Pileus Git - ~andy/linux/blob - net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #define MGMT_VERSION    0
  35 #define MGMT_REVISION   1
  36
  37 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  38
  39 struct pending_cmd {
  40         struct list_head list;
  41         u16 opcode;
  42         int index;
  43         void *param;
  44         struct sock *sk;
  45         void *user_data;
  46 };
  47
  48 /* HCI to MGMT error code conversion table */
  49 static u8 mgmt_status_table[] = {
  50         MGMT_STATUS_SUCCESS,
  51         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  52         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  53         MGMT_STATUS_FAILED,             /* Hardware Failure */
  54         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  55         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  56         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  57         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  58         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  59         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  60         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  61         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  62         MGMT_STATUS_BUSY,               /* Command Disallowed */
  63         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  64         MGMT_STATUS_REJECTED,           /* Rejected Security */
  65         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  66         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  67         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  68         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  69         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  70         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  71         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  72         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  73         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  74         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  75         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  76         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  77         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  78         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  79         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  80         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  81         MGMT_STATUS_FAILED,             /* Unspecified Error */
  82         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  83         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  84         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  85         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  86         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  87         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
  88         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
  89         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
  90         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
  91         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
  92         MGMT_STATUS_FAILED,             /* Transaction Collision */
  93         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
  94         MGMT_STATUS_REJECTED,           /* QoS Rejected */
  95         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
  96         MGMT_STATUS_REJECTED,           /* Insufficient Security */
  97         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
  98         MGMT_STATUS_BUSY,               /* Role Switch Pending */
  99         MGMT_STATUS_FAILED,             /* Slot Violation */
 100         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 101         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 102         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 103         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 104         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 105         MGMT_STATUS_BUSY,               /* Controller Busy */
 106         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 107         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 108         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 109         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 110         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 111 };
 112
 113 static u8 mgmt_status(u8 hci_status)
 114 {
 115         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 116                 return mgmt_status_table[hci_status];
 117
 118         return MGMT_STATUS_FAILED;
 119 }
 120
 121 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 122 {
 123         struct sk_buff *skb;
 124         struct mgmt_hdr *hdr;
 125         struct mgmt_ev_cmd_status *ev;
 126         int err;
 127
 128         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 129
 130         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 131         if (!skb)
 132                 return -ENOMEM;
 133
 134         hdr = (void *) skb_put(skb, sizeof(*hdr));
 135
 136         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 137         hdr->index = cpu_to_le16(index);
 138         hdr->len = cpu_to_le16(sizeof(*ev));
 139
 140         ev = (void *) skb_put(skb, sizeof(*ev));
 141         ev->status = status;
 142         put_unaligned_le16(cmd, &ev->opcode);
 143
 144         err = sock_queue_rcv_skb(sk, skb);
 145         if (err < 0)
 146                 kfree_skb(skb);
 147
 148         return err;
 149 }
 150
 151 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 152                                                                 size_t rp_len)
 153 {
 154         struct sk_buff *skb;
 155         struct mgmt_hdr *hdr;
 156         struct mgmt_ev_cmd_complete *ev;
 157         int err;
 158
 159         BT_DBG("sock %p", sk);
 160
 161         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 162         if (!skb)
 163                 return -ENOMEM;
 164
 165         hdr = (void *) skb_put(skb, sizeof(*hdr));
 166
 167         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 168         hdr->index = cpu_to_le16(index);
 169         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 170
 171         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 172         put_unaligned_le16(cmd, &ev->opcode);
 173
 174         if (rp)
 175                 memcpy(ev->data, rp, rp_len);
 176
 177         err = sock_queue_rcv_skb(sk, skb);
 178         if (err < 0)
 179                 kfree_skb(skb);
 180
 181         return err;;
 182 }
 183
 184 static int read_version(struct sock *sk)
 185 {
 186         struct mgmt_rp_read_version rp;
 187
 188         BT_DBG("sock %p", sk);
 189
 190         rp.version = MGMT_VERSION;
 191         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 192
 193         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 194                                                                 sizeof(rp));
 195 }
 196
 197 static int read_index_list(struct sock *sk)
 198 {
 199         struct mgmt_rp_read_index_list *rp;
 200         struct list_head *p;
 201         struct hci_dev *d;
 202         size_t rp_len;
 203         u16 count;
 204         int i, err;
 205
 206         BT_DBG("sock %p", sk);
 207
 208         read_lock(&hci_dev_list_lock);
 209
 210         count = 0;
 211         list_for_each(p, &hci_dev_list) {
 212                 count++;
 213         }
 214
 215         rp_len = sizeof(*rp) + (2 * count);
 216         rp = kmalloc(rp_len, GFP_ATOMIC);
 217         if (!rp) {
 218                 read_unlock(&hci_dev_list_lock);
 219                 return -ENOMEM;
 220         }
 221
 222         put_unaligned_le16(count, &rp->num_controllers);
 223
 224         i = 0;
 225         list_for_each_entry(d, &hci_dev_list, list) {
 226                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 227                         cancel_delayed_work(&d->power_off);
 228
 229                 if (test_bit(HCI_SETUP, &d->flags))
 230                         continue;
 231
 232                 put_unaligned_le16(d->id, &rp->index[i++]);
 233                 BT_DBG("Added hci%u", d->id);
 234         }
 235
 236         read_unlock(&hci_dev_list_lock);
 237
 238         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 239                                                                         rp_len);
 240
 241         kfree(rp);
 242
 243         return err;
 244 }
 245
 246 static int read_controller_info(struct sock *sk, u16 index)
 247 {
 248         struct mgmt_rp_read_info rp;
 249         struct hci_dev *hdev;
 250
 251         BT_DBG("sock %p hci%u", sk, index);
 252
 253         hdev = hci_dev_get(index);
 254         if (!hdev)
 255                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 256                                                 MGMT_STATUS_INVALID_PARAMS);
 257
 258         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 259                 cancel_delayed_work_sync(&hdev->power_off);
 260
 261         hci_dev_lock_bh(hdev);
 262
 263         set_bit(HCI_MGMT, &hdev->flags);
 264
 265         memset(&rp, 0, sizeof(rp));
 266
 267         rp.type = hdev->dev_type;
 268
 269         rp.powered = test_bit(HCI_UP, &hdev->flags);
 270         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 271         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 272         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 273
 274         if (test_bit(HCI_AUTH, &hdev->flags))
 275                 rp.sec_mode = 3;
 276         else if (hdev->ssp_mode > 0)
 277                 rp.sec_mode = 4;
 278         else
 279                 rp.sec_mode = 2;
 280
 281         bacpy(&rp.bdaddr, &hdev->bdaddr);
 282         memcpy(rp.features, hdev->features, 8);
 283         memcpy(rp.dev_class, hdev->dev_class, 3);
 284         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 285         rp.hci_ver = hdev->hci_ver;
 286         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 287
 288         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 289
 290         hci_dev_unlock_bh(hdev);
 291         hci_dev_put(hdev);
 292
 293         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 294 }
 295
 296 static void mgmt_pending_free(struct pending_cmd *cmd)
 297 {
 298         sock_put(cmd->sk);
 299         kfree(cmd->param);
 300         kfree(cmd);
 301 }
 302
 303 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 304                                                         struct hci_dev *hdev,
 305                                                         void *data, u16 len)
 306 {
 307         struct pending_cmd *cmd;
 308
 309         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 310         if (!cmd)
 311                 return NULL;
 312
 313         cmd->opcode = opcode;
 314         cmd->index = hdev->id;
 315
 316         cmd->param = kmalloc(len, GFP_ATOMIC);
 317         if (!cmd->param) {
 318                 kfree(cmd);
 319                 return NULL;
 320         }
 321
 322         if (data)
 323                 memcpy(cmd->param, data, len);
 324
 325         cmd->sk = sk;
 326         sock_hold(sk);
 327
 328         list_add(&cmd->list, &hdev->mgmt_pending);
 329
 330         return cmd;
 331 }
 332
 333 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 334                                 void (*cb)(struct pending_cmd *cmd, void *data),
 335                                 void *data)
 336 {
 337         struct list_head *p, *n;
 338
 339         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 340                 struct pending_cmd *cmd;
 341
 342                 cmd = list_entry(p, struct pending_cmd, list);
 343
