xref: /openbmc/linux/net/bluetooth/mgmt.c (revision da2ef666)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3 
4    Copyright (C) 2010  Nokia Corporation
5    Copyright (C) 2011-2012 Intel Corporation
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth HCI Management interface */
26 
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29 
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35 
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39 
40 #define MGMT_VERSION	1
41 #define MGMT_REVISION	14
42 
43 static const u16 mgmt_commands[] = {
44 	MGMT_OP_READ_INDEX_LIST,
45 	MGMT_OP_READ_INFO,
46 	MGMT_OP_SET_POWERED,
47 	MGMT_OP_SET_DISCOVERABLE,
48 	MGMT_OP_SET_CONNECTABLE,
49 	MGMT_OP_SET_FAST_CONNECTABLE,
50 	MGMT_OP_SET_BONDABLE,
51 	MGMT_OP_SET_LINK_SECURITY,
52 	MGMT_OP_SET_SSP,
53 	MGMT_OP_SET_HS,
54 	MGMT_OP_SET_LE,
55 	MGMT_OP_SET_DEV_CLASS,
56 	MGMT_OP_SET_LOCAL_NAME,
57 	MGMT_OP_ADD_UUID,
58 	MGMT_OP_REMOVE_UUID,
59 	MGMT_OP_LOAD_LINK_KEYS,
60 	MGMT_OP_LOAD_LONG_TERM_KEYS,
61 	MGMT_OP_DISCONNECT,
62 	MGMT_OP_GET_CONNECTIONS,
63 	MGMT_OP_PIN_CODE_REPLY,
64 	MGMT_OP_PIN_CODE_NEG_REPLY,
65 	MGMT_OP_SET_IO_CAPABILITY,
66 	MGMT_OP_PAIR_DEVICE,
67 	MGMT_OP_CANCEL_PAIR_DEVICE,
68 	MGMT_OP_UNPAIR_DEVICE,
69 	MGMT_OP_USER_CONFIRM_REPLY,
70 	MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 	MGMT_OP_USER_PASSKEY_REPLY,
72 	MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 	MGMT_OP_READ_LOCAL_OOB_DATA,
74 	MGMT_OP_ADD_REMOTE_OOB_DATA,
75 	MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 	MGMT_OP_START_DISCOVERY,
77 	MGMT_OP_STOP_DISCOVERY,
78 	MGMT_OP_CONFIRM_NAME,
79 	MGMT_OP_BLOCK_DEVICE,
80 	MGMT_OP_UNBLOCK_DEVICE,
81 	MGMT_OP_SET_DEVICE_ID,
82 	MGMT_OP_SET_ADVERTISING,
83 	MGMT_OP_SET_BREDR,
84 	MGMT_OP_SET_STATIC_ADDRESS,
85 	MGMT_OP_SET_SCAN_PARAMS,
86 	MGMT_OP_SET_SECURE_CONN,
87 	MGMT_OP_SET_DEBUG_KEYS,
88 	MGMT_OP_SET_PRIVACY,
89 	MGMT_OP_LOAD_IRKS,
90 	MGMT_OP_GET_CONN_INFO,
91 	MGMT_OP_GET_CLOCK_INFO,
92 	MGMT_OP_ADD_DEVICE,
93 	MGMT_OP_REMOVE_DEVICE,
94 	MGMT_OP_LOAD_CONN_PARAM,
95 	MGMT_OP_READ_UNCONF_INDEX_LIST,
96 	MGMT_OP_READ_CONFIG_INFO,
97 	MGMT_OP_SET_EXTERNAL_CONFIG,
98 	MGMT_OP_SET_PUBLIC_ADDRESS,
99 	MGMT_OP_START_SERVICE_DISCOVERY,
100 	MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 	MGMT_OP_READ_EXT_INDEX_LIST,
102 	MGMT_OP_READ_ADV_FEATURES,
103 	MGMT_OP_ADD_ADVERTISING,
104 	MGMT_OP_REMOVE_ADVERTISING,
105 	MGMT_OP_GET_ADV_SIZE_INFO,
106 	MGMT_OP_START_LIMITED_DISCOVERY,
107 	MGMT_OP_READ_EXT_INFO,
108 	MGMT_OP_SET_APPEARANCE,
109 };
110 
111 static const u16 mgmt_events[] = {
112 	MGMT_EV_CONTROLLER_ERROR,
113 	MGMT_EV_INDEX_ADDED,
114 	MGMT_EV_INDEX_REMOVED,
115 	MGMT_EV_NEW_SETTINGS,
116 	MGMT_EV_CLASS_OF_DEV_CHANGED,
117 	MGMT_EV_LOCAL_NAME_CHANGED,
118 	MGMT_EV_NEW_LINK_KEY,
119 	MGMT_EV_NEW_LONG_TERM_KEY,
120 	MGMT_EV_DEVICE_CONNECTED,
121 	MGMT_EV_DEVICE_DISCONNECTED,
122 	MGMT_EV_CONNECT_FAILED,
123 	MGMT_EV_PIN_CODE_REQUEST,
124 	MGMT_EV_USER_CONFIRM_REQUEST,
125 	MGMT_EV_USER_PASSKEY_REQUEST,
126 	MGMT_EV_AUTH_FAILED,
127 	MGMT_EV_DEVICE_FOUND,
128 	MGMT_EV_DISCOVERING,
129 	MGMT_EV_DEVICE_BLOCKED,
130 	MGMT_EV_DEVICE_UNBLOCKED,
131 	MGMT_EV_DEVICE_UNPAIRED,
132 	MGMT_EV_PASSKEY_NOTIFY,
133 	MGMT_EV_NEW_IRK,
134 	MGMT_EV_NEW_CSRK,
135 	MGMT_EV_DEVICE_ADDED,
136 	MGMT_EV_DEVICE_REMOVED,
137 	MGMT_EV_NEW_CONN_PARAM,
138 	MGMT_EV_UNCONF_INDEX_ADDED,
139 	MGMT_EV_UNCONF_INDEX_REMOVED,
140 	MGMT_EV_NEW_CONFIG_OPTIONS,
141 	MGMT_EV_EXT_INDEX_ADDED,
142 	MGMT_EV_EXT_INDEX_REMOVED,
143 	MGMT_EV_LOCAL_OOB_DATA_UPDATED,
144 	MGMT_EV_ADVERTISING_ADDED,
145 	MGMT_EV_ADVERTISING_REMOVED,
146 	MGMT_EV_EXT_INFO_CHANGED,
147 };
148 
149 static const u16 mgmt_untrusted_commands[] = {
150 	MGMT_OP_READ_INDEX_LIST,
151 	MGMT_OP_READ_INFO,
152 	MGMT_OP_READ_UNCONF_INDEX_LIST,
153 	MGMT_OP_READ_CONFIG_INFO,
154 	MGMT_OP_READ_EXT_INDEX_LIST,
155 	MGMT_OP_READ_EXT_INFO,
156 };
157 
158 static const u16 mgmt_untrusted_events[] = {
159 	MGMT_EV_INDEX_ADDED,
160 	MGMT_EV_INDEX_REMOVED,
161 	MGMT_EV_NEW_SETTINGS,
162 	MGMT_EV_CLASS_OF_DEV_CHANGED,
163 	MGMT_EV_LOCAL_NAME_CHANGED,
164 	MGMT_EV_UNCONF_INDEX_ADDED,
165 	MGMT_EV_UNCONF_INDEX_REMOVED,
166 	MGMT_EV_NEW_CONFIG_OPTIONS,
167 	MGMT_EV_EXT_INDEX_ADDED,
168 	MGMT_EV_EXT_INDEX_REMOVED,
169 	MGMT_EV_EXT_INFO_CHANGED,
170 };
171 
172 #define CACHE_TIMEOUT	msecs_to_jiffies(2 * 1000)
173 
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 		 "\x00\x00\x00\x00\x00\x00\x00\x00"
176 
177 /* HCI to MGMT error code conversion table */
178 static u8 mgmt_status_table[] = {
179 	MGMT_STATUS_SUCCESS,
180 	MGMT_STATUS_UNKNOWN_COMMAND,	/* Unknown Command */
181 	MGMT_STATUS_NOT_CONNECTED,	/* No Connection */
182 	MGMT_STATUS_FAILED,		/* Hardware Failure */
183 	MGMT_STATUS_CONNECT_FAILED,	/* Page Timeout */
184 	MGMT_STATUS_AUTH_FAILED,	/* Authentication Failed */
185 	MGMT_STATUS_AUTH_FAILED,	/* PIN or Key Missing */
186 	MGMT_STATUS_NO_RESOURCES,	/* Memory Full */
187 	MGMT_STATUS_TIMEOUT,		/* Connection Timeout */
188 	MGMT_STATUS_NO_RESOURCES,	/* Max Number of Connections */
189 	MGMT_STATUS_NO_RESOURCES,	/* Max Number of SCO Connections */
190 	MGMT_STATUS_ALREADY_CONNECTED,	/* ACL Connection Exists */
191 	MGMT_STATUS_BUSY,		/* Command Disallowed */
192 	MGMT_STATUS_NO_RESOURCES,	/* Rejected Limited Resources */
193 	MGMT_STATUS_REJECTED,		/* Rejected Security */
194 	MGMT_STATUS_REJECTED,		/* Rejected Personal */
195 	MGMT_STATUS_TIMEOUT,		/* Host Timeout */
196 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Feature */
197 	MGMT_STATUS_INVALID_PARAMS,	/* Invalid Parameters */
198 	MGMT_STATUS_DISCONNECTED,	/* OE User Ended Connection */
199 	MGMT_STATUS_NO_RESOURCES,	/* OE Low Resources */
200 	MGMT_STATUS_DISCONNECTED,	/* OE Power Off */
201 	MGMT_STATUS_DISCONNECTED,	/* Connection Terminated */
202 	MGMT_STATUS_BUSY,		/* Repeated Attempts */
203 	MGMT_STATUS_REJECTED,		/* Pairing Not Allowed */
204 	MGMT_STATUS_FAILED,		/* Unknown LMP PDU */
205 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported Remote Feature */
206 	MGMT_STATUS_REJECTED,		/* SCO Offset Rejected */
207 	MGMT_STATUS_REJECTED,		/* SCO Interval Rejected */
208 	MGMT_STATUS_REJECTED,		/* Air Mode Rejected */
209 	MGMT_STATUS_INVALID_PARAMS,	/* Invalid LMP Parameters */
210 	MGMT_STATUS_FAILED,		/* Unspecified Error */
211 	MGMT_STATUS_NOT_SUPPORTED,	/* Unsupported LMP Parameter Value */
212 	MGMT_STATUS_FAILED,		/* Role Change Not Allowed */
213 	MGMT_STATUS_TIMEOUT,		/* LMP Response Timeout */
214 	MGMT_STATUS_FAILED,		/* LMP Error Transaction Collision */
215 	MGMT_STATUS_FAILED,		/* LMP PDU Not Allowed */
216 	MGMT_STATUS_REJECTED,		/* Encryption Mode Not Accepted */
217 	MGMT_STATUS_FAILED,		/* Unit Link Key Used */
218 	MGMT_STATUS_NOT_SUPPORTED,	/* QoS Not Supported */
219 	MGMT_STATUS_TIMEOUT,		/* Instant Passed */
220 	MGMT_STATUS_NOT_SUPPORTED,	/* Pairing Not Supported */
221 	MGMT_STATUS_FAILED,		/* Transaction Collision */
222 	MGMT_STATUS_INVALID_PARAMS,	/* Unacceptable Parameter */
223 	MGMT_STATUS_REJECTED,		/* QoS Rejected */
224 	MGMT_STATUS_NOT_SUPPORTED,	/* Classification Not Supported */
225 	MGMT_STATUS_REJECTED,		/* Insufficient Security */
226 	MGMT_STATUS_INVALID_PARAMS,	/* Parameter Out Of Range */
227 	MGMT_STATUS_BUSY,		/* Role Switch Pending */
228 	MGMT_STATUS_FAILED,		/* Slot Violation */
229 	MGMT_STATUS_FAILED,		/* Role Switch Failed */
230 	MGMT_STATUS_INVALID_PARAMS,	/* EIR Too Large */
231 	MGMT_STATUS_NOT_SUPPORTED,	/* Simple Pairing Not Supported */
232 	MGMT_STATUS_BUSY,		/* Host Busy Pairing */
233 	MGMT_STATUS_REJECTED,		/* Rejected, No Suitable Channel */
234 	MGMT_STATUS_BUSY,		/* Controller Busy */
235 	MGMT_STATUS_INVALID_PARAMS,	/* Unsuitable Connection Interval */
236 	MGMT_STATUS_TIMEOUT,		/* Directed Advertising Timeout */
237 	MGMT_STATUS_AUTH_FAILED,	/* Terminated Due to MIC Failure */
238 	MGMT_STATUS_CONNECT_FAILED,	/* Connection Establishment Failed */
239 	MGMT_STATUS_CONNECT_FAILED,	/* MAC Connection Failed */
240 };
241 
242 static u8 mgmt_status(u8 hci_status)
243 {
244 	if (hci_status < ARRAY_SIZE(mgmt_status_table))
245 		return mgmt_status_table[hci_status];
246 
247 	return MGMT_STATUS_FAILED;
248 }
249 
250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
251 			    u16 len, int flag)
252 {
253 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 			       flag, NULL);
255 }
256 
257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
258 			      u16 len, int flag, struct sock *skip_sk)
259 {
260 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 			       flag, skip_sk);
262 }
263 
264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 		      struct sock *skip_sk)
266 {
267 	return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
268 			       HCI_SOCK_TRUSTED, skip_sk);
269 }
270 
271 static u8 le_addr_type(u8 mgmt_addr_type)
272 {
273 	if (mgmt_addr_type == BDADDR_LE_PUBLIC)
274 		return ADDR_LE_DEV_PUBLIC;
275 	else
276 		return ADDR_LE_DEV_RANDOM;
277 }
278 
279 void mgmt_fill_version_info(void *ver)
280 {
281 	struct mgmt_rp_read_version *rp = ver;
282 
283 	rp->version = MGMT_VERSION;
284 	rp->revision = cpu_to_le16(MGMT_REVISION);
285 }
286 
287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
288 			u16 data_len)
289 {
290 	struct mgmt_rp_read_version rp;
291 
292 	BT_DBG("sock %p", sk);
293 
294 	mgmt_fill_version_info(&rp);
295 
296 	return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
297 				 &rp, sizeof(rp));
298 }
299 
300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
301 			 u16 data_len)
302 {
303 	struct mgmt_rp_read_commands *rp;
304 	u16 num_commands, num_events;
305 	size_t rp_size;
306 	int i, err;
307 
308 	BT_DBG("sock %p", sk);
309 
310 	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
311 		num_commands = ARRAY_SIZE(mgmt_commands);
312 		num_events = ARRAY_SIZE(mgmt_events);
313 	} else {
314 		num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
315 		num_events = ARRAY_SIZE(mgmt_untrusted_events);
316 	}
317 
318 	rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
319 
320 	rp = kmalloc(rp_size, GFP_KERNEL);
321 	if (!rp)
322 		return -ENOMEM;
323 
324 	rp->num_commands = cpu_to_le16(num_commands);
325 	rp->num_events = cpu_to_le16(num_events);
326 
327 	if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
328 		__le16 *opcode = rp->opcodes;
329 
330 		for (i = 0; i < num_commands; i++, opcode++)
331 			put_unaligned_le16(mgmt_commands[i], opcode);
332 
333 		for (i = 0; i < num_events; i++, opcode++)
334 			put_unaligned_le16(mgmt_events[i], opcode);
335 	} else {
336 		__le16 *opcode = rp->opcodes;
337 
338 		for (i = 0; i < num_commands; i++, opcode++)
339 			put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
340 
341 		for (i = 0; i < num_events; i++, opcode++)
342 			put_unaligned_le16(mgmt_untrusted_events[i], opcode);
343 	}
344 
345 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
346 				rp, rp_size);
347 	kfree(rp);
348 
349 	return err;
350 }
351 
352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
353 			   u16 data_len)
354 {
355 	struct mgmt_rp_read_index_list *rp;
356 	struct hci_dev *d;
357 	size_t rp_len;
358 	u16 count;
359 	int err;
360 
361 	BT_DBG("sock %p", sk);
362 
363 	read_lock(&hci_dev_list_lock);
364 
365 	count = 0;
366 	list_for_each_entry(d, &hci_dev_list, list) {
367 		if (d->dev_type == HCI_PRIMARY &&
368 		    !hci_dev_test_flag(d, HCI_UNCONFIGURED))
369 			count++;
370 	}
371 
372 	rp_len = sizeof(*rp) + (2 * count);
373 	rp = kmalloc(rp_len, GFP_ATOMIC);
374 	if (!rp) {
375 		read_unlock(&hci_dev_list_lock);
376 		return -ENOMEM;
377 	}
378 
379 	count = 0;
380 	list_for_each_entry(d, &hci_dev_list, list) {
381 		if (hci_dev_test_flag(d, HCI_SETUP) ||
382 		    hci_dev_test_flag(d, HCI_CONFIG) ||
383 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
384 			continue;
385 
386 		/* Devices marked as raw-only are neither configured
387 		 * nor unconfigured controllers.
388 		 */
389 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
390 			continue;
391 
392 		if (d->dev_type == HCI_PRIMARY &&
393 		    !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
394 			rp->index[count++] = cpu_to_le16(d->id);
395 			BT_DBG("Added hci%u", d->id);
396 		}
397 	}
398 
399 	rp->num_controllers = cpu_to_le16(count);
400 	rp_len = sizeof(*rp) + (2 * count);
401 
402 	read_unlock(&hci_dev_list_lock);
403 
404 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
405 				0, rp, rp_len);
406 
407 	kfree(rp);
408 
409 	return err;
410 }
411 
412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
413 				  void *data, u16 data_len)
414 {
415 	struct mgmt_rp_read_unconf_index_list *rp;
416 	struct hci_dev *d;
417 	size_t rp_len;
418 	u16 count;
419 	int err;
420 
421 	BT_DBG("sock %p", sk);
422 
423 	read_lock(&hci_dev_list_lock);
424 
425 	count = 0;
426 	list_for_each_entry(d, &hci_dev_list, list) {
427 		if (d->dev_type == HCI_PRIMARY &&
428 		    hci_dev_test_flag(d, HCI_UNCONFIGURED))
429 			count++;
430 	}
431 
432 	rp_len = sizeof(*rp) + (2 * count);
433 	rp = kmalloc(rp_len, GFP_ATOMIC);
434 	if (!rp) {
435 		read_unlock(&hci_dev_list_lock);
436 		return -ENOMEM;
437 	}
438 
439 	count = 0;
440 	list_for_each_entry(d, &hci_dev_list, list) {
441 		if (hci_dev_test_flag(d, HCI_SETUP) ||
442 		    hci_dev_test_flag(d, HCI_CONFIG) ||
443 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
444 			continue;
445 
446 		/* Devices marked as raw-only are neither configured
447 		 * nor unconfigured controllers.
448 		 */
449 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
450 			continue;
451 
452 		if (d->dev_type == HCI_PRIMARY &&
453 		    hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
454 			rp->index[count++] = cpu_to_le16(d->id);
455 			BT_DBG("Added hci%u", d->id);
456 		}
457 	}
458 
459 	rp->num_controllers = cpu_to_le16(count);
460 	rp_len = sizeof(*rp) + (2 * count);
461 
462 	read_unlock(&hci_dev_list_lock);
463 
464 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
465 				MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
466 
467 	kfree(rp);
468 
469 	return err;
470 }
471 
472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
473 			       void *data, u16 data_len)
474 {
475 	struct mgmt_rp_read_ext_index_list *rp;
476 	struct hci_dev *d;
477 	size_t rp_len;
478 	u16 count;
479 	int err;
480 
481 	BT_DBG("sock %p", sk);
482 
483 	read_lock(&hci_dev_list_lock);
484 
485 	count = 0;
486 	list_for_each_entry(d, &hci_dev_list, list) {
487 		if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
488 			count++;
489 	}
490 
491 	rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
492 	rp = kmalloc(rp_len, GFP_ATOMIC);
493 	if (!rp) {
494 		read_unlock(&hci_dev_list_lock);
495 		return -ENOMEM;
496 	}
497 
498 	count = 0;
499 	list_for_each_entry(d, &hci_dev_list, list) {
500 		if (hci_dev_test_flag(d, HCI_SETUP) ||
501 		    hci_dev_test_flag(d, HCI_CONFIG) ||
502 		    hci_dev_test_flag(d, HCI_USER_CHANNEL))
503 			continue;
504 
505 		/* Devices marked as raw-only are neither configured
506 		 * nor unconfigured controllers.
507 		 */
508 		if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
509 			continue;
510 
511 		if (d->dev_type == HCI_PRIMARY) {
512 			if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
513 				rp->entry[count].type = 0x01;
514 			else
515 				rp->entry[count].type = 0x00;
516 		} else if (d->dev_type == HCI_AMP) {
517 			rp->entry[count].type = 0x02;
518 		} else {
519 			continue;
520 		}
521 
522 		rp->entry[count].bus = d->bus;
523 		rp->entry[count++].index = cpu_to_le16(d->id);
524 		BT_DBG("Added hci%u", d->id);
525 	}
526 
527 	rp->num_controllers = cpu_to_le16(count);
528 	rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
529 
530 	read_unlock(&hci_dev_list_lock);
531 
532 	/* If this command is called at least once, then all the
533 	 * default index and unconfigured index events are disabled
534 	 * and from now on only extended index events are used.
535 	 */
536 	hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
537 	hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
538 	hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
539 
540 	err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
541 				MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
542 
543 	kfree(rp);
544 
545 	return err;
546 }
547 
548 static bool is_configured(struct hci_dev *hdev)
549 {
550 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
551 	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
552 		return false;
553 
554 	if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 	    !bacmp(&hdev->public_addr, BDADDR_ANY))
556 		return false;
557 
558 	return true;
559 }
560 
561 static __le32 get_missing_options(struct hci_dev *hdev)
562 {
563 	u32 options = 0;
564 
565 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
566 	    !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
567 		options |= MGMT_OPTION_EXTERNAL_CONFIG;
568 
569 	if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
570 	    !bacmp(&hdev->public_addr, BDADDR_ANY))
571 		options |= MGMT_OPTION_PUBLIC_ADDRESS;
572 
573 	return cpu_to_le32(options);
574 }
575 
576 static int new_options(struct hci_dev *hdev, struct sock *skip)
577 {
578 	__le32 options = get_missing_options(hdev);
579 
580 	return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
581 				  sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
582 }
583 
584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
585 {
586 	__le32 options = get_missing_options(hdev);
587 
588 	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
589 				 sizeof(options));
590 }
591 
592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
593 			    void *data, u16 data_len)
594 {
595 	struct mgmt_rp_read_config_info rp;
596 	u32 options = 0;
597 
598 	BT_DBG("sock %p %s", sk, hdev->name);
599 
600 	hci_dev_lock(hdev);
601 
602 	memset(&rp, 0, sizeof(rp));
603 	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
604 
605 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
606 		options |= MGMT_OPTION_EXTERNAL_CONFIG;
607 
608 	if (hdev->set_bdaddr)
609 		options |= MGMT_OPTION_PUBLIC_ADDRESS;
610 
611 	rp.supported_options = cpu_to_le32(options);
612 	rp.missing_options = get_missing_options(hdev);
613 
614 	hci_dev_unlock(hdev);
615 
616 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
617 				 &rp, sizeof(rp));
618 }
619 
620 static u32 get_supported_phys(struct hci_dev *hdev)
621 {
622 	u32 supported_phys = 0;
623 
624 	if (lmp_bredr_capable(hdev)) {
625 		supported_phys |= MGMT_PHY_BR_1M_1SLOT;
626 
627 		if (hdev->features[0][0] & LMP_3SLOT)
628 			supported_phys |= MGMT_PHY_BR_1M_3SLOT;
629 
630 		if (hdev->features[0][0] & LMP_5SLOT)
631 			supported_phys |= MGMT_PHY_BR_1M_5SLOT;
632 
633 		if (lmp_edr_2m_capable(hdev)) {
634 			supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
635 
636 			if (lmp_edr_3slot_capable(hdev))
637 				supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
638 
639 			if (lmp_edr_5slot_capable(hdev))
640 				supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
641 
642 			if (lmp_edr_3m_capable(hdev)) {
643 				supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
644 
645 				if (lmp_edr_3slot_capable(hdev))
646 					supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
647 
648 				if (lmp_edr_5slot_capable(hdev))
649 					supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
650 			}
651 		}
652 	}
653 
654 	if (lmp_le_capable(hdev)) {
655 		supported_phys |= MGMT_PHY_LE_1M_TX;
656 		supported_phys |= MGMT_PHY_LE_1M_RX;
657 
658 		if (hdev->le_features[1] & HCI_LE_PHY_2M) {
659 			supported_phys |= MGMT_PHY_LE_2M_TX;
660 			supported_phys |= MGMT_PHY_LE_2M_RX;
661 		}
662 
663 		if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
664 			supported_phys |= MGMT_PHY_LE_CODED_TX;
665 			supported_phys |= MGMT_PHY_LE_CODED_RX;
666 		}
667 	}
668 
669 	return supported_phys;
670 }
671 
672 static u32 get_selected_phys(struct hci_dev *hdev)
673 {
674 	u32 selected_phys = 0;
675 
676 	if (lmp_bredr_capable(hdev)) {
677 		selected_phys |= MGMT_PHY_BR_1M_1SLOT;
678 
679 		if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
680 			selected_phys |= MGMT_PHY_BR_1M_3SLOT;
681 
682 		if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
683 			selected_phys |= MGMT_PHY_BR_1M_5SLOT;
684 
685 		if (lmp_edr_2m_capable(hdev)) {
686 			if (!(hdev->pkt_type & HCI_2DH1))
687 				selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
688 
689 			if (lmp_edr_3slot_capable(hdev) &&
690 			    !(hdev->pkt_type & HCI_2DH3))
691 				selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
692 
693 			if (lmp_edr_5slot_capable(hdev) &&
694 			    !(hdev->pkt_type & HCI_2DH5))
695 				selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
696 
697 			if (lmp_edr_3m_capable(hdev)) {
698 				if (!(hdev->pkt_type & HCI_3DH1))
699 					selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
700 
701 				if (lmp_edr_3slot_capable(hdev) &&
702 				    !(hdev->pkt_type & HCI_3DH3))
703 					selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
704 
705 				if (lmp_edr_5slot_capable(hdev) &&
706 				    !(hdev->pkt_type & HCI_3DH5))
707 					selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
708 			}
709 		}
710 	}
711 
712 	if (lmp_le_capable(hdev)) {
713 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
714 			selected_phys |= MGMT_PHY_LE_1M_TX;
715 
716 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
717 			selected_phys |= MGMT_PHY_LE_1M_RX;
718 
719 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
720 			selected_phys |= MGMT_PHY_LE_2M_TX;
721 
722 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
723 			selected_phys |= MGMT_PHY_LE_2M_RX;
724 
725 		if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
726 			selected_phys |= MGMT_PHY_LE_CODED_TX;
727 
728 		if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
729 			selected_phys |= MGMT_PHY_LE_CODED_RX;
730 	}
731 
732 	return selected_phys;
733 }
734 
735 static u32 get_configurable_phys(struct hci_dev *hdev)
736 {
737 	return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
738 		~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
739 }
740 
741 static u32 get_supported_settings(struct hci_dev *hdev)
742 {
743 	u32 settings = 0;
744 
745 	settings |= MGMT_SETTING_POWERED;
746 	settings |= MGMT_SETTING_BONDABLE;
747 	settings |= MGMT_SETTING_DEBUG_KEYS;
748 	settings |= MGMT_SETTING_CONNECTABLE;
749 	settings |= MGMT_SETTING_DISCOVERABLE;
750 
751 	if (lmp_bredr_capable(hdev)) {
752 		if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
753 			settings |= MGMT_SETTING_FAST_CONNECTABLE;
754 		settings |= MGMT_SETTING_BREDR;
755 		settings |= MGMT_SETTING_LINK_SECURITY;
756 
757 		if (lmp_ssp_capable(hdev)) {
758 			settings |= MGMT_SETTING_SSP;
759 			settings |= MGMT_SETTING_HS;
760 		}
761 
762 		if (lmp_sc_capable(hdev))
763 			settings |= MGMT_SETTING_SECURE_CONN;
764 	}
765 
766 	if (lmp_le_capable(hdev)) {
767 		settings |= MGMT_SETTING_LE;
768 		settings |= MGMT_SETTING_ADVERTISING;
769 		settings |= MGMT_SETTING_SECURE_CONN;
770 		settings |= MGMT_SETTING_PRIVACY;
771 		settings |= MGMT_SETTING_STATIC_ADDRESS;
772 	}
773 
774 	if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
775 	    hdev->set_bdaddr)
776 		settings |= MGMT_SETTING_CONFIGURATION;
777 
778 	settings |= MGMT_SETTING_PHY_CONFIGURATION;
779 
780 	return settings;
781 }
782 
783 static u32 get_current_settings(struct hci_dev *hdev)
784 {
785 	u32 settings = 0;
786 
787 	if (hdev_is_powered(hdev))
788 		settings |= MGMT_SETTING_POWERED;
789 
790 	if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
791 		settings |= MGMT_SETTING_CONNECTABLE;
792 
793 	if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
794 		settings |= MGMT_SETTING_FAST_CONNECTABLE;
795 
796 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
797 		settings |= MGMT_SETTING_DISCOVERABLE;
798 
799 	if (hci_dev_test_flag(hdev, HCI_BONDABLE))
800 		settings |= MGMT_SETTING_BONDABLE;
801 
802 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
803 		settings |= MGMT_SETTING_BREDR;
804 
805 	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
806 		settings |= MGMT_SETTING_LE;
807 
808 	if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
809 		settings |= MGMT_SETTING_LINK_SECURITY;
810 
811 	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
812 		settings |= MGMT_SETTING_SSP;
813 
814 	if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
815 		settings |= MGMT_SETTING_HS;
816 
817 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
818 		settings |= MGMT_SETTING_ADVERTISING;
819 
820 	if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
821 		settings |= MGMT_SETTING_SECURE_CONN;
822 
823 	if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
824 		settings |= MGMT_SETTING_DEBUG_KEYS;
825 
826 	if (hci_dev_test_flag(hdev, HCI_PRIVACY))
827 		settings |= MGMT_SETTING_PRIVACY;
828 
829 	/* The current setting for static address has two purposes. The
830 	 * first is to indicate if the static address will be used and
831 	 * the second is to indicate if it is actually set.
