Pileus Git - ~andy/linux/blob - net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         __u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static LIST_HEAD(cmd_list);
  47
  48 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  49 {
  50         struct sk_buff *skb;
  51         struct mgmt_hdr *hdr;
  52         struct mgmt_ev_cmd_status *ev;
  53         int err;
  54
  55         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  56
  57         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  58         if (!skb)
  59                 return -ENOMEM;
  60
  61         hdr = (void *) skb_put(skb, sizeof(*hdr));
  62
  63         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  64         hdr->index = cpu_to_le16(index);
  65         hdr->len = cpu_to_le16(sizeof(*ev));
  66
  67         ev = (void *) skb_put(skb, sizeof(*ev));
  68         ev->status = status;
  69         put_unaligned_le16(cmd, &ev->opcode);
  70
  71         err = sock_queue_rcv_skb(sk, skb);
  72         if (err < 0)
  73                 kfree_skb(skb);
  74
  75         return err;
  76 }
  77
  78 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  79                                                                 size_t rp_len)
  80 {
  81         struct sk_buff *skb;
  82         struct mgmt_hdr *hdr;
  83         struct mgmt_ev_cmd_complete *ev;
  84         int err;
  85
  86         BT_DBG("sock %p", sk);
  87
  88         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  89         if (!skb)
  90                 return -ENOMEM;
  91
  92         hdr = (void *) skb_put(skb, sizeof(*hdr));
  93
  94         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  95         hdr->index = cpu_to_le16(index);
  96         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  97
  98         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  99         put_unaligned_le16(cmd, &ev->opcode);
 100
 101         if (rp)
 102                 memcpy(ev->data, rp, rp_len);
 103
 104         err = sock_queue_rcv_skb(sk, skb);
 105         if (err < 0)
 106                 kfree_skb(skb);
 107
 108         return err;;
 109 }
 110
 111 static int read_version(struct sock *sk)
 112 {
 113         struct mgmt_rp_read_version rp;
 114
 115         BT_DBG("sock %p", sk);
 116
 117         rp.version = MGMT_VERSION;
 118         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 119
 120         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 121                                                                 sizeof(rp));
 122 }
 123
 124 static int read_index_list(struct sock *sk)
 125 {
 126         struct mgmt_rp_read_index_list *rp;
 127         struct list_head *p;
 128         struct hci_dev *d;
 129         size_t rp_len;
 130         u16 count;
 131         int i, err;
 132
 133         BT_DBG("sock %p", sk);
 134
 135         read_lock(&hci_dev_list_lock);
 136
 137         count = 0;
 138         list_for_each(p, &hci_dev_list) {
 139                 count++;
 140         }
 141
 142         rp_len = sizeof(*rp) + (2 * count);
 143         rp = kmalloc(rp_len, GFP_ATOMIC);
 144         if (!rp) {
 145                 read_unlock(&hci_dev_list_lock);
 146                 return -ENOMEM;
 147         }
 148
 149         put_unaligned_le16(count, &rp->num_controllers);
 150
 151         i = 0;
 152         list_for_each_entry(d, &hci_dev_list, list) {
 153                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 154                         cancel_delayed_work_sync(&d->power_off);
 155
 156                 if (test_bit(HCI_SETUP, &d->flags))
 157                         continue;
 158
 159                 put_unaligned_le16(d->id, &rp->index[i++]);
 160                 BT_DBG("Added hci%u", d->id);
 161         }
 162
 163         read_unlock(&hci_dev_list_lock);
 164
 165         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 166                                                                         rp_len);
 167
 168         kfree(rp);
 169
 170         return err;
 171 }
 172
 173 static int read_controller_info(struct sock *sk, u16 index)
 174 {
 175         struct mgmt_rp_read_info rp;
 176         struct hci_dev *hdev;
 177
 178         BT_DBG("sock %p hci%u", sk, index);
 179
 180         hdev = hci_dev_get(index);
 181         if (!hdev)
 182                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 183
 184         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 185                 cancel_delayed_work_sync(&hdev->power_off);
 186
 187         hci_dev_lock_bh(hdev);
 188
 189         set_bit(HCI_MGMT, &hdev->flags);
 190
 191         memset(&rp, 0, sizeof(rp));
 192
 193         rp.type = hdev->dev_type;
 194
 195         rp.powered = test_bit(HCI_UP, &hdev->flags);
 196         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 197         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 198         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 199
 200         if (test_bit(HCI_AUTH, &hdev->flags))
 201                 rp.sec_mode = 3;
 202         else if (hdev->ssp_mode > 0)
 203                 rp.sec_mode = 4;
 204         else
 205                 rp.sec_mode = 2;
 206
 207         bacpy(&rp.bdaddr, &hdev->bdaddr);
 208         memcpy(rp.features, hdev->features, 8);
 209         memcpy(rp.dev_class, hdev->dev_class, 3);
 210         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 211         rp.hci_ver = hdev->hci_ver;
 212         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 213
 214         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 215
 216         hci_dev_unlock_bh(hdev);
 217         hci_dev_put(hdev);
 218
 219         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 220 }
 221
 222 static void mgmt_pending_free(struct pending_cmd *cmd)
 223 {
 224         sock_put(cmd->sk);
 225         kfree(cmd->param);
 226         kfree(cmd);
 227 }
 228
 229 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 230                                                 u16 index, void *data, u16 len)
 231 {
 232         struct pending_cmd *cmd;
 233
 234         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 235         if (!cmd)
 236                 return NULL;
 237
 238         cmd->opcode = opcode;
 239         cmd->index = index;
 240
 241         cmd->param = kmalloc(len, GFP_ATOMIC);
 242         if (!cmd->param) {
 243                 kfree(cmd);
 244                 return NULL;
 245         }
 246
 247         if (data)
 248                 memcpy(cmd->param, data, len);
 249
 250         cmd->sk = sk;
 251         sock_hold(sk);
 252
 253         list_add(&cmd->list, &cmd_list);
 254
 255         return cmd;
 256 }
 257
 258 static void mgmt_pending_foreach(u16 opcode, int index,
 259                                 void (*cb)(struct pending_cmd *cmd, void *data),
 260                                 void *data)
 261 {
 262         struct list_head *p, *n;
 263
 264         list_for_each_safe(p, n, &cmd_list) {
 265                 struct pending_cmd *cmd;
 266
 267                 cmd = list_entry(p, struct pending_cmd, list);
 268
 269                 if (opcode > 0 && cmd->opcode != opcode)
 270                         continue;
 271
 272                 if (index >= 0 && cmd->index != index)
 273                         continue;
 274
 275                 cb(cmd, data);
 276         }
 277 }
 278
 279 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 280 {
 281         struct pending_cmd *cmd;
 282
 283         list_for_each_entry(cmd, &cmd_list, list) {
 284                 if (cmd->opcode != opcode)
 285                         continue;
 286
 287                 if (index >= 0 && cmd->index != index)
 288                         continue;
 289
 290                 return cmd;
 291         }
 292
 293         return NULL;
 294 }
 295
 296 static void mgmt_pending_remove(struct pending_cmd *cmd)
 297 {
 298         list_del(&cmd->list);
 299         mgmt_pending_free(cmd);
 300 }
 301
 302 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 303 {
 304         struct mgmt_mode *cp;
 305         struct hci_dev *hdev;
 306         struct pending_cmd *cmd;
 307         int err, up;
 308
 309         cp = (void *) data;
 310
 311         BT_DBG("request for hci%u", index);
 312
 313         if (len != sizeof(*cp))
 314                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 315
 316         hdev = hci_dev_get(index);
 317         if (!hdev)
 318                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 319
 320         hci_dev_lock_bh(hdev);
 321
 322         up = test_bit(HCI_UP, &hdev->flags);
 323         if ((cp->val && up) || (!cp->val && !up)) {
 324                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 325                 goto failed;
 326         }
 327
 328         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 329                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 330                 goto failed;
 331         }
 332
 333         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 334         if (!cmd) {
 335                 err = -ENOMEM;
 336                 goto failed;
 337         }
 338
 339         if (cp->val)
 340                 queue_work(hdev->workqueue, &hdev->power_on);
 341         else
 342                 queue_work(hdev->workqueue, &hdev->power_off.work);
 343
 344         err = 0;
 345
 346 failed:
 347         hci_dev_unlock_bh(hdev);
 348         hci_dev_put(hdev);
 349         return err;
 350 }
 351
 352 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 353                                                                         u16 len)
 354 {
 355         struct mgmt_cp_set_discoverable *cp;