 344                 if (opcode > 0 && cmd->opcode != opcode)
 345                         continue;
 346
 347                 cb(cmd, data);
 348         }
 349 }
 350
 351 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 352 {
 353         struct pending_cmd *cmd;
 354
 355         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 356                 if (cmd->opcode == opcode)
 357                         return cmd;
 358         }
 359
 360         return NULL;
 361 }
 362
 363 static void mgmt_pending_remove(struct pending_cmd *cmd)
 364 {
 365         list_del(&cmd->list);
 366         mgmt_pending_free(cmd);
 367 }
 368
 369 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 370 {
 371         struct mgmt_mode rp;
 372
 373         rp.val = val;
 374
 375         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 376 }
 377
 378 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 379 {
 380         struct mgmt_mode *cp;
 381         struct hci_dev *hdev;
 382         struct pending_cmd *cmd;
 383         int err, up;
 384
 385         cp = (void *) data;
 386
 387         BT_DBG("request for hci%u", index);
 388
 389         if (len != sizeof(*cp))
 390                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 391                                                 MGMT_STATUS_INVALID_PARAMS);
 392
 393         hdev = hci_dev_get(index);
 394         if (!hdev)
 395                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 396                                                 MGMT_STATUS_INVALID_PARAMS);
 397
 398         hci_dev_lock_bh(hdev);
 399
 400         up = test_bit(HCI_UP, &hdev->flags);
 401         if ((cp->val && up) || (!cp->val && !up)) {
 402                 err = send_mode_rsp(sk, index, MGMT_OP_SET_POWERED, cp->val);
 403                 goto failed;
 404         }
 405
 406         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 407                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 408                                                         MGMT_STATUS_BUSY);
 409                 goto failed;
 410         }
 411
 412         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 413         if (!cmd) {
 414                 err = -ENOMEM;
 415                 goto failed;
 416         }
 417
 418         if (cp->val)
 419                 queue_work(hdev->workqueue, &hdev->power_on);
 420         else
 421                 queue_work(hdev->workqueue, &hdev->power_off.work);
 422
 423         err = 0;
 424
 425 failed:
 426         hci_dev_unlock_bh(hdev);
 427         hci_dev_put(hdev);
 428         return err;
 429 }
 430
 431 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 432                                                                         u16 len)
 433 {
 434         struct mgmt_cp_set_discoverable *cp;
 435         struct hci_dev *hdev;
 436         struct pending_cmd *cmd;
 437         u8 scan;
 438         int err;
 439
 440         cp = (void *) data;
 441
 442         BT_DBG("request for hci%u", index);
 443
 444         if (len != sizeof(*cp))
 445                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 446                                                 MGMT_STATUS_INVALID_PARAMS);
 447
 448         hdev = hci_dev_get(index);
 449         if (!hdev)
 450                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 451                                                 MGMT_STATUS_INVALID_PARAMS);
 452
 453         hci_dev_lock_bh(hdev);
 454
 455         if (!test_bit(HCI_UP, &hdev->flags)) {
 456                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 457                                                 MGMT_STATUS_NOT_POWERED);
 458                 goto failed;
 459         }
 460
 461         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 462                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 463                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 464                                                         MGMT_STATUS_BUSY);
 465                 goto failed;
 466         }
 467
 468         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 469                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 470                 err = send_mode_rsp(sk, index, MGMT_OP_SET_DISCOVERABLE,
 471                                                                 cp->val);
 472                 goto failed;
 473         }
 474
 475         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 476         if (!cmd) {
 477                 err = -ENOMEM;
 478                 goto failed;
 479         }
 480
 481         scan = SCAN_PAGE;
 482
 483         if (cp->val)
 484                 scan |= SCAN_INQUIRY;
 485         else
 486                 cancel_delayed_work(&hdev->discov_off);
 487
 488         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 489         if (err < 0)
 490                 mgmt_pending_remove(cmd);
 491
 492         if (cp->val)
 493                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 494
 495 failed:
 496         hci_dev_unlock_bh(hdev);
 497         hci_dev_put(hdev);
 498
 499         return err;
 500 }
 501
 502 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 503                                                                         u16 len)
 504 {
 505         struct mgmt_mode *cp;
 506         struct hci_dev *hdev;
 507         struct pending_cmd *cmd;
 508         u8 scan;
 509         int err;
 510
 511         cp = (void *) data;
 512
 513         BT_DBG("request for hci%u", index);
 514
 515         if (len != sizeof(*cp))
 516                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 517                                                 MGMT_STATUS_INVALID_PARAMS);
 518
 519         hdev = hci_dev_get(index);
 520         if (!hdev)
 521                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 522                                                 MGMT_STATUS_INVALID_PARAMS);
 523
 524         hci_dev_lock_bh(hdev);
 525
 526         if (!test_bit(HCI_UP, &hdev->flags)) {
 527                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 528                                                 MGMT_STATUS_NOT_POWERED);
 529                 goto failed;
 530         }
 531
 532         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 533                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 534                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 535                                                         MGMT_STATUS_BUSY);
 536                 goto failed;
 537         }
 538
 539         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 540                 err = send_mode_rsp(sk, index, MGMT_OP_SET_CONNECTABLE,
 541                                                                 cp->val);
 542                 goto failed;
 543         }
 544
 545         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 546         if (!cmd) {
 547                 err = -ENOMEM;
 548                 goto failed;
 549         }
 550
 551         if (cp->val)
 552                 scan = SCAN_PAGE;
 553         else
 554                 scan = 0;
 555
 556         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 557         if (err < 0)
 558                 mgmt_pending_remove(cmd);
 559
 560 failed:
 561         hci_dev_unlock_bh(hdev);
 562         hci_dev_put(hdev);
 563
 564         return err;
 565 }
 566
 567 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 568                                         u16 data_len, struct sock *skip_sk)
 569 {
 570         struct sk_buff *skb;
 571         struct mgmt_hdr *hdr;
 572
 573         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 574         if (!skb)
 575                 return -ENOMEM;
 576
 577         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 578
 579         hdr = (void *) skb_put(skb, sizeof(*hdr));
 580         hdr->opcode = cpu_to_le16(event);
 581         if (hdev)
 582                 hdr->index = cpu_to_le16(hdev->id);
 583         else
 584                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 585         hdr->len = cpu_to_le16(data_len);
 586
 587         if (data)
 588                 memcpy(skb_put(skb, data_len), data, data_len);
 589
 590         hci_send_to_sock(NULL, skb, skip_sk);
 591         kfree_skb(skb);
 592
 593         return 0;
 594 }
 595
 596 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 597                                                                         u16 len)
 598 {
 599         struct mgmt_mode *cp, ev;
 600         struct hci_dev *hdev;
 601         int err;
 602
 603         cp = (void *) data;
 604
 605         BT_DBG("request for hci%u", index);
 606
 607         if (len != sizeof(*cp))
 608                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 609                                                 MGMT_STATUS_INVALID_PARAMS);
 610
 611         hdev = hci_dev_get(index);
 612         if (!hdev)
 613                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 614                                                 MGMT_STATUS_INVALID_PARAMS);
 615
 616         hci_dev_lock_bh(hdev);
 617
 618         if (cp->val)
 619                 set_bit(HCI_PAIRABLE, &hdev->flags);
 620         else
 621                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 622
 623         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 624         if (err < 0)
 625                 goto failed;
 626
 627         ev.val = cp->val;
 628
 629         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 630
 631 failed:
 632         hci_dev_unlock_bh(hdev);
 633         hci_dev_put(hdev);
 634
 635         return err;
 636 }
 637
 638 #define EIR_FLAGS               0x01 /* flags */
 639 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 640 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 641 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 642 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 643 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 644 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 645 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 646 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 647 #define EIR_TX_POWER            0x0A /* transmit power level */
 648 #define EIR_DEVICE_ID           0x10 /* device ID */
 649
 650 #define PNP_INFO_SVCLASS_ID             0x1200
 651
 652 static u8 bluetooth_base_uuid[] = {
 653                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 654                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 655 };
 656
 657 static u16 get_uuid16(u8 *uuid128)
 658 {
 659         u32 val;
 660         int i;
 661
 662         for (i = 0; i < 12; i++) {
 663                 if (bluetooth_base_uuid[i] != uuid128[i])
 664                         return 0;
 665         }
 666
 667         memcpy(&val, &uuid128[12], 4);
 668
 669         val = le32_to_cpu(val);
 670         if (val > 0xffff)
 671                 return 0;
 672
 673         return (u16) val;
 674 }
 675
 676 static void create_eir(struct hci_dev *hdev, u8 *data)
 677 {
 678         u8 *ptr = data;
 679         u16 eir_len = 0;
 680         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 681         int i, truncated = 0;
 682         struct bt_uuid *uuid;
 683         size_t name_len;
 684
 685         name_len = strlen(hdev->dev_name);
 686
 687         if (name_len > 0) {
 688                 /* EIR Data type */
 689                 if (name_len > 48) {
 690                         name_len = 48;
 691                         ptr[1] = EIR_NAME_SHORT;
 692                 } else
 693                         ptr[1] = EIR_NAME_COMPLETE;
 694
 695                 /* EIR Data length */
 696                 ptr[0] = name_len + 1;
 697
 698                 memcpy(ptr + 2, hdev->dev_name, name_len);
 699
