Pileus Git - ~andy/linux/blob - net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #define MGMT_VERSION    0
  34 #define MGMT_REVISION   1
  35
  36 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  37
  38 struct pending_cmd {
  39         struct list_head list;
  40         u16 opcode;
  41         int index;
  42         void *param;
  43         struct sock *sk;
  44         void *user_data;
  45 };
  46
  47 /* HCI to MGMT error code conversion table */
  48 static u8 mgmt_status_table[] = {
  49         MGMT_STATUS_SUCCESS,
  50         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  51         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  52         MGMT_STATUS_FAILED,             /* Hardware Failure */
  53         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  54         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  55         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  56         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  57         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  58         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  59         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  60         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  61         MGMT_STATUS_BUSY,               /* Command Disallowed */
  62         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  63         MGMT_STATUS_REJECTED,           /* Rejected Security */
  64         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  65         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  66         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  67         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  68         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  69         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  70         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  71         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  72         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  73         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  74         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  75         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  76         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  77         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  78         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  79         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  80         MGMT_STATUS_FAILED,             /* Unspecified Error */
  81         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  82         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  83         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  84         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  85         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  86         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
  87         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
  88         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
  89         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
  90         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
  91         MGMT_STATUS_FAILED,             /* Transaction Collision */
  92         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
  93         MGMT_STATUS_REJECTED,           /* QoS Rejected */
  94         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
  95         MGMT_STATUS_REJECTED,           /* Insufficient Security */
  96         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
  97         MGMT_STATUS_BUSY,               /* Role Switch Pending */
  98         MGMT_STATUS_FAILED,             /* Slot Violation */
  99         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 100         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 101         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 102         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 103         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 104         MGMT_STATUS_BUSY,               /* Controller Busy */
 105         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 106         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 107         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 108         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 109         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 110 };
 111
 112 static u8 mgmt_status(u8 hci_status)
 113 {
 114         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 115                 return mgmt_status_table[hci_status];
 116
 117         return MGMT_STATUS_FAILED;
 118 }
 119
 120 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 121 {
 122         struct sk_buff *skb;
 123         struct mgmt_hdr *hdr;
 124         struct mgmt_ev_cmd_status *ev;
 125         int err;
 126
 127         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 128
 129         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 130         if (!skb)
 131                 return -ENOMEM;
 132
 133         hdr = (void *) skb_put(skb, sizeof(*hdr));
 134
 135         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 136         hdr->index = cpu_to_le16(index);
 137         hdr->len = cpu_to_le16(sizeof(*ev));
 138
 139         ev = (void *) skb_put(skb, sizeof(*ev));
 140         ev->status = status;
 141         put_unaligned_le16(cmd, &ev->opcode);
 142
 143         err = sock_queue_rcv_skb(sk, skb);
 144         if (err < 0)
 145                 kfree_skb(skb);
 146
 147         return err;
 148 }
 149
 150 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 151                                                                 size_t rp_len)
 152 {
 153         struct sk_buff *skb;
 154         struct mgmt_hdr *hdr;
 155         struct mgmt_ev_cmd_complete *ev;
 156         int err;
 157
 158         BT_DBG("sock %p", sk);
 159
 160         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 161         if (!skb)
 162                 return -ENOMEM;
 163
 164         hdr = (void *) skb_put(skb, sizeof(*hdr));
 165
 166         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 167         hdr->index = cpu_to_le16(index);
 168         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 169
 170         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 171         put_unaligned_le16(cmd, &ev->opcode);
 172
 173         if (rp)
 174                 memcpy(ev->data, rp, rp_len);
 175
 176         err = sock_queue_rcv_skb(sk, skb);
 177         if (err < 0)
 178                 kfree_skb(skb);
 179
 180         return err;;
 181 }
 182
 183 static int read_version(struct sock *sk)
 184 {
 185         struct mgmt_rp_read_version rp;
 186
 187         BT_DBG("sock %p", sk);
 188
 189         rp.version = MGMT_VERSION;
 190         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 191
 192         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 193                                                                 sizeof(rp));
 194 }
 195
 196 static int read_index_list(struct sock *sk)
 197 {
 198         struct mgmt_rp_read_index_list *rp;
 199         struct list_head *p;
 200         struct hci_dev *d;
 201         size_t rp_len;
 202         u16 count;
 203         int i, err;
 204
 205         BT_DBG("sock %p", sk);
 206
 207         read_lock(&hci_dev_list_lock);
 208
 209         count = 0;
 210         list_for_each(p, &hci_dev_list) {
 211                 count++;
 212         }
 213
 214         rp_len = sizeof(*rp) + (2 * count);
 215         rp = kmalloc(rp_len, GFP_ATOMIC);
 216         if (!rp) {
 217                 read_unlock(&hci_dev_list_lock);
 218                 return -ENOMEM;
 219         }
 220
 221         put_unaligned_le16(count, &rp->num_controllers);
 222
 223         i = 0;
 224         list_for_each_entry(d, &hci_dev_list, list) {
 225                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 226                         cancel_delayed_work(&d->power_off);
 227
 228                 if (test_bit(HCI_SETUP, &d->flags))
 229                         continue;
 230
 231                 put_unaligned_le16(d->id, &rp->index[i++]);
 232                 BT_DBG("Added hci%u", d->id);
 233         }
 234
 235         read_unlock(&hci_dev_list_lock);
 236
 237         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 238                                                                         rp_len);
 239
 240         kfree(rp);
 241
 242         return err;
 243 }
 244
 245 static u32 get_supported_settings(struct hci_dev *hdev)
 246 {
 247         u32 settings = 0;
 248
 249         settings |= MGMT_SETTING_POWERED;
 250         settings |= MGMT_SETTING_CONNECTABLE;
 251         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 252         settings |= MGMT_SETTING_DISCOVERABLE;
 253         settings |= MGMT_SETTING_PAIRABLE;
 254
 255         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 256                 settings |= MGMT_SETTING_SSP;
 257
 258         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 259                 settings |= MGMT_SETTING_BREDR;
 260                 settings |= MGMT_SETTING_LINK_SECURITY;
 261         }
 262
 263         if (hdev->features[4] & LMP_LE)
 264                 settings |= MGMT_SETTING_LE;
 265
 266         return settings;
 267 }
 268
 269 static u32 get_current_settings(struct hci_dev *hdev)
 270 {
 271         u32 settings = 0;
 272
 273         if (test_bit(HCI_UP, &hdev->flags))
 274                 settings |= MGMT_SETTING_POWERED;
 275         else
 276                 return settings;
 277
 278         if (test_bit(HCI_PSCAN, &hdev->flags))
 279                 settings |= MGMT_SETTING_CONNECTABLE;
 280
 281         if (test_bit(HCI_ISCAN, &hdev->flags))
 282                 settings |= MGMT_SETTING_DISCOVERABLE;
 283
 284         if (test_bit(HCI_PAIRABLE, &hdev->flags))
 285                 settings |= MGMT_SETTING_PAIRABLE;
 286
 287         if (!(hdev->features[4] & LMP_NO_BREDR))
 288                 settings |= MGMT_SETTING_BREDR;
 289
 290         if (hdev->extfeatures[0] & LMP_HOST_LE)
 291                 settings |= MGMT_SETTING_LE;
 292
 293         if (test_bit(HCI_AUTH, &hdev->flags))
 294                 settings |= MGMT_SETTING_LINK_SECURITY;
 295
 296         if (hdev->ssp_mode > 0)
 297                 settings |= MGMT_SETTING_SSP;
 298
 299         return settings;
 300 }
 301
 302 static int read_controller_info(struct sock *sk, u16 index)
 303 {
 304         struct mgmt_rp_read_info rp;
 305         struct hci_dev *hdev;
 306
 307         BT_DBG("sock %p hci%u", sk, index);
 308
 309         hdev = hci_dev_get(index);
 310         if (!hdev)
 311                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 312                                                 MGMT_STATUS_INVALID_PARAMS);
 313
 314         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 315                 cancel_delayed_work_sync(&hdev->power_off);
 316
 317         hci_dev_lock(hdev);
 318
 319         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags)) {
 320                 set_bit(HCI_MGMT, &hdev->flags);
 321                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 322         }
 323
 324         memset(&rp, 0, sizeof(rp));
 325
 326         bacpy(&rp.bdaddr, &hdev->bdaddr);
 327
 328         rp.version = hdev->hci_ver;
 329
 330         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 331
 332         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 333         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 334
 335         memcpy(rp.dev_class, hdev->dev_class, 3);
 336
 337         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 338
 339         hci_dev_unlock(hdev);
 340         hci_dev_put(hdev);
