Pileus Git - ~andy/linux/blob - net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51         int err;
  52
  53         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  54
  55         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  56         if (!skb)
  57                 return -ENOMEM;
  58
  59         hdr = (void *) skb_put(skb, sizeof(*hdr));
  60
  61         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  62         hdr->index = cpu_to_le16(index);
  63         hdr->len = cpu_to_le16(sizeof(*ev));
  64
  65         ev = (void *) skb_put(skb, sizeof(*ev));
  66         ev->status = status;
  67         put_unaligned_le16(cmd, &ev->opcode);
  68
  69         err = sock_queue_rcv_skb(sk, skb);
  70         if (err < 0)
  71                 kfree_skb(skb);
  72
  73         return err;
  74 }
  75
  76 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  77                                                                 size_t rp_len)
  78 {
  79         struct sk_buff *skb;
  80         struct mgmt_hdr *hdr;
  81         struct mgmt_ev_cmd_complete *ev;
  82         int err;
  83
  84         BT_DBG("sock %p", sk);
  85
  86         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  87         if (!skb)
  88                 return -ENOMEM;
  89
  90         hdr = (void *) skb_put(skb, sizeof(*hdr));
  91
  92         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  93         hdr->index = cpu_to_le16(index);
  94         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  95
  96         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  97         put_unaligned_le16(cmd, &ev->opcode);
  98
  99         if (rp)
 100                 memcpy(ev->data, rp, rp_len);
 101
 102         err = sock_queue_rcv_skb(sk, skb);
 103         if (err < 0)
 104                 kfree_skb(skb);
 105
 106         return err;;
 107 }
 108
 109 static int read_version(struct sock *sk)
 110 {
 111         struct mgmt_rp_read_version rp;
 112
 113         BT_DBG("sock %p", sk);
 114
 115         rp.version = MGMT_VERSION;
 116         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 117
 118         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 119                                                                 sizeof(rp));
 120 }
 121
 122 static int read_index_list(struct sock *sk)
 123 {
 124         struct mgmt_rp_read_index_list *rp;
 125         struct list_head *p;
 126         struct hci_dev *d;
 127         size_t rp_len;
 128         u16 count;
 129         int i, err;
 130
 131         BT_DBG("sock %p", sk);
 132
 133         read_lock(&hci_dev_list_lock);
 134
 135         count = 0;
 136         list_for_each(p, &hci_dev_list) {
 137                 count++;
 138         }
 139
 140         rp_len = sizeof(*rp) + (2 * count);
 141         rp = kmalloc(rp_len, GFP_ATOMIC);
 142         if (!rp) {
 143                 read_unlock(&hci_dev_list_lock);
 144                 return -ENOMEM;
 145         }
 146
 147         put_unaligned_le16(count, &rp->num_controllers);
 148
 149         i = 0;
 150         list_for_each_entry(d, &hci_dev_list, list) {
 151                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 152                         cancel_delayed_work(&d->power_off);
 153
 154                 if (test_bit(HCI_SETUP, &d->flags))
 155                         continue;
 156
 157                 put_unaligned_le16(d->id, &rp->index[i++]);
 158                 BT_DBG("Added hci%u", d->id);
 159         }
 160
 161         read_unlock(&hci_dev_list_lock);
 162
 163         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 164                                                                         rp_len);
 165
 166         kfree(rp);
 167
 168         return err;
 169 }
 170
 171 static int read_controller_info(struct sock *sk, u16 index)
 172 {
 173         struct mgmt_rp_read_info rp;
 174         struct hci_dev *hdev;
 175
 176         BT_DBG("sock %p hci%u", sk, index);
 177
 178         hdev = hci_dev_get(index);
 179         if (!hdev)
 180                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 181
 182         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 183                 cancel_delayed_work_sync(&hdev->power_off);
 184
 185         hci_dev_lock_bh(hdev);
 186
 187         set_bit(HCI_MGMT, &hdev->flags);
 188
 189         memset(&rp, 0, sizeof(rp));
 190
 191         rp.type = hdev->dev_type;
 192
 193         rp.powered = test_bit(HCI_UP, &hdev->flags);
 194         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 195         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 196         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 197
 198         if (test_bit(HCI_AUTH, &hdev->flags))
 199                 rp.sec_mode = 3;
 200         else if (hdev->ssp_mode > 0)
 201                 rp.sec_mode = 4;
 202         else
 203                 rp.sec_mode = 2;
 204
 205         bacpy(&rp.bdaddr, &hdev->bdaddr);
 206         memcpy(rp.features, hdev->features, 8);
 207         memcpy(rp.dev_class, hdev->dev_class, 3);
 208         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 209         rp.hci_ver = hdev->hci_ver;
 210         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 211
 212         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 213
 214         hci_dev_unlock_bh(hdev);
 215         hci_dev_put(hdev);
 216
 217         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 218 }
 219
 220 static void mgmt_pending_free(struct pending_cmd *cmd)
 221 {
 222         sock_put(cmd->sk);
 223         kfree(cmd->param);
 224         kfree(cmd);
 225 }
 226
 227 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 228                                                         struct hci_dev *hdev,
 229                                                         void *data, u16 len)
 230 {
 231         struct pending_cmd *cmd;
 232
 233         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 234         if (!cmd)
 235                 return NULL;
 236
 237         cmd->opcode = opcode;
 238         cmd->index = hdev->id;
 239
 240         cmd->param = kmalloc(len, GFP_ATOMIC);
 241         if (!cmd->param) {
 242                 kfree(cmd);
 243                 return NULL;
 244         }
 245
 246         if (data)
 247                 memcpy(cmd->param, data, len);
 248
 249         cmd->sk = sk;
 250         sock_hold(sk);
 251
 252         list_add(&cmd->list, &hdev->mgmt_pending);
 253
 254         return cmd;
 255 }
 256
 257 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 258                                 void (*cb)(struct pending_cmd *cmd, void *data),
 259                                 void *data)
 260 {
 261         struct list_head *p, *n;
 262
 263         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 264                 struct pending_cmd *cmd;
 265
 266                 cmd = list_entry(p, struct pending_cmd, list);
 267
 268                 if (opcode > 0 && cmd->opcode != opcode)
 269                         continue;
 270
 271                 cb(cmd, data);
 272         }
 273 }
 274
 275 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 276 {
 277         struct pending_cmd *cmd;
 278
 279         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 280                 if (cmd->opcode == opcode)
 281                         return cmd;
 282         }
 283
 284         return NULL;
 285 }
 286
 287 static void mgmt_pending_remove(struct pending_cmd *cmd)
 288 {
 289         list_del(&cmd->list);
 290         mgmt_pending_free(cmd);
 291 }
 292
 293 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 294 {
 295         struct mgmt_mode *cp;
 296         struct hci_dev *hdev;
 297         struct pending_cmd *cmd;
 298         int err, up;
 299
 300         cp = (void *) data;
 301
 302         BT_DBG("request for hci%u", index);
 303
 304         if (len != sizeof(*cp))
 305                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 306
 307         hdev = hci_dev_get(index);
 308         if (!hdev)
 309                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 310
 311         hci_dev_lock_bh(hdev);
 312
 313         up = test_bit(HCI_UP, &hdev->flags);
 314         if ((cp->val && up) || (!cp->val && !up)) {
 315                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 316                 goto failed;
 317         }
 318
 319         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 320                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 321                 goto failed;
 322         }
 323
 324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 325         if (!cmd) {
 326                 err = -ENOMEM;
 327                 goto failed;
 328         }
 329
 330         if (cp->val)
 331                 queue_work(hdev->workqueue, &hdev->power_on);
 332         else
 333                 queue_work(hdev->workqueue, &hdev->power_off.work);
 334
 335         err = 0;
 336
 337 failed:
 338         hci_dev_unlock_bh(hdev);
 339         hci_dev_put(hdev);
 340         return err;
 341 }
 342
 343 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 344                                                                         u16 len)
 345 {
 346         struct mgmt_cp_set_discoverable *cp;
 347         struct hci_dev *hdev;
 348         struct pending_cmd *cmd;
 349         u8 scan;
 350         int err;
 351
 352         cp = (void *) data;
 353
 354         BT_DBG("request for hci%u", index);
 355
 356         if (len != sizeof(*cp))
 357                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 358
 359         hdev = hci_dev_get(index);
 360         if (!hdev)
 361                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 362