 700                 eir_len += (name_len + 2);
 701                 ptr += (name_len + 2);
 702         }
 703
 704         memset(uuid16_list, 0, sizeof(uuid16_list));
 705
 706         /* Group all UUID16 types */
 707         list_for_each_entry(uuid, &hdev->uuids, list) {
 708                 u16 uuid16;
 709
 710                 uuid16 = get_uuid16(uuid->uuid);
 711                 if (uuid16 == 0)
 712                         return;
 713
 714                 if (uuid16 < 0x1100)
 715                         continue;
 716
 717                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 718                         continue;
 719
 720                 /* Stop if not enough space to put next UUID */
 721                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 722                         truncated = 1;
 723                         break;
 724                 }
 725
 726                 /* Check for duplicates */
 727                 for (i = 0; uuid16_list[i] != 0; i++)
 728                         if (uuid16_list[i] == uuid16)
 729                                 break;
 730
 731                 if (uuid16_list[i] == 0) {
 732                         uuid16_list[i] = uuid16;
 733                         eir_len += sizeof(u16);
 734                 }
 735         }
 736
 737         if (uuid16_list[0] != 0) {
 738                 u8 *length = ptr;
 739
 740                 /* EIR Data type */
 741                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 742
 743                 ptr += 2;
 744                 eir_len += 2;
 745
 746                 for (i = 0; uuid16_list[i] != 0; i++) {
 747                         *ptr++ = (uuid16_list[i] & 0x00ff);
 748                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 749                 }
 750
 751                 /* EIR Data length */
 752                 *length = (i * sizeof(u16)) + 1;
 753         }
 754 }
 755
 756 static int update_eir(struct hci_dev *hdev)
 757 {
 758         struct hci_cp_write_eir cp;
 759
 760         if (!(hdev->features[6] & LMP_EXT_INQ))
 761                 return 0;
 762
 763         if (hdev->ssp_mode == 0)
 764                 return 0;
 765
 766         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 767                 return 0;
 768
 769         memset(&cp, 0, sizeof(cp));
 770
 771         create_eir(hdev, cp.data);
 772
 773         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 774                 return 0;
 775
 776         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 777
 778         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 779 }
 780
 781 static u8 get_service_classes(struct hci_dev *hdev)
 782 {
 783         struct bt_uuid *uuid;
 784         u8 val = 0;
 785
 786         list_for_each_entry(uuid, &hdev->uuids, list)
 787                 val |= uuid->svc_hint;
 788
 789         return val;
 790 }
 791
 792 static int update_class(struct hci_dev *hdev)
 793 {
 794         u8 cod[3];
 795
 796         BT_DBG("%s", hdev->name);
 797
 798         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 799                 return 0;
 800
 801         cod[0] = hdev->minor_class;
 802         cod[1] = hdev->major_class;
 803         cod[2] = get_service_classes(hdev);
 804
 805         if (memcmp(cod, hdev->dev_class, 3) == 0)
 806                 return 0;
 807
 808         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 809 }
 810
 811 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 812 {
 813         struct mgmt_cp_add_uuid *cp;
 814         struct hci_dev *hdev;
 815         struct bt_uuid *uuid;
 816         int err;
 817
 818         cp = (void *) data;
 819
 820         BT_DBG("request for hci%u", index);
 821
 822         if (len != sizeof(*cp))
 823                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 824                                                 MGMT_STATUS_INVALID_PARAMS);
 825
 826         hdev = hci_dev_get(index);
 827         if (!hdev)
 828                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 829                                                 MGMT_STATUS_INVALID_PARAMS);
 830
 831         hci_dev_lock_bh(hdev);
 832
 833         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 834         if (!uuid) {
 835                 err = -ENOMEM;
 836                 goto failed;
 837         }
 838
 839         memcpy(uuid->uuid, cp->uuid, 16);
 840         uuid->svc_hint = cp->svc_hint;
 841
 842         list_add(&uuid->list, &hdev->uuids);
 843
 844         err = update_class(hdev);
 845         if (err < 0)
 846                 goto failed;
 847
 848         err = update_eir(hdev);
 849         if (err < 0)
 850                 goto failed;
 851
 852         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 853
 854 failed:
 855         hci_dev_unlock_bh(hdev);
 856         hci_dev_put(hdev);
 857
 858         return err;
 859 }
 860
 861 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 862 {
 863         struct list_head *p, *n;
 864         struct mgmt_cp_remove_uuid *cp;
 865         struct hci_dev *hdev;
 866         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 867         int err, found;
 868
 869         cp = (void *) data;
 870
 871         BT_DBG("request for hci%u", index);
 872
 873         if (len != sizeof(*cp))
 874                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 875                                                 MGMT_STATUS_INVALID_PARAMS);
 876
 877         hdev = hci_dev_get(index);
 878         if (!hdev)
 879                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 880                                                 MGMT_STATUS_INVALID_PARAMS);
 881
 882         hci_dev_lock_bh(hdev);
 883
 884         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 885                 err = hci_uuids_clear(hdev);
 886                 goto unlock;
 887         }
 888
 889         found = 0;
 890
 891         list_for_each_safe(p, n, &hdev->uuids) {
 892                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 893
 894                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 895                         continue;
 896
 897                 list_del(&match->list);
 898                 found++;
 899         }
 900
 901         if (found == 0) {
 902                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 903                                                 MGMT_STATUS_INVALID_PARAMS);
 904                 goto unlock;
 905         }
 906
 907         err = update_class(hdev);
 908         if (err < 0)
 909                 goto unlock;
 910
 911         err = update_eir(hdev);
 912         if (err < 0)
 913                 goto unlock;
 914
 915         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 916
 917 unlock:
 918         hci_dev_unlock_bh(hdev);
 919         hci_dev_put(hdev);
 920
 921         return err;
 922 }
 923
 924 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 925                                                                         u16 len)
 926 {
 927         struct hci_dev *hdev;
 928         struct mgmt_cp_set_dev_class *cp;
 929         int err;
 930
 931         cp = (void *) data;
 932
 933         BT_DBG("request for hci%u", index);
 934
 935         if (len != sizeof(*cp))
 936                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 937                                                 MGMT_STATUS_INVALID_PARAMS);
 938
 939         hdev = hci_dev_get(index);
 940         if (!hdev)
 941                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 942                                                 MGMT_STATUS_INVALID_PARAMS);
 943
 944         hci_dev_lock_bh(hdev);
 945
 946         hdev->major_class = cp->major;
 947         hdev->minor_class = cp->minor;
 948
 949         err = update_class(hdev);
 950
 951         if (err == 0)
 952                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 953
 954         hci_dev_unlock_bh(hdev);
 955         hci_dev_put(hdev);
 956
 957         return err;
 958 }
 959
 960 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 961                                                                         u16 len)
 962 {
 963         struct hci_dev *hdev;
 964         struct mgmt_cp_set_service_cache *cp;
 965         int err;
 966
 967         cp = (void *) data;
 968
 969         if (len != sizeof(*cp))
 970                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
 971                                                 MGMT_STATUS_INVALID_PARAMS);
 972
 973         hdev = hci_dev_get(index);
 974         if (!hdev)
 975                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
 976                                                 MGMT_STATUS_INVALID_PARAMS);
 977
 978         hci_dev_lock_bh(hdev);
 979
 980         BT_DBG("hci%u enable %d", index, cp->enable);
 981
 982         if (cp->enable) {
 983                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 984                 err = 0;
 985         } else {
 986                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 987                 err = update_class(hdev);
 988                 if (err == 0)
 989                         err = update_eir(hdev);
 990         }
 991
 992         if (err == 0)
 993                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 994                                                                         0);
 995         else
 996                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 997
 998
 999         hci_dev_unlock_bh(hdev);
1000         hci_dev_put(hdev);
1001
1002         return err;
1003 }
1004
1005 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
1006                                                                 u16 len)
1007 {
1008         struct hci_dev *hdev;
1009         struct mgmt_cp_load_link_keys *cp;
1010         u16 key_count, expected_len;
1011         int i;
1012
1013         cp = (void *) data;
1014
1015         if (len < sizeof(*cp))
1016                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1017                                                 MGMT_STATUS_INVALID_PARAMS);
1018
1019         key_count = get_unaligned_le16(&cp->key_count);
1020
1021         expected_len = sizeof(*cp) + key_count *
1022                                         sizeof(struct mgmt_link_key_info);
1023         if (expected_len != len) {
1024                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1025                                                         len, expected_len);
1026                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1027                                                 MGMT_STATUS_INVALID_PARAMS);
1028         }
1029
1030         hdev = hci_dev_get(index);
1031         if (!hdev)
1032                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1033                                                 MGMT_STATUS_INVALID_PARAMS);
1034
1035         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1036                                                                 key_count);
1037
1038         hci_dev_lock_bh(hdev);
1039
1040         hci_link_keys_clear(hdev);
1041
1042         set_bit(HCI_LINK_KEYS, &hdev->flags);
1043
1044         if (cp->debug_keys)
1045                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
1046         else
1047                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
1048
1049         for (i = 0; i < key_count; i++) {
1050                 struct mgmt_link_key_info *key = &cp->keys[i];
1051
1052                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1053                                                                 key->pin_len);
1054         }
1055
1056         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1057
1058         hci_dev_unlock_bh(hdev);
1059         hci_dev_put(hdev);
