR_UUID32_ALL:
9504 		case EIR_UUID32_SOME:
9505 			for (i = 0; i + 5 <= field_len; i += 4) {
9506 				memcpy(uuid, bluetooth_base_uuid, 16);
9507 				uuid[15] = eir[i + 5];
9508 				uuid[14] = eir[i + 4];
9509 				uuid[13] = eir[i + 3];
9510 				uuid[12] = eir[i + 2];
9511 				if (has_uuid(uuid, uuid_count, uuids))
9512 					return true;
9513 			}
9514 			break;
9515 		case EIR_UUID128_ALL:
9516 		case EIR_UUID128_SOME:
9517 			for (i = 0; i + 17 <= field_len; i += 16) {
9518 				memcpy(uuid, eir + i + 2, 16);
9519 				if (has_uuid(uuid, uuid_count, uuids))
9520 					return true;
9521 			}
9522 			break;
9523 		}
9524 
9525 		parsed += field_len + 1;
9526 		eir += field_len + 1;
9527 	}
9528 
9529 	return false;
9530 }
9531 
9532 static void restart_le_scan(struct hci_dev *hdev)
9533 {
9534 	/* If controller is not scanning we are done. */
9535 	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9536 		return;
9537 
9538 	if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9539 		       hdev->discovery.scan_start +
9540 		       hdev->discovery.scan_duration))
9541 		return;
9542 
9543 	queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9544 			   DISCOV_LE_RESTART_DELAY);
9545 }
9546 
9547 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9548 			    u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9549 {
9550 	/* If a RSSI threshold has been specified, and
9551 	 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9552 	 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9553 	 * is set, let it through for further processing, as we might need to
9554 	 * restart the scan.
9555 	 *
9556 	 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9557 	 * the results are also dropped.
9558 	 */
9559 	if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9560 	    (rssi == HCI_RSSI_INVALID ||
9561 	    (rssi < hdev->discovery.rssi &&
9562 	     !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9563 		return  false;
9564 
9565 	if (hdev->discovery.uuid_count != 0) {
9566 		/* If a list of UUIDs is provided in filter, results with no
9567 		 * matching UUID should be dropped.
9568 		 */
9569 		if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9570 				   hdev->discovery.uuids) &&
9571 		    !eir_has_uuids(scan_rsp, scan_rsp_len,
9572 				   hdev->discovery.uuid_count,
9573 				   hdev->discovery.uuids))
9574 			return false;
9575 	}
9576 
9577 	/* If duplicate filtering does not report RSSI changes, then restart
9578 	 * scanning to ensure updated result with updated RSSI values.
9579 	 */
9580 	if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9581 		restart_le_scan(hdev);
9582 
9583 		/* Validate RSSI value against the RSSI threshold once more. */
9584 		if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9585 		    rssi < hdev->discovery.rssi)
9586 			return false;
9587 	}
9588 
9589 	return true;
9590 }
9591 
9592 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9593 		       u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9594 		       u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9595 {
9596 	struct sk_buff *skb;
9597 	struct mgmt_ev_device_found *ev;
9598 
9599 	/* Don't send events for a non-kernel initiated discovery. With
9600 	 * LE one exception is if we have pend_le_reports > 0 in which
9601 	 * case we're doing passive scanning and want these events.
9602 	 */
9603 	if (!hci_discovery_active(hdev)) {
9604 		if (link_type == ACL_LINK)
9605 			return;
9606 		if (link_type == LE_LINK &&
9607 		    list_empty(&hdev->pend_le_reports) &&
9608 		    !hci_is_adv_monitoring(hdev)) {
9609 			return;
9610 		}
9611 	}
9612 
9613 	if (hdev->discovery.result_filtering) {
9614 		/* We are using service discovery */
9615 		if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9616 				     scan_rsp_len))
9617 			return;
9618 	}
9619 
9620 	if (hdev->discovery.limited) {
9621 		/* Check for limited discoverable bit */
9622 		if (dev_class) {
9623 			if (!(dev_class[1] & 0x20))
9624 				return;
9625 		} else {
9626 			u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9627 			if (!flags || !(flags[0] & LE_AD_LIMITED))
9628 				return;
9629 		}
9630 	}
9631 
9632 	/* Allocate skb. The 5 extra bytes are for the potential CoD field */
9633 	skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
9634 			     sizeof(*ev) + eir_len + scan_rsp_len + 5);
9635 	if (!skb)
9636 		return;
9637 
9638 	ev = skb_put(skb, sizeof(*ev));
9639 
9640 	/* In case of device discovery with BR/EDR devices (pre 1.2), the
9641 	 * RSSI value was reported as 0 when not available. This behavior
9642 	 * is kept when using device discovery. This is required for full
9643 	 * backwards compatibility with the API.