 363         hci_dev_lock_bh(hdev);
 364
 365         if (!test_bit(HCI_UP, &hdev->flags)) {
 366                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 367                 goto failed;
 368         }
 369
 370         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 371                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 372                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 373                 goto failed;
 374         }
 375
 376         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 377                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 378                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 379                 goto failed;
 380         }
 381
 382         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 383         if (!cmd) {
 384                 err = -ENOMEM;
 385                 goto failed;
 386         }
 387
 388         scan = SCAN_PAGE;
 389
 390         if (cp->val)
 391                 scan |= SCAN_INQUIRY;
 392         else
 393                 cancel_delayed_work(&hdev->discov_off);
 394
 395         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 396         if (err < 0)
 397                 mgmt_pending_remove(cmd);
 398
 399         if (cp->val)
 400                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 401
 402 failed:
 403         hci_dev_unlock_bh(hdev);
 404         hci_dev_put(hdev);
 405
 406         return err;
 407 }
 408
 409 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 410                                                                         u16 len)
 411 {
 412         struct mgmt_mode *cp;
 413         struct hci_dev *hdev;
 414         struct pending_cmd *cmd;
 415         u8 scan;
 416         int err;
 417
 418         cp = (void *) data;
 419
 420         BT_DBG("request for hci%u", index);
 421
 422         if (len != sizeof(*cp))
 423                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 424
 425         hdev = hci_dev_get(index);
 426         if (!hdev)
 427                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 428
 429         hci_dev_lock_bh(hdev);
 430
 431         if (!test_bit(HCI_UP, &hdev->flags)) {
 432                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 433                 goto failed;
 434         }
 435
 436         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 437                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 438                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 439                 goto failed;
 440         }
 441
 442         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 443                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 444                 goto failed;
 445         }
 446
 447         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 448         if (!cmd) {
 449                 err = -ENOMEM;
 450                 goto failed;
 451         }
 452
 453         if (cp->val)
 454                 scan = SCAN_PAGE;
 455         else
 456                 scan = 0;
 457
 458         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 459         if (err < 0)
 460                 mgmt_pending_remove(cmd);
 461
 462 failed:
 463         hci_dev_unlock_bh(hdev);
 464         hci_dev_put(hdev);
 465
 466         return err;
 467 }
 468
 469 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 470                                         u16 data_len, struct sock *skip_sk)
 471 {
 472         struct sk_buff *skb;
 473         struct mgmt_hdr *hdr;
 474
 475         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 476         if (!skb)
 477                 return -ENOMEM;
 478
 479         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 480
 481         hdr = (void *) skb_put(skb, sizeof(*hdr));
 482         hdr->opcode = cpu_to_le16(event);
 483         if (hdev)
 484                 hdr->index = cpu_to_le16(hdev->id);
 485         else
 486                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 487         hdr->len = cpu_to_le16(data_len);
 488
 489         if (data)
 490                 memcpy(skb_put(skb, data_len), data, data_len);
 491
 492         hci_send_to_sock(NULL, skb, skip_sk);
 493         kfree_skb(skb);
 494
 495         return 0;
 496 }
 497
 498 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 499 {
 500         struct mgmt_mode rp;
 501
 502         rp.val = val;
 503
 504         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 505 }
 506
 507 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 508                                                                         u16 len)
 509 {
 510         struct mgmt_mode *cp, ev;
 511         struct hci_dev *hdev;
 512         int err;
 513
 514         cp = (void *) data;
 515
 516         BT_DBG("request for hci%u", index);
 517
 518         if (len != sizeof(*cp))
 519                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 520
 521         hdev = hci_dev_get(index);
 522         if (!hdev)
 523                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 524
 525         hci_dev_lock_bh(hdev);
 526
 527         if (cp->val)
 528                 set_bit(HCI_PAIRABLE, &hdev->flags);
 529         else
 530                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 531
 532         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 533         if (err < 0)
 534                 goto failed;
 535
 536         ev.val = cp->val;
 537
 538         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 539
 540 failed:
 541         hci_dev_unlock_bh(hdev);
 542         hci_dev_put(hdev);
 543
 544         return err;
 545 }
 546
 547 #define EIR_FLAGS               0x01 /* flags */
 548 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 549 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 550 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 551 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 552 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 553 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 554 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 555 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 556 #define EIR_TX_POWER            0x0A /* transmit power level */
 557 #define EIR_DEVICE_ID           0x10 /* device ID */
 558
 559 #define PNP_INFO_SVCLASS_ID             0x1200
 560
 561 static u8 bluetooth_base_uuid[] = {
 562                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 563                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 564 };
 565
 566 static u16 get_uuid16(u8 *uuid128)
 567 {
 568         u32 val;
 569         int i;
 570
 571         for (i = 0; i < 12; i++) {
 572                 if (bluetooth_base_uuid[i] != uuid128[i])
 573                         return 0;
 574         }
 575
 576         memcpy(&val, &uuid128[12], 4);
 577
 578         val = le32_to_cpu(val);
 579         if (val > 0xffff)
 580                 return 0;
 581
 582         return (u16) val;
 583 }
 584
 585 static void create_eir(struct hci_dev *hdev, u8 *data)
 586 {
 587         u8 *ptr = data;
 588         u16 eir_len = 0;
 589         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 590         int i, truncated = 0;
 591         struct bt_uuid *uuid;
 592         size_t name_len;
 593
 594         name_len = strlen(hdev->dev_name);
 595
 596         if (name_len > 0) {
 597                 /* EIR Data type */
 598                 if (name_len > 48) {
 599                         name_len = 48;
 600                         ptr[1] = EIR_NAME_SHORT;
 601                 } else
 602                         ptr[1] = EIR_NAME_COMPLETE;
 603
 604                 /* EIR Data length */
 605                 ptr[0] = name_len + 1;
 606
 607                 memcpy(ptr + 2, hdev->dev_name, name_len);
 608
 609                 eir_len += (name_len + 2);
 610                 ptr += (name_len + 2);
 611         }
 612
 613         memset(uuid16_list, 0, sizeof(uuid16_list));
 614
 615         /* Group all UUID16 types */
 616         list_for_each_entry(uuid, &hdev->uuids, list) {
 617                 u16 uuid16;
 618
 619                 uuid16 = get_uuid16(uuid->uuid);
 620                 if (uuid16 == 0)
 621                         return;
 622
 623                 if (uuid16 < 0x1100)
 624                         continue;
 625
 626                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 627                         continue;
 628
 629                 /* Stop if not enough space to put next UUID */
 630                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 631                         truncated = 1;
 632                         break;
 633                 }
 634
 635                 /* Check for duplicates */
 636                 for (i = 0; uuid16_list[i] != 0; i++)
 637                         if (uuid16_list[i] == uuid16)
 638                                 break;
 639
 640                 if (uuid16_list[i] == 0) {
 641                         uuid16_list[i] = uuid16;
 642                         eir_len += sizeof(u16);
 643                 }
 644         }
 645
 646         if (uuid16_list[0] != 0) {
 647                 u8 *length = ptr;
 648
 649                 /* EIR Data type */
 650                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 651
 652                 ptr += 2;
 653                 eir_len += 2;
 654
 655                 for (i = 0; uuid16_list[i] != 0; i++) {
 656                         *ptr++ = (uuid16_list[i] & 0x00ff);
 657                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 658                 }
 659
 660                 /* EIR Data length */