 356         struct hci_dev *hdev;
 357         struct pending_cmd *cmd;
 358         u8 scan;
 359         int err;
 360
 361         cp = (void *) data;
 362
 363         BT_DBG("request for hci%u", index);
 364
 365         if (len != sizeof(*cp))
 366                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 367
 368         hdev = hci_dev_get(index);
 369         if (!hdev)
 370                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 371
 372         hci_dev_lock_bh(hdev);
 373
 374         if (!test_bit(HCI_UP, &hdev->flags)) {
 375                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 376                 goto failed;
 377         }
 378
 379         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 380                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 381                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 382                 goto failed;
 383         }
 384
 385         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 386                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 387                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 388                 goto failed;
 389         }
 390
 391         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 392         if (!cmd) {
 393                 err = -ENOMEM;
 394                 goto failed;
 395         }
 396
 397         scan = SCAN_PAGE;
 398
 399         if (cp->val)
 400                 scan |= SCAN_INQUIRY;
 401         else
 402                 cancel_delayed_work_sync(&hdev->discov_off);
 403
 404         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 405         if (err < 0)
 406                 mgmt_pending_remove(cmd);
 407
 408         if (cp->val)
 409                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 410
 411 failed:
 412         hci_dev_unlock_bh(hdev);
 413         hci_dev_put(hdev);
 414
 415         return err;
 416 }
 417
 418 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 419                                                                         u16 len)
 420 {
 421         struct mgmt_mode *cp;
 422         struct hci_dev *hdev;
 423         struct pending_cmd *cmd;
 424         u8 scan;
 425         int err;
 426
 427         cp = (void *) data;
 428
 429         BT_DBG("request for hci%u", index);
 430
 431         if (len != sizeof(*cp))
 432                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 433
 434         hdev = hci_dev_get(index);
 435         if (!hdev)
 436                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 437
 438         hci_dev_lock_bh(hdev);
 439
 440         if (!test_bit(HCI_UP, &hdev->flags)) {
 441                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 442                 goto failed;
 443         }
 444
 445         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 446                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 447                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 448                 goto failed;
 449         }
 450
 451         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 452                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 453                 goto failed;
 454         }
 455
 456         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 457         if (!cmd) {
 458                 err = -ENOMEM;
 459                 goto failed;
 460         }
 461
 462         if (cp->val)
 463                 scan = SCAN_PAGE;
 464         else
 465                 scan = 0;
 466
 467         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 468         if (err < 0)
 469                 mgmt_pending_remove(cmd);
 470
 471 failed:
 472         hci_dev_unlock_bh(hdev);
 473         hci_dev_put(hdev);
 474
 475         return err;
 476 }
 477
 478 static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
 479                                                         struct sock *skip_sk)
 480 {
 481         struct sk_buff *skb;
 482         struct mgmt_hdr *hdr;
 483
 484         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 485         if (!skb)
 486                 return -ENOMEM;
 487
 488         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 489
 490         hdr = (void *) skb_put(skb, sizeof(*hdr));
 491         hdr->opcode = cpu_to_le16(event);
 492         hdr->index = cpu_to_le16(index);
 493         hdr->len = cpu_to_le16(data_len);
 494
 495         if (data)
 496                 memcpy(skb_put(skb, data_len), data, data_len);
 497
 498         hci_send_to_sock(NULL, skb, skip_sk);
 499         kfree_skb(skb);
 500
 501         return 0;
 502 }
 503
 504 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 505 {
 506         struct mgmt_mode rp;
 507
 508         rp.val = val;
 509
 510         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 511 }
 512
 513 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 514                                                                         u16 len)
 515 {
 516         struct mgmt_mode *cp, ev;
 517         struct hci_dev *hdev;
 518         int err;
 519
 520         cp = (void *) data;
 521
 522         BT_DBG("request for hci%u", index);
 523
 524         if (len != sizeof(*cp))
 525                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 526
 527         hdev = hci_dev_get(index);
 528         if (!hdev)
 529                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 530
 531         hci_dev_lock_bh(hdev);
 532
 533         if (cp->val)
 534                 set_bit(HCI_PAIRABLE, &hdev->flags);
 535         else
 536                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 537
 538         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 539         if (err < 0)
 540                 goto failed;
 541
 542         ev.val = cp->val;
 543
 544         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 545
 546 failed:
 547         hci_dev_unlock_bh(hdev);
 548         hci_dev_put(hdev);
 549
 550         return err;
 551 }
 552
 553 #define EIR_FLAGS               0x01 /* flags */
 554 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 555 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 556 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 557 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 558 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 559 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 560 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 561 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 562 #define EIR_TX_POWER            0x0A /* transmit power level */
 563 #define EIR_DEVICE_ID           0x10 /* device ID */
 564
 565 #define PNP_INFO_SVCLASS_ID             0x1200
 566
 567 static u8 bluetooth_base_uuid[] = {
 568                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 569                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 570 };
 571
 572 static u16 get_uuid16(u8 *uuid128)
 573 {
 574         u32 val;
 575         int i;
 576
 577         for (i = 0; i < 12; i++) {
 578                 if (bluetooth_base_uuid[i] != uuid128[i])
 579                         return 0;
 580         }
 581
 582         memcpy(&val, &uuid128[12], 4);
 583
 584         val = le32_to_cpu(val);
 585         if (val > 0xffff)
 586                 return 0;
 587
 588         return (u16) val;
 589 }
 590
 591 static void create_eir(struct hci_dev *hdev, u8 *data)
 592 {
 593         u8 *ptr = data;
 594         u16 eir_len = 0;
 595         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 596         int i, truncated = 0;
 597         struct bt_uuid *uuid;
 598         size_t name_len;
 599
 600         name_len = strlen(hdev->dev_name);
 601
 602         if (name_len > 0) {
 603                 /* EIR Data type */
 604                 if (name_len > 48) {
 605                         name_len = 48;
 606                         ptr[1] = EIR_NAME_SHORT;
 607                 } else
 608                         ptr[1] = EIR_NAME_COMPLETE;
 609
 610                 /* EIR Data length */
 611                 ptr[0] = name_len + 1;
 612
 613                 memcpy(ptr + 2, hdev->dev_name, name_len);
 614
 615                 eir_len += (name_len + 2);
 616                 ptr += (name_len + 2);
 617         }
 618
 619         memset(uuid16_list, 0, sizeof(uuid16_list));
 620
 621         /* Group all UUID16 types */
 622         list_for_each_entry(uuid, &hdev->uuids, list) {
 623                 u16 uuid16;
 624
 625                 uuid16 = get_uuid16(uuid->uuid);
 626                 if (uuid16 == 0)
 627                         return;
 628
 629                 if (uuid16 < 0x1100)
 630                         continue;
 631
 632                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 633                         continue;
 634
 635                 /* Stop if not enough space to put next UUID */
 636                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 637                         truncated = 1;
 638                         break;
 639                 }
 640
 641                 /* Check for duplicates */
 642                 for (i = 0; uuid16_list[i] != 0; i++)
 643                         if (uuid16_list[i] == uuid16)
 644                                 break;
 645
 646                 if (uuid16_list[i] == 0) {
 647                         uuid16_list[i] = uuid16;
 648                         eir_len += sizeof(u16);
 649                 }
 650         }
 651
 652         if (uuid16_list[0] != 0) {
 653                 u8 *length = ptr;
 654
 655                 /* EIR Data type */