9644 	 *
9645 	 * However when using service discovery, the value 127 will be
9646 	 * returned when the RSSI is not available.
9647 	 */
9648 	if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9649 	    link_type == ACL_LINK)
9650 		rssi = 0;
9651 
9652 	bacpy(&ev->addr.bdaddr, bdaddr);
9653 	ev->addr.type = link_to_bdaddr(link_type, addr_type);
9654 	ev->rssi = rssi;
9655 	ev->flags = cpu_to_le32(flags);
9656 
9657 	if (eir_len > 0)
9658 		/* Copy EIR or advertising data into event */
9659 		skb_put_data(skb, eir, eir_len);
9660 
9661 	if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
9662 		u8 eir_cod[5];
9663 
9664 		eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
9665 					   dev_class, 3);
9666 		skb_put_data(skb, eir_cod, sizeof(eir_cod));
9667 	}
9668 
9669 	if (scan_rsp_len > 0)
9670 		/* Append scan response data to event */
9671 		skb_put_data(skb, scan_rsp, scan_rsp_len);
9672 
9673 	ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9674 
9675 	mgmt_event_skb(skb, NULL);
9676 }
9677 
9678 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9679 		      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9680 {
9681 	struct sk_buff *skb;
9682 	struct mgmt_ev_device_found *ev;
9683 	u16 eir_len;
9684 	u32 flags;
9685 
9686 	if (name_len)
9687 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len);
9688 	else
9689 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0);
9690 
9691 	ev = skb_put(skb, sizeof(*ev));
9692 	bacpy(&ev->addr.bdaddr, bdaddr);
9693 	ev->addr.type = link_to_bdaddr(link_type, addr_type);
9694 	ev->rssi = rssi;
9695 
9696 	if (name) {
9697 		eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9698 					  name_len);
9699 		flags = 0;
9700 		skb_put(skb, eir_len);
9701 	} else {
9702 		eir_len = 0;
9703 		flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
9704 	}
9705 
9706 	ev->eir_len = cpu_to_le16(eir_len);
9707 	ev->flags = cpu_to_le32(flags);
9708 
9709 	mgmt_event_skb(skb, NULL);
9710 }
9711 
9712 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9713 {
9714 	struct mgmt_ev_discovering ev;
9715 
9716 	bt_dev_dbg(hdev, "discovering %u", discovering);
9717 
9718 	memset(&ev, 0, sizeof(ev));
9719 	ev.type = hdev->discovery.type;
9720 	ev.discovering = discovering;
9721 
9722 	mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9723 }
9724 
9725 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9726 {
9727 	struct mgmt_ev_controller_suspend ev;
9728 
9729 	ev.suspend_state = state;
9730 	mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9731 }
9732 
9733 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9734 		   u8 addr_type)
9735 {
9736 	struct mgmt_ev_controller_resume ev;
9737 
9738 	ev.wake_reason = reason;
9739 	if (bdaddr) {
9740 		bacpy(&ev.addr.bdaddr, bdaddr);
9741 		ev.addr.type = addr_type;
9742 	} else {
9743 		memset(&ev.addr, 0, sizeof(ev.addr));
9744 	}
9745 
9746 	mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9747 }
9748 
9749 static struct hci_mgmt_chan chan = {
9750 	.channel	= HCI_CHANNEL_CONTROL,
9751 	.handler_count	= ARRAY_SIZE(mgmt_handlers),
9752 	.handlers	= mgmt_handlers,
9753 	.hdev_init	= mgmt_init_hdev,
9754 };
9755 
9756 int mgmt_init(void)
9757 {
9758 	return hci_mgmt_chan_register(&chan);
9759 }
9760 
9761 void mgmt_exit(void)
9762 {
9763 	hci_mgmt_chan_unregister(&chan);
9764 }
9765