 341
 342         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 343 }
 344
 345 static void mgmt_pending_free(struct pending_cmd *cmd)
 346 {
 347         sock_put(cmd->sk);
 348         kfree(cmd->param);
 349         kfree(cmd);
 350 }
 351
 352 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 353                                                         struct hci_dev *hdev,
 354                                                         void *data, u16 len)
 355 {
 356         struct pending_cmd *cmd;
 357
 358         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 359         if (!cmd)
 360                 return NULL;
 361
 362         cmd->opcode = opcode;
 363         cmd->index = hdev->id;
 364
 365         cmd->param = kmalloc(len, GFP_ATOMIC);
 366         if (!cmd->param) {
 367                 kfree(cmd);
 368                 return NULL;
 369         }
 370
 371         if (data)
 372                 memcpy(cmd->param, data, len);
 373
 374         cmd->sk = sk;
 375         sock_hold(sk);
 376
 377         list_add(&cmd->list, &hdev->mgmt_pending);
 378
 379         return cmd;
 380 }
 381
 382 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 383                                 void (*cb)(struct pending_cmd *cmd, void *data),
 384                                 void *data)
 385 {
 386         struct list_head *p, *n;
 387
 388         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 389                 struct pending_cmd *cmd;
 390
 391                 cmd = list_entry(p, struct pending_cmd, list);
 392
 393                 if (opcode > 0 && cmd->opcode != opcode)
 394                         continue;
 395
 396                 cb(cmd, data);
 397         }
 398 }
 399
 400 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 401 {
 402         struct pending_cmd *cmd;
 403
 404         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 405                 if (cmd->opcode == opcode)
 406                         return cmd;
 407         }
 408
 409         return NULL;
 410 }
 411
 412 static void mgmt_pending_remove(struct pending_cmd *cmd)
 413 {
 414         list_del(&cmd->list);
 415         mgmt_pending_free(cmd);
 416 }
 417
 418 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 419 {
 420         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 421
 422         return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
 423 }
 424
 425 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 426 {
 427         struct mgmt_mode *cp;
 428         struct hci_dev *hdev;
 429         struct pending_cmd *cmd;
 430         int err, up;
 431
 432         cp = (void *) data;
 433
 434         BT_DBG("request for hci%u", index);
 435
 436         if (len != sizeof(*cp))
 437                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 438                                                 MGMT_STATUS_INVALID_PARAMS);
 439
 440         hdev = hci_dev_get(index);
 441         if (!hdev)
 442                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 443                                                 MGMT_STATUS_INVALID_PARAMS);
 444
 445         hci_dev_lock(hdev);
 446
 447         up = test_bit(HCI_UP, &hdev->flags);
 448         if ((cp->val && up) || (!cp->val && !up)) {
 449                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 450                 goto failed;
 451         }
 452
 453         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 454                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 455                                                         MGMT_STATUS_BUSY);
 456                 goto failed;
 457         }
 458
 459         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 460         if (!cmd) {
 461                 err = -ENOMEM;
 462                 goto failed;
 463         }
 464
 465         if (cp->val)
 466                 schedule_work(&hdev->power_on);
 467         else
 468                 schedule_work(&hdev->power_off.work);
 469
 470         err = 0;
 471
 472 failed:
 473         hci_dev_unlock(hdev);
 474         hci_dev_put(hdev);
 475         return err;
 476 }
 477
 478 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 479                                                                         u16 len)
 480 {
 481         struct mgmt_cp_set_discoverable *cp;
 482         struct hci_dev *hdev;
 483         struct pending_cmd *cmd;
 484         u8 scan;
 485         int err;
 486
 487         cp = (void *) data;
 488
 489         BT_DBG("request for hci%u", index);
 490
 491         if (len != sizeof(*cp))
 492                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 493                                                 MGMT_STATUS_INVALID_PARAMS);
 494
 495         hdev = hci_dev_get(index);
 496         if (!hdev)
 497                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 498                                                 MGMT_STATUS_INVALID_PARAMS);
 499
 500         hci_dev_lock(hdev);
 501
 502         if (!test_bit(HCI_UP, &hdev->flags)) {
 503                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 504                                                 MGMT_STATUS_NOT_POWERED);
 505                 goto failed;
 506         }
 507
 508         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 509                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 510                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 511                                                         MGMT_STATUS_BUSY);
 512                 goto failed;
 513         }
 514
 515         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 516                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 517                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 518                 goto failed;
 519         }
 520
 521         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 522         if (!cmd) {
 523                 err = -ENOMEM;
 524                 goto failed;
 525         }
 526
 527         scan = SCAN_PAGE;
 528
 529         if (cp->val)
 530                 scan |= SCAN_INQUIRY;
 531         else
 532                 cancel_delayed_work(&hdev->discov_off);
 533
 534         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 535         if (err < 0)
 536                 mgmt_pending_remove(cmd);
 537
 538         if (cp->val)
 539                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 540
 541 failed:
 542         hci_dev_unlock(hdev);
 543         hci_dev_put(hdev);
 544
 545         return err;
 546 }
 547
 548 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 549                                                                         u16 len)
 550 {
 551         struct mgmt_mode *cp;
 552         struct hci_dev *hdev;
 553         struct pending_cmd *cmd;
 554         u8 scan;
 555         int err;
 556
 557         cp = (void *) data;
 558
 559         BT_DBG("request for hci%u", index);
 560
 561         if (len != sizeof(*cp))
 562                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 563                                                 MGMT_STATUS_INVALID_PARAMS);
 564
 565         hdev = hci_dev_get(index);
 566         if (!hdev)
 567                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 568                                                 MGMT_STATUS_INVALID_PARAMS);
 569
 570         hci_dev_lock(hdev);
 571
 572         if (!test_bit(HCI_UP, &hdev->flags)) {
 573                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 574                                                 MGMT_STATUS_NOT_POWERED);
 575                 goto failed;
 576         }
 577
 578         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 579                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 580                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 581                                                         MGMT_STATUS_BUSY);
 582                 goto failed;
 583         }
 584
 585         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 586                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 587                 goto failed;
 588         }
 589
 590         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 591         if (!cmd) {
 592                 err = -ENOMEM;
 593                 goto failed;
 594         }
 595
 596         if (cp->val)
 597                 scan = SCAN_PAGE;
 598         else
 599                 scan = 0;
 600
 601         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 602         if (err < 0)
 603                 mgmt_pending_remove(cmd);
 604
 605 failed:
 606         hci_dev_unlock(hdev);
 607         hci_dev_put(hdev);
 608
 609         return err;
 610 }
 611
 612 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 613                                         u16 data_len, struct sock *skip_sk)
 614 {
 615         struct sk_buff *skb;
 616         struct mgmt_hdr *hdr;
 617
 618         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 619         if (!skb)
 620                 return -ENOMEM;
 621
 622         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 623
 624         hdr = (void *) skb_put(skb, sizeof(*hdr));
 625         hdr->opcode = cpu_to_le16(event);
 626         if (hdev)
 627                 hdr->index = cpu_to_le16(hdev->id);
 628         else
 629                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 630         hdr->len = cpu_to_le16(data_len);
 631
 632         if (data)
 633                 memcpy(skb_put(skb, data_len), data, data_len);
 634
 635         hci_send_to_sock(NULL, skb, skip_sk);
 636         kfree_skb(skb);
 637
 638         return 0;
 639 }
 640
 641 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 642                                                                         u16 len)
 643 {
 644         struct mgmt_mode *cp;
 645         struct hci_dev *hdev;
 646         __le32 ev;
 647         int err;
 648
 649         cp = (void *) data;
 650
 651         BT_DBG("request for hci%u", index);
 652
 653         if (len != sizeof(*cp))
 654                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 655                                                 MGMT_STATUS_INVALID_PARAMS);
 656
 657         hdev = hci_dev_get(index);
 658         if (!hdev)
 659                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 660                                                 MGMT_STATUS_INVALID_PARAMS);
 661
 662         hci_dev_lock(hdev);
 663
 664         if (cp->val)
 665                 set_bit(HCI_PAIRABLE, &hdev->flags);
 666         else
 667                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 668
 669         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
 670         if (err < 0)
 671                 goto failed;
 672
 673         ev = cpu_to_le32(get_current_settings(hdev));
 674
 675         err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
 676
 677 failed:
 678         hci_dev_unlock(hdev);
 679         hci_dev_put(hdev);
 680
 681         return err;
 682 }
 683
 684 #define EIR_FLAGS               0x01 /* flags */
 685 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 686 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 687 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 688 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 689 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 690 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 691 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 692 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 693 #define EIR_TX_POWER            0x0A /* transmit power level */
 694 #define EIR_DEVICE_ID           0x10 /* device ID */
 695
 696 #define PNP_INFO_SVCLASS_ID             0x1200
 697
 698 static u8 bluetooth_base_uuid[] = {