1060
1061         return 0;
1062 }
1063
1064 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
1065                                                                 u16 len)
1066 {
1067         struct hci_dev *hdev;
1068         struct mgmt_cp_remove_keys *cp;
1069         struct mgmt_rp_remove_keys rp;
1070         struct hci_cp_disconnect dc;
1071         struct pending_cmd *cmd;
1072         struct hci_conn *conn;
1073         int err;
1074
1075         cp = (void *) data;
1076
1077         if (len != sizeof(*cp))
1078                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1079                                                 MGMT_STATUS_INVALID_PARAMS);
1080
1081         hdev = hci_dev_get(index);
1082         if (!hdev)
1083                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1084                                                 MGMT_STATUS_INVALID_PARAMS);
1085
1086         hci_dev_lock_bh(hdev);
1087
1088         memset(&rp, 0, sizeof(rp));
1089         bacpy(&rp.bdaddr, &cp->bdaddr);
1090         rp.status = MGMT_STATUS_FAILED;
1091
1092         err = hci_remove_link_key(hdev, &cp->bdaddr);
1093         if (err < 0) {
1094                 rp.status = MGMT_STATUS_NOT_PAIRED;
1095                 goto unlock;
1096         }
1097
1098         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1099                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1100                                                                 sizeof(rp));
1101                 goto unlock;
1102         }
1103
1104         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1105         if (!conn) {
1106                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1107                                                                 sizeof(rp));
1108                 goto unlock;
1109         }
1110
1111         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1112         if (!cmd) {
1113                 err = -ENOMEM;
1114                 goto unlock;
1115         }
1116
1117         put_unaligned_le16(conn->handle, &dc.handle);
1118         dc.reason = 0x13; /* Remote User Terminated Connection */
1119         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1120         if (err < 0)
1121                 mgmt_pending_remove(cmd);
1122
1123 unlock:
1124         if (err < 0)
1125                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1126                                                                 sizeof(rp));
1127         hci_dev_unlock_bh(hdev);
1128         hci_dev_put(hdev);
1129
1130         return err;
1131 }
1132
1133 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1134 {
1135         struct hci_dev *hdev;
1136         struct mgmt_cp_disconnect *cp;
1137         struct hci_cp_disconnect dc;
1138         struct pending_cmd *cmd;
1139         struct hci_conn *conn;
1140         int err;
1141
1142         BT_DBG("");
1143
1144         cp = (void *) data;
1145
1146         if (len != sizeof(*cp))
1147                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1148                                                 MGMT_STATUS_INVALID_PARAMS);
1149
1150         hdev = hci_dev_get(index);
1151         if (!hdev)
1152                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1153                                                 MGMT_STATUS_INVALID_PARAMS);
1154
1155         hci_dev_lock_bh(hdev);
1156
1157         if (!test_bit(HCI_UP, &hdev->flags)) {
1158                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1159                                                 MGMT_STATUS_NOT_POWERED);
1160                 goto failed;
1161         }
1162
1163         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1164                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1165                                                         MGMT_STATUS_BUSY);
1166                 goto failed;
1167         }
1168
1169         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1170         if (!conn)
1171                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1172
1173         if (!conn) {
1174                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1175                                                 MGMT_STATUS_NOT_CONNECTED);
1176                 goto failed;
1177         }
1178
1179         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1180         if (!cmd) {
1181                 err = -ENOMEM;
1182                 goto failed;
1183         }
1184
1185         put_unaligned_le16(conn->handle, &dc.handle);
1186         dc.reason = 0x13; /* Remote User Terminated Connection */
1187
1188         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1189         if (err < 0)
1190                 mgmt_pending_remove(cmd);
1191
1192 failed:
1193         hci_dev_unlock_bh(hdev);
1194         hci_dev_put(hdev);
1195
1196         return err;
1197 }
1198
1199 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1200 {
1201         switch (link_type) {
1202         case LE_LINK:
1203                 switch (addr_type) {
1204                 case ADDR_LE_DEV_PUBLIC:
1205                         return MGMT_ADDR_LE_PUBLIC;
1206                 case ADDR_LE_DEV_RANDOM:
1207                         return MGMT_ADDR_LE_RANDOM;
1208                 default:
1209                         return MGMT_ADDR_INVALID;
1210                 }
1211         case ACL_LINK:
1212                 return MGMT_ADDR_BREDR;
1213         default:
1214                 return MGMT_ADDR_INVALID;
1215         }
1216 }
1217
1218 static int get_connections(struct sock *sk, u16 index)
1219 {
1220         struct mgmt_rp_get_connections *rp;
1221         struct hci_dev *hdev;
1222         struct hci_conn *c;
1223         struct list_head *p;
1224         size_t rp_len;
1225         u16 count;
1226         int i, err;
1227
1228         BT_DBG("");
1229
1230         hdev = hci_dev_get(index);
1231         if (!hdev)
1232                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1233                                                 MGMT_STATUS_INVALID_PARAMS);
1234
1235         hci_dev_lock_bh(hdev);
1236
1237         count = 0;
1238         list_for_each(p, &hdev->conn_hash.list) {
1239                 count++;
1240         }
1241
1242         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1243         rp = kmalloc(rp_len, GFP_ATOMIC);
1244         if (!rp) {
1245                 err = -ENOMEM;
1246                 goto unlock;
1247         }
1248
1249         put_unaligned_le16(count, &rp->conn_count);
1250
1251         i = 0;
1252         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1253                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1254                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1255                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1256                         continue;
1257                 i++;
1258         }
1259
1260         /* Recalculate length in case of filtered SCO connections, etc */
1261         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1262
1263         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1264
1265 unlock:
1266         kfree(rp);
1267         hci_dev_unlock_bh(hdev);
1268         hci_dev_put(hdev);
1269         return err;
1270 }
1271
1272 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1273                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1274 {
1275         struct pending_cmd *cmd;
1276         int err;
1277
1278         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1279                                                                 sizeof(*cp));
1280         if (!cmd)
1281                 return -ENOMEM;
1282
1283         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1284                                                                 &cp->bdaddr);
1285         if (err < 0)
1286                 mgmt_pending_remove(cmd);
1287
1288         return err;
1289 }
1290
1291 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1292                                                                         u16 len)
1293 {
1294         struct hci_dev *hdev;
1295         struct hci_conn *conn;
1296         struct mgmt_cp_pin_code_reply *cp;
1297         struct mgmt_cp_pin_code_neg_reply ncp;
1298         struct hci_cp_pin_code_reply reply;
1299         struct pending_cmd *cmd;
1300         int err;
1301
1302         BT_DBG("");
1303
1304         cp = (void *) data;
1305
1306         if (len != sizeof(*cp))
1307                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1308                                                 MGMT_STATUS_INVALID_PARAMS);
1309
1310         hdev = hci_dev_get(index);
1311         if (!hdev)
1312                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1313                                                 MGMT_STATUS_INVALID_PARAMS);
1314
1315         hci_dev_lock_bh(hdev);
1316
1317         if (!test_bit(HCI_UP, &hdev->flags)) {
1318                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1319                                                 MGMT_STATUS_NOT_POWERED);
1320                 goto failed;
1321         }
1322
1323         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1324         if (!conn) {
1325                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1326                                                 MGMT_STATUS_NOT_CONNECTED);
1327                 goto failed;
1328         }
1329
1330         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1331                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1332
1333                 BT_ERR("PIN code is not 16 bytes long");
1334
1335                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1336                 if (err >= 0)
1337                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1338                                                 MGMT_STATUS_INVALID_PARAMS);
1339
1340                 goto failed;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto failed;
1347         }
1348
1349         bacpy(&reply.bdaddr, &cp->bdaddr);
1350         reply.pin_len = cp->pin_len;
1351         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1352
1353         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1354         if (err < 0)
1355                 mgmt_pending_remove(cmd);
1356
1357 failed:
1358         hci_dev_unlock_bh(hdev);
1359         hci_dev_put(hdev);
1360
1361         return err;
1362 }
1363
1364 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1365                                                                         u16 len)
1366 {
1367         struct hci_dev *hdev;
1368         struct mgmt_cp_pin_code_neg_reply *cp;
1369         int err;
1370
1371         BT_DBG("");
1372
1373         cp = (void *) data;
1374
1375         if (len != sizeof(*cp))
1376                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1377                                                 MGMT_STATUS_INVALID_PARAMS);
1378
1379         hdev = hci_dev_get(index);
1380         if (!hdev)
1381                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1382                                                 MGMT_STATUS_INVALID_PARAMS);
1383
1384         hci_dev_lock_bh(hdev);
1385
1386         if (!test_bit(HCI_UP, &hdev->flags)) {
1387                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1388                                                 MGMT_STATUS_NOT_POWERED);
1389                 goto failed;
1390         }
1391
1392         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1393
1394 failed:
1395         hci_dev_unlock_bh(hdev);
1396         hci_dev_put(hdev);
1397
1398         return err;
1399 }
1400
1401 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1402                                                                         u16 len)