832 	 *
833 	 * This means if the static address is not configured, this flag
834 	 * will never be set. If the address is configured, then if the
835 	 * address is actually used decides if the flag is set or not.
836 	 *
837 	 * For single mode LE only controllers and dual-mode controllers
838 	 * with BR/EDR disabled, the existence of the static address will
839 	 * be evaluated.
840 	 */
841 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
842 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
843 	    !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
844 		if (bacmp(&hdev->static_addr, BDADDR_ANY))
845 			settings |= MGMT_SETTING_STATIC_ADDRESS;
846 	}
847 
848 	return settings;
849 }
850 
851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
852 {
853 	return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
854 }
855 
856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
857 						  struct hci_dev *hdev,
858 						  const void *data)
859 {
860 	return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
861 }
862 
863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
864 {
865 	struct mgmt_pending_cmd *cmd;
866 
867 	/* If there's a pending mgmt command the flags will not yet have
868 	 * their final values, so check for this first.
869 	 */
870 	cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
871 	if (cmd) {
872 		struct mgmt_mode *cp = cmd->param;
873 		if (cp->val == 0x01)
874 			return LE_AD_GENERAL;
875 		else if (cp->val == 0x02)
876 			return LE_AD_LIMITED;
877 	} else {
878 		if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
879 			return LE_AD_LIMITED;
880 		else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
881 			return LE_AD_GENERAL;
882 	}
883 
884 	return 0;
885 }
886 
887 bool mgmt_get_connectable(struct hci_dev *hdev)
888 {
889 	struct mgmt_pending_cmd *cmd;
890 
891 	/* If there's a pending mgmt command the flag will not yet have
892 	 * it's final value, so check for this first.
893 	 */
894 	cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
895 	if (cmd) {
896 		struct mgmt_mode *cp = cmd->param;
897 
898 		return cp->val;
899 	}
900 
901 	return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
902 }
903 
904 static void service_cache_off(struct work_struct *work)
905 {
906 	struct hci_dev *hdev = container_of(work, struct hci_dev,
907 					    service_cache.work);
908 	struct hci_request req;
909 
910 	if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
911 		return;
912 
913 	hci_req_init(&req, hdev);
914 
915 	hci_dev_lock(hdev);
916 
917 	__hci_req_update_eir(&req);
918 	__hci_req_update_class(&req);
919 
920 	hci_dev_unlock(hdev);
921 
922 	hci_req_run(&req, NULL);
923 }
924 
925 static void rpa_expired(struct work_struct *work)
926 {
927 	struct hci_dev *hdev = container_of(work, struct hci_dev,
928 					    rpa_expired.work);
929 	struct hci_request req;
930 
931 	BT_DBG("");
932 
933 	hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
934 
935 	if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
936 		return;
937 
938 	/* The generation of a new RPA and programming it into the
939 	 * controller happens in the hci_req_enable_advertising()
940 	 * function.
941 	 */
942 	hci_req_init(&req, hdev);
943 	if (ext_adv_capable(hdev))
944 		__hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
945 	else
946 		__hci_req_enable_advertising(&req);
947 	hci_req_run(&req, NULL);
948 }
949 
950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
951 {
952 	if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
953 		return;
954 
955 	INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
956 	INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
957 
958 	/* Non-mgmt controlled devices get this bit set
959 	 * implicitly so that pairing works for them, however
960 	 * for mgmt we require user-space to explicitly enable
961 	 * it
962 	 */
963 	hci_dev_clear_flag(hdev, HCI_BONDABLE);
964 }
965 
966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
967 				void *data, u16 data_len)
968 {
969 	struct mgmt_rp_read_info rp;
970 
971 	BT_DBG("sock %p %s", sk, hdev->name);
972 
973 	hci_dev_lock(hdev);
974 
975 	memset(&rp, 0, sizeof(rp));
976 
977 	bacpy(&rp.bdaddr, &hdev->bdaddr);
978 
979 	rp.version = hdev->hci_ver;
980 	rp.manufacturer = cpu_to_le16(hdev->manufacturer);
981 
982 	rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
983 	rp.current_settings = cpu_to_le32(get_current_settings(hdev));
984 
985 	memcpy(rp.dev_class, hdev->dev_class, 3);
986 
987 	memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
988 	memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
989 
990 	hci_dev_unlock(hdev);
991 
992 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
993 				 sizeof(rp));
994 }
995 
996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
997 {
998 	u16 eir_len = 0;
999 	size_t name_len;
1000 
1001 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002 		eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003 					  hdev->dev_class, 3);
1004 
1005 	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006 		eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007 					  hdev->appearance);
1008 
1009 	name_len = strlen(hdev->dev_name);
1010 	eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011 				  hdev->dev_name, name_len);
1012 
1013 	name_len = strlen(hdev->short_name);
1014 	eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015 				  hdev->short_name, name_len);
1016 
1017 	return eir_len;
1018 }
1019 
1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021 				    void *data, u16 data_len)
1022 {
1023 	char buf[512];
1024 	struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025 	u16 eir_len;
1026 
1027 	BT_DBG("sock %p %s", sk, hdev->name);
1028 
1029 	memset(&buf, 0, sizeof(buf));
1030 
1031 	hci_dev_lock(hdev);
1032 
1033 	bacpy(&rp->bdaddr, &hdev->bdaddr);
1034 
1035 	rp->version = hdev->hci_ver;
1036 	rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037 
1038 	rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039 	rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040 
1041 
1042 	eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043 	rp->eir_len = cpu_to_le16(eir_len);
1044 
1045 	hci_dev_unlock(hdev);
1046 
1047 	/* If this command is called at least once, then the events
1048 	 * for class of device and local name changes are disabled
1049 	 * and only the new extended controller information event
1050 	 * is used.
1051 	 */
1052 	hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053 	hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054 	hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055 
1056 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057 				 sizeof(*rp) + eir_len);
1058 }
1059 
1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061 {
1062 	char buf[512];
1063 	struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064 	u16 eir_len;
1065 
1066 	memset(buf, 0, sizeof(buf));
1067 
1068 	eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069 	ev->eir_len = cpu_to_le16(eir_len);
1070 
1071 	return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072 				  sizeof(*ev) + eir_len,
1073 				  HCI_MGMT_EXT_INFO_EVENTS, skip);
1074 }
1075 
1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077 {
1078 	__le32 settings = cpu_to_le32(get_current_settings(hdev));
1079 
1080 	return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081 				 sizeof(settings));
1082 }
1083 
1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085 {
1086 	BT_DBG("%s status 0x%02x", hdev->name, status);
1087 
1088 	if (hci_conn_count(hdev) == 0) {
1089 		cancel_delayed_work(&hdev->power_off);
1090 		queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091 	}
1092 }
1093 
1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095 {
1096 	struct mgmt_ev_advertising_added ev;
1097 
1098 	ev.instance = instance;
1099 
1100 	mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101 }
1102 
1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104 			      u8 instance)
1105 {
1106 	struct mgmt_ev_advertising_removed ev;
1107 
1108 	ev.instance = instance;
1109 
1110 	mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111 }
1112 
1113 static void cancel_adv_timeout(struct hci_dev *hdev)
1114 {
1115 	if (hdev->adv_instance_timeout) {
1116 		hdev->adv_instance_timeout = 0;
1117 		cancel_delayed_work(&hdev->adv_instance_expire);
1118 	}
1119 }
1120 
1121 static int clean_up_hci_state(struct hci_dev *hdev)
1122 {
1123 	struct hci_request req;
1124 	struct hci_conn *conn;
1125 	bool discov_stopped;
1126 	int err;
1127 
1128 	hci_req_init(&req, hdev);
1129 
1130 	if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131 	    test_bit(HCI_PSCAN, &hdev->flags)) {
1132 		u8 scan = 0x00;
1133 		hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134 	}
1135 
1136 	hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137 
1138 	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139 		__hci_req_disable_advertising(&req);
1140 
1141 	discov_stopped = hci_req_stop_discovery(&req);
1142 
1143 	list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144 		/* 0x15 == Terminated due to Power Off */
1145 		__hci_abort_conn(&req, conn, 0x15);
1146 	}
1147 
1148 	err = hci_req_run(&req, clean_up_hci_complete);
1149 	if (!err && discov_stopped)
1150 		hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151 
1152 	return err;
1153 }
1154 
1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156 		       u16 len)
1157 {
1158 	struct mgmt_mode *cp = data;
1159 	struct mgmt_pending_cmd *cmd;
1160 	int err;
1161 
1162 	BT_DBG("request for %s", hdev->name);
1163 
1164 	if (cp->val != 0x00 && cp->val != 0x01)
1165 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166 				       MGMT_STATUS_INVALID_PARAMS);
1167 
1168 	hci_dev_lock(hdev);
1169 
1170 	if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172 				      MGMT_STATUS_BUSY);
1173 		goto failed;
1174 	}
1175 
1176 	if (!!cp->val == hdev_is_powered(hdev)) {
1177 		err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178 		goto failed;
1179 	}
1180 
1181 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182 	if (!cmd) {
1183 		err = -ENOMEM;
1184 		goto failed;
1185 	}
1186 
1187 	if (cp->val) {
1188 		queue_work(hdev->req_workqueue, &hdev->power_on);
1189 		err = 0;
1190 	} else {
1191 		/* Disconnect connections, stop scans, etc */
1192 		err = clean_up_hci_state(hdev);
1193 		if (!err)
1194 			queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195 					   HCI_POWER_OFF_TIMEOUT);
1196 
1197 		/* ENODATA means there were no HCI commands queued */
1198 		if (err == -ENODATA) {
1199 			cancel_delayed_work(&hdev->power_off);
1200 			queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201 			err = 0;
1202 		}
1203 	}
1204 
1205 failed:
1206 	hci_dev_unlock(hdev);
1207 	return err;
1208 }
1209 
1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212 	__le32 ev = cpu_to_le32(get_current_settings(hdev));
1213 
1214 	return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215 				  sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217 
1218 int mgmt_new_settings(struct hci_dev *hdev)
1219 {
1220 	return new_settings(hdev, NULL);
1221 }
1222 
1223 struct cmd_lookup {
1224 	struct sock *sk;
1225 	struct hci_dev *hdev;
1226 	u8 mgmt_status;
1227 };
1228 
1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230 {
1231 	struct cmd_lookup *match = data;
1232 
1233 	send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234 
1235 	list_del(&cmd->list);
1236 
1237 	if (match->sk == NULL) {
1238 		match->sk = cmd->sk;
1239 		sock_hold(match->sk);
1240 	}
1241 
1242 	mgmt_pending_free(cmd);
1243 }
1244 
1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246 {
1247 	u8 *status = data;
1248 
1249 	mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250 	mgmt_pending_remove(cmd);
1251 }
1252 
1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254 {
1255 	if (cmd->cmd_complete) {
1256 		u8 *status = data;
1257 
1258 		cmd->cmd_complete(cmd, *status);
1259 		mgmt_pending_remove(cmd);
1260 
1261 		return;
1262 	}
1263 
1264 	cmd_status_rsp(cmd, data);
1265 }
1266 
1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268 {
1269 	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270 				 cmd->param, cmd->param_len);
1271 }
1272 
1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274 {
1275 	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276 				 cmd->param, sizeof(struct mgmt_addr_info));
1277 }
1278 
1279 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280 {
1281 	if (!lmp_bredr_capable(hdev))
1282 		return MGMT_STATUS_NOT_SUPPORTED;
1283 	else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284 		return MGMT_STATUS_REJECTED;
1285 	else
1286 		return MGMT_STATUS_SUCCESS;
1287 }
1288 
1289 static u8 mgmt_le_support(struct hci_dev *hdev)
1290 {
1291 	if (!lmp_le_capable(hdev))
1292 		return MGMT_STATUS_NOT_SUPPORTED;
1293 	else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294 		return MGMT_STATUS_REJECTED;
1295 	else
1296 		return MGMT_STATUS_SUCCESS;
1297 }
1298 
1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300 {
1301 	struct mgmt_pending_cmd *cmd;
1302 
1303 	BT_DBG("status 0x%02x", status);
1304 
1305 	hci_dev_lock(hdev);
1306 
1307 	cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308 	if (!cmd)
1309 		goto unlock;
1310 
1311 	if (status) {
1312 		u8 mgmt_err = mgmt_status(status);
1313 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315 		goto remove_cmd;
1316 	}
1317 
1318 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319 	    hdev->discov_timeout > 0) {
1320 		int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321 		queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322 	}
1323 
1324 	send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325 	new_settings(hdev, cmd->sk);
1326 
1327 remove_cmd:
1328 	mgmt_pending_remove(cmd);
1329 
1330 unlock:
1331 	hci_dev_unlock(hdev);
1332 }
1333 
1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335 			    u16 len)
1336 {
1337 	struct mgmt_cp_set_discoverable *cp = data;
1338 	struct mgmt_pending_cmd *cmd;
1339 	u16 timeout;
1340 	int err;
1341 
1342 	BT_DBG("request for %s", hdev->name);
1343 
1344 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347 				       MGMT_STATUS_REJECTED);
1348 
1349 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351 				       MGMT_STATUS_INVALID_PARAMS);
1352 
1353 	timeout = __le16_to_cpu(cp->timeout);
1354 
1355 	/* Disabling discoverable requires that no timeout is set,
1356 	 * and enabling limited discoverable requires a timeout.
1357 	 */
1358 	if ((cp->val == 0x00 && timeout > 0) ||
1359 	    (cp->val == 0x02 && timeout == 0))
1360 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361 				       MGMT_STATUS_INVALID_PARAMS);
1362 
1363 	hci_dev_lock(hdev);
1364 
1365 	if (!hdev_is_powered(hdev) && timeout > 0) {
1366 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367 				      MGMT_STATUS_NOT_POWERED);
1368 		goto failed;
1369 	}
1370 
1371 	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372 	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374 				      MGMT_STATUS_BUSY);
1375 		goto failed;
1376 	}
1377 
1378 	if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380 				      MGMT_STATUS_REJECTED);
1381 		goto failed;
1382 	}
1383 
1384 	if (!hdev_is_powered(hdev)) {
1385 		bool changed = false;
1386 
1387 		/* Setting limited discoverable when powered off is
1388 		 * not a valid operation since it requires a timeout
1389 		 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1390 		 */
1391 		if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392 			hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393 			changed = true;
1394 		}
1395 
1396 		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397 		if (err < 0)
1398 			goto failed;
1399 
1400 		if (changed)
1401 			err = new_settings(hdev, sk);
1402 
1403 		goto failed;
1404 	}
1405 
1406 	/* If the current mode is the same, then just update the timeout
1407 	 * value with the new value. And if only the timeout gets updated,
1408 	 * then no need for any HCI transactions.
1409 	 */
1410 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411 	    (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412 						   HCI_LIMITED_DISCOVERABLE)) {
1413 		cancel_delayed_work(&hdev->discov_off);
1414 		hdev->discov_timeout = timeout;
1415 
1416 		if (cp->val && hdev->discov_timeout > 0) {
1417 			int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418 			queue_delayed_work(hdev->req_workqueue,
1419 					   &hdev->discov_off, to);
1420 		}
1421 
1422 		err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423 		goto failed;
1424 	}
1425 
1426 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427 	if (!cmd) {
1428 		err = -ENOMEM;
1429 		goto failed;
1430 	}
1431 
1432 	/* Cancel any potential discoverable timeout that might be
1433 	 * still active and store new timeout value. The arming of
1434 	 * the timeout happens in the complete handler.
1435 	 */
1436 	cancel_delayed_work(&hdev->discov_off);
1437 	hdev->discov_timeout = timeout;
1438 
1439 	if (cp->val)
1440 		hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441 	else
1442 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443 
1444 	/* Limited discoverable mode */
1445 	if (cp->val == 0x02)
1446 		hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447 	else
1448 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449 
1450 	queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451 	err = 0;
1452 
1453 failed:
1454 	hci_dev_unlock(hdev);
1455 	return err;
1456 }
1457 
1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459 {
1460 	struct mgmt_pending_cmd *cmd;
1461 
1462 	BT_DBG("status 0x%02x", status);
1463 
1464 	hci_dev_lock(hdev);
1465 
1466 	cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467 	if (!cmd)
1468 		goto unlock;
1469 
1470 	if (status) {
1471 		u8 mgmt_err = mgmt_status(status);
1472 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473 		goto remove_cmd;
1474 	}
1475 
1476 	send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477 	new_settings(hdev, cmd->sk);
1478 
1479 remove_cmd:
1480 	mgmt_pending_remove(cmd);
1481 
1482 unlock:
1483 	hci_dev_unlock(hdev);
1484 }
1485 
1486 static int set_connectable_update_settings(struct hci_dev *hdev,
1487 					   struct sock *sk, u8 val)
1488 {
1489 	bool changed = false;
1490 	int err;
1491 
1492 	if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493 		changed = true;
1494 
1495 	if (val) {
1496 		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497 	} else {
1498 		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500 	}
1501 
1502 	err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503 	if (err < 0)
1504 		return err;
1505 
1506 	if (changed) {
1507 		hci_req_update_scan(hdev);
1508 		hci_update_background_scan(hdev);
1509 		return new_settings(hdev, sk);
1510 	}
1511 
1512 	return 0;
1513 }
1514 
1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516 			   u16 len)
1517 {
1518 	struct mgmt_mode *cp = data;
1519 	struct mgmt_pending_cmd *cmd;
1520 	int err;
1521 
1522 	BT_DBG("request for %s", hdev->name);
1523 
1524 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527 				       MGMT_STATUS_REJECTED);
1528 
1529 	if (cp->val != 0x00 && cp->val != 0x01)
1530 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531 				       MGMT_STATUS_INVALID_PARAMS);
1532 
1533 	hci_dev_lock(hdev);
1534 
1535 	if (!hdev_is_powered(hdev)) {
1536 		err = set_connectable_update_settings(hdev, sk, cp->val);
1537 		goto failed;
1538 	}
1539 
1540 	if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541 	    pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543 				      MGMT_STATUS_BUSY);
1544 		goto failed;
1545 	}
1546 
1547 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548 	if (!cmd) {
1549 		err = -ENOMEM;
1550 		goto failed;
1551 	}
1552 
1553 	if (cp->val) {
1554 		hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555 	} else {
1556 		if (hdev->discov_timeout > 0)
1557 			cancel_delayed_work(&hdev->discov_off);
1558 
1559 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560 		hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561 		hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562 	}
1563 
1564 	queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565 	err = 0;
1566 
1567 failed:
1568 	hci_dev_unlock(hdev);
1569 	return err;
1570 }
1571 
1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573 			u16 len)
1574 {
1575 	struct mgmt_mode *cp = data;
1576 	bool changed;
1577 	int err;
1578 
1579 	BT_DBG("request for %s", hdev->name);
1580 
1581 	if (cp->val != 0x00 && cp->val != 0x01)
1582 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583 				       MGMT_STATUS_INVALID_PARAMS);
1584 
1585 	hci_dev_lock(hdev);
1586 
1587 	if (cp->val)
1588 		changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589 	else
1590 		changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591 
1592 	err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593 	if (err < 0)
1594 		goto unlock;
1595 
1596 	if (changed) {
1597 		/* In limited privacy mode the change of bondable mode
1598 		 * may affect the local advertising address.
1599 		 */
1600 		if (hdev_is_powered(hdev) &&
1601 		    hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602 		    hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603 		    hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604 			queue_work(hdev->req_workqueue,
1605 				   &hdev->discoverable_update);
1606 
1607 		err = new_settings(hdev, sk);
1608 	}
1609 
1610 unlock:
1611 	hci_dev_unlock(hdev);
1612 	return err;
1613 }
1614 
1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616 			     u16 len)
1617 {
1618 	struct mgmt_mode *cp = data;
1619 	struct mgmt_pending_cmd *cmd;
1620 	u8 val, status;
1621 	int err;
1622 
1623 	BT_DBG("request for %s", hdev->name);
1624 
1625 	status = mgmt_bredr_support(hdev);
1626 	if (status)
1627 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628 				       status);
1629 
1630 	if (cp->val != 0x00 && cp->val != 0x01)
1631 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632 				       MGMT_STATUS_INVALID_PARAMS);
1633 
1634 	hci_dev_lock(hdev);
1635 
1636 	if (!hdev_is_powered(hdev)) {
1637 		bool changed = false;
1638 
1639 		if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640 			hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641 			changed = true;
1642 		}
1643 
1644 		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645 		if (err < 0)
1646 			goto failed;
1647 
1648 		if (changed)
1649 			err = new_settings(hdev, sk);
1650 
1651 		goto failed;
1652 	}
1653 
1654 	if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656 				      MGMT_STATUS_BUSY);
1657 		goto failed;
1658 	}
1659 
1660 	val = !!cp->val;
1661 
1662 	if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663 		err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664 		goto failed;
1665 	}
1666 
1667 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668 	if (!cmd) {
1669 		err = -ENOMEM;
1670 		goto failed;
1671 	}
1672 
1673 	err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674 	if (err < 0) {
1675 		mgmt_pending_remove(cmd);
1676 		goto failed;
1677 	}
1678 
1679 failed:
1680 	hci_dev_unlock(hdev);
1681 	return err;
1682 }
1683 
1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685 {
1686 	struct mgmt_mode *cp = data;
1687 	struct mgmt_pending_cmd *cmd;
1688 	u8 status;
1689 	int err;
1690 
1691 	BT_DBG("request for %s", hdev->name);
1692 
1693 	status = mgmt_bredr_support(hdev);
1694 	if (status)
1695 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696 
1697 	if (!lmp_ssp_capable(hdev))
1698 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699 				       MGMT_STATUS_NOT_SUPPORTED);
1700 
1701 	if (cp->val != 0x00 && cp->val != 0x01)
1702 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703 				       MGMT_STATUS_INVALID_PARAMS);
1704 
1705 	hci_dev_lock(hdev);
1706 
1707 	if (!hdev_is_powered(hdev)) {
1708 		bool changed;
1709 
1710 		if (cp->val) {
1711 			changed = !hci_dev_test_and_set_flag(hdev,
1712 							     HCI_SSP_ENABLED);
1713 		} else {
1714 			changed = hci_dev_test_and_clear_flag(hdev,
1715 							      HCI_SSP_ENABLED);
1716 			if (!changed)
1717 				changed = hci_dev_test_and_clear_flag(hdev,
1718 								      HCI_HS_ENABLED);
1719 			else
1720 				hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721 		}
1722 
1723 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724 		if (err < 0)
1725 			goto failed;
1726 
1727 		if (changed)
1728 			err = new_settings(hdev, sk);
1729 
1730 		goto failed;
1731 	}
1732 
1733 	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735 				      MGMT_STATUS_BUSY);
1736 		goto failed;
1737 	}
1738 
1739 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741 		goto failed;
1742 	}
1743 
1744 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745 	if (!cmd) {
1746 		err = -ENOMEM;
1747 		goto failed;
1748 	}
1749 
1750 	if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751 		hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752 			     sizeof(cp->val), &cp->val);
1753 
1754 	err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755 	if (err < 0) {
1756 		mgmt_pending_remove(cmd);
1757 		goto failed;
1758 	}
1759 
1760 failed:
1761 	hci_dev_unlock(hdev);
1762 	return err;
1763 }
1764 
1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767 	struct mgmt_mode *cp = data;
1768 	bool changed;
1769 	u8 status;
1770 	int err;
1771 
1772 	BT_DBG("request for %s", hdev->name);
1773 
1774 	status = mgmt_bredr_support(hdev);
1775 	if (status)
1776 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777 
1778 	if (!lmp_ssp_capable(hdev))
1779 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780 				       MGMT_STATUS_NOT_SUPPORTED);
1781 
1782 	if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784 				       MGMT_STATUS_REJECTED);
1785 
1786 	if (cp->val != 0x00 && cp->val != 0x01)
1787 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788 				       MGMT_STATUS_INVALID_PARAMS);
1789 
1790 	hci_dev_lock(hdev);
1791 
1792 	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794 				      MGMT_STATUS_BUSY);
1795 		goto unlock;
1796 	}
1797 
1798 	if (cp->val) {
1799 		changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800 	} else {
1801 		if (hdev_is_powered(hdev)) {
1802 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803 					      MGMT_STATUS_REJECTED);
1804 			goto unlock;
1805 		}
1806 
1807 		changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808 	}
1809 
1810 	err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811 	if (err < 0)
1812 		goto unlock;
1813 
1814 	if (changed)
1815 		err = new_settings(hdev, sk);
1816 
1817 unlock:
1818 	hci_dev_unlock(hdev);
1819 	return err;
1820 }
1821 
1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823 {
1824 	struct cmd_lookup match = { NULL, hdev };
1825 
1826 	hci_dev_lock(hdev);
1827 
1828 	if (status) {
1829 		u8 mgmt_err = mgmt_status(status);
1830 
1831 		mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832 				     &mgmt_err);
1833 		goto unlock;
1834 	}
1835 
1836 	mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837 
1838 	new_settings(hdev, match.sk);
1839 
1840 	if (match.sk)
1841 		sock_put(match.sk);
1842 
1843 	/* Make sure the controller has a good default for
1844 	 * advertising data. Restrict the update to when LE
1845 	 * has actually been enabled. During power on, the
1846 	 * update in powered_update_hci will take care of it.
1847 	 */
1848 	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849 		struct hci_request req;
1850 		hci_req_init(&req, hdev);
1851 		if (ext_adv_capable(hdev)) {
1852 			int err;
1853 
1854 			err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855 			if (!err)
1856 				__hci_req_update_scan_rsp_data(&req, 0x00);
1857 		} else {
1858 			__hci_req_update_adv_data(&req, 0x00);
1859 			__hci_req_update_scan_rsp_data(&req, 0x00);
1860 		}
1861 		hci_req_run(&req, NULL);
1862 		hci_update_background_scan(hdev);
1863 	}
1864 
1865 unlock:
1866 	hci_dev_unlock(hdev);
1867 }
1868 
1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870 {
1871 	struct mgmt_mode *cp = data;
1872 	struct hci_cp_write_le_host_supported hci_cp;
1873 	struct mgmt_pending_cmd *cmd;
1874 	struct hci_request req;
1875 	int err;
1876 	u8 val, enabled;
1877 
1878 	BT_DBG("request for %s", hdev->name);
1879 
1880 	if (!lmp_le_capable(hdev))
1881 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882 				       MGMT_STATUS_NOT_SUPPORTED);
1883 
1884 	if (cp->val != 0x00 && cp->val != 0x01)
1885 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886 				       MGMT_STATUS_INVALID_PARAMS);
1887 
1888 	/* Bluetooth single mode LE only controllers or dual-mode
1889 	 * controllers configured as LE only devices, do not allow
1890 	 * switching LE off. These have either LE enabled explicitly
1891 	 * or BR/EDR has been previously switched off.
1892 	 *
1893 	 * When trying to enable an already enabled LE, then gracefully
1894 	 * send a positive response. Trying to disable it however will
1895 	 * result into rejection.
1896 	 */
1897 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898 		if (cp->val == 0x01)
1899 			return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900 
1901 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902 				       MGMT_STATUS_REJECTED);
1903 	}
1904 
1905 	hci_dev_lock(hdev);
1906 
1907 	val = !!cp->val;
1908 	enabled = lmp_host_le_capable(hdev);
1909 
1910 	if (!val)
1911 		hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912 
1913 	if (!hdev_is_powered(hdev) || val == enabled) {
1914 		bool changed = false;
1915 
1916 		if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917 			hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918 			changed = true;
1919 		}
1920 
1921 		if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922 			hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923 			changed = true;
1924 		}
1925 
1926 		err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927 		if (err < 0)
1928 			goto unlock;
1929 
1930 		if (changed)
1931 			err = new_settings(hdev, sk);
1932 
1933 		goto unlock;
1934 	}
1935 
1936 	if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937 	    pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939 				      MGMT_STATUS_BUSY);
1940 		goto unlock;
1941 	}
1942 
1943 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944 	if (!cmd) {
1945 		err = -ENOMEM;
1946 		goto unlock;
1947 	}
1948 
1949 	hci_req_init(&req, hdev);
1950 
1951 	memset(&hci_cp, 0, sizeof(hci_cp));
1952 
1953 	if (val) {
1954 		hci_cp.le = val;
1955 		hci_cp.simul = 0x00;
1956 	} else {
1957 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958 			__hci_req_disable_advertising(&req);
1959 
1960 		if (ext_adv_capable(hdev))
1961 			__hci_req_clear_ext_adv_sets(&req);
1962 	}
1963 
1964 	hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965 		    &hci_cp);
1966 
1967 	err = hci_req_run(&req, le_enable_complete);
1968 	if (err < 0)
1969 		mgmt_pending_remove(cmd);
1970 
1971 unlock:
1972 	hci_dev_unlock(hdev);
1973 	return err;
1974 }
1975 
1976 /* This is a helper function to test for pending mgmt commands that can
1977  * cause CoD or EIR HCI commands. We can only allow one such pending
1978  * mgmt command at a time since otherwise we cannot easily track what
1979  * the current values are, will be, and based on that calculate if a new
1980  * HCI command needs to be sent and if yes with what value.