 661                 *length = (i * sizeof(u16)) + 1;
 662         }
 663 }
 664
 665 static int update_eir(struct hci_dev *hdev)
 666 {
 667         struct hci_cp_write_eir cp;
 668
 669         if (!(hdev->features[6] & LMP_EXT_INQ))
 670                 return 0;
 671
 672         if (hdev->ssp_mode == 0)
 673                 return 0;
 674
 675         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 676                 return 0;
 677
 678         memset(&cp, 0, sizeof(cp));
 679
 680         create_eir(hdev, cp.data);
 681
 682         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 683                 return 0;
 684
 685         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 686
 687         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 688 }
 689
 690 static u8 get_service_classes(struct hci_dev *hdev)
 691 {
 692         struct bt_uuid *uuid;
 693         u8 val = 0;
 694
 695         list_for_each_entry(uuid, &hdev->uuids, list)
 696                 val |= uuid->svc_hint;
 697
 698         return val;
 699 }
 700
 701 static int update_class(struct hci_dev *hdev)
 702 {
 703         u8 cod[3];
 704
 705         BT_DBG("%s", hdev->name);
 706
 707         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 708                 return 0;
 709
 710         cod[0] = hdev->minor_class;
 711         cod[1] = hdev->major_class;
 712         cod[2] = get_service_classes(hdev);
 713
 714         if (memcmp(cod, hdev->dev_class, 3) == 0)
 715                 return 0;
 716
 717         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 718 }
 719
 720 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 721 {
 722         struct mgmt_cp_add_uuid *cp;
 723         struct hci_dev *hdev;
 724         struct bt_uuid *uuid;
 725         int err;
 726
 727         cp = (void *) data;
 728
 729         BT_DBG("request for hci%u", index);
 730
 731         if (len != sizeof(*cp))
 732                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 733
 734         hdev = hci_dev_get(index);
 735         if (!hdev)
 736                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 737
 738         hci_dev_lock_bh(hdev);
 739
 740         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 741         if (!uuid) {
 742                 err = -ENOMEM;
 743                 goto failed;
 744         }
 745
 746         memcpy(uuid->uuid, cp->uuid, 16);
 747         uuid->svc_hint = cp->svc_hint;
 748
 749         list_add(&uuid->list, &hdev->uuids);
 750
 751         err = update_class(hdev);
 752         if (err < 0)
 753                 goto failed;
 754
 755         err = update_eir(hdev);
 756         if (err < 0)
 757                 goto failed;
 758
 759         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 760
 761 failed:
 762         hci_dev_unlock_bh(hdev);
 763         hci_dev_put(hdev);
 764
 765         return err;
 766 }
 767
 768 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 769 {
 770         struct list_head *p, *n;
 771         struct mgmt_cp_remove_uuid *cp;
 772         struct hci_dev *hdev;
 773         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 774         int err, found;
 775
 776         cp = (void *) data;
 777
 778         BT_DBG("request for hci%u", index);
 779
 780         if (len != sizeof(*cp))
 781                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 782
 783         hdev = hci_dev_get(index);
 784         if (!hdev)
 785                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 786
 787         hci_dev_lock_bh(hdev);
 788
 789         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 790                 err = hci_uuids_clear(hdev);
 791                 goto unlock;
 792         }
 793
 794         found = 0;
 795
 796         list_for_each_safe(p, n, &hdev->uuids) {
 797                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 798
 799                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 800                         continue;
 801
 802                 list_del(&match->list);
 803                 found++;
 804         }
 805
 806         if (found == 0) {
 807                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 808                 goto unlock;
 809         }
 810
 811         err = update_class(hdev);
 812         if (err < 0)
 813                 goto unlock;
 814
 815         err = update_eir(hdev);
 816         if (err < 0)
 817                 goto unlock;
 818
 819         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 820
 821 unlock:
 822         hci_dev_unlock_bh(hdev);
 823         hci_dev_put(hdev);
 824
 825         return err;
 826 }
 827
 828 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 829                                                                         u16 len)
 830 {
 831         struct hci_dev *hdev;
 832         struct mgmt_cp_set_dev_class *cp;
 833         int err;
 834
 835         cp = (void *) data;
 836
 837         BT_DBG("request for hci%u", index);
 838
 839         if (len != sizeof(*cp))
 840                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 841
 842         hdev = hci_dev_get(index);
 843         if (!hdev)
 844                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 845
 846         hci_dev_lock_bh(hdev);
 847
 848         hdev->major_class = cp->major;
 849         hdev->minor_class = cp->minor;
 850
 851         err = update_class(hdev);
 852
 853         if (err == 0)
 854                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 855
 856         hci_dev_unlock_bh(hdev);
 857         hci_dev_put(hdev);
 858
 859         return err;
 860 }
 861
 862 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 863                                                                         u16 len)
 864 {
 865         struct hci_dev *hdev;
 866         struct mgmt_cp_set_service_cache *cp;
 867         int err;
 868
 869         cp = (void *) data;
 870
 871         if (len != sizeof(*cp))
 872                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 873
 874         hdev = hci_dev_get(index);
 875         if (!hdev)
 876                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 877
 878         hci_dev_lock_bh(hdev);
 879
 880         BT_DBG("hci%u enable %d", index, cp->enable);
 881
 882         if (cp->enable) {
 883                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 884                 err = 0;
 885         } else {
 886                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 887                 err = update_class(hdev);
 888                 if (err == 0)
 889                         err = update_eir(hdev);
 890         }
 891
 892         if (err == 0)
 893                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 894                                                                         0);
 895         else
 896                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 897
 898
 899         hci_dev_unlock_bh(hdev);
 900         hci_dev_put(hdev);
 901
 902         return err;
 903 }
 904
 905 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 906                                                                 u16 len)
 907 {
 908         struct hci_dev *hdev;
 909         struct mgmt_cp_load_link_keys *cp;
 910         u16 key_count, expected_len;
 911         int i;
 912
 913         cp = (void *) data;
 914
 915         if (len < sizeof(*cp))
 916                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 917
 918         key_count = get_unaligned_le16(&cp->key_count);
 919
 920         expected_len = sizeof(*cp) + key_count *
 921                                         sizeof(struct mgmt_link_key_info);
 922         if (expected_len != len) {
 923                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 924                                                         len, expected_len);
 925                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 926         }
 927
 928         hdev = hci_dev_get(index);
 929         if (!hdev)
 930                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 931
 932         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 933                                                                 key_count);
 934
 935         hci_dev_lock_bh(hdev);
 936
 937         hci_link_keys_clear(hdev);
 938
 939         set_bit(HCI_LINK_KEYS, &hdev->flags);
 940
 941         if (cp->debug_keys)
 942                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 943         else
 944                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 945
 946         for (i = 0; i < key_count; i++) {
 947                 struct mgmt_link_key_info *key = &cp->keys[i];
 948
 949                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 950                                                                 key->pin_len);
 951         }
 952
 953         hci_dev_unlock_bh(hdev);
 954         hci_dev_put(hdev);
 955
 956         return 0;
 957 }
 958
 959 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 960                                                                 u16 len)
 961 {
 962         struct hci_dev *hdev;
 963         struct mgmt_cp_remove_keys *cp;
 964         struct hci_conn *conn;
 965         int err;
 966
 967         cp = (void *) data;
 968
 969         if (len != sizeof(*cp))
 970                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 971
 972         hdev = hci_dev_get(index);
 973         if (!hdev)
 974                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 975
 976         hci_dev_lock_bh(hdev);
 977
 978         err = hci_remove_link_key(hdev, &cp->bdaddr);
 979         if (err < 0) {