1403 {
1404         struct hci_dev *hdev;
1405         struct mgmt_cp_set_io_capability *cp;
1406
1407         BT_DBG("");
1408
1409         cp = (void *) data;
1410
1411         if (len != sizeof(*cp))
1412                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1413                                                 MGMT_STATUS_INVALID_PARAMS);
1414
1415         hdev = hci_dev_get(index);
1416         if (!hdev)
1417                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1418                                                 MGMT_STATUS_INVALID_PARAMS);
1419
1420         hci_dev_lock_bh(hdev);
1421
1422         hdev->io_capability = cp->io_capability;
1423
1424         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1425                                                         hdev->io_capability);
1426
1427         hci_dev_unlock_bh(hdev);
1428         hci_dev_put(hdev);
1429
1430         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1431 }
1432
1433 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1434 {
1435         struct hci_dev *hdev = conn->hdev;
1436         struct pending_cmd *cmd;
1437
1438         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1439                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1440                         continue;
1441
1442                 if (cmd->user_data != conn)
1443                         continue;
1444
1445                 return cmd;
1446         }
1447
1448         return NULL;
1449 }
1450
1451 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1452 {
1453         struct mgmt_rp_pair_device rp;
1454         struct hci_conn *conn = cmd->user_data;
1455
1456         bacpy(&rp.addr.bdaddr, &conn->dst);
1457         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1458         rp.status = status;
1459
1460         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1461
1462         /* So we don't get further callbacks for this connection */
1463         conn->connect_cfm_cb = NULL;
1464         conn->security_cfm_cb = NULL;
1465         conn->disconn_cfm_cb = NULL;
1466
1467         hci_conn_put(conn);
1468
1469         mgmt_pending_remove(cmd);
1470 }
1471
1472 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1473 {
1474         struct pending_cmd *cmd;
1475
1476         BT_DBG("status %u", status);
1477
1478         cmd = find_pairing(conn);
1479         if (!cmd)
1480                 BT_DBG("Unable to find a pending command");
1481         else
1482                 pairing_complete(cmd, status);
1483 }
1484
1485 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1486 {
1487         struct hci_dev *hdev;
1488         struct mgmt_cp_pair_device *cp;
1489         struct mgmt_rp_pair_device rp;
1490         struct pending_cmd *cmd;
1491         u8 sec_level, auth_type;
1492         struct hci_conn *conn;
1493         int err;
1494
1495         BT_DBG("");
1496
1497         cp = (void *) data;
1498
1499         if (len != sizeof(*cp))
1500                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1501                                                 MGMT_STATUS_INVALID_PARAMS);
1502
1503         hdev = hci_dev_get(index);
1504         if (!hdev)
1505                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1506                                                 MGMT_STATUS_INVALID_PARAMS);
1507
1508         hci_dev_lock_bh(hdev);
1509
1510         sec_level = BT_SECURITY_MEDIUM;
1511         if (cp->io_cap == 0x03)
1512                 auth_type = HCI_AT_DEDICATED_BONDING;
1513         else
1514                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1515
1516         if (cp->addr.type == MGMT_ADDR_BREDR)
1517                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1518                                                                 auth_type);
1519         else
1520                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1521                                                                 auth_type);
1522
1523         memset(&rp, 0, sizeof(rp));
1524         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1525         rp.addr.type = cp->addr.type;
1526
1527         if (IS_ERR(conn)) {
1528                 rp.status = -PTR_ERR(conn);
1529                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1530                                                         &rp, sizeof(rp));
1531                 goto unlock;
1532         }
1533
1534         if (conn->connect_cfm_cb) {
1535                 hci_conn_put(conn);
1536                 rp.status = EBUSY;
1537                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1538                                                         &rp, sizeof(rp));
1539                 goto unlock;
1540         }
1541
1542         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1543         if (!cmd) {
1544                 err = -ENOMEM;
1545                 hci_conn_put(conn);
1546                 goto unlock;
1547         }
1548
1549         /* For LE, just connecting isn't a proof that the pairing finished */
1550         if (cp->addr.type == MGMT_ADDR_BREDR)
1551                 conn->connect_cfm_cb = pairing_complete_cb;
1552
1553         conn->security_cfm_cb = pairing_complete_cb;
1554         conn->disconn_cfm_cb = pairing_complete_cb;
1555         conn->io_capability = cp->io_cap;
1556         cmd->user_data = conn;
1557
1558         if (conn->state == BT_CONNECTED &&
1559                                 hci_conn_security(conn, sec_level, auth_type))
1560                 pairing_complete(cmd, 0);
1561
1562         err = 0;
1563
1564 unlock:
1565         hci_dev_unlock_bh(hdev);
1566         hci_dev_put(hdev);
1567
1568         return err;
1569 }
1570
1571 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1572                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1573 {
1574         struct pending_cmd *cmd;
1575         struct hci_dev *hdev;
1576         struct hci_conn *conn;
1577         int err;
1578
1579         hdev = hci_dev_get(index);
1580         if (!hdev)
1581                 return cmd_status(sk, index, mgmt_op,
1582                                                 MGMT_STATUS_INVALID_PARAMS);
1583
1584         hci_dev_lock_bh(hdev);
1585
1586         if (!test_bit(HCI_UP, &hdev->flags)) {
1587                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1588                 goto done;
1589         }
1590
1591         /*
1592          * Check for an existing ACL link, if present pair via
1593          * HCI commands.
1594          *
1595          * If no ACL link is present, check for an LE link and if
1596          * present, pair via the SMP engine.
1597          *
1598          * If neither ACL nor LE links are present, fail with error.
1599          */
1600         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1601         if (!conn) {
1602                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1603                 if (!conn) {
1604                         err = cmd_status(sk, index, mgmt_op,
1605                                                 MGMT_STATUS_NOT_CONNECTED);
1606                         goto done;
1607                 }
1608
1609                 /* Continue with pairing via SMP */
1610
1611                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
1612                 goto done;
1613         }
1614
1615         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1616         if (!cmd) {
1617                 err = -ENOMEM;
1618                 goto done;
1619         }
1620
1621         /* Continue with pairing via HCI */
1622         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1623                 struct hci_cp_user_passkey_reply cp;
1624
1625                 bacpy(&cp.bdaddr, bdaddr);
1626                 cp.passkey = passkey;
1627                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1628         } else
1629                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1630
1631         if (err < 0)
1632                 mgmt_pending_remove(cmd);
1633
1634 done:
1635         hci_dev_unlock_bh(hdev);
1636         hci_dev_put(hdev);
1637
1638         return err;
1639 }
1640
1641 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1642 {
1643         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1644
1645         BT_DBG("");
1646
1647         if (len != sizeof(*cp))
1648                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1649                                                 MGMT_STATUS_INVALID_PARAMS);
1650
1651         return user_pairing_resp(sk, index, &cp->bdaddr,
1652                         MGMT_OP_USER_CONFIRM_REPLY,
1653                         HCI_OP_USER_CONFIRM_REPLY, 0);
1654 }
1655
1656 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1657                                                                         u16 len)
1658 {
1659         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1660
1661         BT_DBG("");
1662
1663         if (len != sizeof(*cp))
1664                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1665                                                 MGMT_STATUS_INVALID_PARAMS);
1666
1667         return user_pairing_resp(sk, index, &cp->bdaddr,
1668                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1669                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1670 }
1671
1672 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1673 {
1674         struct mgmt_cp_user_passkey_reply *cp = (void *) data;
1675
1676         BT_DBG("");
1677
1678         if (len != sizeof(*cp))
1679                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1680                                                                         EINVAL);
1681
1682         return user_pairing_resp(sk, index, &cp->bdaddr,
1683                         MGMT_OP_USER_PASSKEY_REPLY,
1684                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1685 }
1686
1687 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1688                                                                         u16 len)
1689 {
1690         struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
1691
1692         BT_DBG("");
1693
1694         if (len != sizeof(*cp))
1695                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1696                                                                         EINVAL);
1697
1698         return user_pairing_resp(sk, index, &cp->bdaddr,
1699                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1700                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1701 }
1702
1703 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1704                                                                 u16 len)
1705 {
1706         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1707         struct hci_cp_write_local_name hci_cp;
1708         struct hci_dev *hdev;
1709         struct pending_cmd *cmd;
1710         int err;
1711
1712         BT_DBG("");
1713
1714         if (len != sizeof(*mgmt_cp))
1715                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1716                                                 MGMT_STATUS_INVALID_PARAMS);
1717
1718         hdev = hci_dev_get(index);
1719         if (!hdev)
1720                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1721                                                 MGMT_STATUS_INVALID_PARAMS);
1722
1723         hci_dev_lock_bh(hdev);
1724
1725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1726         if (!cmd) {
1727                 err = -ENOMEM;
1728                 goto failed;
1729         }
1730
1731         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1733                                                                 &hci_cp);
1734         if (err < 0)
1735                 mgmt_pending_remove(cmd);
1736