1981  */
1982 static bool pending_eir_or_class(struct hci_dev *hdev)
1983 {
1984 	struct mgmt_pending_cmd *cmd;
1985 
1986 	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987 		switch (cmd->opcode) {
1988 		case MGMT_OP_ADD_UUID:
1989 		case MGMT_OP_REMOVE_UUID:
1990 		case MGMT_OP_SET_DEV_CLASS:
1991 		case MGMT_OP_SET_POWERED:
1992 			return true;
1993 		}
1994 	}
1995 
1996 	return false;
1997 }
1998 
1999 static const u8 bluetooth_base_uuid[] = {
2000 			0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001 			0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002 };
2003 
2004 static u8 get_uuid_size(const u8 *uuid)
2005 {
2006 	u32 val;
2007 
2008 	if (memcmp(uuid, bluetooth_base_uuid, 12))
2009 		return 128;
2010 
2011 	val = get_unaligned_le32(&uuid[12]);
2012 	if (val > 0xffff)
2013 		return 32;
2014 
2015 	return 16;
2016 }
2017 
2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019 {
2020 	struct mgmt_pending_cmd *cmd;
2021 
2022 	hci_dev_lock(hdev);
2023 
2024 	cmd = pending_find(mgmt_op, hdev);
2025 	if (!cmd)
2026 		goto unlock;
2027 
2028 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029 			  mgmt_status(status), hdev->dev_class, 3);
2030 
2031 	mgmt_pending_remove(cmd);
2032 
2033 unlock:
2034 	hci_dev_unlock(hdev);
2035 }
2036 
2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038 {
2039 	BT_DBG("status 0x%02x", status);
2040 
2041 	mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042 }
2043 
2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045 {
2046 	struct mgmt_cp_add_uuid *cp = data;
2047 	struct mgmt_pending_cmd *cmd;
2048 	struct hci_request req;
2049 	struct bt_uuid *uuid;
2050 	int err;
2051 
2052 	BT_DBG("request for %s", hdev->name);
2053 
2054 	hci_dev_lock(hdev);
2055 
2056 	if (pending_eir_or_class(hdev)) {
2057 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058 				      MGMT_STATUS_BUSY);
2059 		goto failed;
2060 	}
2061 
2062 	uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063 	if (!uuid) {
2064 		err = -ENOMEM;
2065 		goto failed;
2066 	}
2067 
2068 	memcpy(uuid->uuid, cp->uuid, 16);
2069 	uuid->svc_hint = cp->svc_hint;
2070 	uuid->size = get_uuid_size(cp->uuid);
2071 
2072 	list_add_tail(&uuid->list, &hdev->uuids);
2073 
2074 	hci_req_init(&req, hdev);
2075 
2076 	__hci_req_update_class(&req);
2077 	__hci_req_update_eir(&req);
2078 
2079 	err = hci_req_run(&req, add_uuid_complete);
2080 	if (err < 0) {
2081 		if (err != -ENODATA)
2082 			goto failed;
2083 
2084 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085 					hdev->dev_class, 3);
2086 		goto failed;
2087 	}
2088 
2089 	cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090 	if (!cmd) {
2091 		err = -ENOMEM;
2092 		goto failed;
2093 	}
2094 
2095 	err = 0;
2096 
2097 failed:
2098 	hci_dev_unlock(hdev);
2099 	return err;
2100 }
2101 
2102 static bool enable_service_cache(struct hci_dev *hdev)
2103 {
2104 	if (!hdev_is_powered(hdev))
2105 		return false;
2106 
2107 	if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108 		queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109 				   CACHE_TIMEOUT);
2110 		return true;
2111 	}
2112 
2113 	return false;
2114 }
2115 
2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117 {
2118 	BT_DBG("status 0x%02x", status);
2119 
2120 	mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121 }
2122 
2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124 		       u16 len)
2125 {
2126 	struct mgmt_cp_remove_uuid *cp = data;
2127 	struct mgmt_pending_cmd *cmd;
2128 	struct bt_uuid *match, *tmp;
2129 	u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130 	struct hci_request req;
2131 	int err, found;
2132 
2133 	BT_DBG("request for %s", hdev->name);
2134 
2135 	hci_dev_lock(hdev);
2136 
2137 	if (pending_eir_or_class(hdev)) {
2138 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139 				      MGMT_STATUS_BUSY);
2140 		goto unlock;
2141 	}
2142 
2143 	if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144 		hci_uuids_clear(hdev);
2145 
2146 		if (enable_service_cache(hdev)) {
2147 			err = mgmt_cmd_complete(sk, hdev->id,
2148 						MGMT_OP_REMOVE_UUID,
2149 						0, hdev->dev_class, 3);
2150 			goto unlock;
2151 		}
2152 
2153 		goto update_class;
2154 	}
2155 
2156 	found = 0;
2157 
2158 	list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159 		if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160 			continue;
2161 
2162 		list_del(&match->list);
2163 		kfree(match);
2164 		found++;
2165 	}
2166 
2167 	if (found == 0) {
2168 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169 				      MGMT_STATUS_INVALID_PARAMS);
2170 		goto unlock;
2171 	}
2172 
2173 update_class:
2174 	hci_req_init(&req, hdev);
2175 
2176 	__hci_req_update_class(&req);
2177 	__hci_req_update_eir(&req);
2178 
2179 	err = hci_req_run(&req, remove_uuid_complete);
2180 	if (err < 0) {
2181 		if (err != -ENODATA)
2182 			goto unlock;
2183 
2184 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185 					hdev->dev_class, 3);
2186 		goto unlock;
2187 	}
2188 
2189 	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190 	if (!cmd) {
2191 		err = -ENOMEM;
2192 		goto unlock;
2193 	}
2194 
2195 	err = 0;
2196 
2197 unlock:
2198 	hci_dev_unlock(hdev);
2199 	return err;
2200 }
2201 
2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203 {
2204 	BT_DBG("status 0x%02x", status);
2205 
2206 	mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207 }
2208 
2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210 			 u16 len)
2211 {
2212 	struct mgmt_cp_set_dev_class *cp = data;
2213 	struct mgmt_pending_cmd *cmd;
2214 	struct hci_request req;
2215 	int err;
2216 
2217 	BT_DBG("request for %s", hdev->name);
2218 
2219 	if (!lmp_bredr_capable(hdev))
2220 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221 				       MGMT_STATUS_NOT_SUPPORTED);
2222 
2223 	hci_dev_lock(hdev);
2224 
2225 	if (pending_eir_or_class(hdev)) {
2226 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227 				      MGMT_STATUS_BUSY);
2228 		goto unlock;
2229 	}
2230 
2231 	if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233 				      MGMT_STATUS_INVALID_PARAMS);
2234 		goto unlock;
2235 	}
2236 
2237 	hdev->major_class = cp->major;
2238 	hdev->minor_class = cp->minor;
2239 
2240 	if (!hdev_is_powered(hdev)) {
2241 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242 					hdev->dev_class, 3);
2243 		goto unlock;
2244 	}
2245 
2246 	hci_req_init(&req, hdev);
2247 
2248 	if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249 		hci_dev_unlock(hdev);
2250 		cancel_delayed_work_sync(&hdev->service_cache);
2251 		hci_dev_lock(hdev);
2252 		__hci_req_update_eir(&req);
2253 	}
2254 
2255 	__hci_req_update_class(&req);
2256 
2257 	err = hci_req_run(&req, set_class_complete);
2258 	if (err < 0) {
2259 		if (err != -ENODATA)
2260 			goto unlock;
2261 
2262 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263 					hdev->dev_class, 3);
2264 		goto unlock;
2265 	}
2266 
2267 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268 	if (!cmd) {
2269 		err = -ENOMEM;
2270 		goto unlock;
2271 	}
2272 
2273 	err = 0;
2274 
2275 unlock:
2276 	hci_dev_unlock(hdev);
2277 	return err;
2278 }
2279 
2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281 			  u16 len)
2282 {
2283 	struct mgmt_cp_load_link_keys *cp = data;
2284 	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285 				   sizeof(struct mgmt_link_key_info));
2286 	u16 key_count, expected_len;
2287 	bool changed;
2288 	int i;
2289 
2290 	BT_DBG("request for %s", hdev->name);
2291 
2292 	if (!lmp_bredr_capable(hdev))
2293 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294 				       MGMT_STATUS_NOT_SUPPORTED);
2295 
2296 	key_count = __le16_to_cpu(cp->key_count);
2297 	if (key_count > max_key_count) {
2298 		bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299 			   key_count);
2300 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301 				       MGMT_STATUS_INVALID_PARAMS);
2302 	}
2303 
2304 	expected_len = sizeof(*cp) + key_count *
2305 					sizeof(struct mgmt_link_key_info);
2306 	if (expected_len != len) {
2307 		bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2308 			   expected_len, len);
2309 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2310 				       MGMT_STATUS_INVALID_PARAMS);
2311 	}
2312 
2313 	if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2314 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2315 				       MGMT_STATUS_INVALID_PARAMS);
2316 
2317 	BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2318 	       key_count);
2319 
2320 	for (i = 0; i < key_count; i++) {
2321 		struct mgmt_link_key_info *key = &cp->keys[i];
2322 
2323 		if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2324 			return mgmt_cmd_status(sk, hdev->id,
2325 					       MGMT_OP_LOAD_LINK_KEYS,
2326 					       MGMT_STATUS_INVALID_PARAMS);
2327 	}
2328 
2329 	hci_dev_lock(hdev);
2330 
2331 	hci_link_keys_clear(hdev);
2332 
2333 	if (cp->debug_keys)
2334 		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2335 	else
2336 		changed = hci_dev_test_and_clear_flag(hdev,
2337 						      HCI_KEEP_DEBUG_KEYS);
2338 
2339 	if (changed)
2340 		new_settings(hdev, NULL);
2341 
2342 	for (i = 0; i < key_count; i++) {
2343 		struct mgmt_link_key_info *key = &cp->keys[i];
2344 
2345 		/* Always ignore debug keys and require a new pairing if
2346 		 * the user wants to use them.
2347 		 */
2348 		if (key->type == HCI_LK_DEBUG_COMBINATION)
2349 			continue;
2350 
2351 		hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2352 				 key->type, key->pin_len, NULL);
2353 	}
2354 
2355 	mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2356 
2357 	hci_dev_unlock(hdev);
2358 
2359 	return 0;
2360 }
2361 
2362 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2363 			   u8 addr_type, struct sock *skip_sk)
2364 {
2365 	struct mgmt_ev_device_unpaired ev;
2366 
2367 	bacpy(&ev.addr.bdaddr, bdaddr);
2368 	ev.addr.type = addr_type;
2369 
2370 	return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2371 			  skip_sk);
2372 }
2373 
2374 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2375 			 u16 len)
2376 {
2377 	struct mgmt_cp_unpair_device *cp = data;
2378 	struct mgmt_rp_unpair_device rp;
2379 	struct hci_conn_params *params;
2380 	struct mgmt_pending_cmd *cmd;
2381 	struct hci_conn *conn;
2382 	u8 addr_type;
2383 	int err;
2384 
2385 	memset(&rp, 0, sizeof(rp));
2386 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2387 	rp.addr.type = cp->addr.type;
2388 
2389 	if (!bdaddr_type_is_valid(cp->addr.type))
2390 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2391 					 MGMT_STATUS_INVALID_PARAMS,
2392 					 &rp, sizeof(rp));
2393 
2394 	if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2395 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2396 					 MGMT_STATUS_INVALID_PARAMS,
2397 					 &rp, sizeof(rp));
2398 
2399 	hci_dev_lock(hdev);
2400 
2401 	if (!hdev_is_powered(hdev)) {
2402 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2403 					MGMT_STATUS_NOT_POWERED, &rp,
2404 					sizeof(rp));
2405 		goto unlock;
2406 	}
2407 
2408 	if (cp->addr.type == BDADDR_BREDR) {
2409 		/* If disconnection is requested, then look up the
2410 		 * connection. If the remote device is connected, it
2411 		 * will be later used to terminate the link.
2412 		 *
2413 		 * Setting it to NULL explicitly will cause no
2414 		 * termination of the link.
2415 		 */
2416 		if (cp->disconnect)
2417 			conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2418 						       &cp->addr.bdaddr);
2419 		else
2420 			conn = NULL;
2421 
2422 		err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2423 		if (err < 0) {
2424 			err = mgmt_cmd_complete(sk, hdev->id,
2425 						MGMT_OP_UNPAIR_DEVICE,
2426 						MGMT_STATUS_NOT_PAIRED, &rp,
2427 						sizeof(rp));
2428 			goto unlock;
2429 		}
2430 
2431 		goto done;
2432 	}
2433 
2434 	/* LE address type */
2435 	addr_type = le_addr_type(cp->addr.type);
2436 
2437 	hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2438 
2439 	err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2440 	if (err < 0) {
2441 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2442 					MGMT_STATUS_NOT_PAIRED, &rp,
2443 					sizeof(rp));
2444 		goto unlock;
2445 	}
2446 
2447 	conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2448 	if (!conn) {
2449 		hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2450 		goto done;
2451 	}
2452 
2453 	/* Abort any ongoing SMP pairing */
2454 	smp_cancel_pairing(conn);
2455 
2456 	/* Defer clearing up the connection parameters until closing to
2457 	 * give a chance of keeping them if a repairing happens.
2458 	 */
2459 	set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2460 
2461 	/* Disable auto-connection parameters if present */
2462 	params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2463 	if (params) {
2464 		if (params->explicit_connect)
2465 			params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2466 		else
2467 			params->auto_connect = HCI_AUTO_CONN_DISABLED;
2468 	}
2469 
2470 	/* If disconnection is not requested, then clear the connection
2471 	 * variable so that the link is not terminated.
2472 	 */
2473 	if (!cp->disconnect)
2474 		conn = NULL;
2475 
2476 done:
2477 	/* If the connection variable is set, then termination of the
2478 	 * link is requested.
2479 	 */
2480 	if (!conn) {
2481 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2482 					&rp, sizeof(rp));
2483 		device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2484 		goto unlock;
2485 	}
2486 
2487 	cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2488 			       sizeof(*cp));
2489 	if (!cmd) {
2490 		err = -ENOMEM;
2491 		goto unlock;
2492 	}
2493 
2494 	cmd->cmd_complete = addr_cmd_complete;
2495 
2496 	err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2497 	if (err < 0)
2498 		mgmt_pending_remove(cmd);
2499 
2500 unlock:
2501 	hci_dev_unlock(hdev);
2502 	return err;
2503 }
2504 
2505 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2506 		      u16 len)
2507 {
2508 	struct mgmt_cp_disconnect *cp = data;
2509 	struct mgmt_rp_disconnect rp;
2510 	struct mgmt_pending_cmd *cmd;
2511 	struct hci_conn *conn;
2512 	int err;
2513 
2514 	BT_DBG("");
2515 
2516 	memset(&rp, 0, sizeof(rp));
2517 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2518 	rp.addr.type = cp->addr.type;
2519 
2520 	if (!bdaddr_type_is_valid(cp->addr.type))
2521 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2522 					 MGMT_STATUS_INVALID_PARAMS,
2523 					 &rp, sizeof(rp));
2524 
2525 	hci_dev_lock(hdev);
2526 
2527 	if (!test_bit(HCI_UP, &hdev->flags)) {
2528 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2529 					MGMT_STATUS_NOT_POWERED, &rp,
2530 					sizeof(rp));
2531 		goto failed;
2532 	}
2533 
2534 	if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2535 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2536 					MGMT_STATUS_BUSY, &rp, sizeof(rp));
2537 		goto failed;
2538 	}
2539 
2540 	if (cp->addr.type == BDADDR_BREDR)
2541 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2542 					       &cp->addr.bdaddr);
2543 	else
2544 		conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2545 					       le_addr_type(cp->addr.type));
2546 
2547 	if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2548 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2549 					MGMT_STATUS_NOT_CONNECTED, &rp,
2550 					sizeof(rp));
2551 		goto failed;
2552 	}
2553 
2554 	cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2555 	if (!cmd) {
2556 		err = -ENOMEM;
2557 		goto failed;
2558 	}
2559 
2560 	cmd->cmd_complete = generic_cmd_complete;
2561 
2562 	err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2563 	if (err < 0)
2564 		mgmt_pending_remove(cmd);
2565 
2566 failed:
2567 	hci_dev_unlock(hdev);
2568 	return err;
2569 }
2570 
2571 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2572 {
2573 	switch (link_type) {
2574 	case LE_LINK:
2575 		switch (addr_type) {
2576 		case ADDR_LE_DEV_PUBLIC:
2577 			return BDADDR_LE_PUBLIC;
2578 
2579 		default:
2580 			/* Fallback to LE Random address type */
2581 			return BDADDR_LE_RANDOM;
2582 		}
2583 
2584 	default:
2585 		/* Fallback to BR/EDR type */
2586 		return BDADDR_BREDR;
2587 	}
2588 }
2589 
2590 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2591 			   u16 data_len)
2592 {
2593 	struct mgmt_rp_get_connections *rp;
2594 	struct hci_conn *c;
2595 	size_t rp_len;
2596 	int err;
2597 	u16 i;
2598 
2599 	BT_DBG("");
2600 
2601 	hci_dev_lock(hdev);
2602 
2603 	if (!hdev_is_powered(hdev)) {
2604 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2605 				      MGMT_STATUS_NOT_POWERED);
2606 		goto unlock;
2607 	}
2608 
2609 	i = 0;
2610 	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2611 		if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2612 			i++;
2613 	}
2614 
2615 	rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2616 	rp = kmalloc(rp_len, GFP_KERNEL);
2617 	if (!rp) {
2618 		err = -ENOMEM;
2619 		goto unlock;
2620 	}
2621 
2622 	i = 0;
2623 	list_for_each_entry(c, &hdev->conn_hash.list, list) {
2624 		if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2625 			continue;
2626 		bacpy(&rp->addr[i].bdaddr, &c->dst);
2627 		rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2628 		if (c->type == SCO_LINK || c->type == ESCO_LINK)
2629 			continue;
2630 		i++;
2631 	}
2632 
2633 	rp->conn_count = cpu_to_le16(i);
2634 
2635 	/* Recalculate length in case of filtered SCO connections, etc */
2636 	rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2637 
2638 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639 				rp_len);
2640 
2641 	kfree(rp);
2642 
2643 unlock:
2644 	hci_dev_unlock(hdev);
2645 	return err;
2646 }
2647 
2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649 				   struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651 	struct mgmt_pending_cmd *cmd;
2652 	int err;
2653 
2654 	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655 			       sizeof(*cp));
2656 	if (!cmd)
2657 		return -ENOMEM;
2658 
2659 	cmd->cmd_complete = addr_cmd_complete;
2660 
2661 	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2662 			   sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2663 	if (err < 0)
2664 		mgmt_pending_remove(cmd);
2665 
2666 	return err;
2667 }
2668 
2669 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2670 			  u16 len)
2671 {
2672 	struct hci_conn *conn;
2673 	struct mgmt_cp_pin_code_reply *cp = data;
2674 	struct hci_cp_pin_code_reply reply;
2675 	struct mgmt_pending_cmd *cmd;
2676 	int err;
2677 
2678 	BT_DBG("");
2679 
2680 	hci_dev_lock(hdev);
2681 
2682 	if (!hdev_is_powered(hdev)) {
2683 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2684 				      MGMT_STATUS_NOT_POWERED);
2685 		goto failed;
2686 	}
2687 
2688 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2689 	if (!conn) {
2690 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2691 				      MGMT_STATUS_NOT_CONNECTED);
2692 		goto failed;
2693 	}
2694 
2695 	if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2696 		struct mgmt_cp_pin_code_neg_reply ncp;
2697 
2698 		memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2699 
2700 		bt_dev_err(hdev, "PIN code is not 16 bytes long");
2701 
2702 		err = send_pin_code_neg_reply(sk, hdev, &ncp);
2703 		if (err >= 0)
2704 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2705 					      MGMT_STATUS_INVALID_PARAMS);
2706 
2707 		goto failed;
2708 	}
2709 
2710 	cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2711 	if (!cmd) {
2712 		err = -ENOMEM;
2713 		goto failed;
2714 	}
2715 
2716 	cmd->cmd_complete = addr_cmd_complete;
2717 
2718 	bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2719 	reply.pin_len = cp->pin_len;
2720 	memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2721 
2722 	err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2723 	if (err < 0)
2724 		mgmt_pending_remove(cmd);
2725 
2726 failed:
2727 	hci_dev_unlock(hdev);
2728 	return err;
2729 }
2730 
2731 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2732 			     u16 len)
2733 {
2734 	struct mgmt_cp_set_io_capability *cp = data;
2735 
2736 	BT_DBG("");
2737 
2738 	if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2739 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2740 				       MGMT_STATUS_INVALID_PARAMS);
2741 
2742 	hci_dev_lock(hdev);
2743 
2744 	hdev->io_capability = cp->io_capability;
2745 
2746 	BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2747 	       hdev->io_capability);
2748 
2749 	hci_dev_unlock(hdev);
2750 
2751 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2752 				 NULL, 0);
2753 }
2754 
2755 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2756 {
2757 	struct hci_dev *hdev = conn->hdev;
2758 	struct mgmt_pending_cmd *cmd;
2759 
2760 	list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2761 		if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2762 			continue;
2763 
2764 		if (cmd->user_data != conn)
2765 			continue;
2766 
2767 		return cmd;
2768 	}
2769 
2770 	return NULL;
2771 }
2772 
2773 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2774 {
2775 	struct mgmt_rp_pair_device rp;
2776 	struct hci_conn *conn = cmd->user_data;
2777 	int err;
2778 
2779 	bacpy(&rp.addr.bdaddr, &conn->dst);
2780 	rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2781 
2782 	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2783 				status, &rp, sizeof(rp));
2784 
2785 	/* So we don't get further callbacks for this connection */
2786 	conn->connect_cfm_cb = NULL;
2787 	conn->security_cfm_cb = NULL;
2788 	conn->disconn_cfm_cb = NULL;
2789 
2790 	hci_conn_drop(conn);
2791 
2792 	/* The device is paired so there is no need to remove
2793 	 * its connection parameters anymore.
2794 	 */
2795 	clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2796 
2797 	hci_conn_put(conn);
2798 
2799 	return err;
2800 }
2801 
2802 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2803 {
2804 	u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2805 	struct mgmt_pending_cmd *cmd;
2806 
2807 	cmd = find_pairing(conn);
2808 	if (cmd) {
2809 		cmd->cmd_complete(cmd, status);
2810 		mgmt_pending_remove(cmd);
2811 	}
2812 }
2813 
2814 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2815 {
2816 	struct mgmt_pending_cmd *cmd;
2817 
2818 	BT_DBG("status %u", status);
2819 
2820 	cmd = find_pairing(conn);
2821 	if (!cmd) {
2822 		BT_DBG("Unable to find a pending command");
2823 		return;
2824 	}
2825 
2826 	cmd->cmd_complete(cmd, mgmt_status(status));
2827 	mgmt_pending_remove(cmd);
2828 }
2829 
2830 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2831 {
2832 	struct mgmt_pending_cmd *cmd;
2833 
2834 	BT_DBG("status %u", status);
2835 
2836 	if (!status)
2837 		return;
2838 
2839 	cmd = find_pairing(conn);
2840 	if (!cmd) {
2841 		BT_DBG("Unable to find a pending command");
2842 		return;
2843 	}
2844 
2845 	cmd->cmd_complete(cmd, mgmt_status(status));
2846 	mgmt_pending_remove(cmd);
2847 }
2848 
2849 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2850 		       u16 len)
2851 {
2852 	struct mgmt_cp_pair_device *cp = data;
2853 	struct mgmt_rp_pair_device rp;
2854 	struct mgmt_pending_cmd *cmd;
2855 	u8 sec_level, auth_type;
2856 	struct hci_conn *conn;
2857 	int err;
2858 
2859 	BT_DBG("");
2860 
2861 	memset(&rp, 0, sizeof(rp));
2862 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2863 	rp.addr.type = cp->addr.type;
2864 
2865 	if (!bdaddr_type_is_valid(cp->addr.type))
2866 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867 					 MGMT_STATUS_INVALID_PARAMS,
2868 					 &rp, sizeof(rp));
2869 
2870 	if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2871 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2872 					 MGMT_STATUS_INVALID_PARAMS,
2873 					 &rp, sizeof(rp));
2874 
2875 	hci_dev_lock(hdev);
2876 
2877 	if (!hdev_is_powered(hdev)) {
2878 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2879 					MGMT_STATUS_NOT_POWERED, &rp,
2880 					sizeof(rp));
2881 		goto unlock;
2882 	}
2883 
2884 	if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2885 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2886 					MGMT_STATUS_ALREADY_PAIRED, &rp,
2887 					sizeof(rp));
2888 		goto unlock;
2889 	}
2890 
2891 	sec_level = BT_SECURITY_MEDIUM;
2892 	auth_type = HCI_AT_DEDICATED_BONDING;
2893 
2894 	if (cp->addr.type == BDADDR_BREDR) {
2895 		conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2896 				       auth_type);
2897 	} else {
2898 		u8 addr_type = le_addr_type(cp->addr.type);
2899 		struct hci_conn_params *p;
2900 
2901 		/* When pairing a new device, it is expected to remember
2902 		 * this device for future connections. Adding the connection
2903 		 * parameter information ahead of time allows tracking
2904 		 * of the slave preferred values and will speed up any
2905 		 * further connection establishment.
2906 		 *
2907 		 * If connection parameters already exist, then they
2908 		 * will be kept and this function does nothing.
