Pileus Git - ~andy/linux/blob - net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         __u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static LIST_HEAD(cmd_list);
  47
  48 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  49 {
  50         struct sk_buff *skb;
  51         struct mgmt_hdr *hdr;
  52         struct mgmt_ev_cmd_status *ev;
  53         int err;
  54
  55         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  56
  57         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  58         if (!skb)
  59                 return -ENOMEM;
  60
  61         hdr = (void *) skb_put(skb, sizeof(*hdr));
  62
  63         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  64         hdr->index = cpu_to_le16(index);
  65         hdr->len = cpu_to_le16(sizeof(*ev));
  66
  67         ev = (void *) skb_put(skb, sizeof(*ev));
  68         ev->status = status;
  69         put_unaligned_le16(cmd, &ev->opcode);
  70
  71         err = sock_queue_rcv_skb(sk, skb);
  72         if (err < 0)
  73                 kfree_skb(skb);
  74
  75         return err;
  76 }
  77
  78 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  79                                                                 size_t rp_len)
  80 {
  81         struct sk_buff *skb;
  82         struct mgmt_hdr *hdr;
  83         struct mgmt_ev_cmd_complete *ev;
  84         int err;
  85
  86         BT_DBG("sock %p", sk);
  87
  88         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  89         if (!skb)
  90                 return -ENOMEM;
  91
  92         hdr = (void *) skb_put(skb, sizeof(*hdr));
  93
  94         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  95         hdr->index = cpu_to_le16(index);
  96         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  97
  98         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  99         put_unaligned_le16(cmd, &ev->opcode);
 100
 101         if (rp)
 102                 memcpy(ev->data, rp, rp_len);
 103
 104         err = sock_queue_rcv_skb(sk, skb);
 105         if (err < 0)
 106                 kfree_skb(skb);
 107
 108         return err;;
 109 }
 110
 111 static int read_version(struct sock *sk)
 112 {
 113         struct mgmt_rp_read_version rp;
 114
 115         BT_DBG("sock %p", sk);
 116
 117         rp.version = MGMT_VERSION;
 118         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 119
 120         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 121                                                                 sizeof(rp));
 122 }
 123
 124 static int read_index_list(struct sock *sk)
 125 {
 126         struct mgmt_rp_read_index_list *rp;
 127         struct list_head *p;
 128         struct hci_dev *d;
 129         size_t rp_len;
 130         u16 count;
 131         int i, err;
 132
 133         BT_DBG("sock %p", sk);
 134
 135         read_lock(&hci_dev_list_lock);
 136
 137         count = 0;
 138         list_for_each(p, &hci_dev_list) {
 139                 count++;
 140         }
 141
 142         rp_len = sizeof(*rp) + (2 * count);
 143         rp = kmalloc(rp_len, GFP_ATOMIC);
 144         if (!rp) {
 145                 read_unlock(&hci_dev_list_lock);
 146                 return -ENOMEM;
 147         }
 148
 149         put_unaligned_le16(count, &rp->num_controllers);
 150
 151         i = 0;
 152         list_for_each_entry(d, &hci_dev_list, list) {
 153                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 154                         cancel_delayed_work_sync(&d->power_off);
 155
 156                 if (test_bit(HCI_SETUP, &d->flags))
 157                         continue;
 158
 159                 put_unaligned_le16(d->id, &rp->index[i++]);
 160                 BT_DBG("Added hci%u", d->id);
 161         }
 162
 163         read_unlock(&hci_dev_list_lock);
 164
 165         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 166                                                                         rp_len);
 167
 168         kfree(rp);
 169
 170         return err;
 171 }
 172
 173 static int read_controller_info(struct sock *sk, u16 index)
 174 {
 175         struct mgmt_rp_read_info rp;
 176         struct hci_dev *hdev;
 177
 178         BT_DBG("sock %p hci%u", sk, index);
 179
 180         hdev = hci_dev_get(index);
 181         if (!hdev)
 182                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 183
 184         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 185                 cancel_delayed_work_sync(&hdev->power_off);
 186
 187         hci_dev_lock_bh(hdev);
 188
 189         set_bit(HCI_MGMT, &hdev->flags);
 190
 191         memset(&rp, 0, sizeof(rp));
 192
 193         rp.type = hdev->dev_type;
 194
 195         rp.powered = test_bit(HCI_UP, &hdev->flags);
 196         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 197         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 198         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 199
 200         if (test_bit(HCI_AUTH, &hdev->flags))
 201                 rp.sec_mode = 3;
 202         else if (hdev->ssp_mode > 0)
 203                 rp.sec_mode = 4;
 204         else
 205                 rp.sec_mode = 2;
 206
 207         bacpy(&rp.bdaddr, &hdev->bdaddr);
 208         memcpy(rp.features, hdev->features, 8);
 209         memcpy(rp.dev_class, hdev->dev_class, 3);
 210         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 211         rp.hci_ver = hdev->hci_ver;
 212         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 213
 214         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 215
 216         hci_dev_unlock_bh(hdev);
 217         hci_dev_put(hdev);
 218
 219         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 220 }
 221
 222 static void mgmt_pending_free(struct pending_cmd *cmd)
 223 {
 224         sock_put(cmd->sk);
 225         kfree(cmd->param);
 226         kfree(cmd);
 227 }
 228
 229 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 230                                                 u16 index, void *data, u16 len)
 231 {
 232         struct pending_cmd *cmd;
 233
 234         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 235         if (!cmd)
 236                 return NULL;
 237
 238         cmd->opcode = opcode;
 239         cmd->index = index;
 240
 241         cmd->param = kmalloc(len, GFP_ATOMIC);
 242         if (!cmd->param) {
 243                 kfree(cmd);
 244                 return NULL;
 245         }
 246
 247         if (data)
 248                 memcpy(cmd->param, data, len);
 249
 250         cmd->sk = sk;
 251         sock_hold(sk);
 252
 253         list_add(&cmd->list, &cmd_list);
 254
 255         return cmd;
 256 }
 257
 258 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 259                                 void (*cb)(struct pending_cmd *cmd, void *data),
 260                                 void *data)
 261 {
 262         struct list_head *p, *n;
 263
 264         list_for_each_safe(p, n, &cmd_list) {
 265                 struct pending_cmd *cmd;
 266
 267                 cmd = list_entry(p, struct pending_cmd, list);
 268
 269                 if (opcode > 0 && cmd->opcode != opcode)
 270                         continue;
 271
 272                 if (hdev && cmd->index != hdev->id)
 273                         continue;
 274
 275                 cb(cmd, data);
 276         }
 277 }
 278
 279 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 280 {
 281         struct pending_cmd *cmd;
 282
 283         list_for_each_entry(cmd, &cmd_list, list) {
 284                 if (cmd->opcode != opcode)
 285                         continue;
 286
 287                 if (index >= 0 && cmd->index != index)
 288                         continue;
 289
 290                 return cmd;
 291         }
 292
 293         return NULL;
 294 }
 295
 296 static void mgmt_pending_remove(struct pending_cmd *cmd)
 297 {
 298         list_del(&cmd->list);
 299         mgmt_pending_free(cmd);
 300 }
 301
 302 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 303 {
 304         struct mgmt_mode *cp;
 305         struct hci_dev *hdev;
 306         struct pending_cmd *cmd;
 307         int err, up;
 308
 309         cp = (void *) data;
 310
 311         BT_DBG("request for hci%u", index);
 312
 313         if (len != sizeof(*cp))
 314                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 315