 699                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 700                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 701 };
 702
 703 static u16 get_uuid16(u8 *uuid128)
 704 {
 705         u32 val;
 706         int i;
 707
 708         for (i = 0; i < 12; i++) {
 709                 if (bluetooth_base_uuid[i] != uuid128[i])
 710                         return 0;
 711         }
 712
 713         memcpy(&val, &uuid128[12], 4);
 714
 715         val = le32_to_cpu(val);
 716         if (val > 0xffff)
 717                 return 0;
 718
 719         return (u16) val;
 720 }
 721
 722 static void create_eir(struct hci_dev *hdev, u8 *data)
 723 {
 724         u8 *ptr = data;
 725         u16 eir_len = 0;
 726         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 727         int i, truncated = 0;
 728         struct bt_uuid *uuid;
 729         size_t name_len;
 730
 731         name_len = strlen(hdev->dev_name);
 732
 733         if (name_len > 0) {
 734                 /* EIR Data type */
 735                 if (name_len > 48) {
 736                         name_len = 48;
 737                         ptr[1] = EIR_NAME_SHORT;
 738                 } else
 739                         ptr[1] = EIR_NAME_COMPLETE;
 740
 741                 /* EIR Data length */
 742                 ptr[0] = name_len + 1;
 743
 744                 memcpy(ptr + 2, hdev->dev_name, name_len);
 745
 746                 eir_len += (name_len + 2);
 747                 ptr += (name_len + 2);
 748         }
 749
 750         memset(uuid16_list, 0, sizeof(uuid16_list));
 751
 752         /* Group all UUID16 types */
 753         list_for_each_entry(uuid, &hdev->uuids, list) {
 754                 u16 uuid16;
 755
 756                 uuid16 = get_uuid16(uuid->uuid);
 757                 if (uuid16 == 0)
 758                         return;
 759
 760                 if (uuid16 < 0x1100)
 761                         continue;
 762
 763                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 764                         continue;
 765
 766                 /* Stop if not enough space to put next UUID */
 767                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 768                         truncated = 1;
 769                         break;
 770                 }
 771
 772                 /* Check for duplicates */
 773                 for (i = 0; uuid16_list[i] != 0; i++)
 774                         if (uuid16_list[i] == uuid16)
 775                                 break;
 776
 777                 if (uuid16_list[i] == 0) {
 778                         uuid16_list[i] = uuid16;
 779                         eir_len += sizeof(u16);
 780                 }
 781         }
 782
 783         if (uuid16_list[0] != 0) {
 784                 u8 *length = ptr;
 785
 786                 /* EIR Data type */
 787                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 788
 789                 ptr += 2;
 790                 eir_len += 2;
 791
 792                 for (i = 0; uuid16_list[i] != 0; i++) {
 793                         *ptr++ = (uuid16_list[i] & 0x00ff);
 794                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 795                 }
 796
 797                 /* EIR Data length */
 798                 *length = (i * sizeof(u16)) + 1;
 799         }
 800 }
 801
 802 static int update_eir(struct hci_dev *hdev)
 803 {
 804         struct hci_cp_write_eir cp;
 805
 806         if (!(hdev->features[6] & LMP_EXT_INQ))
 807                 return 0;
 808
 809         if (hdev->ssp_mode == 0)
 810                 return 0;
 811
 812         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 813                 return 0;
 814
 815         memset(&cp, 0, sizeof(cp));
 816
 817         create_eir(hdev, cp.data);
 818
 819         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 820                 return 0;
 821
 822         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 823
 824         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 825 }
 826
 827 static u8 get_service_classes(struct hci_dev *hdev)
 828 {
 829         struct bt_uuid *uuid;
 830         u8 val = 0;
 831
 832         list_for_each_entry(uuid, &hdev->uuids, list)
 833                 val |= uuid->svc_hint;
 834
 835         return val;
 836 }
 837
 838 static int update_class(struct hci_dev *hdev)
 839 {
 840         u8 cod[3];
 841
 842         BT_DBG("%s", hdev->name);
 843
 844         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 845                 return 0;
 846
 847         cod[0] = hdev->minor_class;
 848         cod[1] = hdev->major_class;
 849         cod[2] = get_service_classes(hdev);
 850
 851         if (memcmp(cod, hdev->dev_class, 3) == 0)
 852                 return 0;
 853
 854         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 855 }
 856
 857 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 858 {
 859         struct mgmt_cp_add_uuid *cp;
 860         struct hci_dev *hdev;
 861         struct bt_uuid *uuid;
 862         int err;
 863
 864         cp = (void *) data;
 865
 866         BT_DBG("request for hci%u", index);
 867
 868         if (len != sizeof(*cp))
 869                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 870                                                 MGMT_STATUS_INVALID_PARAMS);
 871
 872         hdev = hci_dev_get(index);
 873         if (!hdev)
 874                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 875                                                 MGMT_STATUS_INVALID_PARAMS);
 876
 877         hci_dev_lock(hdev);
 878
 879         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 880         if (!uuid) {
 881                 err = -ENOMEM;
 882                 goto failed;
 883         }
 884
 885         memcpy(uuid->uuid, cp->uuid, 16);
 886         uuid->svc_hint = cp->svc_hint;
 887
 888         list_add(&uuid->list, &hdev->uuids);
 889
 890         err = update_class(hdev);
 891         if (err < 0)
 892                 goto failed;
 893
 894         err = update_eir(hdev);
 895         if (err < 0)
 896                 goto failed;
 897
 898         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 899
 900 failed:
 901         hci_dev_unlock(hdev);
 902         hci_dev_put(hdev);
 903
 904         return err;
 905 }
 906
 907 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 908 {
 909         struct list_head *p, *n;
 910         struct mgmt_cp_remove_uuid *cp;
 911         struct hci_dev *hdev;
 912         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 913         int err, found;
 914
 915         cp = (void *) data;
 916
 917         BT_DBG("request for hci%u", index);
 918
 919         if (len != sizeof(*cp))
 920                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 921                                                 MGMT_STATUS_INVALID_PARAMS);
 922
 923         hdev = hci_dev_get(index);
 924         if (!hdev)
 925                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 926                                                 MGMT_STATUS_INVALID_PARAMS);
 927
 928         hci_dev_lock(hdev);
 929
 930         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 931                 err = hci_uuids_clear(hdev);
 932                 goto unlock;
 933         }
 934
 935         found = 0;
 936
 937         list_for_each_safe(p, n, &hdev->uuids) {
 938                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 939
 940                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 941                         continue;
 942
 943                 list_del(&match->list);
 944                 found++;
 945         }
 946
 947         if (found == 0) {
 948                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 949                                                 MGMT_STATUS_INVALID_PARAMS);
 950                 goto unlock;
 951         }
 952
 953         err = update_class(hdev);
 954         if (err < 0)
 955                 goto unlock;
 956
 957         err = update_eir(hdev);
 958         if (err < 0)
 959                 goto unlock;
 960
 961         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 962
 963 unlock:
 964         hci_dev_unlock(hdev);
 965         hci_dev_put(hdev);
 966
 967         return err;
 968 }
 969
 970 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 971                                                                         u16 len)
 972 {
 973         struct hci_dev *hdev;
 974         struct mgmt_cp_set_dev_class *cp;
 975         int err;
 976
 977         cp = (void *) data;
 978
 979         BT_DBG("request for hci%u", index);
 980
 981         if (len != sizeof(*cp))
 982                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 983                                                 MGMT_STATUS_INVALID_PARAMS);
 984
 985         hdev = hci_dev_get(index);
 986         if (!hdev)
 987                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 988                                                 MGMT_STATUS_INVALID_PARAMS);
 989
 990         hci_dev_lock(hdev);
 991
 992         hdev->major_class = cp->major;
 993         hdev->minor_class = cp->minor;
 994
 995         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
 996                 update_eir(hdev);
 997
 998         err = update_class(hdev);
 999
1000         if (err == 0)
1001                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
1002
1003         hci_dev_unlock(hdev);
1004         hci_dev_put(hdev);
1005
1006         return err;
1007 }
1008
1009 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
1010                                                                 u16 len)
1011 {
1012         struct hci_dev *hdev;
1013         struct mgmt_cp_load_link_keys *cp;
1014         u16 key_count, expected_len;
1015         int i;
1016
1017         cp = (void *) data;
1018
1019         if (len < sizeof(*cp))
1020                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1021                                                 MGMT_STATUS_INVALID_PARAMS);
1022
1023         key_count = get_unaligned_le16(&cp->key_count);
1024
1025         expected_len = sizeof(*cp) + key_count *
1026                                         sizeof(struct mgmt_link_key_info);
1027         if (expected_len != len) {
1028                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1029                                                         len, expected_len);
1030                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1031                                                 MGMT_STATUS_INVALID_PARAMS);
1032         }
1033
1034         hdev = hci_dev_get(index);
1035         if (!hdev)
1036                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1037                                                 MGMT_STATUS_INVALID_PARAMS);
1038
1039         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1040                                                                 key_count);
1041
1042         hci_dev_lock(hdev);
1043
1044         hci_link_keys_clear(hdev);
1045
1046         set_bit(HCI_LINK_KEYS, &hdev->flags);
1047
1048         if (cp->debug_keys)
1049                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
1050         else
1051                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
1052
1053         for (i = 0; i < key_count; i++) {
1054                 struct mgmt_link_key_info *key = &cp->keys[i];
1055
1056                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1057                                                                 key->pin_len);
1058         }
1059
1060         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1061
1062         hci_dev_unlock(hdev);
1063         hci_dev_put(hdev);
1064
1065         return 0;
1066 }
1067
1068 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