 656                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 657
 658                 ptr += 2;
 659                 eir_len += 2;
 660
 661                 for (i = 0; uuid16_list[i] != 0; i++) {
 662                         *ptr++ = (uuid16_list[i] & 0x00ff);
 663                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 664                 }
 665
 666                 /* EIR Data length */
 667                 *length = (i * sizeof(u16)) + 1;
 668         }
 669 }
 670
 671 static int update_eir(struct hci_dev *hdev)
 672 {
 673         struct hci_cp_write_eir cp;
 674
 675         if (!(hdev->features[6] & LMP_EXT_INQ))
 676                 return 0;
 677
 678         if (hdev->ssp_mode == 0)
 679                 return 0;
 680
 681         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 682                 return 0;
 683
 684         memset(&cp, 0, sizeof(cp));
 685
 686         create_eir(hdev, cp.data);
 687
 688         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 689                 return 0;
 690
 691         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 692
 693         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 694 }
 695
 696 static u8 get_service_classes(struct hci_dev *hdev)
 697 {
 698         struct bt_uuid *uuid;
 699         u8 val = 0;
 700
 701         list_for_each_entry(uuid, &hdev->uuids, list)
 702                 val |= uuid->svc_hint;
 703
 704         return val;
 705 }
 706
 707 static int update_class(struct hci_dev *hdev)
 708 {
 709         u8 cod[3];
 710
 711         BT_DBG("%s", hdev->name);
 712
 713         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 714                 return 0;
 715
 716         cod[0] = hdev->minor_class;
 717         cod[1] = hdev->major_class;
 718         cod[2] = get_service_classes(hdev);
 719
 720         if (memcmp(cod, hdev->dev_class, 3) == 0)
 721                 return 0;
 722
 723         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 724 }
 725
 726 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 727 {
 728         struct mgmt_cp_add_uuid *cp;
 729         struct hci_dev *hdev;
 730         struct bt_uuid *uuid;
 731         int err;
 732
 733         cp = (void *) data;
 734
 735         BT_DBG("request for hci%u", index);
 736
 737         if (len != sizeof(*cp))
 738                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 739
 740         hdev = hci_dev_get(index);
 741         if (!hdev)
 742                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 743
 744         hci_dev_lock_bh(hdev);
 745
 746         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 747         if (!uuid) {
 748                 err = -ENOMEM;
 749                 goto failed;
 750         }
 751
 752         memcpy(uuid->uuid, cp->uuid, 16);
 753         uuid->svc_hint = cp->svc_hint;
 754
 755         list_add(&uuid->list, &hdev->uuids);
 756
 757         err = update_class(hdev);
 758         if (err < 0)
 759                 goto failed;
 760
 761         err = update_eir(hdev);
 762         if (err < 0)
 763                 goto failed;
 764
 765         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 766
 767 failed:
 768         hci_dev_unlock_bh(hdev);
 769         hci_dev_put(hdev);
 770
 771         return err;
 772 }
 773
 774 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 775 {
 776         struct list_head *p, *n;
 777         struct mgmt_cp_remove_uuid *cp;
 778         struct hci_dev *hdev;
 779         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 780         int err, found;
 781
 782         cp = (void *) data;
 783
 784         BT_DBG("request for hci%u", index);
 785
 786         if (len != sizeof(*cp))
 787                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 788
 789         hdev = hci_dev_get(index);
 790         if (!hdev)
 791                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 792
 793         hci_dev_lock_bh(hdev);
 794
 795         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 796                 err = hci_uuids_clear(hdev);
 797                 goto unlock;
 798         }
 799
 800         found = 0;
 801
 802         list_for_each_safe(p, n, &hdev->uuids) {
 803                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 804
 805                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 806                         continue;
 807
 808                 list_del(&match->list);
 809                 found++;
 810         }
 811
 812         if (found == 0) {
 813                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 814                 goto unlock;
 815         }
 816
 817         err = update_class(hdev);
 818         if (err < 0)
 819                 goto unlock;
 820
 821         err = update_eir(hdev);
 822         if (err < 0)
 823                 goto unlock;
 824
 825         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 826
 827 unlock:
 828         hci_dev_unlock_bh(hdev);
 829         hci_dev_put(hdev);
 830
 831         return err;
 832 }
 833
 834 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 835                                                                         u16 len)
 836 {
 837         struct hci_dev *hdev;
 838         struct mgmt_cp_set_dev_class *cp;
 839         int err;
 840
 841         cp = (void *) data;
 842
 843         BT_DBG("request for hci%u", index);
 844
 845         if (len != sizeof(*cp))
 846                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 847
 848         hdev = hci_dev_get(index);
 849         if (!hdev)
 850                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 851
 852         hci_dev_lock_bh(hdev);
 853
 854         hdev->major_class = cp->major;
 855         hdev->minor_class = cp->minor;
 856
 857         err = update_class(hdev);
 858
 859         if (err == 0)
 860                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 861
 862         hci_dev_unlock_bh(hdev);
 863         hci_dev_put(hdev);
 864
 865         return err;
 866 }
 867
 868 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 869                                                                         u16 len)
 870 {
 871         struct hci_dev *hdev;
 872         struct mgmt_cp_set_service_cache *cp;
 873         int err;
 874
 875         cp = (void *) data;
 876
 877         if (len != sizeof(*cp))
 878                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 879
 880         hdev = hci_dev_get(index);
 881         if (!hdev)
 882                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 883
 884         hci_dev_lock_bh(hdev);
 885
 886         BT_DBG("hci%u enable %d", index, cp->enable);
 887
 888         if (cp->enable) {
 889                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 890                 err = 0;
 891         } else {
 892                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 893                 err = update_class(hdev);
 894                 if (err == 0)
 895                         err = update_eir(hdev);
 896         }
 897
 898         if (err == 0)
 899                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 900                                                                         0);
 901         else
 902                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 903
 904
 905         hci_dev_unlock_bh(hdev);
 906         hci_dev_put(hdev);
 907
 908         return err;
 909 }
 910
 911 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 912                                                                 u16 len)
 913 {
 914         struct hci_dev *hdev;
 915         struct mgmt_cp_load_link_keys *cp;
 916         u16 key_count, expected_len;
 917         int i;
 918
 919         cp = (void *) data;
 920
 921         if (len < sizeof(*cp))
 922                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 923
 924         key_count = get_unaligned_le16(&cp->key_count);
 925
 926         expected_len = sizeof(*cp) + key_count *
 927                                         sizeof(struct mgmt_link_key_info);
 928         if (expected_len != len) {
 929                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 930                                                         len, expected_len);
 931                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 932         }
 933
 934         hdev = hci_dev_get(index);
 935         if (!hdev)
 936                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 937
 938         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 939                                                                 key_count);
 940
 941         hci_dev_lock_bh(hdev);
 942
 943         hci_link_keys_clear(hdev);
 944
 945         set_bit(HCI_LINK_KEYS, &hdev->flags);
 946
 947         if (cp->debug_keys)
 948                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 949         else
 950                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 951
 952         for (i = 0; i < key_count; i++) {
 953                 struct mgmt_link_key_info *key = &cp->keys[i];
 954
 955                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 956                                                                 key->pin_len);
 957         }
 958
 959         hci_dev_unlock_bh(hdev);
 960         hci_dev_put(hdev);
 961
 962         return 0;
 963 }
 964
 965 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 966                                                                 u16 len)
 967 {
 968         struct hci_dev *hdev;
 969         struct mgmt_cp_remove_keys *cp;
 970         struct hci_conn *conn;