 316         hdev = hci_dev_get(index);
 317         if (!hdev)
 318                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 319
 320         hci_dev_lock_bh(hdev);
 321
 322         up = test_bit(HCI_UP, &hdev->flags);
 323         if ((cp->val && up) || (!cp->val && !up)) {
 324                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 325                 goto failed;
 326         }
 327
 328         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 329                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 330                 goto failed;
 331         }
 332
 333         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 334         if (!cmd) {
 335                 err = -ENOMEM;
 336                 goto failed;
 337         }
 338
 339         if (cp->val)
 340                 queue_work(hdev->workqueue, &hdev->power_on);
 341         else
 342                 queue_work(hdev->workqueue, &hdev->power_off.work);
 343
 344         err = 0;
 345
 346 failed:
 347         hci_dev_unlock_bh(hdev);
 348         hci_dev_put(hdev);
 349         return err;
 350 }
 351
 352 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 353                                                                         u16 len)
 354 {
 355         struct mgmt_cp_set_discoverable *cp;
 356         struct hci_dev *hdev;
 357         struct pending_cmd *cmd;
 358         u8 scan;
 359         int err;
 360
 361         cp = (void *) data;
 362
 363         BT_DBG("request for hci%u", index);
 364
 365         if (len != sizeof(*cp))
 366                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 367
 368         hdev = hci_dev_get(index);
 369         if (!hdev)
 370                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 371
 372         hci_dev_lock_bh(hdev);
 373
 374         if (!test_bit(HCI_UP, &hdev->flags)) {
 375                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 376                 goto failed;
 377         }
 378
 379         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 380                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 381                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 382                 goto failed;
 383         }
 384
 385         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 386                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 387                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 388                 goto failed;
 389         }
 390
 391         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 392         if (!cmd) {
 393                 err = -ENOMEM;
 394                 goto failed;
 395         }
 396
 397         scan = SCAN_PAGE;
 398
 399         if (cp->val)
 400                 scan |= SCAN_INQUIRY;
 401         else
 402                 cancel_delayed_work_sync(&hdev->discov_off);
 403
 404         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 405         if (err < 0)
 406                 mgmt_pending_remove(cmd);
 407
 408         if (cp->val)
 409                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 410
 411 failed:
 412         hci_dev_unlock_bh(hdev);
 413         hci_dev_put(hdev);
 414
 415         return err;
 416 }
 417
 418 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 419                                                                         u16 len)
 420 {
 421         struct mgmt_mode *cp;
 422         struct hci_dev *hdev;
 423         struct pending_cmd *cmd;
 424         u8 scan;
 425         int err;
 426
 427         cp = (void *) data;
 428
 429         BT_DBG("request for hci%u", index);
 430
 431         if (len != sizeof(*cp))
 432                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 433
 434         hdev = hci_dev_get(index);
 435         if (!hdev)
 436                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 437
 438         hci_dev_lock_bh(hdev);
 439
 440         if (!test_bit(HCI_UP, &hdev->flags)) {
 441                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 442                 goto failed;
 443         }
 444
 445         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 446                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 447                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 448                 goto failed;
 449         }
 450
 451         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 452                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 453                 goto failed;
 454         }
 455
 456         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 457         if (!cmd) {
 458                 err = -ENOMEM;
 459                 goto failed;
 460         }
 461
 462         if (cp->val)
 463                 scan = SCAN_PAGE;
 464         else
 465                 scan = 0;
 466
 467         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 468         if (err < 0)
 469                 mgmt_pending_remove(cmd);
 470
 471 failed:
 472         hci_dev_unlock_bh(hdev);
 473         hci_dev_put(hdev);
 474
 475         return err;
 476 }
 477
 478 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 479                                         u16 data_len, struct sock *skip_sk)
 480 {
 481         struct sk_buff *skb;
 482         struct mgmt_hdr *hdr;
 483
 484         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 485         if (!skb)
 486                 return -ENOMEM;
 487
 488         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 489
 490         hdr = (void *) skb_put(skb, sizeof(*hdr));
 491         hdr->opcode = cpu_to_le16(event);
 492         if (hdev)
 493                 hdr->index = cpu_to_le16(hdev->id);
 494         else
 495                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 496         hdr->len = cpu_to_le16(data_len);
 497
 498         if (data)
 499                 memcpy(skb_put(skb, data_len), data, data_len);
 500
 501         hci_send_to_sock(NULL, skb, skip_sk);
 502         kfree_skb(skb);
 503
 504         return 0;
 505 }
 506
 507 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 508 {
 509         struct mgmt_mode rp;
 510
 511         rp.val = val;
 512
 513         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 514 }
 515
 516 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 517                                                                         u16 len)
 518 {
 519         struct mgmt_mode *cp, ev;
 520         struct hci_dev *hdev;
 521         int err;
 522
 523         cp = (void *) data;
 524
 525         BT_DBG("request for hci%u", index);
 526
 527         if (len != sizeof(*cp))
 528                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 529
 530         hdev = hci_dev_get(index);
 531         if (!hdev)
 532                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 533
 534         hci_dev_lock_bh(hdev);
 535
 536         if (cp->val)
 537                 set_bit(HCI_PAIRABLE, &hdev->flags);
 538         else
 539                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 540
 541         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 542         if (err < 0)
 543                 goto failed;
 544
 545         ev.val = cp->val;
 546
 547         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 548
 549 failed:
 550         hci_dev_unlock_bh(hdev);
 551         hci_dev_put(hdev);
 552
 553         return err;
 554 }
 555
 556 #define EIR_FLAGS               0x01 /* flags */
 557 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 558 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 559 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 560 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 561 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 562 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 563 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 564 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 565 #define EIR_TX_POWER            0x0A /* transmit power level */
 566 #define EIR_DEVICE_ID           0x10 /* device ID */
 567
 568 #define PNP_INFO_SVCLASS_ID             0x1200
 569
 570 static u8 bluetooth_base_uuid[] = {
 571                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 572                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 573 };