1069                                                                 u16 len)
1070 {
1071         struct hci_dev *hdev;
1072         struct mgmt_cp_remove_keys *cp;
1073         struct mgmt_rp_remove_keys rp;
1074         struct hci_cp_disconnect dc;
1075         struct pending_cmd *cmd;
1076         struct hci_conn *conn;
1077         int err;
1078
1079         cp = (void *) data;
1080
1081         if (len != sizeof(*cp))
1082                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1083                                                 MGMT_STATUS_INVALID_PARAMS);
1084
1085         hdev = hci_dev_get(index);
1086         if (!hdev)
1087                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1088                                                 MGMT_STATUS_INVALID_PARAMS);
1089
1090         hci_dev_lock(hdev);
1091
1092         memset(&rp, 0, sizeof(rp));
1093         bacpy(&rp.bdaddr, &cp->bdaddr);
1094         rp.status = MGMT_STATUS_FAILED;
1095
1096         err = hci_remove_link_key(hdev, &cp->bdaddr);
1097         if (err < 0) {
1098                 rp.status = MGMT_STATUS_NOT_PAIRED;
1099                 goto unlock;
1100         }
1101
1102         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1103                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1104                                                                 sizeof(rp));
1105                 goto unlock;
1106         }
1107
1108         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1109         if (!conn) {
1110                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1111                                                                 sizeof(rp));
1112                 goto unlock;
1113         }
1114
1115         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1116         if (!cmd) {
1117                 err = -ENOMEM;
1118                 goto unlock;
1119         }
1120
1121         put_unaligned_le16(conn->handle, &dc.handle);
1122         dc.reason = 0x13; /* Remote User Terminated Connection */
1123         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1124         if (err < 0)
1125                 mgmt_pending_remove(cmd);
1126
1127 unlock:
1128         if (err < 0)
1129                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1130                                                                 sizeof(rp));
1131         hci_dev_unlock(hdev);
1132         hci_dev_put(hdev);
1133
1134         return err;
1135 }
1136
1137 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1138 {
1139         struct hci_dev *hdev;
1140         struct mgmt_cp_disconnect *cp;
1141         struct hci_cp_disconnect dc;
1142         struct pending_cmd *cmd;
1143         struct hci_conn *conn;
1144         int err;
1145
1146         BT_DBG("");
1147
1148         cp = (void *) data;
1149
1150         if (len != sizeof(*cp))
1151                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1152                                                 MGMT_STATUS_INVALID_PARAMS);
1153
1154         hdev = hci_dev_get(index);
1155         if (!hdev)
1156                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1157                                                 MGMT_STATUS_INVALID_PARAMS);
1158
1159         hci_dev_lock(hdev);
1160
1161         if (!test_bit(HCI_UP, &hdev->flags)) {
1162                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1163                                                 MGMT_STATUS_NOT_POWERED);
1164                 goto failed;
1165         }
1166
1167         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1168                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1169                                                         MGMT_STATUS_BUSY);
1170                 goto failed;
1171         }
1172
1173         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1174         if (!conn)
1175                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1176
1177         if (!conn) {
1178                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1179                                                 MGMT_STATUS_NOT_CONNECTED);
1180                 goto failed;
1181         }
1182
1183         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1184         if (!cmd) {
1185                 err = -ENOMEM;
1186                 goto failed;
1187         }
1188
1189         put_unaligned_le16(conn->handle, &dc.handle);
1190         dc.reason = 0x13; /* Remote User Terminated Connection */
1191
1192         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1193         if (err < 0)
1194                 mgmt_pending_remove(cmd);
1195
1196 failed:
1197         hci_dev_unlock(hdev);
1198         hci_dev_put(hdev);
1199
1200         return err;
1201 }
1202
1203 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1204 {
1205         switch (link_type) {
1206         case LE_LINK:
1207                 switch (addr_type) {
1208                 case ADDR_LE_DEV_PUBLIC:
1209                         return MGMT_ADDR_LE_PUBLIC;
1210                 case ADDR_LE_DEV_RANDOM:
1211                         return MGMT_ADDR_LE_RANDOM;
1212                 default:
1213                         return MGMT_ADDR_INVALID;
1214                 }
1215         case ACL_LINK:
1216                 return MGMT_ADDR_BREDR;
1217         default:
1218                 return MGMT_ADDR_INVALID;
1219         }
1220 }
1221
1222 static int get_connections(struct sock *sk, u16 index)
1223 {
1224         struct mgmt_rp_get_connections *rp;
1225         struct hci_dev *hdev;
1226         struct hci_conn *c;
1227         struct list_head *p;
1228         size_t rp_len;
1229         u16 count;
1230         int i, err;
1231
1232         BT_DBG("");
1233
1234         hdev = hci_dev_get(index);
1235         if (!hdev)
1236                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1237                                                 MGMT_STATUS_INVALID_PARAMS);
1238
1239         hci_dev_lock(hdev);
1240
1241         count = 0;
1242         list_for_each(p, &hdev->conn_hash.list) {
1243                 count++;
1244         }
1245
1246         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1247         rp = kmalloc(rp_len, GFP_ATOMIC);
1248         if (!rp) {
1249                 err = -ENOMEM;
1250                 goto unlock;
1251         }
1252
1253         put_unaligned_le16(count, &rp->conn_count);
1254
1255         i = 0;
1256         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1257                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1258                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1259                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1260                         continue;
1261                 i++;
1262         }
1263
1264         /* Recalculate length in case of filtered SCO connections, etc */
1265         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1266
1267         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1268
1269 unlock:
1270         kfree(rp);
1271         hci_dev_unlock(hdev);
1272         hci_dev_put(hdev);
1273         return err;
1274 }
1275
1276 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1277                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1278 {
1279         struct pending_cmd *cmd;
1280         int err;
1281
1282         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1283                                                                 sizeof(*cp));
1284         if (!cmd)
1285                 return -ENOMEM;
1286
1287         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1288                                                                 &cp->bdaddr);
1289         if (err < 0)
1290                 mgmt_pending_remove(cmd);
1291
1292         return err;
1293 }
1294
1295 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1296                                                                         u16 len)
1297 {
1298         struct hci_dev *hdev;
1299         struct hci_conn *conn;
1300         struct mgmt_cp_pin_code_reply *cp;
1301         struct mgmt_cp_pin_code_neg_reply ncp;
1302         struct hci_cp_pin_code_reply reply;
1303         struct pending_cmd *cmd;
1304         int err;
1305
1306         BT_DBG("");
1307
1308         cp = (void *) data;
1309
1310         if (len != sizeof(*cp))
1311                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1312                                                 MGMT_STATUS_INVALID_PARAMS);
1313
1314         hdev = hci_dev_get(index);
1315         if (!hdev)
1316                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1317                                                 MGMT_STATUS_INVALID_PARAMS);
1318
1319         hci_dev_lock(hdev);
1320
1321         if (!test_bit(HCI_UP, &hdev->flags)) {
1322                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1323                                                 MGMT_STATUS_NOT_POWERED);
1324                 goto failed;
1325         }
1326
1327         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1328         if (!conn) {
1329                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1330                                                 MGMT_STATUS_NOT_CONNECTED);
1331                 goto failed;
1332         }
1333
1334         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1335                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1336
1337                 BT_ERR("PIN code is not 16 bytes long");
1338
1339                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1340                 if (err >= 0)
1341                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1342                                                 MGMT_STATUS_INVALID_PARAMS);
1343
1344                 goto failed;
1345         }
1346
1347         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1348         if (!cmd) {
1349                 err = -ENOMEM;
1350                 goto failed;
1351         }
1352
1353         bacpy(&reply.bdaddr, &cp->bdaddr);
1354         reply.pin_len = cp->pin_len;
1355         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1356
1357         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1358         if (err < 0)
1359                 mgmt_pending_remove(cmd);
1360
1361 failed:
1362         hci_dev_unlock(hdev);
1363         hci_dev_put(hdev);
1364
1365         return err;
1366 }
1367
1368 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1369                                                                         u16 len)
1370 {
1371         struct hci_dev *hdev;
1372         struct mgmt_cp_pin_code_neg_reply *cp;
1373         int err;
1374
1375         BT_DBG("");
1376
1377         cp = (void *) data;
1378
1379         if (len != sizeof(*cp))
1380                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1381                                                 MGMT_STATUS_INVALID_PARAMS);
1382
1383         hdev = hci_dev_get(index);
1384         if (!hdev)
1385                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1386                                                 MGMT_STATUS_INVALID_PARAMS);
1387
1388         hci_dev_lock(hdev);
1389
1390         if (!test_bit(HCI_UP, &hdev->flags)) {
1391                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1392                                                 MGMT_STATUS_NOT_POWERED);
1393                 goto failed;
1394         }
1395
1396         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1397
1398 failed:
1399         hci_dev_unlock(hdev);
1400         hci_dev_put(hdev);
1401
1402         return err;
1403 }
1404
1405 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1406                                                                         u16 len)