 971         int err;
 972
 973         cp = (void *) data;
 974
 975         if (len != sizeof(*cp))
 976                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 977
 978         hdev = hci_dev_get(index);
 979         if (!hdev)
 980                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 981
 982         hci_dev_lock_bh(hdev);
 983
 984         err = hci_remove_link_key(hdev, &cp->bdaddr);
 985         if (err < 0) {
 986                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 987                 goto unlock;
 988         }
 989
 990         err = 0;
 991
 992         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 993                 goto unlock;
 994
 995         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 996         if (conn) {
 997                 struct hci_cp_disconnect dc;
 998
 999                 put_unaligned_le16(conn->handle, &dc.handle);
1000                 dc.reason = 0x13; /* Remote User Terminated Connection */
1001                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1002         }
1003
1004 unlock:
1005         hci_dev_unlock_bh(hdev);
1006         hci_dev_put(hdev);
1007
1008         return err;
1009 }
1010
1011 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1012 {
1013         struct hci_dev *hdev;
1014         struct mgmt_cp_disconnect *cp;
1015         struct hci_cp_disconnect dc;
1016         struct pending_cmd *cmd;
1017         struct hci_conn *conn;
1018         int err;
1019
1020         BT_DBG("");
1021
1022         cp = (void *) data;
1023
1024         if (len != sizeof(*cp))
1025                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1026
1027         hdev = hci_dev_get(index);
1028         if (!hdev)
1029                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1030
1031         hci_dev_lock_bh(hdev);
1032
1033         if (!test_bit(HCI_UP, &hdev->flags)) {
1034                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1035                 goto failed;
1036         }
1037
1038         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
1039                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1040                 goto failed;
1041         }
1042
1043         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1044         if (!conn)
1045                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1046
1047         if (!conn) {
1048                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1049                 goto failed;
1050         }
1051
1052         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
1053         if (!cmd) {
1054                 err = -ENOMEM;
1055                 goto failed;
1056         }
1057
1058         put_unaligned_le16(conn->handle, &dc.handle);
1059         dc.reason = 0x13; /* Remote User Terminated Connection */
1060
1061         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1062         if (err < 0)
1063                 mgmt_pending_remove(cmd);
1064
1065 failed:
1066         hci_dev_unlock_bh(hdev);
1067         hci_dev_put(hdev);
1068
1069         return err;
1070 }
1071
1072 static u8 link_to_mgmt(u8 link_type)
1073 {
1074         switch (link_type) {
1075         case LE_LINK:
1076                 return MGMT_ADDR_LE;
1077         case ACL_LINK:
1078                 return MGMT_ADDR_BREDR;
1079         default:
1080                 return MGMT_ADDR_INVALID;
1081         }
1082 }
1083
1084 static int get_connections(struct sock *sk, u16 index)
1085 {
1086         struct mgmt_rp_get_connections *rp;
1087         struct hci_dev *hdev;
1088         struct hci_conn *c;
1089         struct list_head *p;
1090         size_t rp_len;
1091         u16 count;
1092         int i, err;
1093
1094         BT_DBG("");
1095
1096         hdev = hci_dev_get(index);
1097         if (!hdev)
1098                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1099
1100         hci_dev_lock_bh(hdev);
1101
1102         count = 0;
1103         list_for_each(p, &hdev->conn_hash.list) {
1104                 count++;
1105         }
1106
1107         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1108         rp = kmalloc(rp_len, GFP_ATOMIC);
1109         if (!rp) {
1110                 err = -ENOMEM;
1111                 goto unlock;
1112         }
1113
1114         put_unaligned_le16(count, &rp->conn_count);
1115
1116         i = 0;
1117         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1118                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1119                 rp->addr[i].type = link_to_mgmt(c->type);
1120                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1121                         continue;
1122                 i++;
1123         }
1124
1125         /* Recalculate length in case of filtered SCO connections, etc */
1126         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1127
1128         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1129
1130 unlock:
1131         kfree(rp);
1132         hci_dev_unlock_bh(hdev);
1133         hci_dev_put(hdev);
1134         return err;
1135 }
1136
1137 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1138                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1139 {
1140         struct pending_cmd *cmd;
1141         int err;
1142
1143         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
1144                                                                 sizeof(*cp));
1145         if (!cmd)
1146                 return -ENOMEM;
1147
1148         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1149                                                                 &cp->bdaddr);
1150         if (err < 0)
1151                 mgmt_pending_remove(cmd);
1152
1153         return err;
1154 }
1155
1156 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1157                                                                         u16 len)
1158 {
1159         struct hci_dev *hdev;
1160         struct hci_conn *conn;
1161         struct mgmt_cp_pin_code_reply *cp;
1162         struct mgmt_cp_pin_code_neg_reply ncp;
1163         struct hci_cp_pin_code_reply reply;
1164         struct pending_cmd *cmd;
1165         int err;
1166
1167         BT_DBG("");
1168
1169         cp = (void *) data;
1170
1171         if (len != sizeof(*cp))
1172                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1173
1174         hdev = hci_dev_get(index);
1175         if (!hdev)
1176                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1177
1178         hci_dev_lock_bh(hdev);
1179
1180         if (!test_bit(HCI_UP, &hdev->flags)) {
1181                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1182                 goto failed;
1183         }
1184
1185         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1186         if (!conn) {
1187                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1188                 goto failed;
1189         }
1190
1191         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1192                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1193
1194                 BT_ERR("PIN code is not 16 bytes long");
1195
1196                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1197                 if (err >= 0)
1198                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1199                                                                 EINVAL);
1200
1201                 goto failed;
1202         }
1203
1204         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
1205         if (!cmd) {
1206                 err = -ENOMEM;
1207                 goto failed;
1208         }
1209
1210         bacpy(&reply.bdaddr, &cp->bdaddr);
1211         reply.pin_len = cp->pin_len;
1212         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1213
1214         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1215         if (err < 0)
1216                 mgmt_pending_remove(cmd);
1217
1218 failed:
1219         hci_dev_unlock_bh(hdev);
1220         hci_dev_put(hdev);
1221
1222         return err;
1223 }
1224
1225 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1226                                                                         u16 len)
1227 {
1228         struct hci_dev *hdev;
1229         struct mgmt_cp_pin_code_neg_reply *cp;
1230         int err;
1231
1232         BT_DBG("");
1233
1234         cp = (void *) data;
1235
1236         if (len != sizeof(*cp))
1237                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1238                                                                         EINVAL);
1239
1240         hdev = hci_dev_get(index);
1241         if (!hdev)
1242                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1243                                                                         ENODEV);
1244
1245         hci_dev_lock_bh(hdev);
1246
1247         if (!test_bit(HCI_UP, &hdev->flags)) {
1248                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1249                                                                 ENETDOWN);
1250                 goto failed;
1251         }
1252
1253         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1254
1255 failed:
1256         hci_dev_unlock_bh(hdev);
1257         hci_dev_put(hdev);
1258
1259         return err;
1260 }
1261
1262 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1263                                                                         u16 len)
1264 {
1265         struct hci_dev *hdev;
1266         struct mgmt_cp_set_io_capability *cp;
1267
1268         BT_DBG("");
1269
1270         cp = (void *) data;
1271
1272         if (len != sizeof(*cp))