 574
 575 static u16 get_uuid16(u8 *uuid128)
 576 {
 577         u32 val;
 578         int i;
 579
 580         for (i = 0; i < 12; i++) {
 581                 if (bluetooth_base_uuid[i] != uuid128[i])
 582                         return 0;
 583         }
 584
 585         memcpy(&val, &uuid128[12], 4);
 586
 587         val = le32_to_cpu(val);
 588         if (val > 0xffff)
 589                 return 0;
 590
 591         return (u16) val;
 592 }
 593
 594 static void create_eir(struct hci_dev *hdev, u8 *data)
 595 {
 596         u8 *ptr = data;
 597         u16 eir_len = 0;
 598         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 599         int i, truncated = 0;
 600         struct bt_uuid *uuid;
 601         size_t name_len;
 602
 603         name_len = strlen(hdev->dev_name);
 604
 605         if (name_len > 0) {
 606                 /* EIR Data type */
 607                 if (name_len > 48) {
 608                         name_len = 48;
 609                         ptr[1] = EIR_NAME_SHORT;
 610                 } else
 611                         ptr[1] = EIR_NAME_COMPLETE;
 612
 613                 /* EIR Data length */
 614                 ptr[0] = name_len + 1;
 615
 616                 memcpy(ptr + 2, hdev->dev_name, name_len);
 617
 618                 eir_len += (name_len + 2);
 619                 ptr += (name_len + 2);
 620         }
 621
 622         memset(uuid16_list, 0, sizeof(uuid16_list));
 623
 624         /* Group all UUID16 types */
 625         list_for_each_entry(uuid, &hdev->uuids, list) {
 626                 u16 uuid16;
 627
 628                 uuid16 = get_uuid16(uuid->uuid);
 629                 if (uuid16 == 0)
 630                         return;
 631
 632                 if (uuid16 < 0x1100)
 633                         continue;
 634
 635                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 636                         continue;
 637
 638                 /* Stop if not enough space to put next UUID */
 639                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 640                         truncated = 1;
 641                         break;
 642                 }
 643
 644                 /* Check for duplicates */
 645                 for (i = 0; uuid16_list[i] != 0; i++)
 646                         if (uuid16_list[i] == uuid16)
 647                                 break;
 648
 649                 if (uuid16_list[i] == 0) {
 650                         uuid16_list[i] = uuid16;
 651                         eir_len += sizeof(u16);
 652                 }
 653         }
 654
 655         if (uuid16_list[0] != 0) {
 656                 u8 *length = ptr;
 657
 658                 /* EIR Data type */
 659                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 660
 661                 ptr += 2;
 662                 eir_len += 2;
 663
 664                 for (i = 0; uuid16_list[i] != 0; i++) {
 665                         *ptr++ = (uuid16_list[i] & 0x00ff);
 666                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 667                 }
 668
 669                 /* EIR Data length */
 670                 *length = (i * sizeof(u16)) + 1;
 671         }
 672 }
 673
 674 static int update_eir(struct hci_dev *hdev)
 675 {
 676         struct hci_cp_write_eir cp;
 677
 678         if (!(hdev->features[6] & LMP_EXT_INQ))
 679                 return 0;
 680
 681         if (hdev->ssp_mode == 0)
 682                 return 0;
 683
 684         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 685                 return 0;
 686
 687         memset(&cp, 0, sizeof(cp));
 688
 689         create_eir(hdev, cp.data);
 690
 691         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 692                 return 0;
 693
 694         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 695
 696         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 697 }
 698
 699 static u8 get_service_classes(struct hci_dev *hdev)
 700 {
 701         struct bt_uuid *uuid;
 702         u8 val = 0;
 703
 704         list_for_each_entry(uuid, &hdev->uuids, list)
 705                 val |= uuid->svc_hint;
 706
 707         return val;
 708 }
 709
 710 static int update_class(struct hci_dev *hdev)
 711 {
 712         u8 cod[3];
 713
 714         BT_DBG("%s", hdev->name);
 715
 716         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 717                 return 0;
 718
 719         cod[0] = hdev->minor_class;
 720         cod[1] = hdev->major_class;
 721         cod[2] = get_service_classes(hdev);
 722
 723         if (memcmp(cod, hdev->dev_class, 3) == 0)
 724                 return 0;
 725
 726         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 727 }
 728
 729 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 730 {
 731         struct mgmt_cp_add_uuid *cp;
 732         struct hci_dev *hdev;
 733         struct bt_uuid *uuid;
 734         int err;
 735
 736         cp = (void *) data;
 737
 738         BT_DBG("request for hci%u", index);
 739
 740         if (len != sizeof(*cp))
 741                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 742
 743         hdev = hci_dev_get(index);
 744         if (!hdev)
 745                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 746
 747         hci_dev_lock_bh(hdev);
 748
 749         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 750         if (!uuid) {
 751                 err = -ENOMEM;
 752                 goto failed;
 753         }
 754
 755         memcpy(uuid->uuid, cp->uuid, 16);
 756         uuid->svc_hint = cp->svc_hint;
 757
 758         list_add(&uuid->list, &hdev->uuids);
 759
 760         err = update_class(hdev);
 761         if (err < 0)
 762                 goto failed;
 763
 764         err = update_eir(hdev);
 765         if (err < 0)
 766                 goto failed;
 767
 768         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 769
 770 failed:
 771         hci_dev_unlock_bh(hdev);
 772         hci_dev_put(hdev);
 773
 774         return err;
 775 }
 776
 777 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 778 {
 779         struct list_head *p, *n;
 780         struct mgmt_cp_remove_uuid *cp;
 781         struct hci_dev *hdev;
 782         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 783         int err, found;
 784
 785         cp = (void *) data;
 786
 787         BT_DBG("request for hci%u", index);
 788
 789         if (len != sizeof(*cp))
 790                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 791
 792         hdev = hci_dev_get(index);
 793         if (!hdev)
 794                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 795
 796         hci_dev_lock_bh(hdev);
 797
 798         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 799                 err = hci_uuids_clear(hdev);
 800                 goto unlock;
 801         }
 802
 803         found = 0;
 804
 805         list_for_each_safe(p, n, &hdev->uuids) {
 806                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 807
 808                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 809                         continue;
 810
 811                 list_del(&match->list);
 812                 found++;
 813         }
 814
 815         if (found == 0) {
 816                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 817                 goto unlock;
 818         }
 819
 820         err = update_class(hdev);
 821         if (err < 0)
 822                 goto unlock;
 823
 824         err = update_eir(hdev);
 825         if (err < 0)
 826                 goto unlock;
 827
 828         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 829
 830 unlock:
 831         hci_dev_unlock_bh(hdev);
 832         hci_dev_put(hdev);
 833
 834         return err;
 835 }
 836
 837 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 838                                                                         u16 len)
 839 {
 840         struct hci_dev *hdev;
 841         struct mgmt_cp_set_dev_class *cp;
 842         int err;
 843
 844         cp = (void *) data;
 845
 846         BT_DBG("request for hci%u", index);
 847
 848         if (len != sizeof(*cp))
 849                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 850
 851         hdev = hci_dev_get(index);
 852         if (!hdev)