1407 {
1408         struct hci_dev *hdev;
1409         struct mgmt_cp_set_io_capability *cp;
1410
1411         BT_DBG("");
1412
1413         cp = (void *) data;
1414
1415         if (len != sizeof(*cp))
1416                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1417                                                 MGMT_STATUS_INVALID_PARAMS);
1418
1419         hdev = hci_dev_get(index);
1420         if (!hdev)
1421                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1422                                                 MGMT_STATUS_INVALID_PARAMS);
1423
1424         hci_dev_lock(hdev);
1425
1426         hdev->io_capability = cp->io_capability;
1427
1428         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1429                                                         hdev->io_capability);
1430
1431         hci_dev_unlock(hdev);
1432         hci_dev_put(hdev);
1433
1434         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1435 }
1436
1437 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1438 {
1439         struct hci_dev *hdev = conn->hdev;
1440         struct pending_cmd *cmd;
1441
1442         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1443                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1444                         continue;
1445
1446                 if (cmd->user_data != conn)
1447                         continue;
1448
1449                 return cmd;
1450         }
1451
1452         return NULL;
1453 }
1454
1455 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1456 {
1457         struct mgmt_rp_pair_device rp;
1458         struct hci_conn *conn = cmd->user_data;
1459
1460         bacpy(&rp.addr.bdaddr, &conn->dst);
1461         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1462         rp.status = status;
1463
1464         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1465
1466         /* So we don't get further callbacks for this connection */
1467         conn->connect_cfm_cb = NULL;
1468         conn->security_cfm_cb = NULL;
1469         conn->disconn_cfm_cb = NULL;
1470
1471         hci_conn_put(conn);
1472
1473         mgmt_pending_remove(cmd);
1474 }
1475
1476 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1477 {
1478         struct pending_cmd *cmd;
1479
1480         BT_DBG("status %u", status);
1481
1482         cmd = find_pairing(conn);
1483         if (!cmd)
1484                 BT_DBG("Unable to find a pending command");
1485         else
1486                 pairing_complete(cmd, status);
1487 }
1488
1489 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1490 {
1491         struct hci_dev *hdev;
1492         struct mgmt_cp_pair_device *cp;
1493         struct mgmt_rp_pair_device rp;
1494         struct pending_cmd *cmd;
1495         u8 sec_level, auth_type;
1496         struct hci_conn *conn;
1497         int err;
1498
1499         BT_DBG("");
1500
1501         cp = (void *) data;
1502
1503         if (len != sizeof(*cp))
1504                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1505                                                 MGMT_STATUS_INVALID_PARAMS);
1506
1507         hdev = hci_dev_get(index);
1508         if (!hdev)
1509                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1510                                                 MGMT_STATUS_INVALID_PARAMS);
1511
1512         hci_dev_lock(hdev);
1513
1514         sec_level = BT_SECURITY_MEDIUM;
1515         if (cp->io_cap == 0x03)
1516                 auth_type = HCI_AT_DEDICATED_BONDING;
1517         else
1518                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1519
1520         if (cp->addr.type == MGMT_ADDR_BREDR)
1521                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1522                                                                 auth_type);
1523         else
1524                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1525                                                                 auth_type);
1526
1527         memset(&rp, 0, sizeof(rp));
1528         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1529         rp.addr.type = cp->addr.type;
1530
1531         if (IS_ERR(conn)) {
1532                 rp.status = -PTR_ERR(conn);
1533                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1534                                                         &rp, sizeof(rp));
1535                 goto unlock;
1536         }
1537
1538         if (conn->connect_cfm_cb) {
1539                 hci_conn_put(conn);
1540                 rp.status = EBUSY;
1541                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1542                                                         &rp, sizeof(rp));
1543                 goto unlock;
1544         }
1545
1546         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1547         if (!cmd) {
1548                 err = -ENOMEM;
1549                 hci_conn_put(conn);
1550                 goto unlock;
1551         }
1552
1553         /* For LE, just connecting isn't a proof that the pairing finished */
1554         if (cp->addr.type == MGMT_ADDR_BREDR)
1555                 conn->connect_cfm_cb = pairing_complete_cb;
1556
1557         conn->security_cfm_cb = pairing_complete_cb;
1558         conn->disconn_cfm_cb = pairing_complete_cb;
1559         conn->io_capability = cp->io_cap;
1560         cmd->user_data = conn;
1561
1562         if (conn->state == BT_CONNECTED &&
1563                                 hci_conn_security(conn, sec_level, auth_type))
1564                 pairing_complete(cmd, 0);
1565
1566         err = 0;
1567
1568 unlock:
1569         hci_dev_unlock(hdev);
1570         hci_dev_put(hdev);
1571
1572         return err;
1573 }
1574
1575 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1576                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1577 {
1578         struct pending_cmd *cmd;
1579         struct hci_dev *hdev;
1580         struct hci_conn *conn;
1581         int err;
1582
1583         hdev = hci_dev_get(index);
1584         if (!hdev)
1585                 return cmd_status(sk, index, mgmt_op,
1586                                                 MGMT_STATUS_INVALID_PARAMS);
1587
1588         hci_dev_lock(hdev);
1589
1590         if (!test_bit(HCI_UP, &hdev->flags)) {
1591                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1592                 goto done;
1593         }
1594
1595         /*
1596          * Check for an existing ACL link, if present pair via
1597          * HCI commands.
1598          *
1599          * If no ACL link is present, check for an LE link and if
1600          * present, pair via the SMP engine.
1601          *
1602          * If neither ACL nor LE links are present, fail with error.
1603          */
1604         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1605         if (!conn) {
1606                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1607                 if (!conn) {
1608                         err = cmd_status(sk, index, mgmt_op,
1609                                                 MGMT_STATUS_NOT_CONNECTED);
1610                         goto done;
1611                 }
1612
1613                 /* Continue with pairing via SMP */
1614
1615                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
1616                 goto done;
1617         }
1618
1619         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1620         if (!cmd) {
1621                 err = -ENOMEM;
1622                 goto done;
1623         }
1624
1625         /* Continue with pairing via HCI */
1626         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1627                 struct hci_cp_user_passkey_reply cp;
1628
1629                 bacpy(&cp.bdaddr, bdaddr);
1630                 cp.passkey = passkey;
1631                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1632         } else
1633                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1634
1635         if (err < 0)
1636                 mgmt_pending_remove(cmd);
1637
1638 done:
1639         hci_dev_unlock(hdev);
1640         hci_dev_put(hdev);
1641
1642         return err;
1643 }
1644
1645 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1646 {
1647         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1648
1649         BT_DBG("");
1650
1651         if (len != sizeof(*cp))
1652                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1653                                                 MGMT_STATUS_INVALID_PARAMS);
1654
1655         return user_pairing_resp(sk, index, &cp->bdaddr,
1656                         MGMT_OP_USER_CONFIRM_REPLY,
1657                         HCI_OP_USER_CONFIRM_REPLY, 0);
1658 }
1659
1660 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1661                                                                         u16 len)
1662 {
1663         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1664
1665         BT_DBG("");
1666
1667         if (len != sizeof(*cp))
1668                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1669                                                 MGMT_STATUS_INVALID_PARAMS);
1670
1671         return user_pairing_resp(sk, index, &cp->bdaddr,
1672                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1673                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1674 }
1675
1676 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1677 {
1678         struct mgmt_cp_user_passkey_reply *cp = (void *) data;
1679
1680         BT_DBG("");
1681
1682         if (len != sizeof(*cp))
1683                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1684                                                                         EINVAL);
1685
1686         return user_pairing_resp(sk, index, &cp->bdaddr,
1687                         MGMT_OP_USER_PASSKEY_REPLY,
1688                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1689 }
1690
1691 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1692                                                                         u16 len)
1693 {
1694         struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
1695
1696         BT_DBG("");
1697
1698         if (len != sizeof(*cp))
1699                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1700                                                                         EINVAL);
1701
1702         return user_pairing_resp(sk, index, &cp->bdaddr,
1703                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1704                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1705 }
1706
1707 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1708                                                                 u16 len)
1709 {
1710         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1711         struct hci_cp_write_local_name hci_cp;
1712         struct hci_dev *hdev;
1713         struct pending_cmd *cmd;
1714         int err;
1715
1716         BT_DBG("");
1717
1718         if (len != sizeof(*mgmt_cp))
1719                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1720                                                 MGMT_STATUS_INVALID_PARAMS);
1721
1722         hdev = hci_dev_get(index);
1723         if (!hdev)
1724                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1725                                                 MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1730         if (!cmd) {
1731                 err = -ENOMEM;
1732                 goto failed;
1733         }
1734
1735         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1736         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1737                                                                 &hci_cp);
1738         if (err < 0)
1739                 mgmt_pending_remove(cmd);
1740
1741 failed:
1742         hci_dev_unlock(hdev);
1743         hci_dev_put(hdev);
1744
1745         return err;
1746 }
1747
1748 static int read_local_oob_data(struct sock *sk, u16 index)
1749 {
1750         struct hci_dev *hdev;
1751         struct pending_cmd *cmd;
1752         int err;
1753
1754         BT_DBG("hci%u", index);
1755
1756         hdev = hci_dev_get(index);
1757         if (!hdev)
1758                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1759                                                 MGMT_STATUS_INVALID_PARAMS);
1760
1761         hci_dev_lock(hdev);
1762
1763         if (!test_bit(HCI_UP, &hdev->flags)) {
1764                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1765                                                 MGMT_STATUS_NOT_POWERED);
1766                 goto unlock;
1767         }
1768
1769         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1770                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1771                                                 MGMT_STATUS_NOT_SUPPORTED);
1772                 goto unlock;
1773         }
1774
1775         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1776                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1777                                                         MGMT_STATUS_BUSY);
1778                 goto unlock;
1779         }
1780
1781         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1782         if (!cmd) {
1783                 err = -ENOMEM;
1784                 goto unlock;
1785         }
1786
1787         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1788         if (err < 0)
1789                 mgmt_pending_remove(cmd);
1790
1791 unlock:
1792         hci_dev_unlock(hdev);
1793         hci_dev_put(hdev);
1794
1795         return err;
1796 }
1797
1798 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1799                                                                         u16 len)
1800 {
1801         struct hci_dev *hdev;
1802         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1803         int err;
1804
1805         BT_DBG("hci%u ", index);
1806
1807         if (len != sizeof(*cp))
1808                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1809                                                 MGMT_STATUS_INVALID_PARAMS);
1810
1811         hdev = hci_dev_get(index);
1812         if (!hdev)
1813                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1814                                                 MGMT_STATUS_INVALID_PARAMS);
1815
1816         hci_dev_lock(hdev);
1817
1818         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1819                                                                 cp->randomizer);
1820         if (err < 0)
1821                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1822                                                         MGMT_STATUS_FAILED);
1823         else
1824                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1825                                                                         0);
1826
1827         hci_dev_unlock(hdev);
1828         hci_dev_put(hdev);
1829
1830         return err;
1831 }
1832
1833 static int remove_remote_oob_data(struct sock *sk, u16 index,
1834                                                 unsigned char *data, u16 len)
1835 {
1836         struct hci_dev *hdev;
1837         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1838         int err;
1839
1840         BT_DBG("hci%u ", index);
1841
1842         if (len != sizeof(*cp))
1843                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1844                                                 MGMT_STATUS_INVALID_PARAMS);
1845
1846         hdev = hci_dev_get(index);
1847         if (!hdev)
1848                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1849                                                 MGMT_STATUS_INVALID_PARAMS);
1850
1851         hci_dev_lock(hdev);
1852
1853         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1854         if (err < 0)
1855                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1856                                                 MGMT_STATUS_INVALID_PARAMS);
1857         else
1858                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1859                                                                 NULL, 0);
1860
1861         hci_dev_unlock(hdev);
1862         hci_dev_put(hdev);
1863
1864         return err;
1865 }
1866
1867 static int start_discovery(struct sock *sk, u16 index,
1868                                                 unsigned char *data, u16 len)
1869 {
1870         struct mgmt_cp_start_discovery *cp = (void *) data;
1871         struct pending_cmd *cmd;
1872         struct hci_dev *hdev;
1873         int err;
1874
1875         BT_DBG("hci%u", index);
1876
1877         if (len != sizeof(*cp))
1878                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1879                                                 MGMT_STATUS_INVALID_PARAMS);
1880
1881         hdev = hci_dev_get(index);
1882         if (!hdev)
1883                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1884                                                 MGMT_STATUS_INVALID_PARAMS);
1885
1886         hci_dev_lock(hdev);
1887
1888         if (!test_bit(HCI_UP, &hdev->flags)) {
1889                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1890                                                 MGMT_STATUS_NOT_POWERED);
1891                 goto failed;
1892         }
1893
1894         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1895         if (!cmd) {
1896                 err = -ENOMEM;
1897                 goto failed;
1898         }
1899
1900         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1901         if (err < 0)
1902                 mgmt_pending_remove(cmd);
1903
1904 failed:
1905         hci_dev_unlock(hdev);
1906         hci_dev_put(hdev);
1907
1908         return err;
1909 }
1910
1911 static int stop_discovery(struct sock *sk, u16 index)
1912 {
1913         struct hci_dev *hdev;
1914         struct pending_cmd *cmd;
1915         int err;
1916
1917         BT_DBG("hci%u", index);
1918
1919         hdev = hci_dev_get(index);
1920         if (!hdev)
1921                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1922                                                 MGMT_STATUS_INVALID_PARAMS);
1923
1924         hci_dev_lock(hdev);
1925
1926         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1927         if (!cmd) {
1928                 err = -ENOMEM;
1929                 goto failed;
1930         }
1931
1932         err = hci_cancel_inquiry(hdev);
1933         if (err < 0)
1934                 mgmt_pending_remove(cmd);
1935
1936 failed:
1937         hci_dev_unlock(hdev);
1938         hci_dev_put(hdev);
1939
1940         return err;
1941 }
1942
1943 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1944                                                                 u16 len)
1945 {
1946         struct hci_dev *hdev;
1947         struct mgmt_cp_block_device *cp = (void *) data;
1948         int err;
1949
1950         BT_DBG("hci%u", index);
1951
1952         if (len != sizeof(*cp))
1953                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1954                                                 MGMT_STATUS_INVALID_PARAMS);
1955
1956         hdev = hci_dev_get(index);
1957         if (!hdev)
1958                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1959                                                 MGMT_STATUS_INVALID_PARAMS);
1960
1961         hci_dev_lock(hdev);
1962
1963         err = hci_blacklist_add(hdev, &cp->bdaddr);
1964         if (err < 0)
1965                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1966                                                         MGMT_STATUS_FAILED);
1967         else
1968                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1969                                                         NULL, 0);
1970
1971         hci_dev_unlock(hdev);
1972         hci_dev_put(hdev);
1973
1974         return err;
1975 }
1976
1977 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1978                                                                 u16 len)
1979 {
1980         struct hci_dev *hdev;
1981         struct mgmt_cp_unblock_device *cp = (void *) data;
1982         int err;
1983
1984         BT_DBG("hci%u", index);
1985
1986         if (len != sizeof(*cp))
1987                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1988                                                 MGMT_STATUS_INVALID_PARAMS);
1989
1990         hdev = hci_dev_get(index);
1991         if (!hdev)
1992                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1993                                                 MGMT_STATUS_INVALID_PARAMS);
1994
1995         hci_dev_lock(hdev);
1996
1997         err = hci_blacklist_del(hdev, &cp->bdaddr);
1998
1999         if (err < 0)
2000                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2001                                                 MGMT_STATUS_INVALID_PARAMS);
2002         else
2003                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2004                                                                 NULL, 0);
2005
2006         hci_dev_unlock(hdev);
2007         hci_dev_put(hdev);
2008
2009         return err;
2010 }
2011
2012 static int set_fast_connectable(struct sock *sk, u16 index,
2013                                         unsigned char *data, u16 len)
2014 {
2015         struct hci_dev *hdev;
2016         struct mgmt_mode *cp = (void *) data;
2017         struct hci_cp_write_page_scan_activity acp;
2018         u8 type;
2019         int err;
2020
2021         BT_DBG("hci%u", index);
2022
2023         if (len != sizeof(*cp))
2024                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2025                                                 MGMT_STATUS_INVALID_PARAMS);
2026
2027         hdev = hci_dev_get(index);
2028         if (!hdev)
2029                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2030                                                 MGMT_STATUS_INVALID_PARAMS);
2031
2032         hci_dev_lock(hdev);
2033
2034         if (cp->val) {
2035                 type = PAGE_SCAN_TYPE_INTERLACED;
2036                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2037         } else {
2038                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2039                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2040         }
2041
2042         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2043
2044         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2045                                                 sizeof(acp), &acp);
2046         if (err < 0) {
2047                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2048                                                         MGMT_STATUS_FAILED);
2049                 goto done;
2050         }
2051
2052         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2053         if (err < 0) {
2054                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2055                                                         MGMT_STATUS_FAILED);
2056                 goto done;
2057         }
2058
2059         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2060                                                         NULL, 0);
2061 done:
2062         hci_dev_unlock(hdev);
2063         hci_dev_put(hdev);
2064
2065         return err;
2066 }
2067
2068 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2069 {
2070         unsigned char *buf;
2071         struct mgmt_hdr *hdr;
2072         u16 opcode, index, len;
2073         int err;
2074
2075         BT_DBG("got %zu bytes", msglen);
2076