2909 		 */
2910 		p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2911 
2912 		if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2913 			p->auto_connect = HCI_AUTO_CONN_DISABLED;
2914 
2915 		conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2916 					   addr_type, sec_level,
2917 					   HCI_LE_CONN_TIMEOUT);
2918 	}
2919 
2920 	if (IS_ERR(conn)) {
2921 		int status;
2922 
2923 		if (PTR_ERR(conn) == -EBUSY)
2924 			status = MGMT_STATUS_BUSY;
2925 		else if (PTR_ERR(conn) == -EOPNOTSUPP)
2926 			status = MGMT_STATUS_NOT_SUPPORTED;
2927 		else if (PTR_ERR(conn) == -ECONNREFUSED)
2928 			status = MGMT_STATUS_REJECTED;
2929 		else
2930 			status = MGMT_STATUS_CONNECT_FAILED;
2931 
2932 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933 					status, &rp, sizeof(rp));
2934 		goto unlock;
2935 	}
2936 
2937 	if (conn->connect_cfm_cb) {
2938 		hci_conn_drop(conn);
2939 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940 					MGMT_STATUS_BUSY, &rp, sizeof(rp));
2941 		goto unlock;
2942 	}
2943 
2944 	cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2945 	if (!cmd) {
2946 		err = -ENOMEM;
2947 		hci_conn_drop(conn);
2948 		goto unlock;
2949 	}
2950 
2951 	cmd->cmd_complete = pairing_complete;
2952 
2953 	/* For LE, just connecting isn't a proof that the pairing finished */
2954 	if (cp->addr.type == BDADDR_BREDR) {
2955 		conn->connect_cfm_cb = pairing_complete_cb;
2956 		conn->security_cfm_cb = pairing_complete_cb;
2957 		conn->disconn_cfm_cb = pairing_complete_cb;
2958 	} else {
2959 		conn->connect_cfm_cb = le_pairing_complete_cb;
2960 		conn->security_cfm_cb = le_pairing_complete_cb;
2961 		conn->disconn_cfm_cb = le_pairing_complete_cb;
2962 	}
2963 
2964 	conn->io_capability = cp->io_cap;
2965 	cmd->user_data = hci_conn_get(conn);
2966 
2967 	if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2968 	    hci_conn_security(conn, sec_level, auth_type, true)) {
2969 		cmd->cmd_complete(cmd, 0);
2970 		mgmt_pending_remove(cmd);
2971 	}
2972 
2973 	err = 0;
2974 
2975 unlock:
2976 	hci_dev_unlock(hdev);
2977 	return err;
2978 }
2979 
2980 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981 			      u16 len)
2982 {
2983 	struct mgmt_addr_info *addr = data;
2984 	struct mgmt_pending_cmd *cmd;
2985 	struct hci_conn *conn;
2986 	int err;
2987 
2988 	BT_DBG("");
2989 
2990 	hci_dev_lock(hdev);
2991 
2992 	if (!hdev_is_powered(hdev)) {
2993 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2994 				      MGMT_STATUS_NOT_POWERED);
2995 		goto unlock;
2996 	}
2997 
2998 	cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2999 	if (!cmd) {
3000 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001 				      MGMT_STATUS_INVALID_PARAMS);
3002 		goto unlock;
3003 	}
3004 
3005 	conn = cmd->user_data;
3006 
3007 	if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3008 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3009 				      MGMT_STATUS_INVALID_PARAMS);
3010 		goto unlock;
3011 	}
3012 
3013 	cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3014 	mgmt_pending_remove(cmd);
3015 
3016 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3017 				addr, sizeof(*addr));
3018 unlock:
3019 	hci_dev_unlock(hdev);
3020 	return err;
3021 }
3022 
3023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3024 			     struct mgmt_addr_info *addr, u16 mgmt_op,
3025 			     u16 hci_op, __le32 passkey)
3026 {
3027 	struct mgmt_pending_cmd *cmd;
3028 	struct hci_conn *conn;
3029 	int err;
3030 
3031 	hci_dev_lock(hdev);
3032 
3033 	if (!hdev_is_powered(hdev)) {
3034 		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3035 					MGMT_STATUS_NOT_POWERED, addr,
3036 					sizeof(*addr));
3037 		goto done;
3038 	}
3039 
3040 	if (addr->type == BDADDR_BREDR)
3041 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3042 	else
3043 		conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3044 					       le_addr_type(addr->type));
3045 
3046 	if (!conn) {
3047 		err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3048 					MGMT_STATUS_NOT_CONNECTED, addr,
3049 					sizeof(*addr));
3050 		goto done;
3051 	}
3052 
3053 	if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3054 		err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3055 		if (!err)
3056 			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3057 						MGMT_STATUS_SUCCESS, addr,
3058 						sizeof(*addr));
3059 		else
3060 			err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3061 						MGMT_STATUS_FAILED, addr,
3062 						sizeof(*addr));
3063 
3064 		goto done;
3065 	}
3066 
3067 	cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3068 	if (!cmd) {
3069 		err = -ENOMEM;
3070 		goto done;
3071 	}
3072 
3073 	cmd->cmd_complete = addr_cmd_complete;
3074 
3075 	/* Continue with pairing via HCI */
3076 	if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3077 		struct hci_cp_user_passkey_reply cp;
3078 
3079 		bacpy(&cp.bdaddr, &addr->bdaddr);
3080 		cp.passkey = passkey;
3081 		err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3082 	} else
3083 		err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3084 				   &addr->bdaddr);
3085 
3086 	if (err < 0)
3087 		mgmt_pending_remove(cmd);
3088 
3089 done:
3090 	hci_dev_unlock(hdev);
3091 	return err;
3092 }
3093 
3094 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3095 			      void *data, u16 len)
3096 {
3097 	struct mgmt_cp_pin_code_neg_reply *cp = data;
3098 
3099 	BT_DBG("");
3100 
3101 	return user_pairing_resp(sk, hdev, &cp->addr,
3102 				MGMT_OP_PIN_CODE_NEG_REPLY,
3103 				HCI_OP_PIN_CODE_NEG_REPLY, 0);
3104 }
3105 
3106 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3107 			      u16 len)
3108 {
3109 	struct mgmt_cp_user_confirm_reply *cp = data;
3110 
3111 	BT_DBG("");
3112 
3113 	if (len != sizeof(*cp))
3114 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3115 				       MGMT_STATUS_INVALID_PARAMS);
3116 
3117 	return user_pairing_resp(sk, hdev, &cp->addr,
3118 				 MGMT_OP_USER_CONFIRM_REPLY,
3119 				 HCI_OP_USER_CONFIRM_REPLY, 0);
3120 }
3121 
3122 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3123 				  void *data, u16 len)
3124 {
3125 	struct mgmt_cp_user_confirm_neg_reply *cp = data;
3126 
3127 	BT_DBG("");
3128 
3129 	return user_pairing_resp(sk, hdev, &cp->addr,
3130 				 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3131 				 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3132 }
3133 
3134 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3135 			      u16 len)
3136 {
3137 	struct mgmt_cp_user_passkey_reply *cp = data;
3138 
3139 	BT_DBG("");
3140 
3141 	return user_pairing_resp(sk, hdev, &cp->addr,
3142 				 MGMT_OP_USER_PASSKEY_REPLY,
3143 				 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3144 }
3145 
3146 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3147 				  void *data, u16 len)
3148 {
3149 	struct mgmt_cp_user_passkey_neg_reply *cp = data;
3150 
3151 	BT_DBG("");
3152 
3153 	return user_pairing_resp(sk, hdev, &cp->addr,
3154 				 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3155 				 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3156 }
3157 
3158 static void adv_expire(struct hci_dev *hdev, u32 flags)
3159 {
3160 	struct adv_info *adv_instance;
3161 	struct hci_request req;
3162 	int err;
3163 
3164 	adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3165 	if (!adv_instance)
3166 		return;
3167 
3168 	/* stop if current instance doesn't need to be changed */
3169 	if (!(adv_instance->flags & flags))
3170 		return;
3171 
3172 	cancel_adv_timeout(hdev);
3173 
3174 	adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3175 	if (!adv_instance)
3176 		return;
3177 
3178 	hci_req_init(&req, hdev);
3179 	err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3180 					      true);
3181 	if (err)
3182 		return;
3183 
3184 	hci_req_run(&req, NULL);
3185 }
3186 
3187 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3188 {
3189 	struct mgmt_cp_set_local_name *cp;
3190 	struct mgmt_pending_cmd *cmd;
3191 
3192 	BT_DBG("status 0x%02x", status);
3193 
3194 	hci_dev_lock(hdev);
3195 
3196 	cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3197 	if (!cmd)
3198 		goto unlock;
3199 
3200 	cp = cmd->param;
3201 
3202 	if (status) {
3203 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3204 			        mgmt_status(status));
3205 	} else {
3206 		mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3207 				  cp, sizeof(*cp));
3208 
3209 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3210 			adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3211 	}
3212 
3213 	mgmt_pending_remove(cmd);
3214 
3215 unlock:
3216 	hci_dev_unlock(hdev);
3217 }
3218 
3219 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3220 			  u16 len)
3221 {
3222 	struct mgmt_cp_set_local_name *cp = data;
3223 	struct mgmt_pending_cmd *cmd;
3224 	struct hci_request req;
3225 	int err;
3226 
3227 	BT_DBG("");
3228 
3229 	hci_dev_lock(hdev);
3230 
3231 	/* If the old values are the same as the new ones just return a
3232 	 * direct command complete event.
3233 	 */
3234 	if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3235 	    !memcmp(hdev->short_name, cp->short_name,
3236 		    sizeof(hdev->short_name))) {
3237 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3238 					data, len);
3239 		goto failed;
3240 	}
3241 
3242 	memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3243 
3244 	if (!hdev_is_powered(hdev)) {
3245 		memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3246 
3247 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3248 					data, len);
3249 		if (err < 0)
3250 			goto failed;
3251 
3252 		err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3253 					 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3254 		ext_info_changed(hdev, sk);
3255 
3256 		goto failed;
3257 	}
3258 
3259 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3260 	if (!cmd) {
3261 		err = -ENOMEM;
3262 		goto failed;
3263 	}
3264 
3265 	memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3266 
3267 	hci_req_init(&req, hdev);
3268 
3269 	if (lmp_bredr_capable(hdev)) {
3270 		__hci_req_update_name(&req);
3271 		__hci_req_update_eir(&req);
3272 	}
3273 
3274 	/* The name is stored in the scan response data and so
3275 	 * no need to udpate the advertising data here.
3276 	 */
3277 	if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3278 		__hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3279 
3280 	err = hci_req_run(&req, set_name_complete);
3281 	if (err < 0)
3282 		mgmt_pending_remove(cmd);
3283 
3284 failed:
3285 	hci_dev_unlock(hdev);
3286 	return err;
3287 }
3288 
3289 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3290 			  u16 len)
3291 {
3292 	struct mgmt_cp_set_appearance *cp = data;
3293 	u16 apperance;
3294 	int err;
3295 
3296 	BT_DBG("");
3297 
3298 	if (!lmp_le_capable(hdev))
3299 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3300 				       MGMT_STATUS_NOT_SUPPORTED);
3301 
3302 	apperance = le16_to_cpu(cp->appearance);
3303 
3304 	hci_dev_lock(hdev);
3305 
3306 	if (hdev->appearance != apperance) {
3307 		hdev->appearance = apperance;
3308 
3309 		if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3310 			adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3311 
3312 		ext_info_changed(hdev, sk);
3313 	}
3314 
3315 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3316 				0);
3317 
3318 	hci_dev_unlock(hdev);
3319 
3320 	return err;
3321 }
3322 
3323 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3324 				 void *data, u16 len)
3325 {
3326 	struct mgmt_rp_get_phy_confguration rp;
3327 
3328 	BT_DBG("sock %p %s", sk, hdev->name);
3329 
3330 	hci_dev_lock(hdev);
3331 
3332 	memset(&rp, 0, sizeof(rp));
3333 
3334 	rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3335 	rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3336 	rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3337 
3338 	hci_dev_unlock(hdev);
3339 
3340 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3341 				 &rp, sizeof(rp));
3342 }
3343 
3344 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3345 {
3346 	struct mgmt_ev_phy_configuration_changed ev;
3347 
3348 	memset(&ev, 0, sizeof(ev));
3349 
3350 	ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3351 
3352 	return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3353 			  sizeof(ev), skip);
3354 }
3355 
3356 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3357 				     u16 opcode, struct sk_buff *skb)
3358 {
3359 	struct mgmt_pending_cmd *cmd;
3360 
3361 	BT_DBG("status 0x%02x", status);
3362 
3363 	hci_dev_lock(hdev);
3364 
3365 	cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3366 	if (!cmd)
3367 		goto unlock;
3368 
3369 	if (status) {
3370 		mgmt_cmd_status(cmd->sk, hdev->id,
3371 				MGMT_OP_SET_PHY_CONFIGURATION,
3372 				mgmt_status(status));
3373 	} else {
3374 		mgmt_cmd_complete(cmd->sk, hdev->id,
3375 				  MGMT_OP_SET_PHY_CONFIGURATION, 0,
3376 				  NULL, 0);
3377 
3378 		mgmt_phy_configuration_changed(hdev, cmd->sk);
3379 	}
3380 
3381 	mgmt_pending_remove(cmd);
3382 
3383 unlock:
3384 	hci_dev_unlock(hdev);
3385 }
3386 
3387 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3388 				 void *data, u16 len)
3389 {
3390 	struct mgmt_cp_set_phy_confguration *cp = data;
3391 	struct hci_cp_le_set_default_phy cp_phy;
3392 	struct mgmt_pending_cmd *cmd;
3393 	struct hci_request req;
3394 	u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3395 	u16 pkt_type = (HCI_DH1 | HCI_DM1);
3396 	bool changed = false;
3397 	int err;
3398 
3399 	BT_DBG("sock %p %s", sk, hdev->name);
3400 
3401 	configurable_phys = get_configurable_phys(hdev);
3402 	supported_phys = get_supported_phys(hdev);
3403 	selected_phys = __le32_to_cpu(cp->selected_phys);
3404 
3405 	if (selected_phys & ~supported_phys)
3406 		return mgmt_cmd_status(sk, hdev->id,
3407 				       MGMT_OP_SET_PHY_CONFIGURATION,
3408 				       MGMT_STATUS_INVALID_PARAMS);
3409 
3410 	unconfigure_phys = supported_phys & ~configurable_phys;
3411 
3412 	if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3413 		return mgmt_cmd_status(sk, hdev->id,
3414 				       MGMT_OP_SET_PHY_CONFIGURATION,
3415 				       MGMT_STATUS_INVALID_PARAMS);
3416 
3417 	if (selected_phys == get_selected_phys(hdev))
3418 		return mgmt_cmd_complete(sk, hdev->id,
3419 					 MGMT_OP_SET_PHY_CONFIGURATION,
3420 					 0, NULL, 0);
3421 
3422 	hci_dev_lock(hdev);
3423 
3424 	if (!hdev_is_powered(hdev)) {
3425 		err = mgmt_cmd_status(sk, hdev->id,
3426 				      MGMT_OP_SET_PHY_CONFIGURATION,
3427 				      MGMT_STATUS_REJECTED);
3428 		goto unlock;
3429 	}
3430 
3431 	if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3432 		err = mgmt_cmd_status(sk, hdev->id,
3433 				      MGMT_OP_SET_PHY_CONFIGURATION,
3434 				      MGMT_STATUS_BUSY);
3435 		goto unlock;
3436 	}
3437 
3438 	if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3439 		pkt_type |= (HCI_DH3 | HCI_DM3);
3440 	else
3441 		pkt_type &= ~(HCI_DH3 | HCI_DM3);
3442 
3443 	if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3444 		pkt_type |= (HCI_DH5 | HCI_DM5);
3445 	else
3446 		pkt_type &= ~(HCI_DH5 | HCI_DM5);
3447 
3448 	if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3449 		pkt_type &= ~HCI_2DH1;
3450 	else
3451 		pkt_type |= HCI_2DH1;
3452 
3453 	if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3454 		pkt_type &= ~HCI_2DH3;
3455 	else
3456 		pkt_type |= HCI_2DH3;
3457 
3458 	if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3459 		pkt_type &= ~HCI_2DH5;
3460 	else
3461 		pkt_type |= HCI_2DH5;
3462 
3463 	if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3464 		pkt_type &= ~HCI_3DH1;
3465 	else
3466 		pkt_type |= HCI_3DH1;
3467 
3468 	if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3469 		pkt_type &= ~HCI_3DH3;
3470 	else
3471 		pkt_type |= HCI_3DH3;
3472 
3473 	if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3474 		pkt_type &= ~HCI_3DH5;
3475 	else
3476 		pkt_type |= HCI_3DH5;
3477 
3478 	if (pkt_type != hdev->pkt_type) {
3479 		hdev->pkt_type = pkt_type;
3480 		changed = true;
3481 	}
3482 
3483 	if ((selected_phys & MGMT_PHY_LE_MASK) ==
3484 	    (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3485 		if (changed)
3486 			mgmt_phy_configuration_changed(hdev, sk);
3487 
3488 		err = mgmt_cmd_complete(sk, hdev->id,
3489 					MGMT_OP_SET_PHY_CONFIGURATION,
3490 					0, NULL, 0);
3491 
3492 		goto unlock;
3493 	}
3494 
3495 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3496 			       len);
3497 	if (!cmd) {
3498 		err = -ENOMEM;
3499 		goto unlock;
3500 	}
3501 
3502 	hci_req_init(&req, hdev);
3503 
3504 	memset(&cp_phy, 0, sizeof(cp_phy));
3505 
3506 	if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3507 		cp_phy.all_phys |= 0x01;
3508 
3509 	if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3510 		cp_phy.all_phys |= 0x02;
3511 
3512 	if (selected_phys & MGMT_PHY_LE_1M_TX)
3513 		cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3514 
3515 	if (selected_phys & MGMT_PHY_LE_2M_TX)
3516 		cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3517 
3518 	if (selected_phys & MGMT_PHY_LE_CODED_TX)
3519 		cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3520 
3521 	if (selected_phys & MGMT_PHY_LE_1M_RX)
3522 		cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3523 
3524 	if (selected_phys & MGMT_PHY_LE_2M_RX)
3525 		cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3526 
3527 	if (selected_phys & MGMT_PHY_LE_CODED_RX)
3528 		cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3529 
3530 	hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3531 
3532 	err = hci_req_run_skb(&req, set_default_phy_complete);
3533 	if (err < 0)
3534 		mgmt_pending_remove(cmd);
3535 
3536 unlock:
3537 	hci_dev_unlock(hdev);
3538 
3539 	return err;
3540 }
3541 
3542 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3543 				         u16 opcode, struct sk_buff *skb)
3544 {
3545 	struct mgmt_rp_read_local_oob_data mgmt_rp;
3546 	size_t rp_size = sizeof(mgmt_rp);
3547 	struct mgmt_pending_cmd *cmd;
3548 
3549 	BT_DBG("%s status %u", hdev->name, status);
3550 
3551 	cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3552 	if (!cmd)
3553 		return;
3554 
3555 	if (status || !skb) {
3556 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3557 				status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3558 		goto remove;
3559 	}
3560 
3561 	memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3562 
3563 	if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3564 		struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3565 
3566 		if (skb->len < sizeof(*rp)) {
3567 			mgmt_cmd_status(cmd->sk, hdev->id,
3568 					MGMT_OP_READ_LOCAL_OOB_DATA,
3569 					MGMT_STATUS_FAILED);
3570 			goto remove;
3571 		}
3572 
3573 		memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3574 		memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3575 
3576 		rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3577 	} else {
3578 		struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3579 
3580 		if (skb->len < sizeof(*rp)) {
3581 			mgmt_cmd_status(cmd->sk, hdev->id,
3582 					MGMT_OP_READ_LOCAL_OOB_DATA,
3583 					MGMT_STATUS_FAILED);
3584 			goto remove;
3585 		}
3586 
3587 		memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3588 		memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3589 
3590 		memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3591 		memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3592 	}
3593 
3594 	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3595 			  MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3596 
3597 remove:
3598 	mgmt_pending_remove(cmd);
3599 }
3600 
3601 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3602 			       void *data, u16 data_len)
3603 {
3604 	struct mgmt_pending_cmd *cmd;
3605 	struct hci_request req;
3606 	int err;
3607 
3608 	BT_DBG("%s", hdev->name);
3609 
3610 	hci_dev_lock(hdev);
3611 
3612 	if (!hdev_is_powered(hdev)) {
3613 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3614 				      MGMT_STATUS_NOT_POWERED);
3615 		goto unlock;
3616 	}
3617 
3618 	if (!lmp_ssp_capable(hdev)) {
3619 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3620 				      MGMT_STATUS_NOT_SUPPORTED);
3621 		goto unlock;
3622 	}
3623 
3624 	if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3625 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3626 				      MGMT_STATUS_BUSY);
3627 		goto unlock;
3628 	}
3629 
3630 	cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3631 	if (!cmd) {
3632 		err = -ENOMEM;
3633 		goto unlock;
3634 	}
3635 
3636 	hci_req_init(&req, hdev);
3637 
3638 	if (bredr_sc_enabled(hdev))
3639 		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3640 	else
3641 		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3642 
3643 	err = hci_req_run_skb(&req, read_local_oob_data_complete);
3644 	if (err < 0)
3645 		mgmt_pending_remove(cmd);
3646 
3647 unlock:
3648 	hci_dev_unlock(hdev);
3649 	return err;
3650 }
3651 
3652 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3653 			       void *data, u16 len)
3654 {
3655 	struct mgmt_addr_info *addr = data;
3656 	int err;
3657 
3658 	BT_DBG("%s ", hdev->name);
3659 
3660 	if (!bdaddr_type_is_valid(addr->type))
3661 		return mgmt_cmd_complete(sk, hdev->id,
3662 					 MGMT_OP_ADD_REMOTE_OOB_DATA,
3663 					 MGMT_STATUS_INVALID_PARAMS,
3664 					 addr, sizeof(*addr));
3665 
3666 	hci_dev_lock(hdev);
3667 
3668 	if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3669 		struct mgmt_cp_add_remote_oob_data *cp = data;
3670 		u8 status;
3671 
3672 		if (cp->addr.type != BDADDR_BREDR) {
3673 			err = mgmt_cmd_complete(sk, hdev->id,
3674 						MGMT_OP_ADD_REMOTE_OOB_DATA,
3675 						MGMT_STATUS_INVALID_PARAMS,
3676 						&cp->addr, sizeof(cp->addr));
3677 			goto unlock;
3678 		}
3679 
3680 		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3681 					      cp->addr.type, cp->hash,
3682 					      cp->rand, NULL, NULL);
3683 		if (err < 0)
3684 			status = MGMT_STATUS_FAILED;
3685 		else
3686 			status = MGMT_STATUS_SUCCESS;
3687 
3688 		err = mgmt_cmd_complete(sk, hdev->id,
3689 					MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3690 					&cp->addr, sizeof(cp->addr));
3691 	} else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3692 		struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3693 		u8 *rand192, *hash192, *rand256, *hash256;
3694 		u8 status;
3695 
3696 		if (bdaddr_type_is_le(cp->addr.type)) {
3697 			/* Enforce zero-valued 192-bit parameters as
3698 			 * long as legacy SMP OOB isn't implemented.
3699 			 */
3700 			if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3701 			    memcmp(cp->hash192, ZERO_KEY, 16)) {
3702 				err = mgmt_cmd_complete(sk, hdev->id,
3703 							MGMT_OP_ADD_REMOTE_OOB_DATA,
3704 							MGMT_STATUS_INVALID_PARAMS,
3705 							addr, sizeof(*addr));
3706 				goto unlock;
3707 			}
3708 
3709 			rand192 = NULL;
3710 			hash192 = NULL;
3711 		} else {
3712 			/* In case one of the P-192 values is set to zero,
3713 			 * then just disable OOB data for P-192.
3714 			 */
3715 			if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3716 			    !memcmp(cp->hash192, ZERO_KEY, 16)) {
3717 				rand192 = NULL;
3718 				hash192 = NULL;
3719 			} else {
3720 				rand192 = cp->rand192;
3721 				hash192 = cp->hash192;
3722 			}
3723 		}
3724 
3725 		/* In case one of the P-256 values is set to zero, then just
3726 		 * disable OOB data for P-256.
3727 		 */
3728 		if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3729 		    !memcmp(cp->hash256, ZERO_KEY, 16)) {
3730 			rand256 = NULL;
3731 			hash256 = NULL;
3732 		} else {
3733 			rand256 = cp->rand256;
3734 			hash256 = cp->hash256;
3735 		}
3736 
3737 		err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3738 					      cp->addr.type, hash192, rand192,
3739 					      hash256, rand256);
3740 		if (err < 0)
3741 			status = MGMT_STATUS_FAILED;
3742 		else
3743 			status = MGMT_STATUS_SUCCESS;
3744 
3745 		err = mgmt_cmd_complete(sk, hdev->id,
3746 					MGMT_OP_ADD_REMOTE_OOB_DATA,
3747 					status, &cp->addr, sizeof(cp->addr));
3748 	} else {
3749 		bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3750 			   len);
3751 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3752 				      MGMT_STATUS_INVALID_PARAMS);
3753 	}
3754 
3755 unlock:
3756 	hci_dev_unlock(hdev);
3757 	return err;
3758 }
3759 
3760 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3761 				  void *data, u16 len)
3762 {
3763 	struct mgmt_cp_remove_remote_oob_data *cp = data;
3764 	u8 status;
3765 	int err;
3766 
3767 	BT_DBG("%s", hdev->name);
3768 
3769 	if (cp->addr.type != BDADDR_BREDR)
3770 		return mgmt_cmd_complete(sk, hdev->id,
3771 					 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3772 					 MGMT_STATUS_INVALID_PARAMS,
3773 					 &cp->addr, sizeof(cp->addr));
3774 
3775 	hci_dev_lock(hdev);
3776 
3777 	if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3778 		hci_remote_oob_data_clear(hdev);
3779 		status = MGMT_STATUS_SUCCESS;
3780 		goto done;
3781 	}
3782 
3783 	err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3784 	if (err < 0)
3785 		status = MGMT_STATUS_INVALID_PARAMS;
3786 	else
3787 		status = MGMT_STATUS_SUCCESS;
3788 
3789 done:
3790 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3791 				status, &cp->addr, sizeof(cp->addr));
3792 
3793 	hci_dev_unlock(hdev);
3794 	return err;
3795 }
3796 
3797 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3798 {
3799 	struct mgmt_pending_cmd *cmd;
3800 
3801 	BT_DBG("status %d", status);
3802 
3803 	hci_dev_lock(hdev);
3804 
3805 	cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3806 	if (!cmd)
3807 		cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3808 
3809 	if (!cmd)
3810 		cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3811 
3812 	if (cmd) {
3813 		cmd->cmd_complete(cmd, mgmt_status(status));
3814 		mgmt_pending_remove(cmd);
3815 	}
3816 
3817 	hci_dev_unlock(hdev);
3818 }
3819 
3820 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3821 				    uint8_t *mgmt_status)
3822 {
3823 	switch (type) {
3824 	case DISCOV_TYPE_LE:
3825 		*mgmt_status = mgmt_le_support(hdev);
3826 		if (*mgmt_status)
3827 			return false;
3828 		break;
3829 	case DISCOV_TYPE_INTERLEAVED:
3830 		*mgmt_status = mgmt_le_support(hdev);
3831 		if (*mgmt_status)
3832 			return false;
3833 		/* Intentional fall-through */
3834 	case DISCOV_TYPE_BREDR:
3835 		*mgmt_status = mgmt_bredr_support(hdev);
3836 		if (*mgmt_status)
3837 			return false;
3838 		break;
3839 	default:
3840 		*mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3841 		return false;
3842 	}
3843 
3844 	return true;
3845 }
3846 
3847 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3848 				    u16 op, void *data, u16 len)
3849 {
3850 	struct mgmt_cp_start_discovery *cp = data;
3851 	struct mgmt_pending_cmd *cmd;
3852 	u8 status;
3853 	int err;
3854 
3855 	BT_DBG("%s", hdev->name);
3856 
3857 	hci_dev_lock(hdev);
3858 
3859 	if (!hdev_is_powered(hdev)) {
3860 		err = mgmt_cmd_complete(sk, hdev->id, op,
3861 					MGMT_STATUS_NOT_POWERED,
3862 					&cp->type, sizeof(cp->type));
3863 		goto failed;
3864 	}
3865 
3866 	if (hdev->discovery.state != DISCOVERY_STOPPED ||
3867 	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3868 		err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3869 					&cp->type, sizeof(cp->type));
3870 		goto failed;
3871 	}
3872 
3873 	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3874 		err = mgmt_cmd_complete(sk, hdev->id, op, status,
3875 					&cp->type, sizeof(cp->type));
3876 		goto failed;
3877 	}
3878 
3879 	/* Clear the discovery filter first to free any previously
3880 	 * allocated memory for the UUID list.
3881 	 */
3882 	hci_discovery_filter_clear(hdev);
3883 
3884 	hdev->discovery.type = cp->type;
3885 	hdev->discovery.report_invalid_rssi = false;
3886 	if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3887 		hdev->discovery.limited = true;
3888 	else
3889 		hdev->discovery.limited = false;
3890 
3891 	cmd = mgmt_pending_add(sk, op, hdev, data, len);
3892 	if (!cmd) {
3893 		err = -ENOMEM;
3894 		goto failed;
3895 	}
3896 
3897 	cmd->cmd_complete = generic_cmd_complete;
3898 
3899 	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3900 	queue_work(hdev->req_workqueue, &hdev->discov_update);
3901 	err = 0;
3902 
3903 failed:
3904 	hci_dev_unlock(hdev);
3905 	return err;
3906 }
3907 
3908 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3909 			   void *data, u16 len)
3910 {
3911 	return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3912 					data, len);
3913 }
3914 
3915 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3916 				   void *data, u16 len)
3917 {
3918 	return start_discovery_internal(sk, hdev,
3919 					MGMT_OP_START_LIMITED_DISCOVERY,
3920 					data, len);
3921 }
3922 
3923 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3924 					  u8 status)
3925 {
3926 	return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3927 				 cmd->param, 1);
3928 }
3929 
3930 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3931 				   void *data, u16 len)
3932 {
3933 	struct mgmt_cp_start_service_discovery *cp = data;
3934 	struct mgmt_pending_cmd *cmd;
3935 	const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3936 	u16 uuid_count, expected_len;
3937 	u8 status;
3938 	int err;
3939 
3940 	BT_DBG("%s", hdev->name);
3941 
3942 	hci_dev_lock(hdev);
3943 
3944 	if (!hdev_is_powered(hdev)) {
3945 		err = mgmt_cmd_complete(sk, hdev->id,
3946 					MGMT_OP_START_SERVICE_DISCOVERY,
3947 					MGMT_STATUS_NOT_POWERED,
3948 					&cp->type, sizeof(cp->type));
3949 		goto failed;
3950 	}
3951 
3952 	if (hdev->discovery.state != DISCOVERY_STOPPED ||
3953 	    hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3954 		err = mgmt_cmd_complete(sk, hdev->id,
3955 					MGMT_OP_START_SERVICE_DISCOVERY,
3956 					MGMT_STATUS_BUSY, &cp->type,
3957 					sizeof(cp->type));
3958 		goto failed;
3959 	}
3960 
3961 	uuid_count = __le16_to_cpu(cp->uuid_count);
3962 	if (uuid_count > max_uuid_count) {
3963 		bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3964 			   uuid_count);
3965 		err = mgmt_cmd_complete(sk, hdev->id,
3966 					MGMT_OP_START_SERVICE_DISCOVERY,
3967 					MGMT_STATUS_INVALID_PARAMS, &cp->type,
3968 					sizeof(cp->type));
3969 		goto failed;
3970 	}
3971 
3972 	expected_len = sizeof(*cp) + uuid_count * 16;
3973 	if (expected_len != len) {
3974 		bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3975 			   expected_len, len);
3976 		err = mgmt_cmd_complete(sk, hdev->id,
3977 					MGMT_OP_START_SERVICE_DISCOVERY,
3978 					MGMT_STATUS_INVALID_PARAMS, &cp->type,
3979 					sizeof(cp->type));
3980 		goto failed;
3981 	}
3982 
3983 	if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3984 		err = mgmt_cmd_complete(sk, hdev->id,
3985 					MGMT_OP_START_SERVICE_DISCOVERY,
3986 					status, &cp->type, sizeof(cp->type));
3987 		goto failed;
3988 	}
3989 
3990 	cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3991 			       hdev, data, len);
3992 	if (!cmd) {
3993 		err = -ENOMEM;
3994 		goto failed;
3995 	}
3996 
3997 	cmd->cmd_complete = service_discovery_cmd_complete;
3998 
3999 	/* Clear the discovery filter first to free any previously
4000 	 * allocated memory for the UUID list.