 980                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 981                 goto unlock;
 982         }
 983
 984         err = 0;
 985
 986         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 987                 goto unlock;
 988
 989         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 990         if (conn) {
 991                 struct hci_cp_disconnect dc;
 992
 993                 put_unaligned_le16(conn->handle, &dc.handle);
 994                 dc.reason = 0x13; /* Remote User Terminated Connection */
 995                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
 996         }
 997
 998 unlock:
 999         hci_dev_unlock_bh(hdev);
1000         hci_dev_put(hdev);
1001
1002         return err;
1003 }
1004
1005 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1006 {
1007         struct hci_dev *hdev;
1008         struct mgmt_cp_disconnect *cp;
1009         struct hci_cp_disconnect dc;
1010         struct pending_cmd *cmd;
1011         struct hci_conn *conn;
1012         int err;
1013
1014         BT_DBG("");
1015
1016         cp = (void *) data;
1017
1018         if (len != sizeof(*cp))
1019                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1020
1021         hdev = hci_dev_get(index);
1022         if (!hdev)
1023                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1024
1025         hci_dev_lock_bh(hdev);
1026
1027         if (!test_bit(HCI_UP, &hdev->flags)) {
1028                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1029                 goto failed;
1030         }
1031
1032         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1033                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1034                 goto failed;
1035         }
1036
1037         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1038         if (!conn)
1039                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1040
1041         if (!conn) {
1042                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1043                 goto failed;
1044         }
1045
1046         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1047         if (!cmd) {
1048                 err = -ENOMEM;
1049                 goto failed;
1050         }
1051
1052         put_unaligned_le16(conn->handle, &dc.handle);
1053         dc.reason = 0x13; /* Remote User Terminated Connection */
1054
1055         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1056         if (err < 0)
1057                 mgmt_pending_remove(cmd);
1058
1059 failed:
1060         hci_dev_unlock_bh(hdev);
1061         hci_dev_put(hdev);
1062
1063         return err;
1064 }
1065
1066 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1067 {
1068         switch (link_type) {
1069         case LE_LINK:
1070                 switch (addr_type) {
1071                 case ADDR_LE_DEV_PUBLIC:
1072                         return MGMT_ADDR_LE_PUBLIC;
1073                 case ADDR_LE_DEV_RANDOM:
1074                         return MGMT_ADDR_LE_RANDOM;
1075                 default:
1076                         return MGMT_ADDR_INVALID;
1077                 }
1078         case ACL_LINK:
1079                 return MGMT_ADDR_BREDR;
1080         default:
1081                 return MGMT_ADDR_INVALID;
1082         }
1083 }
1084
1085 static int get_connections(struct sock *sk, u16 index)
1086 {
1087         struct mgmt_rp_get_connections *rp;
1088         struct hci_dev *hdev;
1089         struct hci_conn *c;
1090         struct list_head *p;
1091         size_t rp_len;
1092         u16 count;
1093         int i, err;
1094
1095         BT_DBG("");
1096
1097         hdev = hci_dev_get(index);
1098         if (!hdev)
1099                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1100
1101         hci_dev_lock_bh(hdev);
1102
1103         count = 0;
1104         list_for_each(p, &hdev->conn_hash.list) {
1105                 count++;
1106         }
1107
1108         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1109         rp = kmalloc(rp_len, GFP_ATOMIC);
1110         if (!rp) {
1111                 err = -ENOMEM;
1112                 goto unlock;
1113         }
1114
1115         put_unaligned_le16(count, &rp->conn_count);
1116
1117         i = 0;
1118         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1119                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1120                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1121                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1122                         continue;
1123                 i++;
1124         }
1125
1126         /* Recalculate length in case of filtered SCO connections, etc */
1127         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1128
1129         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1130
1131 unlock:
1132         kfree(rp);
1133         hci_dev_unlock_bh(hdev);
1134         hci_dev_put(hdev);
1135         return err;
1136 }
1137
1138 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1139                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1140 {
1141         struct pending_cmd *cmd;
1142         int err;
1143
1144         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1145                                                                 sizeof(*cp));
1146         if (!cmd)
1147                 return -ENOMEM;
1148
1149         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1150                                                                 &cp->bdaddr);
1151         if (err < 0)
1152                 mgmt_pending_remove(cmd);
1153
1154         return err;
1155 }
1156
1157 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1158                                                                         u16 len)
1159 {
1160         struct hci_dev *hdev;
1161         struct hci_conn *conn;
1162         struct mgmt_cp_pin_code_reply *cp;
1163         struct mgmt_cp_pin_code_neg_reply ncp;
1164         struct hci_cp_pin_code_reply reply;
1165         struct pending_cmd *cmd;
1166         int err;
1167
1168         BT_DBG("");
1169
1170         cp = (void *) data;
1171
1172         if (len != sizeof(*cp))
1173                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1174
1175         hdev = hci_dev_get(index);
1176         if (!hdev)
1177                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1178
1179         hci_dev_lock_bh(hdev);
1180
1181         if (!test_bit(HCI_UP, &hdev->flags)) {
1182                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1183                 goto failed;
1184         }
1185
1186         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1187         if (!conn) {
1188                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1189                 goto failed;
1190         }
1191
1192         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1193                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1194
1195                 BT_ERR("PIN code is not 16 bytes long");
1196
1197                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1198                 if (err >= 0)
1199                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1200                                                                 EINVAL);
1201
1202                 goto failed;
1203         }
1204
1205         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1206         if (!cmd) {
1207                 err = -ENOMEM;
1208                 goto failed;
1209         }
1210
1211         bacpy(&reply.bdaddr, &cp->bdaddr);
1212         reply.pin_len = cp->pin_len;
1213         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1214
1215         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1216         if (err < 0)
1217                 mgmt_pending_remove(cmd);
1218
1219 failed:
1220         hci_dev_unlock_bh(hdev);
1221         hci_dev_put(hdev);
1222
1223         return err;
1224 }
1225
1226 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1227                                                                         u16 len)
1228 {
1229         struct hci_dev *hdev;
1230         struct mgmt_cp_pin_code_neg_reply *cp;
1231         int err;
1232
1233         BT_DBG("");
1234
1235         cp = (void *) data;
1236
1237         if (len != sizeof(*cp))
1238                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1239                                                                         EINVAL);
1240
1241         hdev = hci_dev_get(index);
1242         if (!hdev)
1243                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1244                                                                         ENODEV);
1245
1246         hci_dev_lock_bh(hdev);
1247
1248         if (!test_bit(HCI_UP, &hdev->flags)) {
1249                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1250                                                                 ENETDOWN);
1251                 goto failed;
1252         }
1253
1254         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1255
1256 failed:
1257         hci_dev_unlock_bh(hdev);
1258         hci_dev_put(hdev);
1259
1260         return err;
1261 }
1262
1263 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1264                                                                         u16 len)
1265 {
1266         struct hci_dev *hdev;
1267         struct mgmt_cp_set_io_capability *cp;
1268
1269         BT_DBG("");
1270
1271         cp = (void *) data;
1272
1273         if (len != sizeof(*cp))
1274                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1275
1276         hdev = hci_dev_get(index);
1277         if (!hdev)