1737 failed:
1738         hci_dev_unlock_bh(hdev);
1739         hci_dev_put(hdev);
1740
1741         return err;
1742 }
1743
1744 static int read_local_oob_data(struct sock *sk, u16 index)
1745 {
1746         struct hci_dev *hdev;
1747         struct pending_cmd *cmd;
1748         int err;
1749
1750         BT_DBG("hci%u", index);
1751
1752         hdev = hci_dev_get(index);
1753         if (!hdev)
1754                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1755                                                 MGMT_STATUS_INVALID_PARAMS);
1756
1757         hci_dev_lock_bh(hdev);
1758
1759         if (!test_bit(HCI_UP, &hdev->flags)) {
1760                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1761                                                 MGMT_STATUS_NOT_POWERED);
1762                 goto unlock;
1763         }
1764
1765         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1766                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1767                                                 MGMT_STATUS_NOT_SUPPORTED);
1768                 goto unlock;
1769         }
1770
1771         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1772                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1773                                                         MGMT_STATUS_BUSY);
1774                 goto unlock;
1775         }
1776
1777         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1778         if (!cmd) {
1779                 err = -ENOMEM;
1780                 goto unlock;
1781         }
1782
1783         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1784         if (err < 0)
1785                 mgmt_pending_remove(cmd);
1786
1787 unlock:
1788         hci_dev_unlock_bh(hdev);
1789         hci_dev_put(hdev);
1790
1791         return err;
1792 }
1793
1794 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1795                                                                         u16 len)
1796 {
1797         struct hci_dev *hdev;
1798         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1799         int err;
1800
1801         BT_DBG("hci%u ", index);
1802
1803         if (len != sizeof(*cp))
1804                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1805                                                 MGMT_STATUS_INVALID_PARAMS);
1806
1807         hdev = hci_dev_get(index);
1808         if (!hdev)
1809                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1810                                                 MGMT_STATUS_INVALID_PARAMS);
1811
1812         hci_dev_lock_bh(hdev);
1813
1814         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1815                                                                 cp->randomizer);
1816         if (err < 0)
1817                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1818                                                         MGMT_STATUS_FAILED);
1819         else
1820                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1821                                                                         0);
1822
1823         hci_dev_unlock_bh(hdev);
1824         hci_dev_put(hdev);
1825
1826         return err;
1827 }
1828
1829 static int remove_remote_oob_data(struct sock *sk, u16 index,
1830                                                 unsigned char *data, u16 len)
1831 {
1832         struct hci_dev *hdev;
1833         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1834         int err;
1835
1836         BT_DBG("hci%u ", index);
1837
1838         if (len != sizeof(*cp))
1839                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1840                                                 MGMT_STATUS_INVALID_PARAMS);
1841
1842         hdev = hci_dev_get(index);
1843         if (!hdev)
1844                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1845                                                 MGMT_STATUS_INVALID_PARAMS);
1846
1847         hci_dev_lock_bh(hdev);
1848
1849         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1850         if (err < 0)
1851                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1852                                                 MGMT_STATUS_INVALID_PARAMS);
1853         else
1854                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1855                                                                 NULL, 0);
1856
1857         hci_dev_unlock_bh(hdev);
1858         hci_dev_put(hdev);
1859
1860         return err;
1861 }
1862
1863 static int start_discovery(struct sock *sk, u16 index,
1864                                                 unsigned char *data, u16 len)
1865 {
1866         struct mgmt_cp_start_discovery *cp = (void *) data;
1867         struct pending_cmd *cmd;
1868         struct hci_dev *hdev;
1869         int err;
1870
1871         BT_DBG("hci%u", index);
1872
1873         if (len != sizeof(*cp))
1874                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1875                                                 MGMT_STATUS_INVALID_PARAMS);
1876
1877         hdev = hci_dev_get(index);
1878         if (!hdev)
1879                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1880                                                 MGMT_STATUS_INVALID_PARAMS);
1881
1882         hci_dev_lock_bh(hdev);
1883
1884         if (!test_bit(HCI_UP, &hdev->flags)) {
1885                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1886                                                 MGMT_STATUS_NOT_POWERED);
1887                 goto failed;
1888         }
1889
1890         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1891         if (!cmd) {
1892                 err = -ENOMEM;
1893                 goto failed;
1894         }
1895
1896         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1897         if (err < 0)
1898                 mgmt_pending_remove(cmd);
1899
1900 failed:
1901         hci_dev_unlock_bh(hdev);
1902         hci_dev_put(hdev);
1903
1904         return err;
1905 }
1906
1907 static int stop_discovery(struct sock *sk, u16 index)
1908 {
1909         struct hci_dev *hdev;
1910         struct pending_cmd *cmd;
1911         int err;
1912
1913         BT_DBG("hci%u", index);
1914
1915         hdev = hci_dev_get(index);
1916         if (!hdev)
1917                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1918                                                 MGMT_STATUS_INVALID_PARAMS);
1919
1920         hci_dev_lock_bh(hdev);
1921
1922         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1923         if (!cmd) {
1924                 err = -ENOMEM;
1925                 goto failed;
1926         }
1927
1928         err = hci_cancel_inquiry(hdev);
1929         if (err < 0)
1930                 mgmt_pending_remove(cmd);
1931
1932 failed:
1933         hci_dev_unlock_bh(hdev);
1934         hci_dev_put(hdev);
1935
1936         return err;
1937 }
1938
1939 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1940                                                                 u16 len)
1941 {
1942         struct hci_dev *hdev;
1943         struct mgmt_cp_block_device *cp = (void *) data;
1944         int err;
1945
1946         BT_DBG("hci%u", index);
1947
1948         if (len != sizeof(*cp))
1949                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1950                                                 MGMT_STATUS_INVALID_PARAMS);
1951
1952         hdev = hci_dev_get(index);
1953         if (!hdev)
1954                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1955                                                 MGMT_STATUS_INVALID_PARAMS);
1956
1957         hci_dev_lock_bh(hdev);
1958
1959         err = hci_blacklist_add(hdev, &cp->bdaddr);
1960         if (err < 0)
1961                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1962                                                         MGMT_STATUS_FAILED);
1963         else
1964                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1965                                                         NULL, 0);
1966
1967         hci_dev_unlock_bh(hdev);
1968         hci_dev_put(hdev);
1969
1970         return err;
1971 }
1972
1973 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1974                                                                 u16 len)
1975 {
1976         struct hci_dev *hdev;
1977         struct mgmt_cp_unblock_device *cp = (void *) data;
1978         int err;
1979
1980         BT_DBG("hci%u", index);
1981
1982         if (len != sizeof(*cp))
1983                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1984                                                 MGMT_STATUS_INVALID_PARAMS);
1985
1986         hdev = hci_dev_get(index);
1987         if (!hdev)
1988                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1989                                                 MGMT_STATUS_INVALID_PARAMS);
1990
1991         hci_dev_lock_bh(hdev);
1992
1993         err = hci_blacklist_del(hdev, &cp->bdaddr);
1994
1995         if (err < 0)
1996                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1997                                                 MGMT_STATUS_INVALID_PARAMS);
1998         else
1999                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2000                                                                 NULL, 0);
2001
2002         hci_dev_unlock_bh(hdev);
2003         hci_dev_put(hdev);
2004
2005         return err;
2006 }
2007
2008 static int set_fast_connectable(struct sock *sk, u16 index,
2009                                         unsigned char *data, u16 len)
2010 {
2011         struct hci_dev *hdev;
2012         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
2013         struct hci_cp_write_page_scan_activity acp;
2014         u8 type;
2015         int err;
2016
2017         BT_DBG("hci%u", index);
2018
2019         if (len != sizeof(*cp))
2020                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2021                                                 MGMT_STATUS_INVALID_PARAMS);
2022
2023         hdev = hci_dev_get(index);
2024         if (!hdev)
2025                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2026                                                 MGMT_STATUS_INVALID_PARAMS);
2027
2028         hci_dev_lock(hdev);
2029
2030         if (cp->enable) {
2031                 type = PAGE_SCAN_TYPE_INTERLACED;
2032                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2033         } else {
2034                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2035                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2036         }
2037
2038         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2039
2040         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2041                                                 sizeof(acp), &acp);
2042         if (err < 0) {
2043                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2044                                                         MGMT_STATUS_FAILED);
2045                 goto done;
2046         }
2047
2048         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2049         if (err < 0) {
2050                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2051                                                         MGMT_STATUS_FAILED);
2052                 goto done;
2053         }
2054
2055         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2056                                                         NULL, 0);
2057 done:
2058         hci_dev_unlock(hdev);
2059         hci_dev_put(hdev);
2060
2061         return err;
2062 }
2063
2064 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2065 {
2066         unsigned char *buf;
2067         struct mgmt_hdr *hdr;
2068         u16 opcode, index, len;
2069         int err;