4001 	 */
4002 	hci_discovery_filter_clear(hdev);
4003 
4004 	hdev->discovery.result_filtering = true;
4005 	hdev->discovery.type = cp->type;
4006 	hdev->discovery.rssi = cp->rssi;
4007 	hdev->discovery.uuid_count = uuid_count;
4008 
4009 	if (uuid_count > 0) {
4010 		hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4011 						GFP_KERNEL);
4012 		if (!hdev->discovery.uuids) {
4013 			err = mgmt_cmd_complete(sk, hdev->id,
4014 						MGMT_OP_START_SERVICE_DISCOVERY,
4015 						MGMT_STATUS_FAILED,
4016 						&cp->type, sizeof(cp->type));
4017 			mgmt_pending_remove(cmd);
4018 			goto failed;
4019 		}
4020 	}
4021 
4022 	hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4023 	queue_work(hdev->req_workqueue, &hdev->discov_update);
4024 	err = 0;
4025 
4026 failed:
4027 	hci_dev_unlock(hdev);
4028 	return err;
4029 }
4030 
4031 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4032 {
4033 	struct mgmt_pending_cmd *cmd;
4034 
4035 	BT_DBG("status %d", status);
4036 
4037 	hci_dev_lock(hdev);
4038 
4039 	cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4040 	if (cmd) {
4041 		cmd->cmd_complete(cmd, mgmt_status(status));
4042 		mgmt_pending_remove(cmd);
4043 	}
4044 
4045 	hci_dev_unlock(hdev);
4046 }
4047 
4048 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4049 			  u16 len)
4050 {
4051 	struct mgmt_cp_stop_discovery *mgmt_cp = data;
4052 	struct mgmt_pending_cmd *cmd;
4053 	int err;
4054 
4055 	BT_DBG("%s", hdev->name);
4056 
4057 	hci_dev_lock(hdev);
4058 
4059 	if (!hci_discovery_active(hdev)) {
4060 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4061 					MGMT_STATUS_REJECTED, &mgmt_cp->type,
4062 					sizeof(mgmt_cp->type));
4063 		goto unlock;
4064 	}
4065 
4066 	if (hdev->discovery.type != mgmt_cp->type) {
4067 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4068 					MGMT_STATUS_INVALID_PARAMS,
4069 					&mgmt_cp->type, sizeof(mgmt_cp->type));
4070 		goto unlock;
4071 	}
4072 
4073 	cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4074 	if (!cmd) {
4075 		err = -ENOMEM;
4076 		goto unlock;
4077 	}
4078 
4079 	cmd->cmd_complete = generic_cmd_complete;
4080 
4081 	hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4082 	queue_work(hdev->req_workqueue, &hdev->discov_update);
4083 	err = 0;
4084 
4085 unlock:
4086 	hci_dev_unlock(hdev);
4087 	return err;
4088 }
4089 
4090 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4091 			u16 len)
4092 {
4093 	struct mgmt_cp_confirm_name *cp = data;
4094 	struct inquiry_entry *e;
4095 	int err;
4096 
4097 	BT_DBG("%s", hdev->name);
4098 
4099 	hci_dev_lock(hdev);
4100 
4101 	if (!hci_discovery_active(hdev)) {
4102 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103 					MGMT_STATUS_FAILED, &cp->addr,
4104 					sizeof(cp->addr));
4105 		goto failed;
4106 	}
4107 
4108 	e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4109 	if (!e) {
4110 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4111 					MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4112 					sizeof(cp->addr));
4113 		goto failed;
4114 	}
4115 
4116 	if (cp->name_known) {
4117 		e->name_state = NAME_KNOWN;
4118 		list_del(&e->list);
4119 	} else {
4120 		e->name_state = NAME_NEEDED;
4121 		hci_inquiry_cache_update_resolve(hdev, e);
4122 	}
4123 
4124 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4125 				&cp->addr, sizeof(cp->addr));
4126 
4127 failed:
4128 	hci_dev_unlock(hdev);
4129 	return err;
4130 }
4131 
4132 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4133 			u16 len)
4134 {
4135 	struct mgmt_cp_block_device *cp = data;
4136 	u8 status;
4137 	int err;
4138 
4139 	BT_DBG("%s", hdev->name);
4140 
4141 	if (!bdaddr_type_is_valid(cp->addr.type))
4142 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4143 					 MGMT_STATUS_INVALID_PARAMS,
4144 					 &cp->addr, sizeof(cp->addr));
4145 
4146 	hci_dev_lock(hdev);
4147 
4148 	err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4149 				  cp->addr.type);
4150 	if (err < 0) {
4151 		status = MGMT_STATUS_FAILED;
4152 		goto done;
4153 	}
4154 
4155 	mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4156 		   sk);
4157 	status = MGMT_STATUS_SUCCESS;
4158 
4159 done:
4160 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4161 				&cp->addr, sizeof(cp->addr));
4162 
4163 	hci_dev_unlock(hdev);
4164 
4165 	return err;
4166 }
4167 
4168 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4169 			  u16 len)
4170 {
4171 	struct mgmt_cp_unblock_device *cp = data;
4172 	u8 status;
4173 	int err;
4174 
4175 	BT_DBG("%s", hdev->name);
4176 
4177 	if (!bdaddr_type_is_valid(cp->addr.type))
4178 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4179 					 MGMT_STATUS_INVALID_PARAMS,
4180 					 &cp->addr, sizeof(cp->addr));
4181 
4182 	hci_dev_lock(hdev);
4183 
4184 	err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4185 				  cp->addr.type);
4186 	if (err < 0) {
4187 		status = MGMT_STATUS_INVALID_PARAMS;
4188 		goto done;
4189 	}
4190 
4191 	mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4192 		   sk);
4193 	status = MGMT_STATUS_SUCCESS;
4194 
4195 done:
4196 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4197 				&cp->addr, sizeof(cp->addr));
4198 
4199 	hci_dev_unlock(hdev);
4200 
4201 	return err;
4202 }
4203 
4204 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4205 			 u16 len)
4206 {
4207 	struct mgmt_cp_set_device_id *cp = data;
4208 	struct hci_request req;
4209 	int err;
4210 	__u16 source;
4211 
4212 	BT_DBG("%s", hdev->name);
4213 
4214 	source = __le16_to_cpu(cp->source);
4215 
4216 	if (source > 0x0002)
4217 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4218 				       MGMT_STATUS_INVALID_PARAMS);
4219 
4220 	hci_dev_lock(hdev);
4221 
4222 	hdev->devid_source = source;
4223 	hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4224 	hdev->devid_product = __le16_to_cpu(cp->product);
4225 	hdev->devid_version = __le16_to_cpu(cp->version);
4226 
4227 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4228 				NULL, 0);
4229 
4230 	hci_req_init(&req, hdev);
4231 	__hci_req_update_eir(&req);
4232 	hci_req_run(&req, NULL);
4233 
4234 	hci_dev_unlock(hdev);
4235 
4236 	return err;
4237 }
4238 
4239 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4240 					u16 opcode)
4241 {
4242 	BT_DBG("status %d", status);
4243 }
4244 
4245 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4246 				     u16 opcode)
4247 {
4248 	struct cmd_lookup match = { NULL, hdev };
4249 	struct hci_request req;
4250 	u8 instance;
4251 	struct adv_info *adv_instance;
4252 	int err;
4253 
4254 	hci_dev_lock(hdev);
4255 
4256 	if (status) {
4257 		u8 mgmt_err = mgmt_status(status);
4258 
4259 		mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4260 				     cmd_status_rsp, &mgmt_err);
4261 		goto unlock;
4262 	}
4263 
4264 	if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4265 		hci_dev_set_flag(hdev, HCI_ADVERTISING);
4266 	else
4267 		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4268 
4269 	mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4270 			     &match);
4271 
4272 	new_settings(hdev, match.sk);
4273 
4274 	if (match.sk)
4275 		sock_put(match.sk);
4276 
4277 	/* If "Set Advertising" was just disabled and instance advertising was
4278 	 * set up earlier, then re-enable multi-instance advertising.
4279 	 */
4280 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4281 	    list_empty(&hdev->adv_instances))
4282 		goto unlock;
4283 
4284 	instance = hdev->cur_adv_instance;
4285 	if (!instance) {
4286 		adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4287 							struct adv_info, list);
4288 		if (!adv_instance)
4289 			goto unlock;
4290 
4291 		instance = adv_instance->instance;
4292 	}
4293 
4294 	hci_req_init(&req, hdev);
4295 
4296 	err = __hci_req_schedule_adv_instance(&req, instance, true);
4297 
4298 	if (!err)
4299 		err = hci_req_run(&req, enable_advertising_instance);
4300 
4301 	if (err)
4302 		bt_dev_err(hdev, "failed to re-configure advertising");
4303 
4304 unlock:
4305 	hci_dev_unlock(hdev);
4306 }
4307 
4308 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4309 			   u16 len)
4310 {
4311 	struct mgmt_mode *cp = data;
4312 	struct mgmt_pending_cmd *cmd;
4313 	struct hci_request req;
4314 	u8 val, status;
4315 	int err;
4316 
4317 	BT_DBG("request for %s", hdev->name);
4318 
4319 	status = mgmt_le_support(hdev);
4320 	if (status)
4321 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4322 				       status);
4323 
4324 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4325 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4326 				       MGMT_STATUS_INVALID_PARAMS);
4327 
4328 	hci_dev_lock(hdev);
4329 
4330 	val = !!cp->val;
4331 
4332 	/* The following conditions are ones which mean that we should
4333 	 * not do any HCI communication but directly send a mgmt
4334 	 * response to user space (after toggling the flag if
4335 	 * necessary).
4336 	 */
4337 	if (!hdev_is_powered(hdev) ||
4338 	    (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4339 	     (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4340 	    hci_conn_num(hdev, LE_LINK) > 0 ||
4341 	    (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4342 	     hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4343 		bool changed;
4344 
4345 		if (cp->val) {
4346 			hdev->cur_adv_instance = 0x00;
4347 			changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4348 			if (cp->val == 0x02)
4349 				hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350 			else
4351 				hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4352 		} else {
4353 			changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4354 			hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4355 		}
4356 
4357 		err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4358 		if (err < 0)
4359 			goto unlock;
4360 
4361 		if (changed)
4362 			err = new_settings(hdev, sk);
4363 
4364 		goto unlock;
4365 	}
4366 
4367 	if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4368 	    pending_find(MGMT_OP_SET_LE, hdev)) {
4369 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4370 				      MGMT_STATUS_BUSY);
4371 		goto unlock;
4372 	}
4373 
4374 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4375 	if (!cmd) {
4376 		err = -ENOMEM;
4377 		goto unlock;
4378 	}
4379 
4380 	hci_req_init(&req, hdev);
4381 
4382 	if (cp->val == 0x02)
4383 		hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4384 	else
4385 		hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4386 
4387 	cancel_adv_timeout(hdev);
4388 
4389 	if (val) {
4390 		/* Switch to instance "0" for the Set Advertising setting.
4391 		 * We cannot use update_[adv|scan_rsp]_data() here as the
4392 		 * HCI_ADVERTISING flag is not yet set.
4393 		 */
4394 		hdev->cur_adv_instance = 0x00;
4395 
4396 		if (ext_adv_capable(hdev)) {
4397 			__hci_req_start_ext_adv(&req, 0x00);
4398 		} else {
4399 			__hci_req_update_adv_data(&req, 0x00);
4400 			__hci_req_update_scan_rsp_data(&req, 0x00);
4401 			__hci_req_enable_advertising(&req);
4402 		}
4403 	} else {
4404 		__hci_req_disable_advertising(&req);
4405 	}
4406 
4407 	err = hci_req_run(&req, set_advertising_complete);
4408 	if (err < 0)
4409 		mgmt_pending_remove(cmd);
4410 
4411 unlock:
4412 	hci_dev_unlock(hdev);
4413 	return err;
4414 }
4415 
4416 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4417 			      void *data, u16 len)
4418 {
4419 	struct mgmt_cp_set_static_address *cp = data;
4420 	int err;
4421 
4422 	BT_DBG("%s", hdev->name);
4423 
4424 	if (!lmp_le_capable(hdev))
4425 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4426 				       MGMT_STATUS_NOT_SUPPORTED);
4427 
4428 	if (hdev_is_powered(hdev))
4429 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4430 				       MGMT_STATUS_REJECTED);
4431 
4432 	if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4433 		if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4434 			return mgmt_cmd_status(sk, hdev->id,
4435 					       MGMT_OP_SET_STATIC_ADDRESS,
4436 					       MGMT_STATUS_INVALID_PARAMS);
4437 
4438 		/* Two most significant bits shall be set */
4439 		if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4440 			return mgmt_cmd_status(sk, hdev->id,
4441 					       MGMT_OP_SET_STATIC_ADDRESS,
4442 					       MGMT_STATUS_INVALID_PARAMS);
4443 	}
4444 
4445 	hci_dev_lock(hdev);
4446 
4447 	bacpy(&hdev->static_addr, &cp->bdaddr);
4448 
4449 	err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4450 	if (err < 0)
4451 		goto unlock;
4452 
4453 	err = new_settings(hdev, sk);
4454 
4455 unlock:
4456 	hci_dev_unlock(hdev);
4457 	return err;
4458 }
4459 
4460 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4461 			   void *data, u16 len)
4462 {
4463 	struct mgmt_cp_set_scan_params *cp = data;
4464 	__u16 interval, window;
4465 	int err;
4466 
4467 	BT_DBG("%s", hdev->name);
4468 
4469 	if (!lmp_le_capable(hdev))
4470 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4471 				       MGMT_STATUS_NOT_SUPPORTED);
4472 
4473 	interval = __le16_to_cpu(cp->interval);
4474 
4475 	if (interval < 0x0004 || interval > 0x4000)
4476 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4477 				       MGMT_STATUS_INVALID_PARAMS);
4478 
4479 	window = __le16_to_cpu(cp->window);
4480 
4481 	if (window < 0x0004 || window > 0x4000)
4482 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4483 				       MGMT_STATUS_INVALID_PARAMS);
4484 
4485 	if (window > interval)
4486 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4487 				       MGMT_STATUS_INVALID_PARAMS);
4488 
4489 	hci_dev_lock(hdev);
4490 
4491 	hdev->le_scan_interval = interval;
4492 	hdev->le_scan_window = window;
4493 
4494 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4495 				NULL, 0);
4496 
4497 	/* If background scan is running, restart it so new parameters are
4498 	 * loaded.
4499 	 */
4500 	if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4501 	    hdev->discovery.state == DISCOVERY_STOPPED) {
4502 		struct hci_request req;
4503 
4504 		hci_req_init(&req, hdev);
4505 
4506 		hci_req_add_le_scan_disable(&req);
4507 		hci_req_add_le_passive_scan(&req);
4508 
4509 		hci_req_run(&req, NULL);
4510 	}
4511 
4512 	hci_dev_unlock(hdev);
4513 
4514 	return err;
4515 }
4516 
4517 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4518 				      u16 opcode)
4519 {
4520 	struct mgmt_pending_cmd *cmd;
4521 
4522 	BT_DBG("status 0x%02x", status);
4523 
4524 	hci_dev_lock(hdev);
4525 
4526 	cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4527 	if (!cmd)
4528 		goto unlock;
4529 
4530 	if (status) {
4531 		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4532 			        mgmt_status(status));
4533 	} else {
4534 		struct mgmt_mode *cp = cmd->param;
4535 
4536 		if (cp->val)
4537 			hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4538 		else
4539 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4540 
4541 		send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4542 		new_settings(hdev, cmd->sk);
4543 	}
4544 
4545 	mgmt_pending_remove(cmd);
4546 
4547 unlock:
4548 	hci_dev_unlock(hdev);
4549 }
4550 
4551 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4552 				void *data, u16 len)
4553 {
4554 	struct mgmt_mode *cp = data;
4555 	struct mgmt_pending_cmd *cmd;
4556 	struct hci_request req;
4557 	int err;
4558 
4559 	BT_DBG("%s", hdev->name);
4560 
4561 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4562 	    hdev->hci_ver < BLUETOOTH_VER_1_2)
4563 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4564 				       MGMT_STATUS_NOT_SUPPORTED);
4565 
4566 	if (cp->val != 0x00 && cp->val != 0x01)
4567 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4568 				       MGMT_STATUS_INVALID_PARAMS);
4569 
4570 	hci_dev_lock(hdev);
4571 
4572 	if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4573 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4574 				      MGMT_STATUS_BUSY);
4575 		goto unlock;
4576 	}
4577 
4578 	if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4579 		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4580 					hdev);
4581 		goto unlock;
4582 	}
4583 
4584 	if (!hdev_is_powered(hdev)) {
4585 		hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4586 		err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4587 					hdev);
4588 		new_settings(hdev, sk);
4589 		goto unlock;
4590 	}
4591 
4592 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4593 			       data, len);
4594 	if (!cmd) {
4595 		err = -ENOMEM;
4596 		goto unlock;
4597 	}
4598 
4599 	hci_req_init(&req, hdev);
4600 
4601 	__hci_req_write_fast_connectable(&req, cp->val);
4602 
4603 	err = hci_req_run(&req, fast_connectable_complete);
4604 	if (err < 0) {
4605 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4606 				      MGMT_STATUS_FAILED);
4607 		mgmt_pending_remove(cmd);
4608 	}
4609 
4610 unlock:
4611 	hci_dev_unlock(hdev);
4612 
4613 	return err;
4614 }
4615 
4616 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4617 {
4618 	struct mgmt_pending_cmd *cmd;
4619 
4620 	BT_DBG("status 0x%02x", status);
4621 
4622 	hci_dev_lock(hdev);
4623 
4624 	cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4625 	if (!cmd)
4626 		goto unlock;
4627 
4628 	if (status) {
4629 		u8 mgmt_err = mgmt_status(status);
4630 
4631 		/* We need to restore the flag if related HCI commands
4632 		 * failed.
4633 		 */
4634 		hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4635 
4636 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4637 	} else {
4638 		send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4639 		new_settings(hdev, cmd->sk);
4640 	}
4641 
4642 	mgmt_pending_remove(cmd);
4643 
4644 unlock:
4645 	hci_dev_unlock(hdev);
4646 }
4647 
4648 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4649 {
4650 	struct mgmt_mode *cp = data;
4651 	struct mgmt_pending_cmd *cmd;
4652 	struct hci_request req;
4653 	int err;
4654 
4655 	BT_DBG("request for %s", hdev->name);
4656 
4657 	if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4658 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659 				       MGMT_STATUS_NOT_SUPPORTED);
4660 
4661 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4662 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4663 				       MGMT_STATUS_REJECTED);
4664 
4665 	if (cp->val != 0x00 && cp->val != 0x01)
4666 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4667 				       MGMT_STATUS_INVALID_PARAMS);
4668 
4669 	hci_dev_lock(hdev);
4670 
4671 	if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4672 		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4673 		goto unlock;
4674 	}
4675 
4676 	if (!hdev_is_powered(hdev)) {
4677 		if (!cp->val) {
4678 			hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4679 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4680 			hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4681 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4682 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4683 		}
4684 
4685 		hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4686 
4687 		err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4688 		if (err < 0)
4689 			goto unlock;
4690 
4691 		err = new_settings(hdev, sk);
4692 		goto unlock;
4693 	}
4694 
4695 	/* Reject disabling when powered on */
4696 	if (!cp->val) {
4697 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4698 				      MGMT_STATUS_REJECTED);
4699 		goto unlock;
4700 	} else {
4701 		/* When configuring a dual-mode controller to operate
4702 		 * with LE only and using a static address, then switching
4703 		 * BR/EDR back on is not allowed.
4704 		 *
4705 		 * Dual-mode controllers shall operate with the public
4706 		 * address as its identity address for BR/EDR and LE. So
4707 		 * reject the attempt to create an invalid configuration.
4708 		 *
4709 		 * The same restrictions applies when secure connections
4710 		 * has been enabled. For BR/EDR this is a controller feature
4711 		 * while for LE it is a host stack feature. This means that
4712 		 * switching BR/EDR back on when secure connections has been
4713 		 * enabled is not a supported transaction.
4714 		 */
4715 		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4716 		    (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4717 		     hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4718 			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4719 					      MGMT_STATUS_REJECTED);
4720 			goto unlock;
4721 		}
4722 	}
4723 
4724 	if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4725 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4726 				      MGMT_STATUS_BUSY);
4727 		goto unlock;
4728 	}
4729 
4730 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4731 	if (!cmd) {
4732 		err = -ENOMEM;
4733 		goto unlock;
4734 	}
4735 
4736 	/* We need to flip the bit already here so that
4737 	 * hci_req_update_adv_data generates the correct flags.
4738 	 */
4739 	hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4740 
4741 	hci_req_init(&req, hdev);
4742 
4743 	__hci_req_write_fast_connectable(&req, false);
4744 	__hci_req_update_scan(&req);
4745 
4746 	/* Since only the advertising data flags will change, there
4747 	 * is no need to update the scan response data.
4748 	 */
4749 	__hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4750 
4751 	err = hci_req_run(&req, set_bredr_complete);
4752 	if (err < 0)
4753 		mgmt_pending_remove(cmd);
4754 
4755 unlock:
4756 	hci_dev_unlock(hdev);
4757 	return err;
4758 }
4759 
4760 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4761 {
4762 	struct mgmt_pending_cmd *cmd;
4763 	struct mgmt_mode *cp;
4764 
4765 	BT_DBG("%s status %u", hdev->name, status);
4766 
4767 	hci_dev_lock(hdev);
4768 
4769 	cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4770 	if (!cmd)
4771 		goto unlock;
4772 
4773 	if (status) {
4774 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4775 			        mgmt_status(status));
4776 		goto remove;
4777 	}
4778 
4779 	cp = cmd->param;
4780 
4781 	switch (cp->val) {
4782 	case 0x00:
4783 		hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4784 		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4785 		break;
4786 	case 0x01:
4787 		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4788 		hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4789 		break;
4790 	case 0x02:
4791 		hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4792 		hci_dev_set_flag(hdev, HCI_SC_ONLY);
4793 		break;
4794 	}
4795 
4796 	send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4797 	new_settings(hdev, cmd->sk);
4798 
4799 remove:
4800 	mgmt_pending_remove(cmd);
4801 unlock:
4802 	hci_dev_unlock(hdev);
4803 }
4804 
4805 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4806 			   void *data, u16 len)
4807 {
4808 	struct mgmt_mode *cp = data;
4809 	struct mgmt_pending_cmd *cmd;
4810 	struct hci_request req;
4811 	u8 val;
4812 	int err;
4813 
4814 	BT_DBG("request for %s", hdev->name);
4815 
4816 	if (!lmp_sc_capable(hdev) &&
4817 	    !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4818 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4819 				       MGMT_STATUS_NOT_SUPPORTED);
4820 
4821 	if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4822 	    lmp_sc_capable(hdev) &&
4823 	    !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4824 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4825 				       MGMT_STATUS_REJECTED);
4826 
4827 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4828 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4829 				  MGMT_STATUS_INVALID_PARAMS);
4830 
4831 	hci_dev_lock(hdev);
4832 
4833 	if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4834 	    !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4835 		bool changed;
4836 
4837 		if (cp->val) {
4838 			changed = !hci_dev_test_and_set_flag(hdev,
4839 							     HCI_SC_ENABLED);
4840 			if (cp->val == 0x02)
4841 				hci_dev_set_flag(hdev, HCI_SC_ONLY);
4842 			else
4843 				hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4844 		} else {
4845 			changed = hci_dev_test_and_clear_flag(hdev,
4846 							      HCI_SC_ENABLED);
4847 			hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4848 		}
4849 
4850 		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4851 		if (err < 0)
4852 			goto failed;
4853 
4854 		if (changed)
4855 			err = new_settings(hdev, sk);
4856 
4857 		goto failed;
4858 	}
4859 
4860 	if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4861 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4862 				      MGMT_STATUS_BUSY);
4863 		goto failed;
4864 	}
4865 
4866 	val = !!cp->val;
4867 
4868 	if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4869 	    (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4870 		err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4871 		goto failed;
4872 	}
4873 
4874 	cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4875 	if (!cmd) {
4876 		err = -ENOMEM;
4877 		goto failed;
4878 	}
4879 
4880 	hci_req_init(&req, hdev);
4881 	hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4882 	err = hci_req_run(&req, sc_enable_complete);
4883 	if (err < 0) {
4884 		mgmt_pending_remove(cmd);
4885 		goto failed;
4886 	}
4887 
4888 failed:
4889 	hci_dev_unlock(hdev);
4890 	return err;
4891 }
4892 
4893 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4894 			  void *data, u16 len)
4895 {
4896 	struct mgmt_mode *cp = data;
4897 	bool changed, use_changed;
4898 	int err;
4899 
4900 	BT_DBG("request for %s", hdev->name);
4901 
4902 	if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4903 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4904 				       MGMT_STATUS_INVALID_PARAMS);
4905 
4906 	hci_dev_lock(hdev);
4907 
4908 	if (cp->val)
4909 		changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4910 	else
4911 		changed = hci_dev_test_and_clear_flag(hdev,
4912 						      HCI_KEEP_DEBUG_KEYS);
4913 
4914 	if (cp->val == 0x02)
4915 		use_changed = !hci_dev_test_and_set_flag(hdev,
4916 							 HCI_USE_DEBUG_KEYS);
4917 	else
4918 		use_changed = hci_dev_test_and_clear_flag(hdev,
4919 							  HCI_USE_DEBUG_KEYS);
4920 
4921 	if (hdev_is_powered(hdev) && use_changed &&
4922 	    hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4923 		u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4924 		hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4925 			     sizeof(mode), &mode);
4926 	}
4927 
4928 	err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4929 	if (err < 0)
4930 		goto unlock;
4931 
4932 	if (changed)
4933 		err = new_settings(hdev, sk);
4934 
4935 unlock:
4936 	hci_dev_unlock(hdev);
4937 	return err;
4938 }
4939 
4940 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4941 		       u16 len)
4942 {
4943 	struct mgmt_cp_set_privacy *cp = cp_data;
4944 	bool changed;
4945 	int err;
4946 
4947 	BT_DBG("request for %s", hdev->name);
4948 
4949 	if (!lmp_le_capable(hdev))
4950 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951 				       MGMT_STATUS_NOT_SUPPORTED);
4952 
4953 	if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4954 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4955 				       MGMT_STATUS_INVALID_PARAMS);
4956 
4957 	if (hdev_is_powered(hdev))
4958 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4959 				       MGMT_STATUS_REJECTED);
4960 
4961 	hci_dev_lock(hdev);
4962 
4963 	/* If user space supports this command it is also expected to
4964 	 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4965 	 */
4966 	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4967 
4968 	if (cp->privacy) {
4969 		changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4970 		memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4971 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4972 		hci_adv_instances_set_rpa_expired(hdev, true);
4973 		if (cp->privacy == 0x02)
4974 			hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4975 		else
4976 			hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4977 	} else {
4978 		changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4979 		memset(hdev->irk, 0, sizeof(hdev->irk));
4980 		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4981 		hci_adv_instances_set_rpa_expired(hdev, false);
4982 		hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4983 	}
4984 
4985 	err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4986 	if (err < 0)
4987 		goto unlock;
4988 
4989 	if (changed)
4990 		err = new_settings(hdev, sk);
4991 
4992 unlock:
4993 	hci_dev_unlock(hdev);
4994 	return err;
4995 }
4996 
4997 static bool irk_is_valid(struct mgmt_irk_info *irk)
4998 {
4999 	switch (irk->addr.type) {
5000 	case BDADDR_LE_PUBLIC:
5001 		return true;
5002 
5003 	case BDADDR_LE_RANDOM:
5004 		/* Two most significant bits shall be set */
5005 		if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5006 			return false;
5007 		return true;
5008 	}
5009 
5010 	return false;
5011 }
5012 
5013 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014 		     u16 len)
5015 {
5016 	struct mgmt_cp_load_irks *cp = cp_data;
5017 	const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5018 				   sizeof(struct mgmt_irk_info));
5019 	u16 irk_count, expected_len;
5020 	int i, err;
5021 
5022 	BT_DBG("request for %s", hdev->name);
5023 
5024 	if (!lmp_le_capable(hdev))
5025 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5026 				       MGMT_STATUS_NOT_SUPPORTED);
5027 
5028 	irk_count = __le16_to_cpu(cp->irk_count);
5029 	if (irk_count > max_irk_count) {
5030 		bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5031 			   irk_count);
5032 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033 				       MGMT_STATUS_INVALID_PARAMS);
5034 	}
5035 
5036 	expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5037 	if (expected_len != len) {
5038 		bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5039 			   expected_len, len);
5040 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5041 				       MGMT_STATUS_INVALID_PARAMS);
5042 	}
5043 
5044 	BT_DBG("%s irk_count %u", hdev->name, irk_count);
5045 
5046 	for (i = 0; i < irk_count; i++) {
5047 		struct mgmt_irk_info *key = &cp->irks[i];
5048 
5049 		if (!irk_is_valid(key))
5050 			return mgmt_cmd_status(sk, hdev->id,
5051 					       MGMT_OP_LOAD_IRKS,
5052 					       MGMT_STATUS_INVALID_PARAMS);
5053 	}
5054 
5055 	hci_dev_lock(hdev);
5056 
5057 	hci_smp_irks_clear(hdev);
5058 
5059 	for (i = 0; i < irk_count; i++) {
5060 		struct mgmt_irk_info *irk = &cp->irks[i];
5061 
5062 		hci_add_irk(hdev, &irk->addr.bdaddr,
5063 			    le_addr_type(irk->addr.type), irk->val,
5064 			    BDADDR_ANY);
5065 	}
5066 
5067 	hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5068 
5069 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5070 
5071 	hci_dev_unlock(hdev);
5072 
5073 	return err;
5074 }
5075 
5076 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5077 {
5078 	if (key->master != 0x00 && key->master != 0x01)
5079 		return false;
5080 
5081 	switch (key->addr.type) {
5082 	case BDADDR_LE_PUBLIC:
5083 		return true;
5084 
5085 	case BDADDR_LE_RANDOM:
5086 		/* Two most significant bits shall be set */
5087 		if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5088 			return false;
5089 		return true;
5090 	}
5091 
5092 	return false;
5093 }
5094 
5095 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5096 			       void *cp_data, u16 len)
5097 {
5098 	struct mgmt_cp_load_long_term_keys *cp = cp_data;
5099 	const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5100 				   sizeof(struct mgmt_ltk_info));
5101 	u16 key_count, expected_len;
5102 	int i, err;
5103 
5104 	BT_DBG("request for %s", hdev->name);
5105 
5106 	if (!lmp_le_capable(hdev))
5107 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5108 				       MGMT_STATUS_NOT_SUPPORTED);
5109 
5110 	key_count = __le16_to_cpu(cp->key_count);
5111 	if (key_count > max_key_count) {
5112 		bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5113 			   key_count);
5114 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115 				       MGMT_STATUS_INVALID_PARAMS);
5116 	}
5117 
5118 	expected_len = sizeof(*cp) + key_count *
5119 					sizeof(struct mgmt_ltk_info);
5120 	if (expected_len != len) {
5121 		bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5122 			   expected_len, len);
5123 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5124 				       MGMT_STATUS_INVALID_PARAMS);
5125 	}
5126 
5127 	BT_DBG("%s key_count %u", hdev->name, key_count);
5128 
5129 	for (i = 0; i < key_count; i++) {
5130 		struct mgmt_ltk_info *key = &cp->keys[i];
5131 
5132 		if (!ltk_is_valid(key))
5133 			return mgmt_cmd_status(sk, hdev->id,
5134 					       MGMT_OP_LOAD_LONG_TERM_KEYS,
5135 					       MGMT_STATUS_INVALID_PARAMS);
5136 	}
5137 
5138 	hci_dev_lock(hdev);
5139 
5140 	hci_smp_ltks_clear(hdev);
5141 
5142 	for (i = 0; i < key_count; i++) {
5143 		struct mgmt_ltk_info *key = &cp->keys[i];
5144 		u8 type, authenticated;
5145 
5146 		switch (key->type) {
5147 		case MGMT_LTK_UNAUTHENTICATED:
5148 			authenticated = 0x00;
5149 			type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5150 			break;
5151 		case MGMT_LTK_AUTHENTICATED:
5152 			authenticated = 0x01;
5153 			type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5154 			break;
5155 		case MGMT_LTK_P256_UNAUTH:
5156 			authenticated = 0x00;
5157 			type = SMP_LTK_P256;
5158 			break;
5159 		case MGMT_LTK_P256_AUTH:
5160 			authenticated = 0x01;
5161 			type = SMP_LTK_P256;
5162 			break;
5163 		case MGMT_LTK_P256_DEBUG:
5164 			authenticated = 0x00;
5165 			type = SMP_LTK_P256_DEBUG;
5166 			/* fall through */
5167 		default:
5168 			continue;
5169 		}
5170 
5171 		hci_add_ltk(hdev, &key->addr.bdaddr,
5172 			    le_addr_type(key->addr.type), type, authenticated,
5173 			    key->val, key->enc_size, key->ediv, key->rand);
5174 	}
5175 
5176 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5177 			   NULL, 0);
5178 
5179 	hci_dev_unlock(hdev);
5180 
5181 	return err;
5182 }
5183 
5184 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5185 {
5186 	struct hci_conn *conn = cmd->user_data;
5187 	struct mgmt_rp_get_conn_info rp;
5188 	int err;
5189 
5190 	memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5191 
5192 	if (status == MGMT_STATUS_SUCCESS) {
5193 		rp.rssi = conn->rssi;
5194 		rp.tx_power = conn->tx_power;
5195 		rp.max_tx_power = conn->max_tx_power;
5196 	} else {
5197 		rp.rssi = HCI_RSSI_INVALID;
5198 		rp.tx_power = HCI_TX_POWER_INVALID;
5199 		rp.max_tx_power = HCI_TX_POWER_INVALID;
5200 	}
5201 
5202 	err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5203 				status, &rp, sizeof(rp));
5204 
5205 	hci_conn_drop(conn);
5206 	hci_conn_put(conn);
5207 
5208 	return err;
5209 }
5210 
5211 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5212 				       u16 opcode)
5213 {
5214 	struct hci_cp_read_rssi *cp;
5215 	struct mgmt_pending_cmd *cmd;
5216 	struct hci_conn *conn;
5217 	u16 handle;
5218 	u8 status;
5219 
5220 	BT_DBG("status 0x%02x", hci_status);
5221 
5222 	hci_dev_lock(hdev);
5223 
5224 	/* Commands sent in request are either Read RSSI or Read Transmit Power
5225 	 * Level so we check which one was last sent to retrieve connection
5226 	 * handle.  Both commands have handle as first parameter so it's safe to
5227 	 * cast data on the same command struct.