2077         if (msglen < sizeof(*hdr))
2078                 return -EINVAL;
2079
2080         buf = kmalloc(msglen, GFP_KERNEL);
2081         if (!buf)
2082                 return -ENOMEM;
2083
2084         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2085                 err = -EFAULT;
2086                 goto done;
2087         }
2088
2089         hdr = (struct mgmt_hdr *) buf;
2090         opcode = get_unaligned_le16(&hdr->opcode);
2091         index = get_unaligned_le16(&hdr->index);
2092         len = get_unaligned_le16(&hdr->len);
2093
2094         if (len != msglen - sizeof(*hdr)) {
2095                 err = -EINVAL;
2096                 goto done;
2097         }
2098
2099         switch (opcode) {
2100         case MGMT_OP_READ_VERSION:
2101                 err = read_version(sk);
2102                 break;
2103         case MGMT_OP_READ_INDEX_LIST:
2104                 err = read_index_list(sk);
2105                 break;
2106         case MGMT_OP_READ_INFO:
2107                 err = read_controller_info(sk, index);
2108                 break;
2109         case MGMT_OP_SET_POWERED:
2110                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
2111                 break;
2112         case MGMT_OP_SET_DISCOVERABLE:
2113                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
2114                 break;
2115         case MGMT_OP_SET_CONNECTABLE:
2116                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
2117                 break;
2118         case MGMT_OP_SET_FAST_CONNECTABLE:
2119                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
2120                                                                 len);
2121                 break;
2122         case MGMT_OP_SET_PAIRABLE:
2123                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
2124                 break;
2125         case MGMT_OP_ADD_UUID:
2126                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
2127                 break;
2128         case MGMT_OP_REMOVE_UUID:
2129                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
2130                 break;
2131         case MGMT_OP_SET_DEV_CLASS:
2132                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
2133                 break;
2134         case MGMT_OP_LOAD_LINK_KEYS:
2135                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
2136                 break;
2137         case MGMT_OP_REMOVE_KEYS:
2138                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
2139                 break;
2140         case MGMT_OP_DISCONNECT:
2141                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
2142                 break;
2143         case MGMT_OP_GET_CONNECTIONS:
2144                 err = get_connections(sk, index);
2145                 break;
2146         case MGMT_OP_PIN_CODE_REPLY:
2147                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
2148                 break;
2149         case MGMT_OP_PIN_CODE_NEG_REPLY:
2150                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
2151                 break;
2152         case MGMT_OP_SET_IO_CAPABILITY:
2153                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
2154                 break;
2155         case MGMT_OP_PAIR_DEVICE:
2156                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
2157                 break;
2158         case MGMT_OP_USER_CONFIRM_REPLY:
2159                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
2160                 break;
2161         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2162                 err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
2163                                                                         len);
2164                 break;
2165         case MGMT_OP_USER_PASSKEY_REPLY:
2166                 err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
2167                 break;
2168         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2169                 err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
2170                                                                         len);
2171                 break;
2172         case MGMT_OP_SET_LOCAL_NAME:
2173                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
2174                 break;
2175         case MGMT_OP_READ_LOCAL_OOB_DATA:
2176                 err = read_local_oob_data(sk, index);
2177                 break;
2178         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2179                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
2180                 break;
2181         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2182                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
2183                                                                         len);
2184                 break;
2185         case MGMT_OP_START_DISCOVERY:
2186                 err = start_discovery(sk, index, buf + sizeof(*hdr), len);
2187                 break;
2188         case MGMT_OP_STOP_DISCOVERY:
2189                 err = stop_discovery(sk, index);
2190                 break;
2191         case MGMT_OP_BLOCK_DEVICE:
2192                 err = block_device(sk, index, buf + sizeof(*hdr), len);
2193                 break;
2194         case MGMT_OP_UNBLOCK_DEVICE:
2195                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
2196                 break;
2197         default:
2198                 BT_DBG("Unknown op %u", opcode);
2199                 err = cmd_status(sk, index, opcode,
2200                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2201                 break;
2202         }
2203
2204         if (err < 0)
2205                 goto done;
2206
2207         err = msglen;
2208
2209 done:
2210         kfree(buf);
2211         return err;
2212 }
2213
2214 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2215 {
2216         u8 *status = data;
2217
2218         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2219         mgmt_pending_remove(cmd);
2220 }
2221
2222 int mgmt_index_added(struct hci_dev *hdev)
2223 {
2224         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2225 }
2226
2227 int mgmt_index_removed(struct hci_dev *hdev)
2228 {
2229         u8 status = ENODEV;
2230
2231         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2232
2233         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2234 }
2235
2236 struct cmd_lookup {
2237         u8 val;
2238         struct sock *sk;
2239         struct hci_dev *hdev;
2240 };
2241
2242 static void settings_rsp(struct pending_cmd *cmd, void *data)
2243 {
2244         struct cmd_lookup *match = data;
2245
2246         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2247
2248         list_del(&cmd->list);
2249
2250         if (match->sk == NULL) {
2251                 match->sk = cmd->sk;
2252                 sock_hold(match->sk);
2253         }
2254
2255         mgmt_pending_free(cmd);
2256 }
2257
2258 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2259 {
2260         struct cmd_lookup match = { powered, NULL, hdev };
2261         __le32 ev;
2262         int ret;
2263
2264         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2265
2266         if (!powered) {
2267                 u8 status = ENETDOWN;
2268                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2269         }
2270
2271         ev = cpu_to_le32(get_current_settings(hdev));
2272
2273         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2274                                                                 match.sk);
2275
2276         if (match.sk)
2277                 sock_put(match.sk);
2278
2279         return ret;
2280 }
2281
2282 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2283 {
2284         struct cmd_lookup match = { discoverable, NULL, hdev };
2285         __le32 ev;
2286         int ret;
2287
2288         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
2289
2290         ev = cpu_to_le32(get_current_settings(hdev));
2291
2292         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2293                                                                 match.sk);
2294         if (match.sk)
2295                 sock_put(match.sk);
2296
2297         return ret;
2298 }
2299
2300 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2301 {
2302         __le32 ev;
2303         struct cmd_lookup match = { connectable, NULL, hdev };
2304         int ret;
2305
2306         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2307                                                                 &match);
2308
2309         ev = cpu_to_le32(get_current_settings(hdev));
2310
2311         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
2312
2313         if (match.sk)
2314                 sock_put(match.sk);
2315
2316         return ret;
2317 }
2318
2319 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2320 {
2321         u8 mgmt_err = mgmt_status(status);
2322
2323         if (scan & SCAN_PAGE)
2324                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2325                                                 cmd_status_rsp, &mgmt_err);
2326
2327         if (scan & SCAN_INQUIRY)
2328                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2329                                                 cmd_status_rsp, &mgmt_err);
2330
2331         return 0;
2332 }
2333
2334 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2335                                                                 u8 persistent)
2336 {
2337         struct mgmt_ev_new_link_key ev;
2338
2339         memset(&ev, 0, sizeof(ev));
2340
2341         ev.store_hint = persistent;
2342         bacpy(&ev.key.bdaddr, &key->bdaddr);
2343         ev.key.type = key->type;
2344         memcpy(ev.key.val, key->val, 16);
2345         ev.key.pin_len = key->pin_len;
2346
2347         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2348 }
2349
2350 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2351                                                                 u8 addr_type)
2352 {
2353         struct mgmt_addr_info ev;
2354
2355         bacpy(&ev.bdaddr, bdaddr);
2356         ev.type = link_to_mgmt(link_type, addr_type);
2357
2358         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2359 }
2360
2361 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2362 {
2363         struct mgmt_cp_disconnect *cp = cmd->param;
2364         struct sock **sk = data;
2365         struct mgmt_rp_disconnect rp;
2366
2367         bacpy(&rp.bdaddr, &cp->bdaddr);
2368         rp.status = 0;
2369
2370         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2371
2372         *sk = cmd->sk;
2373         sock_hold(*sk);
2374
2375         mgmt_pending_remove(cmd);
2376 }
2377
2378 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2379 {
2380         u8 *status = data;
2381         struct mgmt_cp_remove_keys *cp = cmd->param;
2382         struct mgmt_rp_remove_keys rp;
2383
2384         memset(&rp, 0, sizeof(rp));
2385         bacpy(&rp.bdaddr, &cp->bdaddr);
2386         if (status != NULL)
2387                 rp.status = *status;
2388
2389         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2390                                                                 sizeof(rp));
2391
2392         mgmt_pending_remove(cmd);
2393 }
2394
2395 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2396                                                                 u8 addr_type)
2397 {
2398         struct mgmt_addr_info ev;
2399         struct sock *sk = NULL;
2400         int err;
2401
2402         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2403
2404         bacpy(&ev.bdaddr, bdaddr);
2405         ev.type = link_to_mgmt(link_type, addr_type);
2406
2407         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2408
2409         if (sk)