2070
2071         BT_DBG("got %zu bytes", msglen);
2072
2073         if (msglen < sizeof(*hdr))
2074                 return -EINVAL;
2075
2076         buf = kmalloc(msglen, GFP_KERNEL);
2077         if (!buf)
2078                 return -ENOMEM;
2079
2080         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2081                 err = -EFAULT;
2082                 goto done;
2083         }
2084
2085         hdr = (struct mgmt_hdr *) buf;
2086         opcode = get_unaligned_le16(&hdr->opcode);
2087         index = get_unaligned_le16(&hdr->index);
2088         len = get_unaligned_le16(&hdr->len);
2089
2090         if (len != msglen - sizeof(*hdr)) {
2091                 err = -EINVAL;
2092                 goto done;
2093         }
2094
2095         switch (opcode) {
2096         case MGMT_OP_READ_VERSION:
2097                 err = read_version(sk);
2098                 break;
2099         case MGMT_OP_READ_INDEX_LIST:
2100                 err = read_index_list(sk);
2101                 break;
2102         case MGMT_OP_READ_INFO:
2103                 err = read_controller_info(sk, index);
2104                 break;
2105         case MGMT_OP_SET_POWERED:
2106                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
2107                 break;
2108         case MGMT_OP_SET_DISCOVERABLE:
2109                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
2110                 break;
2111         case MGMT_OP_SET_CONNECTABLE:
2112                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
2113                 break;
2114         case MGMT_OP_SET_PAIRABLE:
2115                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
2116                 break;
2117         case MGMT_OP_ADD_UUID:
2118                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
2119                 break;
2120         case MGMT_OP_REMOVE_UUID:
2121                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
2122                 break;
2123         case MGMT_OP_SET_DEV_CLASS:
2124                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
2125                 break;
2126         case MGMT_OP_SET_SERVICE_CACHE:
2127                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
2128                 break;
2129         case MGMT_OP_LOAD_LINK_KEYS:
2130                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
2131                 break;
2132         case MGMT_OP_REMOVE_KEYS:
2133                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
2134                 break;
2135         case MGMT_OP_DISCONNECT:
2136                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
2137                 break;
2138         case MGMT_OP_GET_CONNECTIONS:
2139                 err = get_connections(sk, index);
2140                 break;
2141         case MGMT_OP_PIN_CODE_REPLY:
2142                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
2143                 break;
2144         case MGMT_OP_PIN_CODE_NEG_REPLY:
2145                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
2146                 break;
2147         case MGMT_OP_SET_IO_CAPABILITY:
2148                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
2149                 break;
2150         case MGMT_OP_PAIR_DEVICE:
2151                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
2152                 break;
2153         case MGMT_OP_USER_CONFIRM_REPLY:
2154                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
2155                 break;
2156         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2157                 err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
2158                                                                         len);
2159                 break;
2160         case MGMT_OP_USER_PASSKEY_REPLY:
2161                 err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
2162                 break;
2163         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2164                 err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
2165                                                                         len);
2166                 break;
2167         case MGMT_OP_SET_LOCAL_NAME:
2168                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
2169                 break;
2170         case MGMT_OP_READ_LOCAL_OOB_DATA:
2171                 err = read_local_oob_data(sk, index);
2172                 break;
2173         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2174                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
2175                 break;
2176         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2177                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
2178                                                                         len);
2179                 break;
2180         case MGMT_OP_START_DISCOVERY:
2181                 err = start_discovery(sk, index, buf + sizeof(*hdr), len);
2182                 break;
2183         case MGMT_OP_STOP_DISCOVERY:
2184                 err = stop_discovery(sk, index);
2185                 break;
2186         case MGMT_OP_BLOCK_DEVICE:
2187                 err = block_device(sk, index, buf + sizeof(*hdr), len);
2188                 break;
2189         case MGMT_OP_UNBLOCK_DEVICE:
2190                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
2191                 break;
2192         case MGMT_OP_SET_FAST_CONNECTABLE:
2193                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
2194                                                                 len);
2195                 break;
2196         default:
2197                 BT_DBG("Unknown op %u", opcode);
2198                 err = cmd_status(sk, index, opcode,
2199                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2200                 break;
2201         }
2202
2203         if (err < 0)
2204                 goto done;
2205
2206         err = msglen;
2207
2208 done:
2209         kfree(buf);
2210         return err;
2211 }
2212
2213 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2214 {
2215         u8 *status = data;
2216
2217         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2218         mgmt_pending_remove(cmd);
2219 }
2220
2221 int mgmt_index_added(struct hci_dev *hdev)
2222 {
2223         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2224 }
2225
2226 int mgmt_index_removed(struct hci_dev *hdev)
2227 {
2228         u8 status = ENODEV;
2229
2230         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2231
2232         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2233 }
2234
2235 struct cmd_lookup {
2236         u8 val;
2237         struct sock *sk;
2238 };
2239
2240 static void mode_rsp(struct pending_cmd *cmd, void *data)
2241 {
2242         struct mgmt_mode *cp = cmd->param;
2243         struct cmd_lookup *match = data;
2244
2245         if (cp->val != match->val)
2246                 return;
2247
2248         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
2249
2250         list_del(&cmd->list);
2251
2252         if (match->sk == NULL) {
2253                 match->sk = cmd->sk;
2254                 sock_hold(match->sk);
2255         }
2256
2257         mgmt_pending_free(cmd);
2258 }
2259
2260 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2261 {
2262         struct mgmt_mode ev;
2263         struct cmd_lookup match = { powered, NULL };
2264         int ret;
2265
2266         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2267
2268         if (!powered) {
2269                 u8 status = ENETDOWN;
2270                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2271         }
2272
2273         ev.val = powered;
2274
2275         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2276
2277         if (match.sk)
2278                 sock_put(match.sk);
2279
2280         return ret;
2281 }
2282
2283 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2284 {
2285         struct mgmt_mode ev;
2286         struct cmd_lookup match = { discoverable, NULL };
2287         int ret;
2288
2289         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2290
2291         ev.val = discoverable;
2292
2293         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2294                                                                 match.sk);
2295
2296         if (match.sk)
2297                 sock_put(match.sk);
2298
2299         return ret;
2300 }
2301
2302 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2303 {
2304         struct mgmt_mode ev;
2305         struct cmd_lookup match = { connectable, NULL };
2306         int ret;
2307
2308         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2309
2310         ev.val = connectable;
2311
2312         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2313
2314         if (match.sk)
2315                 sock_put(match.sk);
2316
2317         return ret;
2318 }
2319
2320 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2321 {
2322         u8 mgmt_err = mgmt_status(status);
2323
2324         if (scan & SCAN_PAGE)
2325                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2326                                                 cmd_status_rsp, &mgmt_err);
2327
2328         if (scan & SCAN_INQUIRY)
2329                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2330                                                 cmd_status_rsp, &mgmt_err);
2331
2332         return 0;
2333 }
2334
2335 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2336                                                                 u8 persistent)
2337 {
2338         struct mgmt_ev_new_link_key ev;
2339
2340         memset(&ev, 0, sizeof(ev));
2341
2342         ev.store_hint = persistent;
2343         bacpy(&ev.key.bdaddr, &key->bdaddr);
2344         ev.key.type = key->type;
2345         memcpy(ev.key.val, key->val, 16);
2346         ev.key.pin_len = key->pin_len;
2347
2348         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2349 }
2350
2351 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2352                                                                 u8 addr_type)
2353 {
2354         struct mgmt_addr_info ev;
2355
2356         bacpy(&ev.bdaddr, bdaddr);
2357         ev.type = link_to_mgmt(link_type, addr_type);
2358
2359         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2360 }
2361
2362 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2363 {
2364         struct mgmt_cp_disconnect *cp = cmd->param;
2365         struct sock **sk = data;
2366         struct mgmt_rp_disconnect rp;
2367
2368         bacpy(&rp.bdaddr, &cp->bdaddr);
2369         rp.status = 0;
2370
2371         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2372
2373         *sk = cmd->sk;
2374         sock_hold(*sk);
2375
2376         mgmt_pending_remove(cmd);
2377 }
2378
2379 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2380 {
2381         u8 *status = data;
2382         struct mgmt_cp_remove_keys *cp = cmd->param;
2383         struct mgmt_rp_remove_keys rp;
2384
2385         memset(&rp, 0, sizeof(rp));
2386         bacpy(&rp.bdaddr, &cp->bdaddr);
2387         if (status != NULL)
2388                 rp.status = *status;
2389
2390         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2391                                                                 sizeof(rp));
2392
2393         mgmt_pending_remove(cmd);
2394 }
2395
2396 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2397                                                                 u8 addr_type)
2398 {
2399         struct mgmt_addr_info ev;
2400         struct sock *sk = NULL;
2401         int err;
2402
2403         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2404
2405         bacpy(&ev.bdaddr, bdaddr);
2406         ev.type = link_to_mgmt(link_type, addr_type);
2407