1278                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1279
1280         hci_dev_lock_bh(hdev);
1281
1282         hdev->io_capability = cp->io_capability;
1283
1284         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1285                                                         hdev->io_capability);
1286
1287         hci_dev_unlock_bh(hdev);
1288         hci_dev_put(hdev);
1289
1290         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1291 }
1292
1293 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1294 {
1295         struct hci_dev *hdev = conn->hdev;
1296         struct pending_cmd *cmd;
1297
1298         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1299                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1300                         continue;
1301
1302                 if (cmd->user_data != conn)
1303                         continue;
1304
1305                 return cmd;
1306         }
1307
1308         return NULL;
1309 }
1310
1311 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1312 {
1313         struct mgmt_rp_pair_device rp;
1314         struct hci_conn *conn = cmd->user_data;
1315
1316         bacpy(&rp.bdaddr, &conn->dst);
1317         rp.status = status;
1318
1319         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1320
1321         /* So we don't get further callbacks for this connection */
1322         conn->connect_cfm_cb = NULL;
1323         conn->security_cfm_cb = NULL;
1324         conn->disconn_cfm_cb = NULL;
1325
1326         hci_conn_put(conn);
1327
1328         mgmt_pending_remove(cmd);
1329 }
1330
1331 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1332 {
1333         struct pending_cmd *cmd;
1334         struct hci_dev *hdev = conn->hdev;
1335
1336         BT_DBG("status %u", status);
1337
1338         hci_dev_lock_bh(hdev);
1339
1340         cmd = find_pairing(conn);
1341         if (!cmd)
1342                 BT_DBG("Unable to find a pending command");
1343         else
1344                 pairing_complete(cmd, status);
1345
1346         hci_dev_unlock_bh(hdev);
1347 }
1348
1349 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1350 {
1351         struct hci_dev *hdev;
1352         struct mgmt_cp_pair_device *cp;
1353         struct pending_cmd *cmd;
1354         struct adv_entry *entry;
1355         u8 sec_level, auth_type;
1356         struct hci_conn *conn;
1357         int err;
1358
1359         BT_DBG("");
1360
1361         cp = (void *) data;
1362
1363         if (len != sizeof(*cp))
1364                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1365
1366         hdev = hci_dev_get(index);
1367         if (!hdev)
1368                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1369
1370         hci_dev_lock_bh(hdev);
1371
1372         sec_level = BT_SECURITY_MEDIUM;
1373         if (cp->io_cap == 0x03)
1374                 auth_type = HCI_AT_DEDICATED_BONDING;
1375         else
1376                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1377
1378         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1379         if (entry)
1380                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1381                                                                 auth_type);
1382         else
1383                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1384                                                                 auth_type);
1385
1386         if (IS_ERR(conn)) {
1387                 err = PTR_ERR(conn);
1388                 goto unlock;
1389         }
1390
1391         if (conn->connect_cfm_cb) {
1392                 hci_conn_put(conn);
1393                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1394                 goto unlock;
1395         }
1396
1397         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1398         if (!cmd) {
1399                 err = -ENOMEM;
1400                 hci_conn_put(conn);
1401                 goto unlock;
1402         }
1403
1404         /* For LE, just connecting isn't a proof that the pairing finished */
1405         if (!entry)
1406                 conn->connect_cfm_cb = pairing_complete_cb;
1407
1408         conn->security_cfm_cb = pairing_complete_cb;
1409         conn->disconn_cfm_cb = pairing_complete_cb;
1410         conn->io_capability = cp->io_cap;
1411         cmd->user_data = conn;
1412
1413         if (conn->state == BT_CONNECTED &&
1414                                 hci_conn_security(conn, sec_level, auth_type))
1415                 pairing_complete(cmd, 0);
1416
1417         err = 0;
1418
1419 unlock:
1420         hci_dev_unlock_bh(hdev);
1421         hci_dev_put(hdev);
1422
1423         return err;
1424 }
1425
1426 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1427                                                         u16 len, int success)
1428 {
1429         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1430         u16 mgmt_op, hci_op;
1431         struct pending_cmd *cmd;
1432         struct hci_dev *hdev;
1433         int err;
1434
1435         BT_DBG("");
1436
1437         if (success) {
1438                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1439                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1440         } else {
1441                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1442                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1443         }
1444
1445         if (len != sizeof(*cp))
1446                 return cmd_status(sk, index, mgmt_op, EINVAL);
1447
1448         hdev = hci_dev_get(index);
1449         if (!hdev)
1450                 return cmd_status(sk, index, mgmt_op, ENODEV);
1451
1452         hci_dev_lock_bh(hdev);
1453
1454         if (!test_bit(HCI_UP, &hdev->flags)) {
1455                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1456                 goto failed;
1457         }
1458
1459         cmd = mgmt_pending_add(sk, mgmt_op, hdev, data, len);
1460         if (!cmd) {
1461                 err = -ENOMEM;
1462                 goto failed;
1463         }
1464
1465         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1466         if (err < 0)
1467                 mgmt_pending_remove(cmd);
1468
1469 failed:
1470         hci_dev_unlock_bh(hdev);
1471         hci_dev_put(hdev);
1472
1473         return err;
1474 }
1475
1476 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1477                                                                 u16 len)
1478 {
1479         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1480         struct hci_cp_write_local_name hci_cp;
1481         struct hci_dev *hdev;
1482         struct pending_cmd *cmd;
1483         int err;
1484
1485         BT_DBG("");
1486
1487         if (len != sizeof(*mgmt_cp))
1488                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1489
1490         hdev = hci_dev_get(index);
1491         if (!hdev)
1492                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1493
1494         hci_dev_lock_bh(hdev);
1495
1496         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1497         if (!cmd) {
1498                 err = -ENOMEM;
1499                 goto failed;
1500         }
1501
1502         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1503         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1504                                                                 &hci_cp);
1505         if (err < 0)
1506                 mgmt_pending_remove(cmd);
1507
1508 failed:
1509         hci_dev_unlock_bh(hdev);
1510         hci_dev_put(hdev);
1511
1512         return err;
1513 }
1514
1515 static int read_local_oob_data(struct sock *sk, u16 index)
1516 {
1517         struct hci_dev *hdev;
1518         struct pending_cmd *cmd;
1519         int err;
1520
1521         BT_DBG("hci%u", index);
1522
1523         hdev = hci_dev_get(index);
1524         if (!hdev)
1525                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1526                                                                         ENODEV);
1527
1528         hci_dev_lock_bh(hdev);
1529
1530         if (!test_bit(HCI_UP, &hdev->flags)) {
1531                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1532                                                                 ENETDOWN);
1533                 goto unlock;
1534         }
1535
1536         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1537                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1538                                                                 EOPNOTSUPP);
1539                 goto unlock;
1540         }
1541
1542         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1543                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1544                 goto unlock;
1545         }
1546
1547         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1548         if (!cmd) {
1549                 err = -ENOMEM;
1550                 goto unlock;
1551         }
1552
1553         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1554         if (err < 0)
1555                 mgmt_pending_remove(cmd);
1556
1557 unlock:
1558         hci_dev_unlock_bh(hdev);
1559         hci_dev_put(hdev);
1560
1561         return err;
1562 }
1563
1564 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1565                                                                         u16 len)
1566 {
1567         struct hci_dev *hdev;
1568         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1569         int err;
1570
1571         BT_DBG("hci%u ", index);
1572
1573         if (len != sizeof(*cp))
1574                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1575                                                                         EINVAL);