1273                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1274
1275         hdev = hci_dev_get(index);
1276         if (!hdev)
1277                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1278
1279         hci_dev_lock_bh(hdev);
1280
1281         hdev->io_capability = cp->io_capability;
1282
1283         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1284                                                         hdev->io_capability);
1285
1286         hci_dev_unlock_bh(hdev);
1287         hci_dev_put(hdev);
1288
1289         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1290 }
1291
1292 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1293 {
1294         struct hci_dev *hdev = conn->hdev;
1295         struct pending_cmd *cmd;
1296
1297         list_for_each_entry(cmd, &cmd_list, list) {
1298                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1299                         continue;
1300
1301                 if (cmd->index != hdev->id)
1302                         continue;
1303
1304                 if (cmd->user_data != conn)
1305                         continue;
1306
1307                 return cmd;
1308         }
1309
1310         return NULL;
1311 }
1312
1313 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1314 {
1315         struct mgmt_rp_pair_device rp;
1316         struct hci_conn *conn = cmd->user_data;
1317
1318         bacpy(&rp.bdaddr, &conn->dst);
1319         rp.status = status;
1320
1321         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1322
1323         /* So we don't get further callbacks for this connection */
1324         conn->connect_cfm_cb = NULL;
1325         conn->security_cfm_cb = NULL;
1326         conn->disconn_cfm_cb = NULL;
1327
1328         hci_conn_put(conn);
1329
1330         mgmt_pending_remove(cmd);
1331 }
1332
1333 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1334 {
1335         struct pending_cmd *cmd;
1336
1337         BT_DBG("status %u", status);
1338
1339         cmd = find_pairing(conn);
1340         if (!cmd) {
1341                 BT_DBG("Unable to find a pending command");
1342                 return;
1343         }
1344
1345         pairing_complete(cmd, status);
1346 }
1347
1348 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1349 {
1350         struct hci_dev *hdev;
1351         struct mgmt_cp_pair_device *cp;
1352         struct pending_cmd *cmd;
1353         struct adv_entry *entry;
1354         u8 sec_level, auth_type;
1355         struct hci_conn *conn;
1356         int err;
1357
1358         BT_DBG("");
1359
1360         cp = (void *) data;
1361
1362         if (len != sizeof(*cp))
1363                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1364
1365         hdev = hci_dev_get(index);
1366         if (!hdev)
1367                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1368
1369         hci_dev_lock_bh(hdev);
1370
1371         sec_level = BT_SECURITY_MEDIUM;
1372         if (cp->io_cap == 0x03)
1373                 auth_type = HCI_AT_DEDICATED_BONDING;
1374         else
1375                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1376
1377         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1378         if (entry)
1379                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1380                                                                 auth_type);
1381         else
1382                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1383                                                                 auth_type);
1384
1385         if (IS_ERR(conn)) {
1386                 err = PTR_ERR(conn);
1387                 goto unlock;
1388         }
1389
1390         if (conn->connect_cfm_cb) {
1391                 hci_conn_put(conn);
1392                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1393                 goto unlock;
1394         }
1395
1396         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1397         if (!cmd) {
1398                 err = -ENOMEM;
1399                 hci_conn_put(conn);
1400                 goto unlock;
1401         }
1402
1403         /* For LE, just connecting isn't a proof that the pairing finished */
1404         if (!entry)
1405                 conn->connect_cfm_cb = pairing_complete_cb;
1406
1407         conn->security_cfm_cb = pairing_complete_cb;
1408         conn->disconn_cfm_cb = pairing_complete_cb;
1409         conn->io_capability = cp->io_cap;
1410         cmd->user_data = conn;
1411
1412         if (conn->state == BT_CONNECTED &&
1413                                 hci_conn_security(conn, sec_level, auth_type))
1414                 pairing_complete(cmd, 0);
1415
1416         err = 0;
1417
1418 unlock:
1419         hci_dev_unlock_bh(hdev);
1420         hci_dev_put(hdev);
1421
1422         return err;
1423 }
1424
1425 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1426                                                         u16 len, int success)
1427 {
1428         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1429         u16 mgmt_op, hci_op;
1430         struct pending_cmd *cmd;
1431         struct hci_dev *hdev;
1432         int err;
1433
1434         BT_DBG("");
1435
1436         if (success) {
1437                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1438                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1439         } else {
1440                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1441                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1442         }
1443
1444         if (len != sizeof(*cp))
1445                 return cmd_status(sk, index, mgmt_op, EINVAL);
1446
1447         hdev = hci_dev_get(index);
1448         if (!hdev)
1449                 return cmd_status(sk, index, mgmt_op, ENODEV);
1450
1451         hci_dev_lock_bh(hdev);
1452
1453         if (!test_bit(HCI_UP, &hdev->flags)) {
1454                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1455                 goto failed;
1456         }
1457
1458         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1459         if (!cmd) {
1460                 err = -ENOMEM;
1461                 goto failed;
1462         }
1463
1464         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1465         if (err < 0)
1466                 mgmt_pending_remove(cmd);
1467
1468 failed:
1469         hci_dev_unlock_bh(hdev);
1470         hci_dev_put(hdev);
1471
1472         return err;
1473 }
1474
1475 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1476                                                                 u16 len)
1477 {
1478         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1479         struct hci_cp_write_local_name hci_cp;
1480         struct hci_dev *hdev;
1481         struct pending_cmd *cmd;
1482         int err;
1483
1484         BT_DBG("");
1485
1486         if (len != sizeof(*mgmt_cp))
1487                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1488
1489         hdev = hci_dev_get(index);
1490         if (!hdev)
1491                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1492
1493         hci_dev_lock_bh(hdev);
1494
1495         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
1496         if (!cmd) {
1497                 err = -ENOMEM;
1498                 goto failed;
1499         }
1500
1501         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1502         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1503                                                                 &hci_cp);
1504         if (err < 0)
1505                 mgmt_pending_remove(cmd);
1506
1507 failed:
1508         hci_dev_unlock_bh(hdev);
1509         hci_dev_put(hdev);
1510
1511         return err;
1512 }
1513
1514 static int read_local_oob_data(struct sock *sk, u16 index)
1515 {
1516         struct hci_dev *hdev;
1517         struct pending_cmd *cmd;
1518         int err;
1519
1520         BT_DBG("hci%u", index);
1521
1522         hdev = hci_dev_get(index);
1523         if (!hdev)
1524                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1525                                                                         ENODEV);
1526
1527         hci_dev_lock_bh(hdev);
1528
1529         if (!test_bit(HCI_UP, &hdev->flags)) {
1530                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1531                                                                 ENETDOWN);
1532                 goto unlock;
1533         }
1534
1535         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1536                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1537                                                                 EOPNOTSUPP);
1538                 goto unlock;
1539         }
1540
1541         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
1542                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1543                 goto unlock;
1544         }
1545
1546         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
1547         if (!cmd) {
1548                 err = -ENOMEM;
1549                 goto unlock;
1550         }
1551
1552         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1553         if (err < 0)
1554                 mgmt_pending_remove(cmd);
1555
1556 unlock:
1557         hci_dev_unlock_bh(hdev);
1558         hci_dev_put(hdev);
1559
1560         return err;
1561 }
1562
1563 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1564                                                                         u16 len)
1565 {
1566         struct hci_dev *hdev;
1567         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1568         int err;
1569
1570         BT_DBG("hci%u ", index);
1571