2410                 sock_put(sk);
2411
2412         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2413
2414         return err;
2415 }
2416
2417 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2418 {
2419         struct pending_cmd *cmd;
2420         u8 mgmt_err = mgmt_status(status);
2421         int err;
2422
2423         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2424         if (!cmd)
2425                 return -ENOENT;
2426
2427         if (bdaddr) {
2428                 struct mgmt_rp_disconnect rp;
2429
2430                 bacpy(&rp.bdaddr, bdaddr);
2431                 rp.status = status;
2432
2433                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2434                                                         &rp, sizeof(rp));
2435         } else
2436                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2437                                                                 mgmt_err);
2438
2439         mgmt_pending_remove(cmd);
2440
2441         return err;
2442 }
2443
2444 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2445                                                 u8 addr_type, u8 status)
2446 {
2447         struct mgmt_ev_connect_failed ev;
2448
2449         bacpy(&ev.addr.bdaddr, bdaddr);
2450         ev.addr.type = link_to_mgmt(link_type, addr_type);
2451         ev.status = mgmt_status(status);
2452
2453         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2454 }
2455
2456 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2457 {
2458         struct mgmt_ev_pin_code_request ev;
2459
2460         bacpy(&ev.bdaddr, bdaddr);
2461         ev.secure = secure;
2462
2463         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2464                                                                         NULL);
2465 }
2466
2467 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2468                                                                 u8 status)
2469 {
2470         struct pending_cmd *cmd;
2471         struct mgmt_rp_pin_code_reply rp;
2472         int err;
2473
2474         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2475         if (!cmd)
2476                 return -ENOENT;
2477
2478         bacpy(&rp.bdaddr, bdaddr);
2479         rp.status = mgmt_status(status);
2480
2481         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2482                                                                 sizeof(rp));
2483
2484         mgmt_pending_remove(cmd);
2485
2486         return err;
2487 }
2488
2489 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2490                                                                 u8 status)
2491 {
2492         struct pending_cmd *cmd;
2493         struct mgmt_rp_pin_code_reply rp;
2494         int err;
2495
2496         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2497         if (!cmd)
2498                 return -ENOENT;
2499
2500         bacpy(&rp.bdaddr, bdaddr);
2501         rp.status = mgmt_status(status);
2502
2503         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2504                                                                 sizeof(rp));
2505
2506         mgmt_pending_remove(cmd);
2507
2508         return err;
2509 }
2510
2511 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2512                                                 __le32 value, u8 confirm_hint)
2513 {
2514         struct mgmt_ev_user_confirm_request ev;
2515
2516         BT_DBG("%s", hdev->name);
2517
2518         bacpy(&ev.bdaddr, bdaddr);
2519         ev.confirm_hint = confirm_hint;
2520         put_unaligned_le32(value, &ev.value);
2521
2522         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2523                                                                         NULL);
2524 }
2525
2526 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2527 {
2528         struct mgmt_ev_user_passkey_request ev;
2529
2530         BT_DBG("%s", hdev->name);
2531
2532         bacpy(&ev.bdaddr, bdaddr);
2533
2534         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2535                                                                         NULL);
2536 }
2537
2538 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2539                                                         u8 status, u8 opcode)
2540 {
2541         struct pending_cmd *cmd;
2542         struct mgmt_rp_user_confirm_reply rp;
2543         int err;
2544
2545         cmd = mgmt_pending_find(opcode, hdev);
2546         if (!cmd)
2547                 return -ENOENT;
2548
2549         bacpy(&rp.bdaddr, bdaddr);
2550         rp.status = mgmt_status(status);
2551         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2552
2553         mgmt_pending_remove(cmd);
2554
2555         return err;
2556 }
2557
2558 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2559                                                                 u8 status)
2560 {
2561         return user_pairing_resp_complete(hdev, bdaddr, status,
2562                                                 MGMT_OP_USER_CONFIRM_REPLY);
2563 }
2564
2565 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2566                                                 bdaddr_t *bdaddr, u8 status)
2567 {
2568         return user_pairing_resp_complete(hdev, bdaddr, status,
2569                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2570 }
2571
2572 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2573                                                                 u8 status)
2574 {
2575         return user_pairing_resp_complete(hdev, bdaddr, status,
2576                                                 MGMT_OP_USER_PASSKEY_REPLY);
2577 }
2578
2579 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2580                                                 bdaddr_t *bdaddr, u8 status)
2581 {
2582         return user_pairing_resp_complete(hdev, bdaddr, status,
2583                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2584 }
2585
2586 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2587 {
2588         struct mgmt_ev_auth_failed ev;
2589
2590         bacpy(&ev.bdaddr, bdaddr);
2591         ev.status = mgmt_status(status);
2592
2593         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2594 }
2595
2596 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2597 {
2598         struct pending_cmd *cmd;
2599         struct mgmt_cp_set_local_name ev;
2600         int err;
2601
2602         memset(&ev, 0, sizeof(ev));
2603         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2604
2605         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2606         if (!cmd)
2607                 goto send_event;
2608
2609         if (status) {
2610                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2611                                                         mgmt_status(status));
2612                 goto failed;
2613         }
2614
2615         update_eir(hdev);
2616
2617         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2618                                                                 sizeof(ev));
2619         if (err < 0)
2620                 goto failed;
2621
2622 send_event:
2623         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2624                                                         cmd ? cmd->sk : NULL);
2625
2626 failed:
2627         if (cmd)
2628                 mgmt_pending_remove(cmd);
2629         return err;
2630 }
2631
2632 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2633                                                 u8 *randomizer, u8 status)
2634 {
2635         struct pending_cmd *cmd;
2636         int err;
2637
2638         BT_DBG("%s status %u", hdev->name, status);
2639
2640         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2641         if (!cmd)
2642                 return -ENOENT;
2643
2644         if (status) {
2645                 err = cmd_status(cmd->sk, hdev->id,
2646                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2647                                                 mgmt_status(status));
2648         } else {
2649                 struct mgmt_rp_read_local_oob_data rp;
2650
2651                 memcpy(rp.hash, hash, sizeof(rp.hash));
2652                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2653
2654                 err = cmd_complete(cmd->sk, hdev->id,
2655                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2656                                                 &rp, sizeof(rp));
2657         }
2658
2659         mgmt_pending_remove(cmd);
2660
2661         return err;
2662 }
2663
2664 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2665                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2666 {
2667         struct mgmt_ev_device_found ev;
2668
2669         memset(&ev, 0, sizeof(ev));
2670
2671         bacpy(&ev.addr.bdaddr, bdaddr);
2672         ev.addr.type = link_to_mgmt(link_type, addr_type);
2673         ev.rssi = rssi;
2674
2675         if (eir)
2676                 memcpy(ev.eir, eir, sizeof(ev.eir));
2677
2678         if (dev_class)
2679                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2680
2681         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2682 }
2683
2684 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2685 {
2686         struct mgmt_ev_remote_name ev;
2687
2688         memset(&ev, 0, sizeof(ev));
2689
2690         bacpy(&ev.bdaddr, bdaddr);
2691         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2692
2693         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2694 }
2695
2696 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2697 {
2698         struct pending_cmd *cmd;
2699         int err;
2700
2701         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2702         if (!cmd)
2703                 return -ENOENT;
2704
2705         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2706         mgmt_pending_remove(cmd);
2707
2708         return err;
2709 }
2710
2711 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2712 {
2713         struct pending_cmd *cmd;
2714         int err;
2715
2716         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2717         if (!cmd)
2718                 return -ENOENT;
2719
2720         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2721         mgmt_pending_remove(cmd);
2722
2723         return err;
2724 }
2725
2726 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2727 {
2728         struct pending_cmd *cmd;
2729
2730         if (discovering)
2731                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2732         else
2733                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2734
2735         if (cmd != NULL) {
2736                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2737                 mgmt_pending_remove(cmd);
2738         }
2739
2740         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2741                                                 sizeof(discovering), NULL);
2742 }
2743
2744 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2745 {
2746         struct pending_cmd *cmd;
2747         struct mgmt_ev_device_blocked ev;
2748
2749         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2750
2751         bacpy(&ev.bdaddr, bdaddr);
2752
2753         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2754                                                         cmd ? cmd->sk : NULL);
2755 }
2756
2757 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2758 {
2759         struct pending_cmd *cmd;
2760         struct mgmt_ev_device_unblocked ev;
2761
2762         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2763
2764         bacpy(&ev.bdaddr, bdaddr);
2765
2766         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2767                                                         cmd ? cmd->sk : NULL);
2768 }