1576
1577         hdev = hci_dev_get(index);
1578         if (!hdev)
1579                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1580                                                                         ENODEV);
1581
1582         hci_dev_lock_bh(hdev);
1583
1584         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1585                                                                 cp->randomizer);
1586         if (err < 0)
1587                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1588         else
1589                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1590                                                                         0);
1591
1592         hci_dev_unlock_bh(hdev);
1593         hci_dev_put(hdev);
1594
1595         return err;
1596 }
1597
1598 static int remove_remote_oob_data(struct sock *sk, u16 index,
1599                                                 unsigned char *data, u16 len)
1600 {
1601         struct hci_dev *hdev;
1602         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1603         int err;
1604
1605         BT_DBG("hci%u ", index);
1606
1607         if (len != sizeof(*cp))
1608                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1609                                                                         EINVAL);
1610
1611         hdev = hci_dev_get(index);
1612         if (!hdev)
1613                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1614                                                                         ENODEV);
1615
1616         hci_dev_lock_bh(hdev);
1617
1618         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1619         if (err < 0)
1620                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1621                                                                         -err);
1622         else
1623                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1624                                                                 NULL, 0);
1625
1626         hci_dev_unlock_bh(hdev);
1627         hci_dev_put(hdev);
1628
1629         return err;
1630 }
1631
1632 static int start_discovery(struct sock *sk, u16 index)
1633 {
1634         struct pending_cmd *cmd;
1635         struct hci_dev *hdev;
1636         int err;
1637
1638         BT_DBG("hci%u", index);
1639
1640         hdev = hci_dev_get(index);
1641         if (!hdev)
1642                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1643
1644         hci_dev_lock_bh(hdev);
1645
1646         if (!test_bit(HCI_UP, &hdev->flags)) {
1647                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1648                 goto failed;
1649         }
1650
1651         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1652         if (!cmd) {
1653                 err = -ENOMEM;
1654                 goto failed;
1655         }
1656
1657         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1658         if (err < 0)
1659                 mgmt_pending_remove(cmd);
1660
1661 failed:
1662         hci_dev_unlock_bh(hdev);
1663         hci_dev_put(hdev);
1664
1665         return err;
1666 }
1667
1668 static int stop_discovery(struct sock *sk, u16 index)
1669 {
1670         struct hci_dev *hdev;
1671         struct pending_cmd *cmd;
1672         int err;
1673
1674         BT_DBG("hci%u", index);
1675
1676         hdev = hci_dev_get(index);
1677         if (!hdev)
1678                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1679
1680         hci_dev_lock_bh(hdev);
1681
1682         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1683         if (!cmd) {
1684                 err = -ENOMEM;
1685                 goto failed;
1686         }
1687
1688         err = hci_cancel_inquiry(hdev);
1689         if (err < 0)
1690                 mgmt_pending_remove(cmd);
1691
1692 failed:
1693         hci_dev_unlock_bh(hdev);
1694         hci_dev_put(hdev);
1695
1696         return err;
1697 }
1698
1699 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1700                                                                 u16 len)
1701 {
1702         struct hci_dev *hdev;
1703         struct mgmt_cp_block_device *cp = (void *) data;
1704         int err;
1705
1706         BT_DBG("hci%u", index);
1707
1708         if (len != sizeof(*cp))
1709                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1710                                                         EINVAL);
1711
1712         hdev = hci_dev_get(index);
1713         if (!hdev)
1714                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1715                                                         ENODEV);
1716
1717         hci_dev_lock_bh(hdev);
1718
1719         err = hci_blacklist_add(hdev, &cp->bdaddr);
1720         if (err < 0)
1721                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1722         else
1723                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1724                                                         NULL, 0);
1725
1726         hci_dev_unlock_bh(hdev);
1727         hci_dev_put(hdev);
1728
1729         return err;
1730 }
1731
1732 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1733                                                                 u16 len)
1734 {
1735         struct hci_dev *hdev;
1736         struct mgmt_cp_unblock_device *cp = (void *) data;
1737         int err;
1738
1739         BT_DBG("hci%u", index);
1740
1741         if (len != sizeof(*cp))
1742                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1743                                                                 EINVAL);
1744
1745         hdev = hci_dev_get(index);
1746         if (!hdev)
1747                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1748                                                                 ENODEV);
1749
1750         hci_dev_lock_bh(hdev);
1751
1752         err = hci_blacklist_del(hdev, &cp->bdaddr);
1753
1754         if (err < 0)
1755                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1756         else
1757                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1758                                                                 NULL, 0);
1759
1760         hci_dev_unlock_bh(hdev);
1761         hci_dev_put(hdev);
1762
1763         return err;
1764 }
1765
1766 static int set_fast_connectable(struct sock *sk, u16 index,
1767                                         unsigned char *data, u16 len)
1768 {
1769         struct hci_dev *hdev;
1770         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1771         struct hci_cp_write_page_scan_activity acp;
1772         u8 type;
1773         int err;
1774
1775         BT_DBG("hci%u", index);
1776
1777         if (len != sizeof(*cp))
1778                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1779                                                                 EINVAL);
1780
1781         hdev = hci_dev_get(index);
1782         if (!hdev)
1783                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1784                                                                 ENODEV);
1785
1786         hci_dev_lock(hdev);
1787
1788         if (cp->enable) {
1789                 type = PAGE_SCAN_TYPE_INTERLACED;
1790                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1791         } else {
1792                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1793                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1794         }
1795
1796         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1797
1798         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1799                                                 sizeof(acp), &acp);
1800         if (err < 0) {
1801                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1802                                                                 -err);
1803                 goto done;
1804         }
1805
1806         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1807         if (err < 0) {
1808                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1809                                                                 -err);
1810                 goto done;
1811         }
1812
1813         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1814                                                         NULL, 0);
1815 done:
1816         hci_dev_unlock(hdev);
1817         hci_dev_put(hdev);
1818
1819         return err;
1820 }
1821
1822 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1823 {
1824         unsigned char *buf;
1825         struct mgmt_hdr *hdr;
1826         u16 opcode, index, len;
1827         int err;
1828
1829         BT_DBG("got %zu bytes", msglen);
1830
1831         if (msglen < sizeof(*hdr))
1832                 return -EINVAL;
1833
1834         buf = kmalloc(msglen, GFP_KERNEL);
1835         if (!buf)
1836                 return -ENOMEM;
1837
1838         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1839                 err = -EFAULT;
1840                 goto done;
1841         }
1842
1843         hdr = (struct mgmt_hdr *) buf;
1844         opcode = get_unaligned_le16(&hdr->opcode);
1845         index = get_unaligned_le16(&hdr->index);
1846         len = get_unaligned_le16(&hdr->len);
1847
1848         if (len != msglen - sizeof(*hdr)) {
1849                 err = -EINVAL;
1850                 goto done;
1851         }
1852
1853         switch (opcode) {
1854         case MGMT_OP_READ_VERSION:
1855                 err = read_version(sk);
1856                 break;
1857         case MGMT_OP_READ_INDEX_LIST:
1858                 err = read_index_list(sk);
1859                 break;
1860         case MGMT_OP_READ_INFO:
1861                 err = read_controller_info(sk, index);
1862                 break;
1863         case MGMT_OP_SET_POWERED:
1864                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1865                 break;
1866         case MGMT_OP_SET_DISCOVERABLE:
1867                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1868                 break;
1869         case MGMT_OP_SET_CONNECTABLE:
1870                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1871                 break;
1872         case MGMT_OP_SET_PAIRABLE:
1873                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1874                 break;
1875         case MGMT_OP_ADD_UUID:
1876                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1877                 break;
1878         case MGMT_OP_REMOVE_UUID:
1879                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1880                 break;
1881         case MGMT_OP_SET_DEV_CLASS:
1882                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1883                 break;
1884         case MGMT_OP_SET_SERVICE_CACHE:
1885                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1886                 break;
1887         case MGMT_OP_LOAD_LINK_KEYS:
1888                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1889                 break;
1890         case MGMT_OP_REMOVE_KEYS:
1891                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1892                 break;
1893         case MGMT_OP_DISCONNECT:
1894                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1895                 break;
1896         case MGMT_OP_GET_CONNECTIONS:
1897                 err = get_connections(sk, index);
1898                 break;
1899         case MGMT_OP_PIN_CODE_REPLY:
1900                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1901                 break;
1902         case MGMT_OP_PIN_CODE_NEG_REPLY:
1903                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1904                 break;
1905         case MGMT_OP_SET_IO_CAPABILITY:
1906                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1907                 break;
1908         case MGMT_OP_PAIR_DEVICE:
1909                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1910                 break;
1911         case MGMT_OP_USER_CONFIRM_REPLY:
1912                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1913                 break;
1914         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1915                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1916                 break;
1917         case MGMT_OP_SET_LOCAL_NAME:
1918                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1919                 break;
1920         case MGMT_OP_READ_LOCAL_OOB_DATA:
1921                 err = read_local_oob_data(sk, index);
1922                 break;
1923         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1924                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1925                 break;
1926         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1927                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1928                                                                         len);
1929                 break;
1930         case MGMT_OP_START_DISCOVERY:
1931                 err = start_discovery(sk, index);
1932                 break;
1933         case MGMT_OP_STOP_DISCOVERY:
1934                 err = stop_discovery(sk, index);
1935                 break;
1936         case MGMT_OP_BLOCK_DEVICE:
1937                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1938                 break;
1939         case MGMT_OP_UNBLOCK_DEVICE:
1940                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1941                 break;
1942         case MGMT_OP_SET_FAST_CONNECTABLE:
1943                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1944                                                                 len);
1945                 break;
1946         default:
1947                 BT_DBG("Unknown op %u", opcode);
1948                 err = cmd_status(sk, index, opcode, 0x01);
1949                 break;
1950         }
1951
1952         if (err < 0)
1953                 goto done;
1954
1955         err = msglen;
1956
1957 done:
1958         kfree(buf);
1959         return err;
1960 }
1961
1962 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1963 {
1964         u8 *status = data;
1965
1966         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1967         mgmt_pending_remove(cmd);
1968 }
1969
1970 int mgmt_index_added(struct hci_dev *hdev)
1971 {
1972         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
1973 }
1974
1975 int mgmt_index_removed(struct hci_dev *hdev)
1976 {
1977         u8 status = ENODEV;
1978
1979         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
1980
1981         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
1982 }
1983
1984 struct cmd_lookup {
1985         u8 val;
1986         struct sock *sk;
1987 };
1988
1989 static void mode_rsp(struct pending_cmd *cmd, void *data)
1990 {
1991         struct mgmt_mode *cp = cmd->param;
1992         struct cmd_lookup *match = data;
1993
1994         if (cp->val != match->val)
1995                 return;
1996
1997         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1998
1999         list_del(&cmd->list);
2000
2001         if (match->sk == NULL) {
2002                 match->sk = cmd->sk;
2003                 sock_hold(match->sk);
2004         }
2005
2006         mgmt_pending_free(cmd);
2007 }
2008
2009 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2010 {
2011         struct mgmt_mode ev;
2012         struct cmd_lookup match = { powered, NULL };
2013         int ret;
2014
2015         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2016
2017         if (!powered) {
2018                 u8 status = ENETDOWN;
2019                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2020         }
2021
2022         ev.val = powered;
2023
2024         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2025
2026         if (match.sk)
2027                 sock_put(match.sk);
2028
2029         return ret;
2030 }
2031
2032 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2033 {
2034         struct mgmt_mode ev;
2035         struct cmd_lookup match = { discoverable, NULL };
2036         int ret;
2037
2038         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2039
2040         ev.val = discoverable;
2041
2042         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2043                                                                 match.sk);
2044
2045         if (match.sk)
2046                 sock_put(match.sk);
2047
2048         return ret;
2049 }
2050
2051 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2052 {
2053         struct mgmt_mode ev;
2054         struct cmd_lookup match = { connectable, NULL };
2055         int ret;
2056
2057         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2058
2059         ev.val = connectable;
2060
2061         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2062
2063         if (match.sk)
2064                 sock_put(match.sk);
2065
2066         return ret;
2067 }
2068
2069 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2070 {
2071         if (scan & SCAN_PAGE)
2072                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2073                                                 cmd_status_rsp, &status);
2074
2075         if (scan & SCAN_INQUIRY)
2076                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2077                                                 cmd_status_rsp, &status);
2078
2079         return 0;
2080 }
2081
2082 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2083                                                                 u8 persistent)
2084 {
2085         struct mgmt_ev_new_link_key ev;
2086
2087         memset(&ev, 0, sizeof(ev));
2088
2089         ev.store_hint = persistent;
2090         bacpy(&ev.key.bdaddr, &key->bdaddr);
2091         ev.key.type = key->type;
2092         memcpy(ev.key.val, key->val, 16);
2093         ev.key.pin_len = key->pin_len;
2094
2095         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2096 }
2097
2098 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2099                                                                 u8 addr_type)
2100 {
2101         struct mgmt_addr_info ev;
2102
2103         bacpy(&ev.bdaddr, bdaddr);
2104         ev.type = link_to_mgmt(link_type, addr_type);
2105
2106         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2107 }
2108
2109 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2110 {
2111         struct mgmt_cp_disconnect *cp = cmd->param;
2112         struct sock **sk = data;
2113         struct mgmt_rp_disconnect rp;
2114
2115         bacpy(&rp.bdaddr, &cp->bdaddr);
2116
2117         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2118
2119         *sk = cmd->sk;
2120         sock_hold(*sk);
2121
2122         mgmt_pending_remove(cmd);
2123 }
2124
2125 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2126                                                                 u8 addr_type)
2127 {
2128         struct mgmt_addr_info ev;
2129         struct sock *sk = NULL;
2130         int err;
2131
2132         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2133
2134         bacpy(&ev.bdaddr, bdaddr);
2135         ev.type = link_to_mgmt(link_type, addr_type);
2136
2137         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2138
2139         if (sk)
2140                 sock_put(sk);
2141
2142         return err;
2143 }
2144