1572         if (len != sizeof(*cp))
1573                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1574                                                                         EINVAL);
1575
1576         hdev = hci_dev_get(index);
1577         if (!hdev)
1578                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1579                                                                         ENODEV);
1580
1581         hci_dev_lock_bh(hdev);
1582
1583         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1584                                                                 cp->randomizer);
1585         if (err < 0)
1586                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1587         else
1588                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1589                                                                         0);
1590
1591         hci_dev_unlock_bh(hdev);
1592         hci_dev_put(hdev);
1593
1594         return err;
1595 }
1596
1597 static int remove_remote_oob_data(struct sock *sk, u16 index,
1598                                                 unsigned char *data, u16 len)
1599 {
1600         struct hci_dev *hdev;
1601         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1602         int err;
1603
1604         BT_DBG("hci%u ", index);
1605
1606         if (len != sizeof(*cp))
1607                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1608                                                                         EINVAL);
1609
1610         hdev = hci_dev_get(index);
1611         if (!hdev)
1612                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1613                                                                         ENODEV);
1614
1615         hci_dev_lock_bh(hdev);
1616
1617         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1618         if (err < 0)
1619                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1620                                                                         -err);
1621         else
1622                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1623                                                                 NULL, 0);
1624
1625         hci_dev_unlock_bh(hdev);
1626         hci_dev_put(hdev);
1627
1628         return err;
1629 }
1630
1631 static int start_discovery(struct sock *sk, u16 index)
1632 {
1633         struct pending_cmd *cmd;
1634         struct hci_dev *hdev;
1635         int err;
1636
1637         BT_DBG("hci%u", index);
1638
1639         hdev = hci_dev_get(index);
1640         if (!hdev)
1641                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1642
1643         hci_dev_lock_bh(hdev);
1644
1645         if (!test_bit(HCI_UP, &hdev->flags)) {
1646                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1647                 goto failed;
1648         }
1649
1650         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
1651         if (!cmd) {
1652                 err = -ENOMEM;
1653                 goto failed;
1654         }
1655
1656         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1657         if (err < 0)
1658                 mgmt_pending_remove(cmd);
1659
1660 failed:
1661         hci_dev_unlock_bh(hdev);
1662         hci_dev_put(hdev);
1663
1664         return err;
1665 }
1666
1667 static int stop_discovery(struct sock *sk, u16 index)
1668 {
1669         struct hci_dev *hdev;
1670         struct pending_cmd *cmd;
1671         int err;
1672
1673         BT_DBG("hci%u", index);
1674
1675         hdev = hci_dev_get(index);
1676         if (!hdev)
1677                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1678
1679         hci_dev_lock_bh(hdev);
1680
1681         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
1682         if (!cmd) {
1683                 err = -ENOMEM;
1684                 goto failed;
1685         }
1686
1687         err = hci_cancel_inquiry(hdev);
1688         if (err < 0)
1689                 mgmt_pending_remove(cmd);
1690
1691 failed:
1692         hci_dev_unlock_bh(hdev);
1693         hci_dev_put(hdev);
1694
1695         return err;
1696 }
1697
1698 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1699                                                                 u16 len)
1700 {
1701         struct hci_dev *hdev;
1702         struct mgmt_cp_block_device *cp = (void *) data;
1703         int err;
1704
1705         BT_DBG("hci%u", index);
1706
1707         if (len != sizeof(*cp))
1708                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1709                                                         EINVAL);
1710
1711         hdev = hci_dev_get(index);
1712         if (!hdev)
1713                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1714                                                         ENODEV);
1715
1716         hci_dev_lock_bh(hdev);
1717
1718         err = hci_blacklist_add(hdev, &cp->bdaddr);
1719         if (err < 0)
1720                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1721         else
1722                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1723                                                         NULL, 0);
1724
1725         hci_dev_unlock_bh(hdev);
1726         hci_dev_put(hdev);
1727
1728         return err;
1729 }
1730
1731 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1732                                                                 u16 len)
1733 {
1734         struct hci_dev *hdev;
1735         struct mgmt_cp_unblock_device *cp = (void *) data;
1736         int err;
1737
1738         BT_DBG("hci%u", index);
1739
1740         if (len != sizeof(*cp))
1741                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1742                                                                 EINVAL);
1743
1744         hdev = hci_dev_get(index);
1745         if (!hdev)
1746                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1747                                                                 ENODEV);
1748
1749         hci_dev_lock_bh(hdev);
1750
1751         err = hci_blacklist_del(hdev, &cp->bdaddr);
1752
1753         if (err < 0)
1754                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1755         else
1756                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1757                                                                 NULL, 0);
1758
1759         hci_dev_unlock_bh(hdev);
1760         hci_dev_put(hdev);
1761
1762         return err;
1763 }
1764
1765 static int set_fast_connectable(struct sock *sk, u16 index,
1766                                         unsigned char *data, u16 len)
1767 {
1768         struct hci_dev *hdev;
1769         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1770         struct hci_cp_write_page_scan_activity acp;
1771         u8 type;
1772         int err;
1773
1774         BT_DBG("hci%u", index);
1775
1776         if (len != sizeof(*cp))
1777                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1778                                                                 EINVAL);
1779
1780         hdev = hci_dev_get(index);
1781         if (!hdev)
1782                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1783                                                                 ENODEV);
1784
1785         hci_dev_lock(hdev);
1786
1787         if (cp->enable) {
1788                 type = PAGE_SCAN_TYPE_INTERLACED;
1789                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1790         } else {
1791                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1792                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1793         }
1794
1795         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1796
1797         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1798                                                 sizeof(acp), &acp);
1799         if (err < 0) {
1800                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1801                                                                 -err);
1802                 goto done;
1803         }
1804
1805         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1806         if (err < 0) {
1807                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1808                                                                 -err);
1809                 goto done;
1810         }
1811
1812         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1813                                                         NULL, 0);
1814 done:
1815         hci_dev_unlock(hdev);
1816         hci_dev_put(hdev);
1817
1818         return err;
1819 }
1820
1821 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1822 {
1823         unsigned char *buf;
1824         struct mgmt_hdr *hdr;
1825         u16 opcode, index, len;
1826         int err;
1827
1828         BT_DBG("got %zu bytes", msglen);
1829
1830         if (msglen < sizeof(*hdr))
1831                 return -EINVAL;
1832
1833         buf = kmalloc(msglen, GFP_KERNEL);
1834         if (!buf)
1835                 return -ENOMEM;
1836
1837         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1838                 err = -EFAULT;
1839                 goto done;
1840         }
1841
1842         hdr = (struct mgmt_hdr *) buf;
1843         opcode = get_unaligned_le16(&hdr->opcode);
1844         index = get_unaligned_le16(&hdr->index);
1845         len = get_unaligned_le16(&hdr->len);
1846
1847         if (len != msglen - sizeof(*hdr)) {
1848                 err = -EINVAL;
1849                 goto done;
1850         }
1851
1852         switch (opcode) {
1853         case MGMT_OP_READ_VERSION:
1854                 err = read_version(sk);
1855                 break;
1856         case MGMT_OP_READ_INDEX_LIST:
1857                 err = read_index_list(sk);
1858                 break;
1859         case MGMT_OP_READ_INFO:
1860                 err = read_controller_info(sk, index);
1861                 break;
1862         case MGMT_OP_SET_POWERED:
1863                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1864                 break;
1865         case MGMT_OP_SET_DISCOVERABLE:
1866                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1867                 break;
1868         case MGMT_OP_SET_CONNECTABLE:
1869                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1870                 break;
1871         case MGMT_OP_SET_PAIRABLE:
1872                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1873                 break;
1874         case MGMT_OP_ADD_UUID:
1875                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1876                 break;
1877         case MGMT_OP_REMOVE_UUID:
1878                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1879                 break;
1880         case MGMT_OP_SET_DEV_CLASS:
1881                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1882                 break;
1883         case MGMT_OP_SET_SERVICE_CACHE:
1884                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1885                 break;
1886         case MGMT_OP_LOAD_LINK_KEYS:
1887                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1888                 break;
1889         case MGMT_OP_REMOVE_KEYS:
1890                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1891                 break;
1892         case MGMT_OP_DISCONNECT:
1893                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1894                 break;
1895         case MGMT_OP_GET_CONNECTIONS:
1896                 err = get_connections(sk, index);
1897                 break;
1898         case MGMT_OP_PIN_CODE_REPLY:
1899                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1900                 break;
1901         case MGMT_OP_PIN_CODE_NEG_REPLY:
1902                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1903                 break;
1904         case MGMT_OP_SET_IO_CAPABILITY:
1905                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1906                 break;
1907         case MGMT_OP_PAIR_DEVICE:
1908                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1909                 break;
1910         case MGMT_OP_USER_CONFIRM_REPLY:
1911                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1912                 break;
1913         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1914                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1915                 break;
1916         case MGMT_OP_SET_LOCAL_NAME:
1917                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1918                 break;
1919         case MGMT_OP_READ_LOCAL_OOB_DATA:
1920                 err = read_local_oob_data(sk, index);
1921                 break;
1922         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1923                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1924                 break;
1925         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1926                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1927                                                                         len);
1928                 break;
1929         case MGMT_OP_START_DISCOVERY:
1930                 err = start_discovery(sk, index);
1931                 break;
1932         case MGMT_OP_STOP_DISCOVERY:
1933                 err = stop_discovery(sk, index);
1934                 break;
1935         case MGMT_OP_BLOCK_DEVICE:
1936                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1937                 break;
1938         case MGMT_OP_UNBLOCK_DEVICE:
1939                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1940                 break;
1941         case MGMT_OP_SET_FAST_CONNECTABLE:
1942                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1943                                                                 len);
1944                 break;
1945         default:
1946                 BT_DBG("Unknown op %u", opcode);
1947                 err = cmd_status(sk, index, opcode, 0x01);
1948                 break;
1949         }
1950
1951         if (err < 0)
1952                 goto done;
1953
1954         err = msglen;
1955
1956 done:
1957         kfree(buf);
1958         return err;
1959 }
1960
1961 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1962 {
1963         u8 *status = data;
1964
1965         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1966         mgmt_pending_remove(cmd);
1967 }
1968
1969 int mgmt_index_added(u16 index)
1970 {
1971         return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
1972 }
1973
1974 int mgmt_index_removed(u16 index)
1975 {
1976         u8 status = ENODEV;
1977
1978         mgmt_pending_foreach(0, index, cmd_status_rsp, &status);
1979
1980         return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
1981 }
1982
1983 struct cmd_lookup {
1984         u8 val;
1985         struct sock *sk;
1986 };
1987
1988 static void mode_rsp(struct pending_cmd *cmd, void *data)
1989 {
1990         struct mgmt_mode *cp = cmd->param;
1991         struct cmd_lookup *match = data;
1992
1993         if (cp->val != match->val)
1994                 return;
1995
1996         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1997
1998         list_del(&cmd->list);
1999
2000         if (match->sk == NULL) {
2001                 match->sk = cmd->sk;
2002                 sock_hold(match->sk);
2003         }
2004
2005         mgmt_pending_free(cmd);
2006 }
2007
2008 int mgmt_powered(u16 index, u8 powered)
2009 {
2010         struct mgmt_mode ev;
2011         struct cmd_lookup match = { powered, NULL };
2012         int ret;
2013
2014         mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
2015
2016         if (!powered) {
2017                 u8 status = ENETDOWN;
2018                 mgmt_pending_foreach(0, index, cmd_status_rsp, &status);
2019         }
2020
2021         ev.val = powered;
2022
2023         ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
2024
2025         if (match.sk)
2026                 sock_put(match.sk);
2027
2028         return ret;
2029 }
2030
2031 int mgmt_discoverable(u16 index, u8 discoverable)
2032 {
2033         struct mgmt_mode ev;
2034         struct cmd_lookup match = { discoverable, NULL };
2035         int ret;
2036
2037         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
2038
2039         ev.val = discoverable;
2040
2041         ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
2042                                                                 match.sk);
2043
2044         if (match.sk)
2045                 sock_put(match.sk);
2046
2047         return ret;
2048 }
2049
2050 int mgmt_connectable(u16 index, u8 connectable)
2051 {
2052         struct mgmt_mode ev;
2053         struct cmd_lookup match = { connectable, NULL };
2054         int ret;
2055
2056         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
2057
2058         ev.val = connectable;
2059
2060         ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
2061
2062         if (match.sk)
2063                 sock_put(match.sk);
2064
2065         return ret;
2066 }
2067
2068 int mgmt_write_scan_failed(u16 index, u8 scan, u8 status)
2069 {
2070         if (scan & SCAN_PAGE)
2071                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index,
2072                                                 cmd_status_rsp, &status);
2073
2074         if (scan & SCAN_INQUIRY)
2075                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index,
2076                                                 cmd_status_rsp, &status);
2077
2078         return 0;
2079 }
2080
2081 int mgmt_new_link_key(u16 index, struct link_key *key, u8 persistent)
2082 {
2083         struct mgmt_ev_new_link_key ev;
2084
2085         memset(&ev, 0, sizeof(ev));
2086
2087         ev.store_hint = persistent;
2088         bacpy(&ev.key.bdaddr, &key->bdaddr);
2089         ev.key.type = key->type;
2090         memcpy(ev.key.val, key->val, 16);
2091         ev.key.pin_len = key->pin_len;
2092
2093         return mgmt_event(MGMT_EV_NEW_LINK_KEY, index, &ev, sizeof(ev), NULL);
2094 }
2095
2096 int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type)
2097 {
2098         struct mgmt_addr_info ev;
2099
2100         bacpy(&ev.bdaddr, bdaddr);
2101         ev.type = link_to_mgmt(link_type);
2102
2103         return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
2104 }
2105
2106 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2107 {
2108         struct mgmt_cp_disconnect *cp = cmd->param;
2109         struct sock **sk = data;
2110         struct mgmt_rp_disconnect rp;
2111
2112         bacpy(&rp.bdaddr, &cp->bdaddr);
2113
2114         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2115
2116         *sk = cmd->sk;
2117         sock_hold(*sk);
2118
2119         mgmt_pending_remove(cmd);
2120 }
2121
2122 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr, u8 type)
2123 {
2124         struct mgmt_addr_info ev;
2125         struct sock *sk = NULL;
2126         int err;
2127
2128         mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
2129
2130         bacpy(&ev.bdaddr, bdaddr);
2131         ev.type = link_to_mgmt(type);
2132
2133         err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
2134
2135         if (sk)