5228 	 *
5229 	 * First command sent is always Read RSSI and we fail only if it fails.
5230 	 * In other case we simply override error to indicate success as we
5231 	 * already remembered if TX power value is actually valid.
5232 	 */
5233 	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5234 	if (!cp) {
5235 		cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5236 		status = MGMT_STATUS_SUCCESS;
5237 	} else {
5238 		status = mgmt_status(hci_status);
5239 	}
5240 
5241 	if (!cp) {
5242 		bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5243 		goto unlock;
5244 	}
5245 
5246 	handle = __le16_to_cpu(cp->handle);
5247 	conn = hci_conn_hash_lookup_handle(hdev, handle);
5248 	if (!conn) {
5249 		bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5250 			   handle);
5251 		goto unlock;
5252 	}
5253 
5254 	cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5255 	if (!cmd)
5256 		goto unlock;
5257 
5258 	cmd->cmd_complete(cmd, status);
5259 	mgmt_pending_remove(cmd);
5260 
5261 unlock:
5262 	hci_dev_unlock(hdev);
5263 }
5264 
5265 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5266 			 u16 len)
5267 {
5268 	struct mgmt_cp_get_conn_info *cp = data;
5269 	struct mgmt_rp_get_conn_info rp;
5270 	struct hci_conn *conn;
5271 	unsigned long conn_info_age;
5272 	int err = 0;
5273 
5274 	BT_DBG("%s", hdev->name);
5275 
5276 	memset(&rp, 0, sizeof(rp));
5277 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5278 	rp.addr.type = cp->addr.type;
5279 
5280 	if (!bdaddr_type_is_valid(cp->addr.type))
5281 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5282 					 MGMT_STATUS_INVALID_PARAMS,
5283 					 &rp, sizeof(rp));
5284 
5285 	hci_dev_lock(hdev);
5286 
5287 	if (!hdev_is_powered(hdev)) {
5288 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5289 					MGMT_STATUS_NOT_POWERED, &rp,
5290 					sizeof(rp));
5291 		goto unlock;
5292 	}
5293 
5294 	if (cp->addr.type == BDADDR_BREDR)
5295 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5296 					       &cp->addr.bdaddr);
5297 	else
5298 		conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5299 
5300 	if (!conn || conn->state != BT_CONNECTED) {
5301 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5302 					MGMT_STATUS_NOT_CONNECTED, &rp,
5303 					sizeof(rp));
5304 		goto unlock;
5305 	}
5306 
5307 	if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5308 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5309 					MGMT_STATUS_BUSY, &rp, sizeof(rp));
5310 		goto unlock;
5311 	}
5312 
5313 	/* To avoid client trying to guess when to poll again for information we
5314 	 * calculate conn info age as random value between min/max set in hdev.
5315 	 */
5316 	conn_info_age = hdev->conn_info_min_age +
5317 			prandom_u32_max(hdev->conn_info_max_age -
5318 					hdev->conn_info_min_age);
5319 
5320 	/* Query controller to refresh cached values if they are too old or were
5321 	 * never read.
5322 	 */
5323 	if (time_after(jiffies, conn->conn_info_timestamp +
5324 		       msecs_to_jiffies(conn_info_age)) ||
5325 	    !conn->conn_info_timestamp) {
5326 		struct hci_request req;
5327 		struct hci_cp_read_tx_power req_txp_cp;
5328 		struct hci_cp_read_rssi req_rssi_cp;
5329 		struct mgmt_pending_cmd *cmd;
5330 
5331 		hci_req_init(&req, hdev);
5332 		req_rssi_cp.handle = cpu_to_le16(conn->handle);
5333 		hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5334 			    &req_rssi_cp);
5335 
5336 		/* For LE links TX power does not change thus we don't need to
5337 		 * query for it once value is known.
5338 		 */
5339 		if (!bdaddr_type_is_le(cp->addr.type) ||
5340 		    conn->tx_power == HCI_TX_POWER_INVALID) {
5341 			req_txp_cp.handle = cpu_to_le16(conn->handle);
5342 			req_txp_cp.type = 0x00;
5343 			hci_req_add(&req, HCI_OP_READ_TX_POWER,
5344 				    sizeof(req_txp_cp), &req_txp_cp);
5345 		}
5346 
5347 		/* Max TX power needs to be read only once per connection */
5348 		if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5349 			req_txp_cp.handle = cpu_to_le16(conn->handle);
5350 			req_txp_cp.type = 0x01;
5351 			hci_req_add(&req, HCI_OP_READ_TX_POWER,
5352 				    sizeof(req_txp_cp), &req_txp_cp);
5353 		}
5354 
5355 		err = hci_req_run(&req, conn_info_refresh_complete);
5356 		if (err < 0)
5357 			goto unlock;
5358 
5359 		cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5360 				       data, len);
5361 		if (!cmd) {
5362 			err = -ENOMEM;
5363 			goto unlock;
5364 		}
5365 
5366 		hci_conn_hold(conn);
5367 		cmd->user_data = hci_conn_get(conn);
5368 		cmd->cmd_complete = conn_info_cmd_complete;
5369 
5370 		conn->conn_info_timestamp = jiffies;
5371 	} else {
5372 		/* Cache is valid, just reply with values cached in hci_conn */
5373 		rp.rssi = conn->rssi;
5374 		rp.tx_power = conn->tx_power;
5375 		rp.max_tx_power = conn->max_tx_power;
5376 
5377 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5378 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5379 	}
5380 
5381 unlock:
5382 	hci_dev_unlock(hdev);
5383 	return err;
5384 }
5385 
5386 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5387 {
5388 	struct hci_conn *conn = cmd->user_data;
5389 	struct mgmt_rp_get_clock_info rp;
5390 	struct hci_dev *hdev;
5391 	int err;
5392 
5393 	memset(&rp, 0, sizeof(rp));
5394 	memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5395 
5396 	if (status)
5397 		goto complete;
5398 
5399 	hdev = hci_dev_get(cmd->index);
5400 	if (hdev) {
5401 		rp.local_clock = cpu_to_le32(hdev->clock);
5402 		hci_dev_put(hdev);
5403 	}
5404 
5405 	if (conn) {
5406 		rp.piconet_clock = cpu_to_le32(conn->clock);
5407 		rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5408 	}
5409 
5410 complete:
5411 	err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5412 				sizeof(rp));
5413 
5414 	if (conn) {
5415 		hci_conn_drop(conn);
5416 		hci_conn_put(conn);
5417 	}
5418 
5419 	return err;
5420 }
5421 
5422 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5423 {
5424 	struct hci_cp_read_clock *hci_cp;
5425 	struct mgmt_pending_cmd *cmd;
5426 	struct hci_conn *conn;
5427 
5428 	BT_DBG("%s status %u", hdev->name, status);
5429 
5430 	hci_dev_lock(hdev);
5431 
5432 	hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5433 	if (!hci_cp)
5434 		goto unlock;
5435 
5436 	if (hci_cp->which) {
5437 		u16 handle = __le16_to_cpu(hci_cp->handle);
5438 		conn = hci_conn_hash_lookup_handle(hdev, handle);
5439 	} else {
5440 		conn = NULL;
5441 	}
5442 
5443 	cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5444 	if (!cmd)
5445 		goto unlock;
5446 
5447 	cmd->cmd_complete(cmd, mgmt_status(status));
5448 	mgmt_pending_remove(cmd);
5449 
5450 unlock:
5451 	hci_dev_unlock(hdev);
5452 }
5453 
5454 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5455 			 u16 len)
5456 {
5457 	struct mgmt_cp_get_clock_info *cp = data;
5458 	struct mgmt_rp_get_clock_info rp;
5459 	struct hci_cp_read_clock hci_cp;
5460 	struct mgmt_pending_cmd *cmd;
5461 	struct hci_request req;
5462 	struct hci_conn *conn;
5463 	int err;
5464 
5465 	BT_DBG("%s", hdev->name);
5466 
5467 	memset(&rp, 0, sizeof(rp));
5468 	bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5469 	rp.addr.type = cp->addr.type;
5470 
5471 	if (cp->addr.type != BDADDR_BREDR)
5472 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5473 					 MGMT_STATUS_INVALID_PARAMS,
5474 					 &rp, sizeof(rp));
5475 
5476 	hci_dev_lock(hdev);
5477 
5478 	if (!hdev_is_powered(hdev)) {
5479 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5480 					MGMT_STATUS_NOT_POWERED, &rp,
5481 					sizeof(rp));
5482 		goto unlock;
5483 	}
5484 
5485 	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5486 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5487 					       &cp->addr.bdaddr);
5488 		if (!conn || conn->state != BT_CONNECTED) {
5489 			err = mgmt_cmd_complete(sk, hdev->id,
5490 						MGMT_OP_GET_CLOCK_INFO,
5491 						MGMT_STATUS_NOT_CONNECTED,
5492 						&rp, sizeof(rp));
5493 			goto unlock;
5494 		}
5495 	} else {
5496 		conn = NULL;
5497 	}
5498 
5499 	cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5500 	if (!cmd) {
5501 		err = -ENOMEM;
5502 		goto unlock;
5503 	}
5504 
5505 	cmd->cmd_complete = clock_info_cmd_complete;
5506 
5507 	hci_req_init(&req, hdev);
5508 
5509 	memset(&hci_cp, 0, sizeof(hci_cp));
5510 	hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5511 
5512 	if (conn) {
5513 		hci_conn_hold(conn);
5514 		cmd->user_data = hci_conn_get(conn);
5515 
5516 		hci_cp.handle = cpu_to_le16(conn->handle);
5517 		hci_cp.which = 0x01; /* Piconet clock */
5518 		hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5519 	}
5520 
5521 	err = hci_req_run(&req, get_clock_info_complete);
5522 	if (err < 0)
5523 		mgmt_pending_remove(cmd);
5524 
5525 unlock:
5526 	hci_dev_unlock(hdev);
5527 	return err;
5528 }
5529 
5530 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5531 {
5532 	struct hci_conn *conn;
5533 
5534 	conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5535 	if (!conn)
5536 		return false;
5537 
5538 	if (conn->dst_type != type)
5539 		return false;
5540 
5541 	if (conn->state != BT_CONNECTED)
5542 		return false;
5543 
5544 	return true;
5545 }
5546 
5547 /* This function requires the caller holds hdev->lock */
5548 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5549 			       u8 addr_type, u8 auto_connect)
5550 {
5551 	struct hci_conn_params *params;
5552 
5553 	params = hci_conn_params_add(hdev, addr, addr_type);
5554 	if (!params)
5555 		return -EIO;
5556 
5557 	if (params->auto_connect == auto_connect)
5558 		return 0;
5559 
5560 	list_del_init(&params->action);
5561 
5562 	switch (auto_connect) {
5563 	case HCI_AUTO_CONN_DISABLED:
5564 	case HCI_AUTO_CONN_LINK_LOSS:
5565 		/* If auto connect is being disabled when we're trying to
5566 		 * connect to device, keep connecting.
5567 		 */
5568 		if (params->explicit_connect)
5569 			list_add(&params->action, &hdev->pend_le_conns);
5570 		break;
5571 	case HCI_AUTO_CONN_REPORT:
5572 		if (params->explicit_connect)
5573 			list_add(&params->action, &hdev->pend_le_conns);
5574 		else
5575 			list_add(&params->action, &hdev->pend_le_reports);
5576 		break;
5577 	case HCI_AUTO_CONN_DIRECT:
5578 	case HCI_AUTO_CONN_ALWAYS:
5579 		if (!is_connected(hdev, addr, addr_type))
5580 			list_add(&params->action, &hdev->pend_le_conns);
5581 		break;
5582 	}
5583 
5584 	params->auto_connect = auto_connect;
5585 
5586 	BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5587 	       auto_connect);
5588 
5589 	return 0;
5590 }
5591 
5592 static void device_added(struct sock *sk, struct hci_dev *hdev,
5593 			 bdaddr_t *bdaddr, u8 type, u8 action)
5594 {
5595 	struct mgmt_ev_device_added ev;
5596 
5597 	bacpy(&ev.addr.bdaddr, bdaddr);
5598 	ev.addr.type = type;
5599 	ev.action = action;
5600 
5601 	mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5602 }
5603 
5604 static int add_device(struct sock *sk, struct hci_dev *hdev,
5605 		      void *data, u16 len)
5606 {
5607 	struct mgmt_cp_add_device *cp = data;
5608 	u8 auto_conn, addr_type;
5609 	int err;
5610 
5611 	BT_DBG("%s", hdev->name);
5612 
5613 	if (!bdaddr_type_is_valid(cp->addr.type) ||
5614 	    !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5615 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5616 					 MGMT_STATUS_INVALID_PARAMS,
5617 					 &cp->addr, sizeof(cp->addr));
5618 
5619 	if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5620 		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5621 					 MGMT_STATUS_INVALID_PARAMS,
5622 					 &cp->addr, sizeof(cp->addr));
5623 
5624 	hci_dev_lock(hdev);
5625 
5626 	if (cp->addr.type == BDADDR_BREDR) {
5627 		/* Only incoming connections action is supported for now */
5628 		if (cp->action != 0x01) {
5629 			err = mgmt_cmd_complete(sk, hdev->id,
5630 						MGMT_OP_ADD_DEVICE,
5631 						MGMT_STATUS_INVALID_PARAMS,
5632 						&cp->addr, sizeof(cp->addr));
5633 			goto unlock;
5634 		}
5635 
5636 		err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5637 					  cp->addr.type);
5638 		if (err)
5639 			goto unlock;
5640 
5641 		hci_req_update_scan(hdev);
5642 
5643 		goto added;
5644 	}
5645 
5646 	addr_type = le_addr_type(cp->addr.type);
5647 
5648 	if (cp->action == 0x02)
5649 		auto_conn = HCI_AUTO_CONN_ALWAYS;
5650 	else if (cp->action == 0x01)
5651 		auto_conn = HCI_AUTO_CONN_DIRECT;
5652 	else
5653 		auto_conn = HCI_AUTO_CONN_REPORT;
5654 
5655 	/* Kernel internally uses conn_params with resolvable private
5656 	 * address, but Add Device allows only identity addresses.
5657 	 * Make sure it is enforced before calling
5658 	 * hci_conn_params_lookup.
5659 	 */
5660 	if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5661 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5662 					MGMT_STATUS_INVALID_PARAMS,
5663 					&cp->addr, sizeof(cp->addr));
5664 		goto unlock;
5665 	}
5666 
5667 	/* If the connection parameters don't exist for this device,
5668 	 * they will be created and configured with defaults.
5669 	 */
5670 	if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5671 				auto_conn) < 0) {
5672 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5673 					MGMT_STATUS_FAILED, &cp->addr,
5674 					sizeof(cp->addr));
5675 		goto unlock;
5676 	}
5677 
5678 	hci_update_background_scan(hdev);
5679 
5680 added:
5681 	device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5682 
5683 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5684 				MGMT_STATUS_SUCCESS, &cp->addr,
5685 				sizeof(cp->addr));
5686 
5687 unlock:
5688 	hci_dev_unlock(hdev);
5689 	return err;
5690 }
5691 
5692 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5693 			   bdaddr_t *bdaddr, u8 type)
5694 {
5695 	struct mgmt_ev_device_removed ev;
5696 
5697 	bacpy(&ev.addr.bdaddr, bdaddr);
5698 	ev.addr.type = type;
5699 
5700 	mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5701 }
5702 
5703 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5704 			 void *data, u16 len)
5705 {
5706 	struct mgmt_cp_remove_device *cp = data;
5707 	int err;
5708 
5709 	BT_DBG("%s", hdev->name);
5710 
5711 	hci_dev_lock(hdev);
5712 
5713 	if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5714 		struct hci_conn_params *params;
5715 		u8 addr_type;
5716 
5717 		if (!bdaddr_type_is_valid(cp->addr.type)) {
5718 			err = mgmt_cmd_complete(sk, hdev->id,
5719 						MGMT_OP_REMOVE_DEVICE,
5720 						MGMT_STATUS_INVALID_PARAMS,
5721 						&cp->addr, sizeof(cp->addr));
5722 			goto unlock;
5723 		}
5724 
5725 		if (cp->addr.type == BDADDR_BREDR) {
5726 			err = hci_bdaddr_list_del(&hdev->whitelist,
5727 						  &cp->addr.bdaddr,
5728 						  cp->addr.type);
5729 			if (err) {
5730 				err = mgmt_cmd_complete(sk, hdev->id,
5731 							MGMT_OP_REMOVE_DEVICE,
5732 							MGMT_STATUS_INVALID_PARAMS,
5733 							&cp->addr,
5734 							sizeof(cp->addr));
5735 				goto unlock;
5736 			}
5737 
5738 			hci_req_update_scan(hdev);
5739 
5740 			device_removed(sk, hdev, &cp->addr.bdaddr,
5741 				       cp->addr.type);
5742 			goto complete;
5743 		}
5744 
5745 		addr_type = le_addr_type(cp->addr.type);
5746 
5747 		/* Kernel internally uses conn_params with resolvable private
5748 		 * address, but Remove Device allows only identity addresses.
5749 		 * Make sure it is enforced before calling
5750 		 * hci_conn_params_lookup.