 853                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 854
 855         hci_dev_lock_bh(hdev);
 856
 857         hdev->major_class = cp->major;
 858         hdev->minor_class = cp->minor;
 859
 860         err = update_class(hdev);
 861
 862         if (err == 0)
 863                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 864
 865         hci_dev_unlock_bh(hdev);
 866         hci_dev_put(hdev);
 867
 868         return err;
 869 }
 870
 871 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 872                                                                         u16 len)
 873 {
 874         struct hci_dev *hdev;
 875         struct mgmt_cp_set_service_cache *cp;
 876         int err;
 877
 878         cp = (void *) data;
 879
 880         if (len != sizeof(*cp))
 881                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 882
 883         hdev = hci_dev_get(index);
 884         if (!hdev)
 885                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 886
 887         hci_dev_lock_bh(hdev);
 888
 889         BT_DBG("hci%u enable %d", index, cp->enable);
 890
 891         if (cp->enable) {
 892                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 893                 err = 0;
 894         } else {
 895                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 896                 err = update_class(hdev);
 897                 if (err == 0)
 898                         err = update_eir(hdev);
 899         }
 900
 901         if (err == 0)
 902                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 903                                                                         0);
 904         else
 905                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 906
 907
 908         hci_dev_unlock_bh(hdev);
 909         hci_dev_put(hdev);
 910
 911         return err;
 912 }
 913
 914 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 915                                                                 u16 len)
 916 {
 917         struct hci_dev *hdev;
 918         struct mgmt_cp_load_link_keys *cp;
 919         u16 key_count, expected_len;
 920         int i;
 921
 922         cp = (void *) data;
 923
 924         if (len < sizeof(*cp))
 925                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 926
 927         key_count = get_unaligned_le16(&cp->key_count);
 928
 929         expected_len = sizeof(*cp) + key_count *
 930                                         sizeof(struct mgmt_link_key_info);
 931         if (expected_len != len) {
 932                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 933                                                         len, expected_len);
 934                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 935         }
 936
 937         hdev = hci_dev_get(index);
 938         if (!hdev)
 939                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 940
 941         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 942                                                                 key_count);
 943
 944         hci_dev_lock_bh(hdev);
 945
 946         hci_link_keys_clear(hdev);
 947
 948         set_bit(HCI_LINK_KEYS, &hdev->flags);
 949
 950         if (cp->debug_keys)
 951                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 952         else
 953                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 954
 955         for (i = 0; i < key_count; i++) {
 956                 struct mgmt_link_key_info *key = &cp->keys[i];
 957
 958                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 959                                                                 key->pin_len);
 960         }
 961
 962         hci_dev_unlock_bh(hdev);
 963         hci_dev_put(hdev);
 964
 965         return 0;
 966 }
 967
 968 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 969                                                                 u16 len)
 970 {
 971         struct hci_dev *hdev;
 972         struct mgmt_cp_remove_keys *cp;
 973         struct hci_conn *conn;
 974         int err;
 975
 976         cp = (void *) data;
 977
 978         if (len != sizeof(*cp))
 979                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 980
 981         hdev = hci_dev_get(index);
 982         if (!hdev)
 983                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 984
 985         hci_dev_lock_bh(hdev);
 986
 987         err = hci_remove_link_key(hdev, &cp->bdaddr);
 988         if (err < 0) {
 989                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 990                 goto unlock;
 991         }
 992
 993         err = 0;
 994
 995         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 996                 goto unlock;
 997
 998         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 999         if (conn) {
1000                 struct hci_cp_disconnect dc;
1001
1002                 put_unaligned_le16(conn->handle, &dc.handle);
1003                 dc.reason = 0x13; /* Remote User Terminated Connection */
1004                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1005         }
1006
1007 unlock:
1008         hci_dev_unlock_bh(hdev);
1009         hci_dev_put(hdev);
1010
1011         return err;
1012 }
1013
1014 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1015 {
1016         struct hci_dev *hdev;
1017         struct mgmt_cp_disconnect *cp;
1018         struct hci_cp_disconnect dc;
1019         struct pending_cmd *cmd;
1020         struct hci_conn *conn;
1021         int err;
1022
1023         BT_DBG("");
1024
1025         cp = (void *) data;
1026
1027         if (len != sizeof(*cp))
1028                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1029
1030         hdev = hci_dev_get(index);
1031         if (!hdev)
1032                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1033
1034         hci_dev_lock_bh(hdev);
1035
1036         if (!test_bit(HCI_UP, &hdev->flags)) {
1037                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1038                 goto failed;
1039         }
1040
1041         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
1042                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1043                 goto failed;
1044         }
1045
1046         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1047         if (!conn)
1048                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1049
1050         if (!conn) {
1051                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1052                 goto failed;
1053         }
1054
1055         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
1056         if (!cmd) {
1057                 err = -ENOMEM;
1058                 goto failed;
1059         }
1060
1061         put_unaligned_le16(conn->handle, &dc.handle);
1062         dc.reason = 0x13; /* Remote User Terminated Connection */
1063
1064         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1065         if (err < 0)
1066                 mgmt_pending_remove(cmd);
1067
1068 failed:
1069         hci_dev_unlock_bh(hdev);
1070         hci_dev_put(hdev);
1071
1072         return err;
1073 }
1074
1075 static u8 link_to_mgmt(u8 link_type)
1076 {
1077         switch (link_type) {
1078         case LE_LINK:
1079                 return MGMT_ADDR_LE;
1080         case ACL_LINK:
1081                 return MGMT_ADDR_BREDR;
1082         default:
1083                 return MGMT_ADDR_INVALID;
1084         }
1085 }
1086
1087 static int get_connections(struct sock *sk, u16 index)
1088 {
1089         struct mgmt_rp_get_connections *rp;
1090         struct hci_dev *hdev;
1091         struct hci_conn *c;
1092         struct list_head *p;
1093         size_t rp_len;
1094         u16 count;
1095         int i, err;
1096
1097         BT_DBG("");
1098
1099         hdev = hci_dev_get(index);
1100         if (!hdev)
1101                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1102
1103         hci_dev_lock_bh(hdev);
1104
1105         count = 0;
1106         list_for_each(p, &hdev->conn_hash.list) {
1107                 count++;
1108         }
1109
1110         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1111         rp = kmalloc(rp_len, GFP_ATOMIC);
1112         if (!rp) {
1113                 err = -ENOMEM;