2145 int mgmt_disconnect_failed(struct hci_dev *hdev)
2146 {
2147         struct pending_cmd *cmd;
2148         int err;
2149
2150         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2151         if (!cmd)
2152                 return -ENOENT;
2153
2154         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT, EIO);
2155
2156         mgmt_pending_remove(cmd);
2157
2158         return err;
2159 }
2160
2161 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2162                                                 u8 addr_type, u8 status)
2163 {
2164         struct mgmt_ev_connect_failed ev;
2165
2166         bacpy(&ev.addr.bdaddr, bdaddr);
2167         ev.addr.type = link_to_mgmt(link_type, addr_type);
2168         ev.status = status;
2169
2170         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2171 }
2172
2173 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2174 {
2175         struct mgmt_ev_pin_code_request ev;
2176
2177         bacpy(&ev.bdaddr, bdaddr);
2178         ev.secure = secure;
2179
2180         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2181                                                                         NULL);
2182 }
2183
2184 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2185                                                                 u8 status)
2186 {
2187         struct pending_cmd *cmd;
2188         struct mgmt_rp_pin_code_reply rp;
2189         int err;
2190
2191         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2192         if (!cmd)
2193                 return -ENOENT;
2194
2195         bacpy(&rp.bdaddr, bdaddr);
2196         rp.status = status;
2197
2198         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2199                                                                 sizeof(rp));
2200
2201         mgmt_pending_remove(cmd);
2202
2203         return err;
2204 }
2205
2206 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2207                                                                 u8 status)
2208 {
2209         struct pending_cmd *cmd;
2210         struct mgmt_rp_pin_code_reply rp;
2211         int err;
2212
2213         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2214         if (!cmd)
2215                 return -ENOENT;
2216
2217         bacpy(&rp.bdaddr, bdaddr);
2218         rp.status = status;
2219
2220         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2221                                                                 sizeof(rp));
2222
2223         mgmt_pending_remove(cmd);
2224
2225         return err;
2226 }
2227
2228 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2229                                                 __le32 value, u8 confirm_hint)
2230 {
2231         struct mgmt_ev_user_confirm_request ev;
2232
2233         BT_DBG("%s", hdev->name);
2234
2235         bacpy(&ev.bdaddr, bdaddr);
2236         ev.confirm_hint = confirm_hint;
2237         put_unaligned_le32(value, &ev.value);
2238
2239         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2240                                                                         NULL);
2241 }
2242
2243 static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2244                                                         u8 status, u8 opcode)
2245 {
2246         struct pending_cmd *cmd;
2247         struct mgmt_rp_user_confirm_reply rp;
2248         int err;
2249
2250         cmd = mgmt_pending_find(opcode, hdev);
2251         if (!cmd)
2252                 return -ENOENT;
2253
2254         bacpy(&rp.bdaddr, bdaddr);
2255         rp.status = status;
2256         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2257
2258         mgmt_pending_remove(cmd);
2259
2260         return err;
2261 }
2262
2263 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2264                                                                 u8 status)
2265 {
2266         return confirm_reply_complete(hdev, bdaddr, status,
2267                                                 MGMT_OP_USER_CONFIRM_REPLY);
2268 }
2269
2270 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2271                                                 bdaddr_t *bdaddr, u8 status)
2272 {
2273         return confirm_reply_complete(hdev, bdaddr, status,
2274                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2275 }
2276
2277 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2278 {
2279         struct mgmt_ev_auth_failed ev;
2280
2281         bacpy(&ev.bdaddr, bdaddr);
2282         ev.status = status;
2283
2284         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2285 }
2286
2287 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2288 {
2289         struct pending_cmd *cmd;
2290         struct mgmt_cp_set_local_name ev;
2291         int err;
2292
2293         memset(&ev, 0, sizeof(ev));
2294         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2295
2296         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2297         if (!cmd)
2298                 goto send_event;
2299
2300         if (status) {
2301                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2302                                                                         EIO);
2303                 goto failed;
2304         }
2305
2306         update_eir(hdev);
2307
2308         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2309                                                                 sizeof(ev));
2310         if (err < 0)
2311                 goto failed;
2312
2313 send_event:
2314         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2315                                                         cmd ? cmd->sk : NULL);
2316
2317 failed:
2318         if (cmd)
2319                 mgmt_pending_remove(cmd);
2320         return err;
2321 }
2322
2323 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2324                                                 u8 *randomizer, u8 status)
2325 {
2326         struct pending_cmd *cmd;
2327         int err;
2328
2329         BT_DBG("%s status %u", hdev->name, status);
2330
2331         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2332         if (!cmd)
2333                 return -ENOENT;
2334
2335         if (status) {
2336                 err = cmd_status(cmd->sk, hdev->id,
2337                                         MGMT_OP_READ_LOCAL_OOB_DATA, EIO);
2338         } else {
2339                 struct mgmt_rp_read_local_oob_data rp;
2340
2341                 memcpy(rp.hash, hash, sizeof(rp.hash));
2342                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2343
2344                 err = cmd_complete(cmd->sk, hdev->id,
2345                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2346                                                 &rp, sizeof(rp));
2347         }
2348
2349         mgmt_pending_remove(cmd);
2350
2351         return err;
2352 }
2353
2354 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2355                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2356 {
2357         struct mgmt_ev_device_found ev;
2358
2359         memset(&ev, 0, sizeof(ev));
2360
2361         bacpy(&ev.addr.bdaddr, bdaddr);
2362         ev.addr.type = link_to_mgmt(link_type, addr_type);
2363         ev.rssi = rssi;
2364
2365         if (eir)
2366                 memcpy(ev.eir, eir, sizeof(ev.eir));
2367
2368         if (dev_class)
2369                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2370
2371         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2372 }
2373
2374 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2375 {
2376         struct mgmt_ev_remote_name ev;
2377
2378         memset(&ev, 0, sizeof(ev));
2379
2380         bacpy(&ev.bdaddr, bdaddr);
2381         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2382
2383         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2384 }
2385
2386 int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status)
2387 {
2388         struct pending_cmd *cmd;
2389         int err;
2390
2391         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2392         if (!cmd)
2393                 return -ENOENT;
2394
2395         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2396         mgmt_pending_remove(cmd);
2397
2398         return err;
2399 }
2400
2401 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2402 {
2403         struct pending_cmd *cmd;
2404
2405         if (discovering)
2406                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2407         else
2408                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2409
2410         if (cmd != NULL) {
2411                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2412                 mgmt_pending_remove(cmd);
2413         }
2414
2415         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2416                                                 sizeof(discovering), NULL);
2417 }
2418
2419 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2420 {
2421         struct pending_cmd *cmd;
2422         struct mgmt_ev_device_blocked ev;
2423
2424         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2425
2426         bacpy(&ev.bdaddr, bdaddr);
2427
2428         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2429                                                         cmd ? cmd->sk : NULL);
2430 }
2431
2432 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2433 {
2434         struct pending_cmd *cmd;
2435         struct mgmt_ev_device_unblocked ev;
2436
2437         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2438
2439         bacpy(&ev.bdaddr, bdaddr);
2440
2441         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2442                                                         cmd ? cmd->sk : NULL);
2443 }