5751 		 */
5752 		if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5753 			err = mgmt_cmd_complete(sk, hdev->id,
5754 						MGMT_OP_REMOVE_DEVICE,
5755 						MGMT_STATUS_INVALID_PARAMS,
5756 						&cp->addr, sizeof(cp->addr));
5757 			goto unlock;
5758 		}
5759 
5760 		params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5761 						addr_type);
5762 		if (!params) {
5763 			err = mgmt_cmd_complete(sk, hdev->id,
5764 						MGMT_OP_REMOVE_DEVICE,
5765 						MGMT_STATUS_INVALID_PARAMS,
5766 						&cp->addr, sizeof(cp->addr));
5767 			goto unlock;
5768 		}
5769 
5770 		if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5771 		    params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5772 			err = mgmt_cmd_complete(sk, hdev->id,
5773 						MGMT_OP_REMOVE_DEVICE,
5774 						MGMT_STATUS_INVALID_PARAMS,
5775 						&cp->addr, sizeof(cp->addr));
5776 			goto unlock;
5777 		}
5778 
5779 		list_del(&params->action);
5780 		list_del(&params->list);
5781 		kfree(params);
5782 		hci_update_background_scan(hdev);
5783 
5784 		device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5785 	} else {
5786 		struct hci_conn_params *p, *tmp;
5787 		struct bdaddr_list *b, *btmp;
5788 
5789 		if (cp->addr.type) {
5790 			err = mgmt_cmd_complete(sk, hdev->id,
5791 						MGMT_OP_REMOVE_DEVICE,
5792 						MGMT_STATUS_INVALID_PARAMS,
5793 						&cp->addr, sizeof(cp->addr));
5794 			goto unlock;
5795 		}
5796 
5797 		list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5798 			device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5799 			list_del(&b->list);
5800 			kfree(b);
5801 		}
5802 
5803 		hci_req_update_scan(hdev);
5804 
5805 		list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5806 			if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5807 				continue;
5808 			device_removed(sk, hdev, &p->addr, p->addr_type);
5809 			if (p->explicit_connect) {
5810 				p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5811 				continue;
5812 			}
5813 			list_del(&p->action);
5814 			list_del(&p->list);
5815 			kfree(p);
5816 		}
5817 
5818 		BT_DBG("All LE connection parameters were removed");
5819 
5820 		hci_update_background_scan(hdev);
5821 	}
5822 
5823 complete:
5824 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5825 				MGMT_STATUS_SUCCESS, &cp->addr,
5826 				sizeof(cp->addr));
5827 unlock:
5828 	hci_dev_unlock(hdev);
5829 	return err;
5830 }
5831 
5832 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5833 			   u16 len)
5834 {
5835 	struct mgmt_cp_load_conn_param *cp = data;
5836 	const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5837 				     sizeof(struct mgmt_conn_param));
5838 	u16 param_count, expected_len;
5839 	int i;
5840 
5841 	if (!lmp_le_capable(hdev))
5842 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5843 				       MGMT_STATUS_NOT_SUPPORTED);
5844 
5845 	param_count = __le16_to_cpu(cp->param_count);
5846 	if (param_count > max_param_count) {
5847 		bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5848 			   param_count);
5849 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5850 				       MGMT_STATUS_INVALID_PARAMS);
5851 	}
5852 
5853 	expected_len = sizeof(*cp) + param_count *
5854 					sizeof(struct mgmt_conn_param);
5855 	if (expected_len != len) {
5856 		bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5857 			   expected_len, len);
5858 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5859 				       MGMT_STATUS_INVALID_PARAMS);
5860 	}
5861 
5862 	BT_DBG("%s param_count %u", hdev->name, param_count);
5863 
5864 	hci_dev_lock(hdev);
5865 
5866 	hci_conn_params_clear_disabled(hdev);
5867 
5868 	for (i = 0; i < param_count; i++) {
5869 		struct mgmt_conn_param *param = &cp->params[i];
5870 		struct hci_conn_params *hci_param;
5871 		u16 min, max, latency, timeout;
5872 		u8 addr_type;
5873 
5874 		BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5875 		       param->addr.type);
5876 
5877 		if (param->addr.type == BDADDR_LE_PUBLIC) {
5878 			addr_type = ADDR_LE_DEV_PUBLIC;
5879 		} else if (param->addr.type == BDADDR_LE_RANDOM) {
5880 			addr_type = ADDR_LE_DEV_RANDOM;
5881 		} else {
5882 			bt_dev_err(hdev, "ignoring invalid connection parameters");
5883 			continue;
5884 		}
5885 
5886 		min = le16_to_cpu(param->min_interval);
5887 		max = le16_to_cpu(param->max_interval);
5888 		latency = le16_to_cpu(param->latency);
5889 		timeout = le16_to_cpu(param->timeout);
5890 
5891 		BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5892 		       min, max, latency, timeout);
5893 
5894 		if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5895 			bt_dev_err(hdev, "ignoring invalid connection parameters");
5896 			continue;
5897 		}
5898 
5899 		hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5900 						addr_type);
5901 		if (!hci_param) {
5902 			bt_dev_err(hdev, "failed to add connection parameters");
5903 			continue;
5904 		}
5905 
5906 		hci_param->conn_min_interval = min;
5907 		hci_param->conn_max_interval = max;
5908 		hci_param->conn_latency = latency;
5909 		hci_param->supervision_timeout = timeout;
5910 	}
5911 
5912 	hci_dev_unlock(hdev);
5913 
5914 	return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5915 				 NULL, 0);
5916 }
5917 
5918 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5919 			       void *data, u16 len)
5920 {
5921 	struct mgmt_cp_set_external_config *cp = data;
5922 	bool changed;
5923 	int err;
5924 
5925 	BT_DBG("%s", hdev->name);
5926 
5927 	if (hdev_is_powered(hdev))
5928 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5929 				       MGMT_STATUS_REJECTED);
5930 
5931 	if (cp->config != 0x00 && cp->config != 0x01)
5932 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5933 				         MGMT_STATUS_INVALID_PARAMS);
5934 
5935 	if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5936 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5937 				       MGMT_STATUS_NOT_SUPPORTED);
5938 
5939 	hci_dev_lock(hdev);
5940 
5941 	if (cp->config)
5942 		changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5943 	else
5944 		changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5945 
5946 	err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5947 	if (err < 0)
5948 		goto unlock;
5949 
5950 	if (!changed)
5951 		goto unlock;
5952 
5953 	err = new_options(hdev, sk);
5954 
5955 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5956 		mgmt_index_removed(hdev);
5957 
5958 		if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5959 			hci_dev_set_flag(hdev, HCI_CONFIG);
5960 			hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5961 
5962 			queue_work(hdev->req_workqueue, &hdev->power_on);
5963 		} else {
5964 			set_bit(HCI_RAW, &hdev->flags);
5965 			mgmt_index_added(hdev);
5966 		}
5967 	}
5968 
5969 unlock:
5970 	hci_dev_unlock(hdev);
5971 	return err;
5972 }
5973 
5974 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5975 			      void *data, u16 len)
5976 {
5977 	struct mgmt_cp_set_public_address *cp = data;
5978 	bool changed;
5979 	int err;
5980 
5981 	BT_DBG("%s", hdev->name);
5982 
5983 	if (hdev_is_powered(hdev))
5984 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5985 				       MGMT_STATUS_REJECTED);
5986 
5987 	if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5988 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5989 				       MGMT_STATUS_INVALID_PARAMS);
5990 
5991 	if (!hdev->set_bdaddr)
5992 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5993 				       MGMT_STATUS_NOT_SUPPORTED);
5994 
5995 	hci_dev_lock(hdev);
5996 
5997 	changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5998 	bacpy(&hdev->public_addr, &cp->bdaddr);
5999 
6000 	err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6001 	if (err < 0)
6002 		goto unlock;
6003 
6004 	if (!changed)
6005 		goto unlock;
6006 
6007 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6008 		err = new_options(hdev, sk);
6009 
6010 	if (is_configured(hdev)) {
6011 		mgmt_index_removed(hdev);
6012 
6013 		hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6014 
6015 		hci_dev_set_flag(hdev, HCI_CONFIG);
6016 		hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6017 
6018 		queue_work(hdev->req_workqueue, &hdev->power_on);
6019 	}
6020 
6021 unlock:
6022 	hci_dev_unlock(hdev);
6023 	return err;
6024 }
6025 
6026 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6027 					     u16 opcode, struct sk_buff *skb)
6028 {
6029 	const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6030 	struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6031 	u8 *h192, *r192, *h256, *r256;
6032 	struct mgmt_pending_cmd *cmd;
6033 	u16 eir_len;
6034 	int err;
6035 
6036 	BT_DBG("%s status %u", hdev->name, status);
6037 
6038 	cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6039 	if (!cmd)
6040 		return;
6041 
6042 	mgmt_cp = cmd->param;
6043 
6044 	if (status) {
6045 		status = mgmt_status(status);
6046 		eir_len = 0;
6047 
6048 		h192 = NULL;
6049 		r192 = NULL;
6050 		h256 = NULL;
6051 		r256 = NULL;
6052 	} else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6053 		struct hci_rp_read_local_oob_data *rp;
6054 
6055 		if (skb->len != sizeof(*rp)) {
6056 			status = MGMT_STATUS_FAILED;
6057 			eir_len = 0;
6058 		} else {
6059 			status = MGMT_STATUS_SUCCESS;
6060 			rp = (void *)skb->data;
6061 
6062 			eir_len = 5 + 18 + 18;
6063 			h192 = rp->hash;
6064 			r192 = rp->rand;
6065 			h256 = NULL;
6066 			r256 = NULL;
6067 		}
6068 	} else {
6069 		struct hci_rp_read_local_oob_ext_data *rp;
6070 
6071 		if (skb->len != sizeof(*rp)) {
6072 			status = MGMT_STATUS_FAILED;
6073 			eir_len = 0;
6074 		} else {
6075 			status = MGMT_STATUS_SUCCESS;
6076 			rp = (void *)skb->data;
6077 
6078 			if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6079 				eir_len = 5 + 18 + 18;
6080 				h192 = NULL;
6081 				r192 = NULL;
6082 			} else {
6083 				eir_len = 5 + 18 + 18 + 18 + 18;
6084 				h192 = rp->hash192;
6085 				r192 = rp->rand192;
6086 			}
6087 
6088 			h256 = rp->hash256;
6089 			r256 = rp->rand256;
6090 		}
6091 	}
6092 
6093 	mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6094 	if (!mgmt_rp)
6095 		goto done;
6096 
6097 	if (status)
6098 		goto send_rsp;
6099 
6100 	eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6101 				  hdev->dev_class, 3);
6102 
6103 	if (h192 && r192) {
6104 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6105 					  EIR_SSP_HASH_C192, h192, 16);
6106 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6107 					  EIR_SSP_RAND_R192, r192, 16);
6108 	}
6109 
6110 	if (h256 && r256) {
6111 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6112 					  EIR_SSP_HASH_C256, h256, 16);
6113 		eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6114 					  EIR_SSP_RAND_R256, r256, 16);
6115 	}
6116 
6117 send_rsp:
6118 	mgmt_rp->type = mgmt_cp->type;
6119 	mgmt_rp->eir_len = cpu_to_le16(eir_len);
6120 
6121 	err = mgmt_cmd_complete(cmd->sk, hdev->id,
6122 				MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6123 				mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6124 	if (err < 0 || status)
6125 		goto done;
6126 
6127 	hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6128 
6129 	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6130 				 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6131 				 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6132 done:
6133 	kfree(mgmt_rp);
6134 	mgmt_pending_remove(cmd);
6135 }
6136 
6137 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6138 				  struct mgmt_cp_read_local_oob_ext_data *cp)
6139 {
6140 	struct mgmt_pending_cmd *cmd;
6141 	struct hci_request req;
6142 	int err;
6143 
6144 	cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6145 			       cp, sizeof(*cp));
6146 	if (!cmd)
6147 		return -ENOMEM;
6148 
6149 	hci_req_init(&req, hdev);
6150 
6151 	if (bredr_sc_enabled(hdev))
6152 		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6153 	else
6154 		hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6155 
6156 	err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6157 	if (err < 0) {
6158 		mgmt_pending_remove(cmd);
6159 		return err;
6160 	}
6161 
6162 	return 0;
6163 }
6164 
6165 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6166 				   void *data, u16 data_len)
6167 {
6168 	struct mgmt_cp_read_local_oob_ext_data *cp = data;
6169 	struct mgmt_rp_read_local_oob_ext_data *rp;
6170 	size_t rp_len;
6171 	u16 eir_len;
6172 	u8 status, flags, role, addr[7], hash[16], rand[16];
6173 	int err;
6174 
6175 	BT_DBG("%s", hdev->name);
6176 
6177 	if (hdev_is_powered(hdev)) {
6178 		switch (cp->type) {
6179 		case BIT(BDADDR_BREDR):
6180 			status = mgmt_bredr_support(hdev);
6181 			if (status)
6182 				eir_len = 0;
6183 			else
6184 				eir_len = 5;
6185 			break;
6186 		case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6187 			status = mgmt_le_support(hdev);
6188 			if (status)
6189 				eir_len = 0;
6190 			else
6191 				eir_len = 9 + 3 + 18 + 18 + 3;
6192 			break;
6193 		default:
6194 			status = MGMT_STATUS_INVALID_PARAMS;
6195 			eir_len = 0;
6196 			break;
6197 		}
6198 	} else {
6199 		status = MGMT_STATUS_NOT_POWERED;
6200 		eir_len = 0;
6201 	}
6202 
6203 	rp_len = sizeof(*rp) + eir_len;
6204 	rp = kmalloc(rp_len, GFP_ATOMIC);
6205 	if (!rp)
6206 		return -ENOMEM;
6207 
6208 	if (status)
6209 		goto complete;
6210 
6211 	hci_dev_lock(hdev);
6212 
6213 	eir_len = 0;
6214 	switch (cp->type) {
6215 	case BIT(BDADDR_BREDR):
6216 		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6217 			err = read_local_ssp_oob_req(hdev, sk, cp);
6218 			hci_dev_unlock(hdev);
6219 			if (!err)
6220 				goto done;
6221 
6222 			status = MGMT_STATUS_FAILED;
6223 			goto complete;
6224 		} else {
6225 			eir_len = eir_append_data(rp->eir, eir_len,
6226 						  EIR_CLASS_OF_DEV,
6227 						  hdev->dev_class, 3);
6228 		}
6229 		break;
6230 	case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6231 		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6232 		    smp_generate_oob(hdev, hash, rand) < 0) {
6233 			hci_dev_unlock(hdev);
6234 			status = MGMT_STATUS_FAILED;
6235 			goto complete;
6236 		}
6237 
6238 		/* This should return the active RPA, but since the RPA
6239 		 * is only programmed on demand, it is really hard to fill
6240 		 * this in at the moment. For now disallow retrieving
6241 		 * local out-of-band data when privacy is in use.
6242 		 *
6243 		 * Returning the identity address will not help here since
6244 		 * pairing happens before the identity resolving key is
6245 		 * known and thus the connection establishment happens
6246 		 * based on the RPA and not the identity address.
6247 		 */
6248 		if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6249 			hci_dev_unlock(hdev);
6250 			status = MGMT_STATUS_REJECTED;
6251 			goto complete;
6252 		}
6253 
6254 		if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6255 		   !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6256 		   (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6257 		    bacmp(&hdev->static_addr, BDADDR_ANY))) {
6258 			memcpy(addr, &hdev->static_addr, 6);
6259 			addr[6] = 0x01;
6260 		} else {
6261 			memcpy(addr, &hdev->bdaddr, 6);
6262 			addr[6] = 0x00;
6263 		}
6264 
6265 		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6266 					  addr, sizeof(addr));
6267 
6268 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6269 			role = 0x02;
6270 		else
6271 			role = 0x01;
6272 
6273 		eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6274 					  &role, sizeof(role));
6275 
6276 		if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6277 			eir_len = eir_append_data(rp->eir, eir_len,
6278 						  EIR_LE_SC_CONFIRM,
6279 						  hash, sizeof(hash));
6280 
6281 			eir_len = eir_append_data(rp->eir, eir_len,
6282 						  EIR_LE_SC_RANDOM,
6283 						  rand, sizeof(rand));
6284 		}
6285 
6286 		flags = mgmt_get_adv_discov_flags(hdev);
6287 
6288 		if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6289 			flags |= LE_AD_NO_BREDR;
6290 
6291 		eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6292 					  &flags, sizeof(flags));
6293 		break;
6294 	}
6295 
6296 	hci_dev_unlock(hdev);
6297 
6298 	hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6299 
6300 	status = MGMT_STATUS_SUCCESS;
6301 
6302 complete:
6303 	rp->type = cp->type;
6304 	rp->eir_len = cpu_to_le16(eir_len);
6305 
6306 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6307 				status, rp, sizeof(*rp) + eir_len);
6308 	if (err < 0 || status)
6309 		goto done;
6310 
6311 	err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6312 				 rp, sizeof(*rp) + eir_len,
6313 				 HCI_MGMT_OOB_DATA_EVENTS, sk);
6314 
6315 done:
6316 	kfree(rp);
6317 
6318 	return err;
6319 }
6320 
6321 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6322 {
6323 	u32 flags = 0;
6324 
6325 	flags |= MGMT_ADV_FLAG_CONNECTABLE;
6326 	flags |= MGMT_ADV_FLAG_DISCOV;
6327 	flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6328 	flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6329 	flags |= MGMT_ADV_FLAG_APPEARANCE;
6330 	flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6331 
6332 	/* In extended adv TX_POWER returned from Set Adv Param
6333 	 * will be always valid.
6334 	 */
6335 	if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6336 	    ext_adv_capable(hdev))
6337 		flags |= MGMT_ADV_FLAG_TX_POWER;
6338 
6339 	if (ext_adv_capable(hdev)) {
6340 		flags |= MGMT_ADV_FLAG_SEC_1M;
6341 
6342 		if (hdev->le_features[1] & HCI_LE_PHY_2M)
6343 			flags |= MGMT_ADV_FLAG_SEC_2M;
6344 
6345 		if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6346 			flags |= MGMT_ADV_FLAG_SEC_CODED;
6347 	}
6348 
6349 	return flags;
6350 }
6351 
6352 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6353 			     void *data, u16 data_len)
6354 {
6355 	struct mgmt_rp_read_adv_features *rp;
6356 	size_t rp_len;
6357 	int err;
6358 	struct adv_info *adv_instance;
6359 	u32 supported_flags;
6360 	u8 *instance;
6361 
6362 	BT_DBG("%s", hdev->name);
6363 
6364 	if (!lmp_le_capable(hdev))
6365 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6366 				       MGMT_STATUS_REJECTED);
6367 
6368 	hci_dev_lock(hdev);
6369 
6370 	rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6371 	rp = kmalloc(rp_len, GFP_ATOMIC);
6372 	if (!rp) {
6373 		hci_dev_unlock(hdev);
6374 		return -ENOMEM;
6375 	}
6376 
6377 	supported_flags = get_supported_adv_flags(hdev);
6378 
6379 	rp->supported_flags = cpu_to_le32(supported_flags);
6380 	rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6381 	rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6382 	rp->max_instances = HCI_MAX_ADV_INSTANCES;
6383 	rp->num_instances = hdev->adv_instance_cnt;
6384 
6385 	instance = rp->instance;
6386 	list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6387 		*instance = adv_instance->instance;
6388 		instance++;
6389 	}
6390 
6391 	hci_dev_unlock(hdev);
6392 
6393 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6394 				MGMT_STATUS_SUCCESS, rp, rp_len);
6395 
6396 	kfree(rp);
6397 
6398 	return err;
6399 }
6400 
6401 static u8 calculate_name_len(struct hci_dev *hdev)
6402 {
6403 	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6404 
6405 	return append_local_name(hdev, buf, 0);
6406 }
6407 
6408 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6409 			   bool is_adv_data)
6410 {
6411 	u8 max_len = HCI_MAX_AD_LENGTH;
6412 
6413 	if (is_adv_data) {
6414 		if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6415 				 MGMT_ADV_FLAG_LIMITED_DISCOV |
6416 				 MGMT_ADV_FLAG_MANAGED_FLAGS))
6417 			max_len -= 3;
6418 
6419 		if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6420 			max_len -= 3;
6421 	} else {
6422 		if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6423 			max_len -= calculate_name_len(hdev);
6424 
6425 		if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6426 			max_len -= 4;
6427 	}
6428 
6429 	return max_len;
6430 }
6431 
6432 static bool flags_managed(u32 adv_flags)
6433 {
6434 	return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6435 			    MGMT_ADV_FLAG_LIMITED_DISCOV |
6436 			    MGMT_ADV_FLAG_MANAGED_FLAGS);
6437 }
6438 
6439 static bool tx_power_managed(u32 adv_flags)
6440 {
6441 	return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6442 }
6443 
6444 static bool name_managed(u32 adv_flags)
6445 {
6446 	return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6447 }
6448 
6449 static bool appearance_managed(u32 adv_flags)
6450 {
6451 	return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6452 }
6453 
6454 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6455 			      u8 len, bool is_adv_data)
6456 {
6457 	int i, cur_len;
6458 	u8 max_len;
6459 
6460 	max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6461 
6462 	if (len > max_len)
6463 		return false;
6464 
6465 	/* Make sure that the data is correctly formatted. */
6466 	for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6467 		cur_len = data[i];
6468 
6469 		if (data[i + 1] == EIR_FLAGS &&
6470 		    (!is_adv_data || flags_managed(adv_flags)))
6471 			return false;
6472 
6473 		if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6474 			return false;
6475 
6476 		if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6477 			return false;
6478 
6479 		if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6480 			return false;
6481 
6482 		if (data[i + 1] == EIR_APPEARANCE &&
6483 		    appearance_managed(adv_flags))
6484 			return false;
6485 
6486 		/* If the current field length would exceed the total data
6487 		 * length, then it's invalid.
6488 		 */
6489 		if (i + cur_len >= len)
6490 			return false;
6491 	}
6492 
6493 	return true;
6494 }
6495 
6496 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6497 				     u16 opcode)
6498 {
6499 	struct mgmt_pending_cmd *cmd;
6500 	struct mgmt_cp_add_advertising *cp;
6501 	struct mgmt_rp_add_advertising rp;
6502 	struct adv_info *adv_instance, *n;
6503 	u8 instance;
6504 
6505 	BT_DBG("status %d", status);
6506 
6507 	hci_dev_lock(hdev);
6508 
6509 	cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6510 
6511 	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6512 		if (!adv_instance->pending)
6513 			continue;
6514 
6515 		if (!status) {
6516 			adv_instance->pending = false;
6517 			continue;
6518 		}
6519 
6520 		instance = adv_instance->instance;
6521 
6522 		if (hdev->cur_adv_instance == instance)
6523 			cancel_adv_timeout(hdev);
6524 
6525 		hci_remove_adv_instance(hdev, instance);
6526 		mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6527 	}
6528 
6529 	if (!cmd)
6530 		goto unlock;
6531 
6532 	cp = cmd->param;
6533 	rp.instance = cp->instance;
6534 
6535 	if (status)
6536 		mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6537 				mgmt_status(status));
6538 	else
6539 		mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6540 				  mgmt_status(status), &rp, sizeof(rp));
6541 
6542 	mgmt_pending_remove(cmd);
6543 
6544 unlock:
6545 	hci_dev_unlock(hdev);
6546 }
6547 
6548 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6549 			   void *data, u16 data_len)
6550 {
6551 	struct mgmt_cp_add_advertising *cp = data;
6552 	struct mgmt_rp_add_advertising rp;
6553 	u32 flags;
6554 	u32 supported_flags, phy_flags;
6555 	u8 status;
6556 	u16 timeout, duration;
6557 	unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6558 	u8 schedule_instance = 0;
6559 	struct adv_info *next_instance;
6560 	int err;
6561 	struct mgmt_pending_cmd *cmd;
6562 	struct hci_request req;
6563 
6564 	BT_DBG("%s", hdev->name);
6565 
6566 	status = mgmt_le_support(hdev);
6567 	if (status)
6568 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6569 				       status);
6570 
6571 	if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6572 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6573 				       MGMT_STATUS_INVALID_PARAMS);
6574 
6575 	if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6576 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6577 				       MGMT_STATUS_INVALID_PARAMS);
6578 
6579 	flags = __le32_to_cpu(cp->flags);
6580 	timeout = __le16_to_cpu(cp->timeout);
6581 	duration = __le16_to_cpu(cp->duration);
6582 
6583 	/* The current implementation only supports a subset of the specified
6584 	 * flags. Also need to check mutual exclusiveness of sec flags.
6585 	 */
6586 	supported_flags = get_supported_adv_flags(hdev);
6587 	phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6588 	if (flags & ~supported_flags ||
6589 	    ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6590 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6591 				       MGMT_STATUS_INVALID_PARAMS);
6592 
6593 	hci_dev_lock(hdev);
6594 
6595 	if (timeout && !hdev_is_powered(hdev)) {
6596 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6597 				      MGMT_STATUS_REJECTED);
6598 		goto unlock;
6599 	}
6600 
6601 	if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6602 	    pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6603 	    pending_find(MGMT_OP_SET_LE, hdev)) {
6604 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6605 				      MGMT_STATUS_BUSY);
6606 		goto unlock;
6607 	}
6608 
6609 	if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6610 	    !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6611 			       cp->scan_rsp_len, false)) {
6612 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6613 				      MGMT_STATUS_INVALID_PARAMS);
6614 		goto unlock;
6615 	}
6616 
6617 	err = hci_add_adv_instance(hdev, cp->instance, flags,
6618 				   cp->adv_data_len, cp->data,
6619 				   cp->scan_rsp_len,
6620 				   cp->data + cp->adv_data_len,
6621 				   timeout, duration);
6622 	if (err < 0) {
6623 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6624 				      MGMT_STATUS_FAILED);
6625 		goto unlock;
6626 	}
6627 
6628 	/* Only trigger an advertising added event if a new instance was
6629 	 * actually added.
6630 	 */
6631 	if (hdev->adv_instance_cnt > prev_instance_cnt)
6632 		mgmt_advertising_added(sk, hdev, cp->instance);
6633 
6634 	if (hdev->cur_adv_instance == cp->instance) {
6635 		/* If the currently advertised instance is being changed then
6636 		 * cancel the current advertising and schedule the next
6637 		 * instance. If there is only one instance then the overridden
6638 		 * advertising data will be visible right away.
6639 		 */
6640 		cancel_adv_timeout(hdev);
6641 
6642 		next_instance = hci_get_next_instance(hdev, cp->instance);
6643 		if (next_instance)
6644 			schedule_instance = next_instance->instance;
6645 	} else if (!hdev->adv_instance_timeout) {
6646 		/* Immediately advertise the new instance if no other
6647 		 * instance is currently being advertised.
6648 		 */
6649 		schedule_instance = cp->instance;
6650 	}
6651 
6652 	/* If the HCI_ADVERTISING flag is set or the device isn't powered or
6653 	 * there is no instance to be advertised then we have no HCI
6654 	 * communication to make. Simply return.
6655 	 */
6656 	if (!hdev_is_powered(hdev) ||
6657 	    hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6658 	    !schedule_instance) {
6659 		rp.instance = cp->instance;
6660 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6661 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6662 		goto unlock;
6663 	}
6664 
6665 	/* We're good to go, update advertising data, parameters, and start
6666 	 * advertising.
6667 	 */
6668 	cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6669 			       data_len);
6670 	if (!cmd) {
6671 		err = -ENOMEM;
6672 		goto unlock;
6673 	}
6674 
6675 	hci_req_init(&req, hdev);
6676 
6677 	err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6678 
6679 	if (!err)
6680 		err = hci_req_run(&req, add_advertising_complete);
6681 
6682 	if (err < 0)
6683 		mgmt_pending_remove(cmd);
6684 
6685 unlock:
6686 	hci_dev_unlock(hdev);
6687 
6688 	return err;
6689 }
6690 
6691 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6692 					u16 opcode)
6693 {
6694 	struct mgmt_pending_cmd *cmd;
6695 	struct mgmt_cp_remove_advertising *cp;
6696 	struct mgmt_rp_remove_advertising rp;
6697 
6698 	BT_DBG("status %d", status);
6699 
6700 	hci_dev_lock(hdev);
6701 
6702 	/* A failure status here only means that we failed to disable
6703 	 * advertising. Otherwise, the advertising instance has been removed,
6704 	 * so report success.
6705 	 */
6706 	cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6707 	if (!cmd)
6708 		goto unlock;
6709 
6710 	cp = cmd->param;
6711 	rp.instance = cp->instance;
6712 
6713 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6714 			  &rp, sizeof(rp));
6715 	mgmt_pending_remove(cmd);
6716 
6717 unlock:
6718 	hci_dev_unlock(hdev);
6719 }
6720 
6721 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6722 			      void *data, u16 data_len)
6723 {
6724 	struct mgmt_cp_remove_advertising *cp = data;
6725 	struct mgmt_rp_remove_advertising rp;
6726 	struct mgmt_pending_cmd *cmd;
6727 	struct hci_request req;
6728 	int err;
6729 
6730 	BT_DBG("%s", hdev->name);
6731 
6732 	hci_dev_lock(hdev);
6733 
6734 	if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6735 		err = mgmt_cmd_status(sk, hdev->id,
6736 				      MGMT_OP_REMOVE_ADVERTISING,
6737 				      MGMT_STATUS_INVALID_PARAMS);
6738 		goto unlock;
6739 	}
6740 
6741 	if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6742 	    pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6743 	    pending_find(MGMT_OP_SET_LE, hdev)) {
6744 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6745 				      MGMT_STATUS_BUSY);
6746 		goto unlock;
6747 	}
6748 
6749 	if (list_empty(&hdev->adv_instances)) {
6750 		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6751 				      MGMT_STATUS_INVALID_PARAMS);
6752 		goto unlock;
6753 	}
6754 
6755 	hci_req_init(&req, hdev);
6756 
6757 	hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6758 
6759 	if (list_empty(&hdev->adv_instances))
6760 		__hci_req_disable_advertising(&req);
6761 
6762 	/* If no HCI commands have been collected so far or the HCI_ADVERTISING
6763 	 * flag is set or the device isn't powered then we have no HCI
6764 	 * communication to make. Simply return.
6765 	 */
6766 	if (skb_queue_empty(&req.cmd_q) ||
6767 	    !hdev_is_powered(hdev) ||
6768 	    hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6769 		hci_req_purge(&req);
6770 		rp.instance = cp->instance;
6771 		err = mgmt_cmd_complete(sk, hdev->id,
6772 					MGMT_OP_REMOVE_ADVERTISING,
6773 					MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6774 		goto unlock;
6775 	}
6776 
6777 	cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6778 			       data_len);
6779 	if (!cmd) {
6780 		err = -ENOMEM;
6781 		goto unlock;
6782 	}
6783 
6784 	err = hci_req_run(&req, remove_advertising_complete);
6785 	if (err < 0)
6786 		mgmt_pending_remove(cmd);
6787 
6788 unlock:
6789 	hci_dev_unlock(hdev);
6790 
6791 	return err;
6792 }
6793 
6794 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6795 			     void *data, u16 data_len)
6796 {
6797 	struct mgmt_cp_get_adv_size_info *cp = data;
6798 	struct mgmt_rp_get_adv_size_info rp;
6799 	u32 flags, supported_flags;
6800 	int err;
6801 
6802 	BT_DBG("%s", hdev->name);
6803 
6804 	if (!lmp_le_capable(hdev))
6805 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6806 				       MGMT_STATUS_REJECTED);
6807 
6808 	if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6809 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6810 				       MGMT_STATUS_INVALID_PARAMS);
6811 
6812 	flags = __le32_to_cpu(cp->flags);
6813 
6814 	/* The current implementation only supports a subset of the specified
6815 	 * flags.
6816 	 */
6817 	supported_flags = get_supported_adv_flags(hdev);
6818 	if (flags & ~supported_flags)
6819 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6820 				       MGMT_STATUS_INVALID_PARAMS);
6821 
6822 	rp.instance = cp->instance;
6823 	rp.flags = cp->flags;
6824 	rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6825 	rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6826 
6827 	err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6828 				MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6829 
6830 	return err;
6831 }
6832 
6833 static const struct hci_mgmt_handler mgmt_handlers[] = {
6834 	{ NULL }, /* 0x0000 (no command) */
6835 	{ read_version,            MGMT_READ_VERSION_SIZE,
6836 						HCI_MGMT_NO_HDEV |
6837 						HCI_MGMT_UNTRUSTED },
6838 	{ read_commands,           MGMT_READ_COMMANDS_SIZE,
6839 						HCI_MGMT_NO_HDEV |
6840 						HCI_MGMT_UNTRUSTED },
6841 	{ read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6842 						HCI_MGMT_NO_HDEV |
6843 						HCI_MGMT_UNTRUSTED },
6844 	{ read_controller_info,    MGMT_READ_INFO_SIZE,
6845 						HCI_MGMT_UNTRUSTED },
6846 	{ set_powered,             MGMT_SETTING_SIZE },
6847 	{ set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6848 	{ set_connectable,         MGMT_SETTING_SIZE },
6849 	{ set_fast_connectable,    MGMT_SETTING_SIZE },
6850 	{ set_bondable,            MGMT_SETTING_SIZE },
6851 	{ set_link_security,       MGMT_SETTING_SIZE },
6852 	{ set_ssp,                 MGMT_SETTING_SIZE },
6853 	{ set_hs,                  MGMT_SETTING_SIZE },
6854 	{ set_le,                  MGMT_SETTING_SIZE },
6855 	{ set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6856 	{ set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6857 	{ add_uuid,                MGMT_ADD_UUID_SIZE },
6858 	{ remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6859 	{ load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6860 						HCI_MGMT_VAR_LEN },
6861 	{ load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6862 						HCI_MGMT_VAR_LEN },
6863 	{ disconnect,              MGMT_DISCONNECT_SIZE },
6864 	{ get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6865 	{ pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6866 	{ pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6867 	{ set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6868 	{ pair_device,             MGMT_PAIR_DEVICE_SIZE },
6869 	{ cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6870 	{ unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6871 	{ user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6872 	{ user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6873 	{ user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6874 	{ user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6875 	{ read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6876 	{ add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6877 						HCI_MGMT_VAR_LEN },
6878 	{ remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6879 	{ start_discovery,         MGMT_START_DISCOVERY_SIZE },
6880 	{ stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6881 	{ confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6882 	{ block_device,            MGMT_BLOCK_DEVICE_SIZE },
6883 	{ unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6884 	{ set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6885 	{ set_advertising,         MGMT_SETTING_SIZE },
6886 	{ set_bredr,               MGMT_SETTING_SIZE },
6887 	{ set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6888 	{ set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6889 	{ set_secure_conn,         MGMT_SETTING_SIZE },
6890 	{ set_debug_keys,          MGMT_SETTING_SIZE },
6891 	{ set_privacy,             MGMT_SET_PRIVACY_SIZE },
6892 	{ load_irks,               MGMT_LOAD_IRKS_SIZE,
6893 						HCI_MGMT_VAR_LEN },
6894 	{ get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6895 	{ get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6896 	{ add_device,              MGMT_ADD_DEVICE_SIZE },
6897 	{ remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6898 	{ load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6899 						HCI_MGMT_VAR_LEN },
6900 	{ read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6901 						HCI_MGMT_NO_HDEV |
6902 						HCI_MGMT_UNTRUSTED },
6903 	{ read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6904 						HCI_MGMT_UNCONFIGURED |
6905 						HCI_MGMT_UNTRUSTED },
6906 	{ set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6907 						HCI_MGMT_UNCONFIGURED },
6908 	{ set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6909 						HCI_MGMT_UNCONFIGURED },
6910 	{ start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6911 						HCI_MGMT_VAR_LEN },
6912 	{ read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6913 	{ read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6914 						HCI_MGMT_NO_HDEV |
6915 						HCI_MGMT_UNTRUSTED },
6916 	{ read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6917 	{ add_advertising,	   MGMT_ADD_ADVERTISING_SIZE,
6918 						HCI_MGMT_VAR_LEN },
6919 	{ remove_advertising,	   MGMT_REMOVE_ADVERTISING_SIZE },
6920 	{ get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6921 	{ start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6922 	{ read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6923 						HCI_MGMT_UNTRUSTED },
6924 	{ set_appearance,	   MGMT_SET_APPEARANCE_SIZE },
6925 	{ get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
6926 	{ set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
6927 };
6928 
6929 void mgmt_index_added(struct hci_dev *hdev)
6930 {
6931 	struct mgmt_ev_ext_index ev;
6932 
6933 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6934 		return;
6935 
6936 	switch (hdev->dev_type) {
6937 	case HCI_PRIMARY:
6938 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6939 			mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6940 					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6941 			ev.type = 0x01;
6942 		} else {
6943 			mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6944 					 HCI_MGMT_INDEX_EVENTS);
6945 			ev.type = 0x00;
6946 		}
6947 		break;
6948 	case HCI_AMP:
6949 		ev.type = 0x02;
6950 		break;
6951 	default:
6952 		return;
6953 	}
6954 
6955 	ev.bus = hdev->bus;
6956 
6957 	mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6958 			 HCI_MGMT_EXT_INDEX_EVENTS);
6959 }
6960 
6961 void mgmt_index_removed(struct hci_dev *hdev)
6962 {
6963 	struct mgmt_ev_ext_index ev;
6964 	u8 status = MGMT_STATUS_INVALID_INDEX;
6965 
6966 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6967 		return;
6968 
6969 	switch (hdev->dev_type) {
6970 	case HCI_PRIMARY:
6971 		mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6972 
6973 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6974 			mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6975 					 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6976 			ev.type = 0x01;
6977 		} else {
6978 			mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6979 					 HCI_MGMT_INDEX_EVENTS);
6980 			ev.type = 0x00;
6981 		}
6982 		break;
6983 	case HCI_AMP:
6984 		ev.type = 0x02;
6985 		break;
6986 	default:
6987 		return;
6988 	}
6989 
6990 	ev.bus = hdev->bus;
6991 
6992 	mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6993 			 HCI_MGMT_EXT_INDEX_EVENTS);
6994 }
6995 
6996 /* This function requires the caller holds hdev->lock */
6997 static void restart_le_actions(struct hci_dev *hdev)
6998 {
6999 	struct hci_conn_params *p;
7000 
7001 	list_for_each_entry(p, &hdev->le_conn_params, list) {
7002 		/* Needed for AUTO_OFF case where might not "really"
7003 		 * have been powered off.