1114                 goto unlock;
1115         }
1116
1117         put_unaligned_le16(count, &rp->conn_count);
1118
1119         i = 0;
1120         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1121                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1122                 rp->addr[i].type = link_to_mgmt(c->type);
1123                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1124                         continue;
1125                 i++;
1126         }
1127
1128         /* Recalculate length in case of filtered SCO connections, etc */
1129         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1130
1131         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1132
1133 unlock:
1134         kfree(rp);
1135         hci_dev_unlock_bh(hdev);
1136         hci_dev_put(hdev);
1137         return err;
1138 }
1139
1140 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1141                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1142 {
1143         struct pending_cmd *cmd;
1144         int err;
1145
1146         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
1147                                                                 sizeof(*cp));
1148         if (!cmd)
1149                 return -ENOMEM;
1150
1151         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1152                                                                 &cp->bdaddr);
1153         if (err < 0)
1154                 mgmt_pending_remove(cmd);
1155
1156         return err;
1157 }
1158
1159 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1160                                                                         u16 len)
1161 {
1162         struct hci_dev *hdev;
1163         struct hci_conn *conn;
1164         struct mgmt_cp_pin_code_reply *cp;
1165         struct mgmt_cp_pin_code_neg_reply ncp;
1166         struct hci_cp_pin_code_reply reply;
1167         struct pending_cmd *cmd;
1168         int err;
1169
1170         BT_DBG("");
1171
1172         cp = (void *) data;
1173
1174         if (len != sizeof(*cp))
1175                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1176
1177         hdev = hci_dev_get(index);
1178         if (!hdev)
1179                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1180
1181         hci_dev_lock_bh(hdev);
1182
1183         if (!test_bit(HCI_UP, &hdev->flags)) {
1184                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1185                 goto failed;
1186         }
1187
1188         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1189         if (!conn) {
1190                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1191                 goto failed;
1192         }
1193
1194         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1195                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1196
1197                 BT_ERR("PIN code is not 16 bytes long");
1198
1199                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1200                 if (err >= 0)
1201                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1202                                                                 EINVAL);
1203
1204                 goto failed;
1205         }
1206
1207         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
1208         if (!cmd) {
1209                 err = -ENOMEM;
1210                 goto failed;
1211         }
1212
1213         bacpy(&reply.bdaddr, &cp->bdaddr);
1214         reply.pin_len = cp->pin_len;
1215         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1216
1217         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1218         if (err < 0)
1219                 mgmt_pending_remove(cmd);
1220
1221 failed:
1222         hci_dev_unlock_bh(hdev);
1223         hci_dev_put(hdev);
1224
1225         return err;
1226 }
1227
1228 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1229                                                                         u16 len)
1230 {
1231         struct hci_dev *hdev;
1232         struct mgmt_cp_pin_code_neg_reply *cp;
1233         int err;
1234
1235         BT_DBG("");
1236
1237         cp = (void *) data;
1238
1239         if (len != sizeof(*cp))
1240                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1241                                                                         EINVAL);
1242
1243         hdev = hci_dev_get(index);
1244         if (!hdev)
1245                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1246                                                                         ENODEV);
1247
1248         hci_dev_lock_bh(hdev);
1249
1250         if (!test_bit(HCI_UP, &hdev->flags)) {
1251                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1252                                                                 ENETDOWN);
1253                 goto failed;
1254         }
1255
1256         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1257
1258 failed:
1259         hci_dev_unlock_bh(hdev);
1260         hci_dev_put(hdev);
1261
1262         return err;
1263 }
1264
1265 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1266                                                                         u16 len)
1267 {
1268         struct hci_dev *hdev;
1269         struct mgmt_cp_set_io_capability *cp;
1270
1271         BT_DBG("");
1272
1273         cp = (void *) data;
1274
1275         if (len != sizeof(*cp))
1276                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1277
1278         hdev = hci_dev_get(index);
1279         if (!hdev)
1280                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1281
1282         hci_dev_lock_bh(hdev);
1283
1284         hdev->io_capability = cp->io_capability;
1285
1286         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1287                                                         hdev->io_capability);
1288
1289         hci_dev_unlock_bh(hdev);
1290         hci_dev_put(hdev);
1291
1292         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1293 }
1294
1295 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1296 {
1297         struct hci_dev *hdev = conn->hdev;
1298         struct pending_cmd *cmd;
1299
1300         list_for_each_entry(cmd, &cmd_list, list) {
1301                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1302                         continue;
1303
1304                 if (cmd->index != hdev->id)
1305                         continue;
1306
1307                 if (cmd->user_data != conn)
1308                         continue;
1309
1310                 return cmd;
1311         }
1312
1313         return NULL;
1314 }
1315
1316 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1317 {
1318         struct mgmt_rp_pair_device rp;
1319         struct hci_conn *conn = cmd->user_data;
1320
1321         bacpy(&rp.bdaddr, &conn->dst);
1322         rp.status = status;
1323
1324         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1325
1326         /* So we don't get further callbacks for this connection */
1327         conn->connect_cfm_cb = NULL;
1328         conn->security_cfm_cb = NULL;
1329         conn->disconn_cfm_cb = NULL;
1330
1331         hci_conn_put(conn);
1332
1333         mgmt_pending_remove(cmd);
1334 }
1335
1336 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1337 {
1338         struct pending_cmd *cmd;
1339
1340         BT_DBG("status %u", status);
1341
1342         cmd = find_pairing(conn);
1343         if (!cmd) {
1344                 BT_DBG("Unable to find a pending command");
1345                 return;
1346         }
1347
1348         pairing_complete(cmd, status);
1349 }
1350
1351 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1352 {
1353         struct hci_dev *hdev;
1354         struct mgmt_cp_pair_device *cp;
1355         struct pending_cmd *cmd;
1356         struct adv_entry *entry;
1357         u8 sec_level, auth_type;
1358         struct hci_conn *conn;
1359         int err;
1360
1361         BT_DBG("");
1362
1363         cp = (void *) data;
1364
1365         if (len != sizeof(*cp))
1366                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1367
1368         hdev = hci_dev_get(index);
1369         if (!hdev)
1370                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1371
1372         hci_dev_lock_bh(hdev);
1373
1374         sec_level = BT_SECURITY_MEDIUM;