2408         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2409
2410         if (sk)
2411                 sock_put(sk);
2412
2413         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2414
2415         return err;
2416 }
2417
2418 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2419 {
2420         struct pending_cmd *cmd;
2421         u8 mgmt_err = mgmt_status(status);
2422         int err;
2423
2424         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2425         if (!cmd)
2426                 return -ENOENT;
2427
2428         if (bdaddr) {
2429                 struct mgmt_rp_disconnect rp;
2430
2431                 bacpy(&rp.bdaddr, bdaddr);
2432                 rp.status = status;
2433
2434                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2435                                                         &rp, sizeof(rp));
2436         } else
2437                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2438                                                                 mgmt_err);
2439
2440         mgmt_pending_remove(cmd);
2441
2442         return err;
2443 }
2444
2445 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2446                                                 u8 addr_type, u8 status)
2447 {
2448         struct mgmt_ev_connect_failed ev;
2449
2450         bacpy(&ev.addr.bdaddr, bdaddr);
2451         ev.addr.type = link_to_mgmt(link_type, addr_type);
2452         ev.status = mgmt_status(status);
2453
2454         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2455 }
2456
2457 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2458 {
2459         struct mgmt_ev_pin_code_request ev;
2460
2461         bacpy(&ev.bdaddr, bdaddr);
2462         ev.secure = secure;
2463
2464         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2465                                                                         NULL);
2466 }
2467
2468 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2469                                                                 u8 status)
2470 {
2471         struct pending_cmd *cmd;
2472         struct mgmt_rp_pin_code_reply rp;
2473         int err;
2474
2475         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2476         if (!cmd)
2477                 return -ENOENT;
2478
2479         bacpy(&rp.bdaddr, bdaddr);
2480         rp.status = mgmt_status(status);
2481
2482         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2483                                                                 sizeof(rp));
2484
2485         mgmt_pending_remove(cmd);
2486
2487         return err;
2488 }
2489
2490 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2491                                                                 u8 status)
2492 {
2493         struct pending_cmd *cmd;
2494         struct mgmt_rp_pin_code_reply rp;
2495         int err;
2496
2497         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2498         if (!cmd)
2499                 return -ENOENT;
2500
2501         bacpy(&rp.bdaddr, bdaddr);
2502         rp.status = mgmt_status(status);
2503
2504         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2505                                                                 sizeof(rp));
2506
2507         mgmt_pending_remove(cmd);
2508
2509         return err;
2510 }
2511
2512 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2513                                                 __le32 value, u8 confirm_hint)
2514 {
2515         struct mgmt_ev_user_confirm_request ev;
2516
2517         BT_DBG("%s", hdev->name);
2518
2519         bacpy(&ev.bdaddr, bdaddr);
2520         ev.confirm_hint = confirm_hint;
2521         put_unaligned_le32(value, &ev.value);
2522
2523         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2524                                                                         NULL);
2525 }
2526
2527 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2528 {
2529         struct mgmt_ev_user_passkey_request ev;
2530
2531         BT_DBG("%s", hdev->name);
2532
2533         bacpy(&ev.bdaddr, bdaddr);
2534
2535         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2536                                                                         NULL);
2537 }
2538
2539 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2540                                                         u8 status, u8 opcode)
2541 {
2542         struct pending_cmd *cmd;
2543         struct mgmt_rp_user_confirm_reply rp;
2544         int err;
2545
2546         cmd = mgmt_pending_find(opcode, hdev);
2547         if (!cmd)
2548                 return -ENOENT;
2549
2550         bacpy(&rp.bdaddr, bdaddr);
2551         rp.status = mgmt_status(status);
2552         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2553
2554         mgmt_pending_remove(cmd);
2555
2556         return err;
2557 }
2558
2559 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2560                                                                 u8 status)
2561 {
2562         return user_pairing_resp_complete(hdev, bdaddr, status,
2563                                                 MGMT_OP_USER_CONFIRM_REPLY);
2564 }
2565
2566 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2567                                                 bdaddr_t *bdaddr, u8 status)
2568 {
2569         return user_pairing_resp_complete(hdev, bdaddr, status,
2570                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2571 }
2572
2573 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2574                                                                 u8 status)
2575 {
2576         return user_pairing_resp_complete(hdev, bdaddr, status,
2577                                                 MGMT_OP_USER_PASSKEY_REPLY);
2578 }
2579
2580 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2581                                                 bdaddr_t *bdaddr, u8 status)
2582 {
2583         return user_pairing_resp_complete(hdev, bdaddr, status,
2584                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2585 }
2586
2587 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2588 {
2589         struct mgmt_ev_auth_failed ev;
2590
2591         bacpy(&ev.bdaddr, bdaddr);
2592         ev.status = mgmt_status(status);
2593
2594         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2595 }
2596
2597 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2598 {
2599         struct pending_cmd *cmd;
2600         struct mgmt_cp_set_local_name ev;
2601         int err;
2602
2603         memset(&ev, 0, sizeof(ev));
2604         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2605
2606         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2607         if (!cmd)
2608                 goto send_event;
2609
2610         if (status) {
2611                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2612                                                         mgmt_status(status));
2613                 goto failed;
2614         }
2615
2616         update_eir(hdev);
2617
2618         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2619                                                                 sizeof(ev));
2620         if (err < 0)
2621                 goto failed;
2622
2623 send_event:
2624         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2625                                                         cmd ? cmd->sk : NULL);
2626
2627 failed:
2628         if (cmd)
2629                 mgmt_pending_remove(cmd);
2630         return err;
2631 }
2632
2633 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2634                                                 u8 *randomizer, u8 status)
2635 {
2636         struct pending_cmd *cmd;
2637         int err;
2638
2639         BT_DBG("%s status %u", hdev->name, status);
2640
2641         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2642         if (!cmd)
2643                 return -ENOENT;
2644
2645         if (status) {
2646                 err = cmd_status(cmd->sk, hdev->id,
2647                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2648                                                 mgmt_status(status));
2649         } else {
2650                 struct mgmt_rp_read_local_oob_data rp;
2651
2652                 memcpy(rp.hash, hash, sizeof(rp.hash));
2653                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2654
2655                 err = cmd_complete(cmd->sk, hdev->id,
2656                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2657                                                 &rp, sizeof(rp));
2658         }
2659
2660         mgmt_pending_remove(cmd);
2661
2662         return err;
2663 }
2664
2665 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2666                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2667 {
2668         struct mgmt_ev_device_found ev;
2669
2670         memset(&ev, 0, sizeof(ev));
2671
2672         bacpy(&ev.addr.bdaddr, bdaddr);
2673         ev.addr.type = link_to_mgmt(link_type, addr_type);
2674         ev.rssi = rssi;
2675
2676         if (eir)
2677                 memcpy(ev.eir, eir, sizeof(ev.eir));
2678
2679         if (dev_class)
2680                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2681
2682         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2683 }
2684
2685 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2686 {
2687         struct mgmt_ev_remote_name ev;
2688
2689         memset(&ev, 0, sizeof(ev));
2690
2691         bacpy(&ev.bdaddr, bdaddr);
2692         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2693
2694         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2695 }
2696
2697 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2698 {
2699         struct pending_cmd *cmd;
2700         int err;
2701
2702         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2703         if (!cmd)
2704                 return -ENOENT;
2705
2706         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2707         mgmt_pending_remove(cmd);
2708
2709         return err;
2710 }
2711
2712 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2713 {
2714         struct pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2718         if (!cmd)
2719                 return -ENOENT;
2720
2721         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2722         mgmt_pending_remove(cmd);
2723
2724         return err;
2725 }
2726
2727 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2728 {
2729         struct pending_cmd *cmd;
2730
2731         if (discovering)
2732                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2733         else
2734                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2735
2736         if (cmd != NULL) {
2737                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2738                 mgmt_pending_remove(cmd);
2739         }
2740
2741         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2742                                                 sizeof(discovering), NULL);
2743 }
2744
2745 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2746 {
2747         struct pending_cmd *cmd;
2748         struct mgmt_ev_device_blocked ev;
2749
2750         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2751
2752         bacpy(&ev.bdaddr, bdaddr);
2753
2754         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2755                                                         cmd ? cmd->sk : NULL);
2756 }
2757
2758 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2759 {
2760         struct pending_cmd *cmd;
2761         struct mgmt_ev_device_unblocked ev;
2762
2763         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2764
2765         bacpy(&ev.bdaddr, bdaddr);
2766
2767         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2768                                                         cmd ? cmd->sk : NULL);
2769 }