7004 		 */
7005 		list_del_init(&p->action);
7006 
7007 		switch (p->auto_connect) {
7008 		case HCI_AUTO_CONN_DIRECT:
7009 		case HCI_AUTO_CONN_ALWAYS:
7010 			list_add(&p->action, &hdev->pend_le_conns);
7011 			break;
7012 		case HCI_AUTO_CONN_REPORT:
7013 			list_add(&p->action, &hdev->pend_le_reports);
7014 			break;
7015 		default:
7016 			break;
7017 		}
7018 	}
7019 }
7020 
7021 void mgmt_power_on(struct hci_dev *hdev, int err)
7022 {
7023 	struct cmd_lookup match = { NULL, hdev };
7024 
7025 	BT_DBG("err %d", err);
7026 
7027 	hci_dev_lock(hdev);
7028 
7029 	if (!err) {
7030 		restart_le_actions(hdev);
7031 		hci_update_background_scan(hdev);
7032 	}
7033 
7034 	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7035 
7036 	new_settings(hdev, match.sk);
7037 
7038 	if (match.sk)
7039 		sock_put(match.sk);
7040 
7041 	hci_dev_unlock(hdev);
7042 }
7043 
7044 void __mgmt_power_off(struct hci_dev *hdev)
7045 {
7046 	struct cmd_lookup match = { NULL, hdev };
7047 	u8 status, zero_cod[] = { 0, 0, 0 };
7048 
7049 	mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7050 
7051 	/* If the power off is because of hdev unregistration let
7052 	 * use the appropriate INVALID_INDEX status. Otherwise use
7053 	 * NOT_POWERED. We cover both scenarios here since later in
7054 	 * mgmt_index_removed() any hci_conn callbacks will have already
7055 	 * been triggered, potentially causing misleading DISCONNECTED
7056 	 * status responses.
7057 	 */
7058 	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7059 		status = MGMT_STATUS_INVALID_INDEX;
7060 	else
7061 		status = MGMT_STATUS_NOT_POWERED;
7062 
7063 	mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7064 
7065 	if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7066 		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7067 				   zero_cod, sizeof(zero_cod),
7068 				   HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7069 		ext_info_changed(hdev, NULL);
7070 	}
7071 
7072 	new_settings(hdev, match.sk);
7073 
7074 	if (match.sk)
7075 		sock_put(match.sk);
7076 }
7077 
7078 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7079 {
7080 	struct mgmt_pending_cmd *cmd;
7081 	u8 status;
7082 
7083 	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7084 	if (!cmd)
7085 		return;
7086 
7087 	if (err == -ERFKILL)
7088 		status = MGMT_STATUS_RFKILLED;
7089 	else
7090 		status = MGMT_STATUS_FAILED;
7091 
7092 	mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7093 
7094 	mgmt_pending_remove(cmd);
7095 }
7096 
7097 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7098 		       bool persistent)
7099 {
7100 	struct mgmt_ev_new_link_key ev;
7101 
7102 	memset(&ev, 0, sizeof(ev));
7103 
7104 	ev.store_hint = persistent;
7105 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7106 	ev.key.addr.type = BDADDR_BREDR;
7107 	ev.key.type = key->type;
7108 	memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7109 	ev.key.pin_len = key->pin_len;
7110 
7111 	mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7112 }
7113 
7114 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7115 {
7116 	switch (ltk->type) {
7117 	case SMP_LTK:
7118 	case SMP_LTK_SLAVE:
7119 		if (ltk->authenticated)
7120 			return MGMT_LTK_AUTHENTICATED;
7121 		return MGMT_LTK_UNAUTHENTICATED;
7122 	case SMP_LTK_P256:
7123 		if (ltk->authenticated)
7124 			return MGMT_LTK_P256_AUTH;
7125 		return MGMT_LTK_P256_UNAUTH;
7126 	case SMP_LTK_P256_DEBUG:
7127 		return MGMT_LTK_P256_DEBUG;
7128 	}
7129 
7130 	return MGMT_LTK_UNAUTHENTICATED;
7131 }
7132 
7133 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7134 {
7135 	struct mgmt_ev_new_long_term_key ev;
7136 
7137 	memset(&ev, 0, sizeof(ev));
7138 
7139 	/* Devices using resolvable or non-resolvable random addresses
7140 	 * without providing an identity resolving key don't require
7141 	 * to store long term keys. Their addresses will change the
7142 	 * next time around.
7143 	 *
7144 	 * Only when a remote device provides an identity address
7145 	 * make sure the long term key is stored. If the remote
7146 	 * identity is known, the long term keys are internally
7147 	 * mapped to the identity address. So allow static random
7148 	 * and public addresses here.
7149 	 */
7150 	if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7151 	    (key->bdaddr.b[5] & 0xc0) != 0xc0)
7152 		ev.store_hint = 0x00;
7153 	else
7154 		ev.store_hint = persistent;
7155 
7156 	bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7157 	ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7158 	ev.key.type = mgmt_ltk_type(key);
7159 	ev.key.enc_size = key->enc_size;
7160 	ev.key.ediv = key->ediv;
7161 	ev.key.rand = key->rand;
7162 
7163 	if (key->type == SMP_LTK)
7164 		ev.key.master = 1;
7165 
7166 	/* Make sure we copy only the significant bytes based on the
7167 	 * encryption key size, and set the rest of the value to zeroes.
7168 	 */
7169 	memcpy(ev.key.val, key->val, key->enc_size);
7170 	memset(ev.key.val + key->enc_size, 0,
7171 	       sizeof(ev.key.val) - key->enc_size);
7172 
7173 	mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7174 }
7175 
7176 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7177 {
7178 	struct mgmt_ev_new_irk ev;
7179 
7180 	memset(&ev, 0, sizeof(ev));
7181 
7182 	ev.store_hint = persistent;
7183 
7184 	bacpy(&ev.rpa, &irk->rpa);
7185 	bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7186 	ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7187 	memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7188 
7189 	mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7190 }
7191 
7192 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7193 		   bool persistent)
7194 {
7195 	struct mgmt_ev_new_csrk ev;
7196 
7197 	memset(&ev, 0, sizeof(ev));
7198 
7199 	/* Devices using resolvable or non-resolvable random addresses
7200 	 * without providing an identity resolving key don't require
7201 	 * to store signature resolving keys. Their addresses will change
7202 	 * the next time around.
7203 	 *
7204 	 * Only when a remote device provides an identity address
7205 	 * make sure the signature resolving key is stored. So allow
7206 	 * static random and public addresses here.
7207 	 */
7208 	if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7209 	    (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7210 		ev.store_hint = 0x00;
7211 	else
7212 		ev.store_hint = persistent;
7213 
7214 	bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7215 	ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7216 	ev.key.type = csrk->type;
7217 	memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7218 
7219 	mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7220 }
7221 
7222 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7223 			 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7224 			 u16 max_interval, u16 latency, u16 timeout)
7225 {
7226 	struct mgmt_ev_new_conn_param ev;
7227 
7228 	if (!hci_is_identity_address(bdaddr, bdaddr_type))
7229 		return;
7230 
7231 	memset(&ev, 0, sizeof(ev));
7232 	bacpy(&ev.addr.bdaddr, bdaddr);
7233 	ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7234 	ev.store_hint = store_hint;
7235 	ev.min_interval = cpu_to_le16(min_interval);
7236 	ev.max_interval = cpu_to_le16(max_interval);
7237 	ev.latency = cpu_to_le16(latency);
7238 	ev.timeout = cpu_to_le16(timeout);
7239 
7240 	mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7241 }
7242 
7243 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7244 			   u32 flags, u8 *name, u8 name_len)
7245 {
7246 	char buf[512];
7247 	struct mgmt_ev_device_connected *ev = (void *) buf;
7248 	u16 eir_len = 0;
7249 
7250 	bacpy(&ev->addr.bdaddr, &conn->dst);
7251 	ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7252 
7253 	ev->flags = __cpu_to_le32(flags);
7254 
7255 	/* We must ensure that the EIR Data fields are ordered and
7256 	 * unique. Keep it simple for now and avoid the problem by not
7257 	 * adding any BR/EDR data to the LE adv.
7258 	 */
7259 	if (conn->le_adv_data_len > 0) {
7260 		memcpy(&ev->eir[eir_len],
7261 		       conn->le_adv_data, conn->le_adv_data_len);
7262 		eir_len = conn->le_adv_data_len;
7263 	} else {
7264 		if (name_len > 0)
7265 			eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7266 						  name, name_len);
7267 
7268 		if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7269 			eir_len = eir_append_data(ev->eir, eir_len,
7270 						  EIR_CLASS_OF_DEV,
7271 						  conn->dev_class, 3);
7272 	}
7273 
7274 	ev->eir_len = cpu_to_le16(eir_len);
7275 
7276 	mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7277 		    sizeof(*ev) + eir_len, NULL);
7278 }
7279 
7280 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7281 {
7282 	struct sock **sk = data;
7283 
7284 	cmd->cmd_complete(cmd, 0);
7285 
7286 	*sk = cmd->sk;
7287 	sock_hold(*sk);
7288 
7289 	mgmt_pending_remove(cmd);
7290 }
7291 
7292 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7293 {
7294 	struct hci_dev *hdev = data;
7295 	struct mgmt_cp_unpair_device *cp = cmd->param;
7296 
7297 	device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7298 
7299 	cmd->cmd_complete(cmd, 0);
7300 	mgmt_pending_remove(cmd);
7301 }
7302 
7303 bool mgmt_powering_down(struct hci_dev *hdev)
7304 {
7305 	struct mgmt_pending_cmd *cmd;
7306 	struct mgmt_mode *cp;
7307 
7308 	cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7309 	if (!cmd)
7310 		return false;
7311 
7312 	cp = cmd->param;
7313 	if (!cp->val)
7314 		return true;
7315 
7316 	return false;
7317 }
7318 
7319 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7320 			      u8 link_type, u8 addr_type, u8 reason,
7321 			      bool mgmt_connected)
7322 {
7323 	struct mgmt_ev_device_disconnected ev;
7324 	struct sock *sk = NULL;
7325 
7326 	/* The connection is still in hci_conn_hash so test for 1
7327 	 * instead of 0 to know if this is the last one.
7328 	 */
7329 	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7330 		cancel_delayed_work(&hdev->power_off);
7331 		queue_work(hdev->req_workqueue, &hdev->power_off.work);
7332 	}
7333 
7334 	if (!mgmt_connected)
7335 		return;
7336 
7337 	if (link_type != ACL_LINK && link_type != LE_LINK)
7338 		return;
7339 
7340 	mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7341 
7342 	bacpy(&ev.addr.bdaddr, bdaddr);
7343 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7344 	ev.reason = reason;
7345 
7346 	mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7347 
7348 	if (sk)
7349 		sock_put(sk);
7350 
7351 	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7352 			     hdev);
7353 }
7354 
7355 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7356 			    u8 link_type, u8 addr_type, u8 status)
7357 {
7358 	u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7359 	struct mgmt_cp_disconnect *cp;
7360 	struct mgmt_pending_cmd *cmd;
7361 
7362 	mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7363 			     hdev);
7364 
7365 	cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7366 	if (!cmd)
7367 		return;
7368 
7369 	cp = cmd->param;
7370 
7371 	if (bacmp(bdaddr, &cp->addr.bdaddr))
7372 		return;
7373 
7374 	if (cp->addr.type != bdaddr_type)
7375 		return;
7376 
7377 	cmd->cmd_complete(cmd, mgmt_status(status));
7378 	mgmt_pending_remove(cmd);
7379 }
7380 
7381 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7382 			 u8 addr_type, u8 status)
7383 {
7384 	struct mgmt_ev_connect_failed ev;
7385 
7386 	/* The connection is still in hci_conn_hash so test for 1
7387 	 * instead of 0 to know if this is the last one.
7388 	 */
7389 	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7390 		cancel_delayed_work(&hdev->power_off);
7391 		queue_work(hdev->req_workqueue, &hdev->power_off.work);
7392 	}
7393 
7394 	bacpy(&ev.addr.bdaddr, bdaddr);
7395 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7396 	ev.status = mgmt_status(status);
7397 
7398 	mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7399 }
7400 
7401 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7402 {
7403 	struct mgmt_ev_pin_code_request ev;
7404 
7405 	bacpy(&ev.addr.bdaddr, bdaddr);
7406 	ev.addr.type = BDADDR_BREDR;
7407 	ev.secure = secure;
7408 
7409 	mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7410 }
7411 
7412 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7413 				  u8 status)
7414 {
7415 	struct mgmt_pending_cmd *cmd;
7416 
7417 	cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7418 	if (!cmd)
7419 		return;
7420 
7421 	cmd->cmd_complete(cmd, mgmt_status(status));
7422 	mgmt_pending_remove(cmd);
7423 }
7424 
7425 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7426 				      u8 status)
7427 {
7428 	struct mgmt_pending_cmd *cmd;
7429 
7430 	cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7431 	if (!cmd)
7432 		return;
7433 
7434 	cmd->cmd_complete(cmd, mgmt_status(status));
7435 	mgmt_pending_remove(cmd);
7436 }
7437 
7438 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7439 			      u8 link_type, u8 addr_type, u32 value,
7440 			      u8 confirm_hint)
7441 {
7442 	struct mgmt_ev_user_confirm_request ev;
7443 
7444 	BT_DBG("%s", hdev->name);
7445 
7446 	bacpy(&ev.addr.bdaddr, bdaddr);
7447 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7448 	ev.confirm_hint = confirm_hint;
7449 	ev.value = cpu_to_le32(value);
7450 
7451 	return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7452 			  NULL);
7453 }
7454 
7455 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7456 			      u8 link_type, u8 addr_type)
7457 {
7458 	struct mgmt_ev_user_passkey_request ev;
7459 
7460 	BT_DBG("%s", hdev->name);
7461 
7462 	bacpy(&ev.addr.bdaddr, bdaddr);
7463 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7464 
7465 	return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7466 			  NULL);
7467 }
7468 
7469 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7470 				      u8 link_type, u8 addr_type, u8 status,
7471 				      u8 opcode)
7472 {
7473 	struct mgmt_pending_cmd *cmd;
7474 
7475 	cmd = pending_find(opcode, hdev);
7476 	if (!cmd)
7477 		return -ENOENT;
7478 
7479 	cmd->cmd_complete(cmd, mgmt_status(status));
7480 	mgmt_pending_remove(cmd);
7481 
7482 	return 0;
7483 }
7484 
7485 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7486 				     u8 link_type, u8 addr_type, u8 status)
7487 {
7488 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7489 					  status, MGMT_OP_USER_CONFIRM_REPLY);
7490 }
7491 
7492 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7493 					 u8 link_type, u8 addr_type, u8 status)
7494 {
7495 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7496 					  status,
7497 					  MGMT_OP_USER_CONFIRM_NEG_REPLY);
7498 }
7499 
7500 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7501 				     u8 link_type, u8 addr_type, u8 status)
7502 {
7503 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7504 					  status, MGMT_OP_USER_PASSKEY_REPLY);
7505 }
7506 
7507 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7508 					 u8 link_type, u8 addr_type, u8 status)
7509 {
7510 	return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7511 					  status,
7512 					  MGMT_OP_USER_PASSKEY_NEG_REPLY);
7513 }
7514 
7515 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7516 			     u8 link_type, u8 addr_type, u32 passkey,
7517 			     u8 entered)
7518 {
7519 	struct mgmt_ev_passkey_notify ev;
7520 
7521 	BT_DBG("%s", hdev->name);
7522 
7523 	bacpy(&ev.addr.bdaddr, bdaddr);
7524 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
7525 	ev.passkey = __cpu_to_le32(passkey);
7526 	ev.entered = entered;
7527 
7528 	return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7529 }
7530 
7531 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7532 {
7533 	struct mgmt_ev_auth_failed ev;
7534 	struct mgmt_pending_cmd *cmd;
7535 	u8 status = mgmt_status(hci_status);
7536 
7537 	bacpy(&ev.addr.bdaddr, &conn->dst);
7538 	ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7539 	ev.status = status;
7540 
7541 	cmd = find_pairing(conn);
7542 
7543 	mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7544 		    cmd ? cmd->sk : NULL);
7545 
7546 	if (cmd) {
7547 		cmd->cmd_complete(cmd, status);
7548 		mgmt_pending_remove(cmd);
7549 	}
7550 }
7551 
7552 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7553 {
7554 	struct cmd_lookup match = { NULL, hdev };
7555 	bool changed;
7556 
7557 	if (status) {
7558 		u8 mgmt_err = mgmt_status(status);
7559 		mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7560 				     cmd_status_rsp, &mgmt_err);
7561 		return;
7562 	}
7563 
7564 	if (test_bit(HCI_AUTH, &hdev->flags))
7565 		changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7566 	else
7567 		changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7568 
7569 	mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7570 			     &match);
7571 
7572 	if (changed)
7573 		new_settings(hdev, match.sk);
7574 
7575 	if (match.sk)
7576 		sock_put(match.sk);
7577 }
7578 
7579 static void clear_eir(struct hci_request *req)
7580 {
7581 	struct hci_dev *hdev = req->hdev;
7582 	struct hci_cp_write_eir cp;
7583 
7584 	if (!lmp_ext_inq_capable(hdev))
7585 		return;
7586 
7587 	memset(hdev->eir, 0, sizeof(hdev->eir));
7588 
7589 	memset(&cp, 0, sizeof(cp));
7590 
7591 	hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7592 }
7593 
7594 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7595 {
7596 	struct cmd_lookup match = { NULL, hdev };
7597 	struct hci_request req;
7598 	bool changed = false;
7599 
7600 	if (status) {
7601 		u8 mgmt_err = mgmt_status(status);
7602 
7603 		if (enable && hci_dev_test_and_clear_flag(hdev,
7604 							  HCI_SSP_ENABLED)) {
7605 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7606 			new_settings(hdev, NULL);
7607 		}
7608 
7609 		mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7610 				     &mgmt_err);
7611 		return;
7612 	}
7613 
7614 	if (enable) {
7615 		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7616 	} else {
7617 		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7618 		if (!changed)
7619 			changed = hci_dev_test_and_clear_flag(hdev,
7620 							      HCI_HS_ENABLED);
7621 		else
7622 			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7623 	}
7624 
7625 	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7626 
7627 	if (changed)
7628 		new_settings(hdev, match.sk);
7629 
7630 	if (match.sk)
7631 		sock_put(match.sk);
7632 
7633 	hci_req_init(&req, hdev);
7634 
7635 	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7636 		if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7637 			hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7638 				    sizeof(enable), &enable);
7639 		__hci_req_update_eir(&req);
7640 	} else {
7641 		clear_eir(&req);
7642 	}
7643 
7644 	hci_req_run(&req, NULL);
7645 }
7646 
7647 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7648 {
7649 	struct cmd_lookup *match = data;
7650 
7651 	if (match->sk == NULL) {
7652 		match->sk = cmd->sk;
7653 		sock_hold(match->sk);
7654 	}
7655 }
7656 
7657 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7658 				    u8 status)
7659 {
7660 	struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7661 
7662 	mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7663 	mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7664 	mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7665 
7666 	if (!status) {
7667 		mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7668 				   3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7669 		ext_info_changed(hdev, NULL);
7670 	}
7671 
7672 	if (match.sk)
7673 		sock_put(match.sk);
7674 }
7675 
7676 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7677 {
7678 	struct mgmt_cp_set_local_name ev;
7679 	struct mgmt_pending_cmd *cmd;
7680 
7681 	if (status)
7682 		return;
7683 
7684 	memset(&ev, 0, sizeof(ev));
7685 	memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7686 	memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7687 
7688 	cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7689 	if (!cmd) {
7690 		memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7691 
7692 		/* If this is a HCI command related to powering on the
7693 		 * HCI dev don't send any mgmt signals.
7694 		 */
7695 		if (pending_find(MGMT_OP_SET_POWERED, hdev))
7696 			return;
7697 	}
7698 
7699 	mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7700 			   HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7701 	ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7702 }
7703 
7704 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7705 {
7706 	int i;
7707 
7708 	for (i = 0; i < uuid_count; i++) {
7709 		if (!memcmp(uuid, uuids[i], 16))
7710 			return true;
7711 	}
7712 
7713 	return false;
7714 }
7715 
7716 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7717 {
7718 	u16 parsed = 0;
7719 
7720 	while (parsed < eir_len) {
7721 		u8 field_len = eir[0];
7722 		u8 uuid[16];
7723 		int i;
7724 
7725 		if (field_len == 0)
7726 			break;
7727 
7728 		if (eir_len - parsed < field_len + 1)
7729 			break;
7730 
7731 		switch (eir[1]) {
7732 		case EIR_UUID16_ALL:
7733 		case EIR_UUID16_SOME:
7734 			for (i = 0; i + 3 <= field_len; i += 2) {
7735 				memcpy(uuid, bluetooth_base_uuid, 16);
7736 				uuid[13] = eir[i + 3];
7737 				uuid[12] = eir[i + 2];
7738 				if (has_uuid(uuid, uuid_count, uuids))
7739 					return true;
7740 			}
7741 			break;
7742 		case EIR_UUID32_ALL:
7743 		case EIR_UUID32_SOME:
7744 			for (i = 0; i + 5 <= field_len; i += 4) {
7745 				memcpy(uuid, bluetooth_base_uuid, 16);
7746 				uuid[15] = eir[i + 5];
7747 				uuid[14] = eir[i + 4];
7748 				uuid[13] = eir[i + 3];
7749 				uuid[12] = eir[i + 2];
7750 				if (has_uuid(uuid, uuid_count, uuids))
7751 					return true;
7752 			}
7753 			break;
7754 		case EIR_UUID128_ALL:
7755 		case EIR_UUID128_SOME:
7756 			for (i = 0; i + 17 <= field_len; i += 16) {
7757 				memcpy(uuid, eir + i + 2, 16);
7758 				if (has_uuid(uuid, uuid_count, uuids))
7759 					return true;
7760 			}
7761 			break;
7762 		}
7763 
7764 		parsed += field_len + 1;
7765 		eir += field_len + 1;
7766 	}
7767 
7768 	return false;
7769 }
7770 
7771 static void restart_le_scan(struct hci_dev *hdev)
7772 {
7773 	/* If controller is not scanning we are done. */
7774 	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7775 		return;
7776 
7777 	if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7778 		       hdev->discovery.scan_start +
7779 		       hdev->discovery.scan_duration))
7780 		return;
7781 
7782 	queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7783 			   DISCOV_LE_RESTART_DELAY);
7784 }
7785 
7786 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7787 			    u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7788 {
7789 	/* If a RSSI threshold has been specified, and
7790 	 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7791 	 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7792 	 * is set, let it through for further processing, as we might need to
7793 	 * restart the scan.
7794 	 *
7795 	 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7796 	 * the results are also dropped.
7797 	 */
7798 	if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7799 	    (rssi == HCI_RSSI_INVALID ||
7800 	    (rssi < hdev->discovery.rssi &&
7801 	     !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7802 		return  false;
7803 
7804 	if (hdev->discovery.uuid_count != 0) {
7805 		/* If a list of UUIDs is provided in filter, results with no
7806 		 * matching UUID should be dropped.
7807 		 */
7808 		if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7809 				   hdev->discovery.uuids) &&
7810 		    !eir_has_uuids(scan_rsp, scan_rsp_len,
7811 				   hdev->discovery.uuid_count,
7812 				   hdev->discovery.uuids))
7813 			return false;
7814 	}
7815 
7816 	/* If duplicate filtering does not report RSSI changes, then restart
7817 	 * scanning to ensure updated result with updated RSSI values.
7818 	 */
7819 	if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7820 		restart_le_scan(hdev);
7821 
7822 		/* Validate RSSI value against the RSSI threshold once more. */
7823 		if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7824 		    rssi < hdev->discovery.rssi)
7825 			return false;
7826 	}
7827 
7828 	return true;
7829 }
7830 
7831 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7832 		       u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7833 		       u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7834 {
7835 	char buf[512];
7836 	struct mgmt_ev_device_found *ev = (void *)buf;
7837 	size_t ev_size;
7838 
7839 	/* Don't send events for a non-kernel initiated discovery. With
7840 	 * LE one exception is if we have pend_le_reports > 0 in which
7841 	 * case we're doing passive scanning and want these events.
7842 	 */
7843 	if (!hci_discovery_active(hdev)) {
7844 		if (link_type == ACL_LINK)
7845 			return;
7846 		if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7847 			return;
7848 	}
7849 
7850 	if (hdev->discovery.result_filtering) {
7851 		/* We are using service discovery */
7852 		if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7853 				     scan_rsp_len))
7854 			return;
7855 	}
7856 
7857 	if (hdev->discovery.limited) {
7858 		/* Check for limited discoverable bit */
7859 		if (dev_class) {
7860 			if (!(dev_class[1] & 0x20))
7861 				return;
7862 		} else {
7863 			u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7864 			if (!flags || !(flags[0] & LE_AD_LIMITED))
7865 				return;
7866 		}
7867 	}
7868 
7869 	/* Make sure that the buffer is big enough. The 5 extra bytes
7870 	 * are for the potential CoD field.
7871 	 */
7872 	if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7873 		return;
7874 
7875 	memset(buf, 0, sizeof(buf));
7876 
7877 	/* In case of device discovery with BR/EDR devices (pre 1.2), the
7878 	 * RSSI value was reported as 0 when not available. This behavior
7879 	 * is kept when using device discovery. This is required for full
7880 	 * backwards compatibility with the API.
7881 	 *
7882 	 * However when using service discovery, the value 127 will be
7883 	 * returned when the RSSI is not available.
7884 	 */
7885 	if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7886 	    link_type == ACL_LINK)
7887 		rssi = 0;
7888 
7889 	bacpy(&ev->addr.bdaddr, bdaddr);
7890 	ev->addr.type = link_to_bdaddr(link_type, addr_type);
7891 	ev->rssi = rssi;
7892 	ev->flags = cpu_to_le32(flags);
7893 
7894 	if (eir_len > 0)
7895 		/* Copy EIR or advertising data into event */
7896 		memcpy(ev->eir, eir, eir_len);
7897 
7898 	if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7899 				       NULL))
7900 		eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7901 					  dev_class, 3);
7902 
7903 	if (scan_rsp_len > 0)
7904 		/* Append scan response data to event */
7905 		memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7906 
7907 	ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7908 	ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7909 
7910 	mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7911 }
7912 
7913 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7914 		      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7915 {
7916 	struct mgmt_ev_device_found *ev;
7917 	char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7918 	u16 eir_len;
7919 
7920 	ev = (struct mgmt_ev_device_found *) buf;
7921 
7922 	memset(buf, 0, sizeof(buf));
7923 
7924 	bacpy(&ev->addr.bdaddr, bdaddr);
7925 	ev->addr.type = link_to_bdaddr(link_type, addr_type);
7926 	ev->rssi = rssi;
7927 
7928 	eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7929 				  name_len);
7930 
7931 	ev->eir_len = cpu_to_le16(eir_len);
7932 
7933 	mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7934 }
7935 
7936 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7937 {
7938 	struct mgmt_ev_discovering ev;
7939 
7940 	BT_DBG("%s discovering %u", hdev->name, discovering);
7941 
7942 	memset(&ev, 0, sizeof(ev));
7943 	ev.type = hdev->discovery.type;
7944 	ev.discovering = discovering;
7945 
7946 	mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7947 }
7948 
7949 static struct hci_mgmt_chan chan = {
7950 	.channel	= HCI_CHANNEL_CONTROL,
7951 	.handler_count	= ARRAY_SIZE(mgmt_handlers),
7952 	.handlers	= mgmt_handlers,
7953 	.hdev_init	= mgmt_init_hdev,
7954 };
7955 
7956 int mgmt_init(void)
7957 {
7958 	return hci_mgmt_chan_register(&chan);
7959 }
7960 
7961 void mgmt_exit(void)
7962 {
7963 	hci_mgmt_chan_unregister(&chan);
7964 }
7965