1375         if (cp->io_cap == 0x03)
1376                 auth_type = HCI_AT_DEDICATED_BONDING;
1377         else
1378                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1379
1380         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1381         if (entry)
1382                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1383                                                                 auth_type);
1384         else
1385                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1386                                                                 auth_type);
1387
1388         if (IS_ERR(conn)) {
1389                 err = PTR_ERR(conn);
1390                 goto unlock;
1391         }
1392
1393         if (conn->connect_cfm_cb) {
1394                 hci_conn_put(conn);
1395                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1396                 goto unlock;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 hci_conn_put(conn);
1403                 goto unlock;
1404         }
1405
1406         /* For LE, just connecting isn't a proof that the pairing finished */
1407         if (!entry)
1408                 conn->connect_cfm_cb = pairing_complete_cb;
1409
1410         conn->security_cfm_cb = pairing_complete_cb;
1411         conn->disconn_cfm_cb = pairing_complete_cb;
1412         conn->io_capability = cp->io_cap;
1413         cmd->user_data = conn;
1414
1415         if (conn->state == BT_CONNECTED &&
1416                                 hci_conn_security(conn, sec_level, auth_type))
1417                 pairing_complete(cmd, 0);
1418
1419         err = 0;
1420
1421 unlock:
1422         hci_dev_unlock_bh(hdev);
1423         hci_dev_put(hdev);
1424
1425         return err;
1426 }
1427
1428 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1429                                                         u16 len, int success)
1430 {
1431         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1432         u16 mgmt_op, hci_op;
1433         struct pending_cmd *cmd;
1434         struct hci_dev *hdev;
1435         int err;
1436
1437         BT_DBG("");
1438
1439         if (success) {
1440                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1441                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1442         } else {
1443                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1444                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1445         }
1446
1447         if (len != sizeof(*cp))
1448                 return cmd_status(sk, index, mgmt_op, EINVAL);
1449
1450         hdev = hci_dev_get(index);
1451         if (!hdev)
1452                 return cmd_status(sk, index, mgmt_op, ENODEV);
1453
1454         hci_dev_lock_bh(hdev);
1455
1456         if (!test_bit(HCI_UP, &hdev->flags)) {
1457                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1458                 goto failed;
1459         }
1460
1461         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1462         if (!cmd) {
1463                 err = -ENOMEM;
1464                 goto failed;
1465         }
1466
1467         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1468         if (err < 0)
1469                 mgmt_pending_remove(cmd);
1470
1471 failed:
1472         hci_dev_unlock_bh(hdev);
1473         hci_dev_put(hdev);
1474
1475         return err;
1476 }
1477
1478 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1479                                                                 u16 len)
1480 {
1481         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1482         struct hci_cp_write_local_name hci_cp;
1483         struct hci_dev *hdev;
1484         struct pending_cmd *cmd;
1485         int err;
1486
1487         BT_DBG("");
1488
1489         if (len != sizeof(*mgmt_cp))
1490                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1491
1492         hdev = hci_dev_get(index);
1493         if (!hdev)
1494                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1495
1496         hci_dev_lock_bh(hdev);
1497
1498         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
1499         if (!cmd) {
1500                 err = -ENOMEM;
1501                 goto failed;
1502         }
1503
1504         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1505         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1506                                                                 &hci_cp);
1507         if (err < 0)
1508                 mgmt_pending_remove(cmd);
1509
1510 failed:
1511         hci_dev_unlock_bh(hdev);
1512         hci_dev_put(hdev);
1513
1514         return err;
1515 }
1516
1517 static int read_local_oob_data(struct sock *sk, u16 index)
1518 {
1519         struct hci_dev *hdev;
1520         struct pending_cmd *cmd;
1521         int err;
1522
1523         BT_DBG("hci%u", index);
1524
1525         hdev = hci_dev_get(index);
1526         if (!hdev)
1527                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1528                                                                         ENODEV);
1529
1530         hci_dev_lock_bh(hdev);
1531
1532         if (!test_bit(HCI_UP, &hdev->flags)) {
1533                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1534                                                                 ENETDOWN);
1535                 goto unlock;
1536         }
1537
1538         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1539                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1540                                                                 EOPNOTSUPP);
1541                 goto unlock;
1542         }
1543
1544         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
1545                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1546                 goto unlock;
1547         }
1548
1549         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1556         if (err < 0)
1557                 mgmt_pending_remove(cmd);
1558
1559 unlock:
1560         hci_dev_unlock_bh(hdev);
1561         hci_dev_put(hdev);
1562
1563         return err;
1564 }
1565
1566 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1567                                                                         u16 len)
1568 {
1569         struct hci_dev *hdev;
1570         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1571         int err;
1572
1573         BT_DBG("hci%u ", index);
1574
1575         if (len != sizeof(*cp))
1576                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1577                                                                         EINVAL);
1578
1579         hdev = hci_dev_get(index);
1580         if (!hdev)
1581                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1582                                                                         ENODEV);
1583
1584         hci_dev_lock_bh(hdev);
1585
1586         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1587                                                                 cp->randomizer);
1588         if (err < 0)
1589                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1590         else
1591                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1592                                                                         0);
1593
1594         hci_dev_unlock_bh(hdev);
1595         hci_dev_put(hdev);
1596
1597         return err;
1598 }
1599
1600 static int remove_remote_oob_data(struct sock *sk, u16 index,
1601                                                 unsigned char *data, u16 len)
1602 {
1603         struct hci_dev *hdev;
1604         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1605         int err;
1606
1607         BT_DBG("hci%u ", index);
1608
1609         if (len != sizeof(*cp))
1610                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1611                                                                         EINVAL);
1612
1613         hdev = hci_dev_get(index);
1614         if (!hdev)
1615                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1616                                                                         ENODEV);
1617
1618         hci_dev_lock_bh(hdev);
1619
1620         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1621         if (err < 0)