2136                 sock_put(sk);
2137
2138         return err;
2139 }
2140
2141 int mgmt_disconnect_failed(u16 index)
2142 {
2143         struct pending_cmd *cmd;
2144         int err;
2145
2146         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
2147         if (!cmd)
2148                 return -ENOENT;
2149
2150         err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
2151
2152         mgmt_pending_remove(cmd);
2153
2154         return err;
2155 }
2156
2157 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 type, u8 status)
2158 {
2159         struct mgmt_ev_connect_failed ev;
2160
2161         bacpy(&ev.addr.bdaddr, bdaddr);
2162         ev.addr.type = link_to_mgmt(type);
2163         ev.status = status;
2164
2165         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
2166 }
2167
2168 int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
2169 {
2170         struct mgmt_ev_pin_code_request ev;
2171
2172         bacpy(&ev.bdaddr, bdaddr);
2173         ev.secure = secure;
2174
2175         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
2176                                                                         NULL);
2177 }
2178
2179 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2180 {
2181         struct pending_cmd *cmd;
2182         struct mgmt_rp_pin_code_reply rp;
2183         int err;
2184
2185         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
2186         if (!cmd)
2187                 return -ENOENT;
2188
2189         bacpy(&rp.bdaddr, bdaddr);
2190         rp.status = status;
2191
2192         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
2193                                                                 sizeof(rp));
2194
2195         mgmt_pending_remove(cmd);
2196
2197         return err;
2198 }
2199
2200 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2201 {
2202         struct pending_cmd *cmd;
2203         struct mgmt_rp_pin_code_reply rp;
2204         int err;
2205
2206         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
2207         if (!cmd)
2208                 return -ENOENT;
2209
2210         bacpy(&rp.bdaddr, bdaddr);
2211         rp.status = status;
2212
2213         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2214                                                                 sizeof(rp));
2215
2216         mgmt_pending_remove(cmd);
2217
2218         return err;
2219 }
2220
2221 int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
2222                                                         u8 confirm_hint)
2223 {
2224         struct mgmt_ev_user_confirm_request ev;
2225
2226         BT_DBG("hci%u", index);
2227
2228         bacpy(&ev.bdaddr, bdaddr);
2229         ev.confirm_hint = confirm_hint;
2230         put_unaligned_le32(value, &ev.value);
2231
2232         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
2233                                                                         NULL);
2234 }
2235
2236 static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
2237                                                                 u8 opcode)
2238 {
2239         struct pending_cmd *cmd;
2240         struct mgmt_rp_user_confirm_reply rp;
2241         int err;
2242
2243         cmd = mgmt_pending_find(opcode, index);
2244         if (!cmd)
2245                 return -ENOENT;
2246
2247         bacpy(&rp.bdaddr, bdaddr);
2248         rp.status = status;
2249         err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
2250
2251         mgmt_pending_remove(cmd);
2252
2253         return err;
2254 }
2255
2256 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2257 {
2258         return confirm_reply_complete(index, bdaddr, status,
2259                                                 MGMT_OP_USER_CONFIRM_REPLY);
2260 }
2261
2262 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2263 {
2264         return confirm_reply_complete(index, bdaddr, status,
2265                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2266 }
2267
2268 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2269 {
2270         struct mgmt_ev_auth_failed ev;
2271
2272         bacpy(&ev.bdaddr, bdaddr);
2273         ev.status = status;
2274
2275         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
2276 }
2277
2278 int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
2279 {
2280         struct pending_cmd *cmd;
2281         struct hci_dev *hdev;
2282         struct mgmt_cp_set_local_name ev;
2283         int err;
2284
2285         memset(&ev, 0, sizeof(ev));
2286         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2287
2288         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
2289         if (!cmd)
2290                 goto send_event;
2291
2292         if (status) {
2293                 err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
2294                 goto failed;
2295         }
2296
2297         hdev = hci_dev_get(index);
2298         if (hdev) {
2299                 hci_dev_lock_bh(hdev);
2300                 update_eir(hdev);
2301                 hci_dev_unlock_bh(hdev);
2302                 hci_dev_put(hdev);
2303         }
2304
2305         err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
2306                                                                 sizeof(ev));
2307         if (err < 0)
2308                 goto failed;
2309
2310 send_event:
2311         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
2312                                                         cmd ? cmd->sk : NULL);
2313
2314 failed:
2315         if (cmd)
2316                 mgmt_pending_remove(cmd);
2317         return err;
2318 }
2319
2320 int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
2321                                                                 u8 status)
2322 {
2323         struct pending_cmd *cmd;
2324         int err;
2325
2326         BT_DBG("hci%u status %u", index, status);
2327
2328         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
2329         if (!cmd)
2330                 return -ENOENT;
2331
2332         if (status) {
2333                 err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2334                                                                         EIO);
2335         } else {
2336                 struct mgmt_rp_read_local_oob_data rp;
2337
2338                 memcpy(rp.hash, hash, sizeof(rp.hash));
2339                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2340
2341                 err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2342                                                         &rp, sizeof(rp));
2343         }
2344
2345         mgmt_pending_remove(cmd);
2346
2347         return err;
2348 }
2349
2350 int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 type, u8 *dev_class,
2351                                                         s8 rssi, u8 *eir)
2352 {
2353         struct mgmt_ev_device_found ev;
2354
2355         memset(&ev, 0, sizeof(ev));
2356
2357         bacpy(&ev.addr.bdaddr, bdaddr);
2358         ev.addr.type = link_to_mgmt(type);
2359         ev.rssi = rssi;
2360
2361         if (eir)
2362                 memcpy(ev.eir, eir, sizeof(ev.eir));
2363
2364         if (dev_class)
2365                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2366
2367         return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
2368 }
2369
2370 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
2371 {
2372         struct mgmt_ev_remote_name ev;
2373
2374         memset(&ev, 0, sizeof(ev));
2375
2376         bacpy(&ev.bdaddr, bdaddr);
2377         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2378
2379         return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
2380 }
2381
2382 int mgmt_inquiry_failed(u16 index, u8 status)
2383 {
2384         struct pending_cmd *cmd;
2385         int err;
2386
2387         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, index);
2388         if (!cmd)
2389                 return -ENOENT;
2390
2391         err = cmd_status(cmd->sk, index, cmd->opcode, status);
2392         mgmt_pending_remove(cmd);
2393
2394         return err;
2395 }
2396
2397 int mgmt_discovering(u16 index, u8 discovering)
2398 {
2399         struct pending_cmd *cmd;
2400
2401         if (discovering)
2402                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, index);
2403         else
2404                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, index);
2405
2406         if (cmd != NULL) {
2407                 cmd_complete(cmd->sk, index, cmd->opcode, NULL, 0);
2408                 mgmt_pending_remove(cmd);
2409         }
2410
2411         return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
2412                                                 sizeof(discovering), NULL);
2413 }
2414
2415 int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr)
2416 {
2417         struct pending_cmd *cmd;
2418         struct mgmt_ev_device_blocked ev;
2419
2420         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, index);
2421
2422         bacpy(&ev.bdaddr, bdaddr);
2423
2424         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, index, &ev, sizeof(ev),
2425                                                 cmd ? cmd->sk : NULL);
2426 }
2427
2428 int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr)
2429 {
2430         struct pending_cmd *cmd;
2431         struct mgmt_ev_device_unblocked ev;
2432
2433         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, index);
2434
2435         bacpy(&ev.bdaddr, bdaddr);
2436
2437         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, index, &ev, sizeof(ev),
2438                                                 cmd ? cmd->sk : NULL);
2439 }