1622                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1623                                                                         -err);
1624         else
1625                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1626                                                                 NULL, 0);
1627
1628         hci_dev_unlock_bh(hdev);
1629         hci_dev_put(hdev);
1630
1631         return err;
1632 }
1633
1634 static int start_discovery(struct sock *sk, u16 index)
1635 {
1636         struct pending_cmd *cmd;
1637         struct hci_dev *hdev;
1638         int err;
1639
1640         BT_DBG("hci%u", index);
1641
1642         hdev = hci_dev_get(index);
1643         if (!hdev)
1644                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1645
1646         hci_dev_lock_bh(hdev);
1647
1648         if (!test_bit(HCI_UP, &hdev->flags)) {
1649                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1650                 goto failed;
1651         }
1652
1653         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
1654         if (!cmd) {
1655                 err = -ENOMEM;
1656                 goto failed;
1657         }
1658
1659         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1660         if (err < 0)
1661                 mgmt_pending_remove(cmd);
1662
1663 failed:
1664         hci_dev_unlock_bh(hdev);
1665         hci_dev_put(hdev);
1666
1667         return err;
1668 }
1669
1670 static int stop_discovery(struct sock *sk, u16 index)
1671 {
1672         struct hci_dev *hdev;
1673         struct pending_cmd *cmd;
1674         int err;
1675
1676         BT_DBG("hci%u", index);
1677
1678         hdev = hci_dev_get(index);
1679         if (!hdev)
1680                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1681
1682         hci_dev_lock_bh(hdev);
1683
1684         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
1685         if (!cmd) {
1686                 err = -ENOMEM;
1687                 goto failed;
1688         }
1689
1690         err = hci_cancel_inquiry(hdev);
1691         if (err < 0)
1692                 mgmt_pending_remove(cmd);
1693
1694 failed:
1695         hci_dev_unlock_bh(hdev);
1696         hci_dev_put(hdev);
1697
1698         return err;
1699 }
1700
1701 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1702                                                                 u16 len)
1703 {
1704         struct hci_dev *hdev;
1705         struct mgmt_cp_block_device *cp = (void *) data;
1706         int err;
1707
1708         BT_DBG("hci%u", index);
1709
1710         if (len != sizeof(*cp))
1711                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1712                                                         EINVAL);
1713
1714         hdev = hci_dev_get(index);
1715         if (!hdev)
1716                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1717                                                         ENODEV);
1718
1719         hci_dev_lock_bh(hdev);
1720
1721         err = hci_blacklist_add(hdev, &cp->bdaddr);
1722         if (err < 0)
1723                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1724         else
1725                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1726                                                         NULL, 0);
1727
1728         hci_dev_unlock_bh(hdev);
1729         hci_dev_put(hdev);
1730
1731         return err;
1732 }
1733
1734 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1735                                                                 u16 len)
1736 {
1737         struct hci_dev *hdev;
1738         struct mgmt_cp_unblock_device *cp = (void *) data;
1739         int err;
1740
1741         BT_DBG("hci%u", index);
1742
1743         if (len != sizeof(*cp))
1744                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1745                                                                 EINVAL);
1746
1747         hdev = hci_dev_get(index);
1748         if (!hdev)
1749                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1750                                                                 ENODEV);
1751
1752         hci_dev_lock_bh(hdev);
1753
1754         err = hci_blacklist_del(hdev, &cp->bdaddr);
1755
1756         if (err < 0)
1757                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1758         else
1759                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1760                                                                 NULL, 0);
1761
1762         hci_dev_unlock_bh(hdev);
1763         hci_dev_put(hdev);
1764
1765         return err;
1766 }
1767
1768 static int set_fast_connectable(struct sock *sk, u16 index,
1769                                         unsigned char *data, u16 len)
1770 {
1771         struct hci_dev *hdev;
1772         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1773         struct hci_cp_write_page_scan_activity acp;
1774         u8 type;
1775         int err;
1776
1777         BT_DBG("hci%u", index);
1778
1779         if (len != sizeof(*cp))
1780                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1781                                                                 EINVAL);
1782
1783         hdev = hci_dev_get(index);
1784         if (!hdev)
1785                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1786                                                                 ENODEV);
1787
1788         hci_dev_lock(hdev);
1789
1790         if (cp->enable) {
1791                 type = PAGE_SCAN_TYPE_INTERLACED;
1792                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1793         } else {
1794                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1795                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1796         }
1797
1798         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1799
1800         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1801                                                 sizeof(acp), &acp);
1802         if (err < 0) {
1803                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1804                                                                 -err);
1805                 goto done;
1806         }
1807
1808         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1809         if (err < 0) {
1810                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1811                                                                 -err);
1812                 goto done;
1813         }
1814
1815         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1816                                                         NULL, 0);
1817 done:
1818         hci_dev_unlock(hdev);
1819         hci_dev_put(hdev);
1820
1821         return err;
1822 }
1823
1824 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1825 {
1826         unsigned char *buf;
1827         struct mgmt_hdr *hdr;
1828         u16 opcode, index, len;
1829         int err;
1830
1831         BT_DBG("got %zu bytes", msglen);
1832
1833         if (msglen < sizeof(*hdr))
1834                 return -EINVAL;
1835
1836         buf = kmalloc(msglen, GFP_KERNEL);
1837         if (!buf)
1838                 return -ENOMEM;
1839
1840         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1841                 err = -EFAULT;
1842                 goto done;
1843         }
1844
1845         hdr = (struct mgmt_hdr *) buf;
1846         opcode = get_unaligned_le16(&hdr->opcode);
1847         index = get_unaligned_le16(&hdr->index);
1848         len = get_unaligned_le16(&hdr->len);
1849
1850         if (len != msglen - sizeof(*hdr)) {
1851                 err = -EINVAL;
1852                 goto done;
1853         }
1854
1855         switch (opcode) {
1856         case MGMT_OP_READ_VERSION:
1857                 err = read_version(sk);
1858                 break;
1859         case MGMT_OP_READ_INDEX_LIST:
1860                 err = read_index_list(sk);
1861                 break;
1862         case MGMT_OP_READ_INFO:
1863                 err = read_controller_info(sk, index);
1864                 break;
1865         case MGMT_OP_SET_POWERED:
1866                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1867                 break;
1868         case MGMT_OP_SET_DISCOVERABLE:
1869                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1870                 break;
1871         case MGMT_OP_SET_CONNECTABLE:
1872                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1873                 break;
1874         case MGMT_OP_SET_PAIRABLE:
1875                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1876                 break;
1877         case MGMT_OP_ADD_UUID:
1878                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1879                 break;
1880         case MGMT_OP_REMOVE_UUID:
1881                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1882                 break;
1883         case MGMT_OP_SET_DEV_CLASS:
1884                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1885                 break;
1886         case MGMT_OP_SET_SERVICE_CACHE:
1887                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1888                 break;
1889         case MGMT_OP_LOAD_LINK_KEYS:
1890                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1891                 break;
1892         case MGMT_OP_REMOVE_KEYS:
1893                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1894                 break;
1895         case MGMT_OP_DISCONNECT:
1896                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1897                 break;
1898         case MGMT_OP_GET_CONNECTIONS:
1899                 err = get_connections(sk, index);
1900                 break;
1901         case MGMT_OP_PIN_CODE_REPLY:
1902                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1903                 break;
1904         case MGMT_OP_PIN_CODE_NEG_REPLY:
1905                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1906                 break;
1907         case MGMT_OP_SET_IO_CAPABILITY:
1908                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1909                 break;
1910         case MGMT_OP_PAIR_DEVICE:
1911                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1912                 break;
1913         case MGMT_OP_USER_CONFIRM_REPLY:
1914                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1915                 break;
1916         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1917                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1918                 break;
1919         case MGMT_OP_SET_LOCAL_NAME:
1920                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1921                 break;
1922         case MGMT_OP_READ_LOCAL_OOB_DATA:
1923                 err = read_local_oob_data(sk, index);
1924                 break;
1925         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1926                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1927                 break;
1928         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1929                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1930                                                                         len);
1931                 break;
1932         case MGMT_OP_START_DISCOVERY:
1933                 err = start_discovery(sk, index);
1934                 break;
1935         case MGMT_OP_STOP_DISCOVERY:
1936                 err = stop_discovery(sk, index);
1937                 break;
1938         case MGMT_OP_BLOCK_DEVICE:
1939                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1940                 break;
1941         case MGMT_OP_UNBLOCK_DEVICE:
1942                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1943                 break;
1944         case MGMT_OP_SET_FAST_CONNECTABLE:
1945                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1946                                                                 len);
1947                 break;
1948         default:
1949                 BT_DBG("Unknown op %u", opcode);
1950                 err = cmd_status(sk, index, opcode, 0x01);
1951                 break;
1952         }
1953
1954         if (err < 0)
1955                 goto done;
1956
1957         err = msglen;
1958
1959 done:
1960         kfree(buf);
1961         return err;
1962 }
1963
1964 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1965 {
1966         u8 *status = data;
1967
1968         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1969         mgmt_pending_remove(cmd);
1970 }
1971
1972 int mgmt_index_added(struct hci_dev *hdev)
1973 {
1974         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
1975 }
1976
1977 int mgmt_index_removed(struct hci_dev *hdev)
1978 {
1979         u8 status = ENODEV;
1980
1981         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
1982
1983         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
1984 }
1985
1986 struct cmd_lookup {
1987         u8 val;
1988         struct sock *sk;
1989 };
1990
1991 static void mode_rsp(struct pending_cmd *cmd, void *data)
1992 {
1993         struct mgmt_mode *cp = cmd->param;
1994         struct cmd_lookup *match = data;
1995
1996         if (cp->val != match->val)
1997                 return;
1998
1999         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
2000
2001         list_del(&cmd->list);
2002
2003         if (match->sk == NULL) {
2004                 match->sk = cmd->sk;
2005                 sock_hold(match->sk);
2006         }
2007
2008         mgmt_pending_free(cmd);
2009 }
2010
2011 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2012 {
2013         struct mgmt_mode ev;
2014         struct cmd_lookup match = { powered, NULL };
2015         int ret;
2016
2017         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2018
2019         if (!powered) {
2020                 u8 status = ENETDOWN;
2021                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2022         }
2023
2024         ev.val = powered;
2025
2026         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2027
2028         if (match.sk)
2029                 sock_put(match.sk);
2030
2031         return ret;
2032 }
2033
2034 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2035 {
2036         struct mgmt_mode ev;
2037         struct cmd_lookup match = { discoverable, NULL };
2038         int ret;
2039
2040         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2041
2042         ev.val = discoverable;
2043
2044         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2045                                                                 match.sk);
2046
2047         if (match.sk)
2048                 sock_put(match.sk);
2049
2050         return ret;
2051 }
2052
2053 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2054 {
2055         struct mgmt_mode ev;
2056         struct cmd_lookup match = { connectable, NULL };
2057         int ret;
2058
2059         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2060
2061         ev.val = connectable;
2062
2063         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2064
2065         if (match.sk)
2066                 sock_put(match.sk);
2067
2068         return ret;
2069 }
2070
2071 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2072 {
2073         if (scan & SCAN_PAGE)
2074                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2075                                                 cmd_status_rsp, &status);
2076
2077         if (scan & SCAN_INQUIRY)
2078                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2079                                                 cmd_status_rsp, &status);
2080
2081         return 0;
2082 }
2083
2084 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2085                                                                 u8 persistent)
2086 {
2087         struct mgmt_ev_new_link_key ev;
2088
2089         memset(&ev, 0, sizeof(ev));
2090
2091         ev.store_hint = persistent;
2092         bacpy(&ev.key.bdaddr, &key->bdaddr);
2093         ev.key.type = key->type;
2094         memcpy(ev.key.val, key->val, 16);
2095         ev.key.pin_len = key->pin_len;
2096
2097         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2098 }
2099
2100 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type)
2101 {
2102         struct mgmt_addr_info ev;
2103
2104         bacpy(&ev.bdaddr, bdaddr);
2105         ev.type = link_to_mgmt(link_type);
2106
2107         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2108 }
2109
2110 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2111 {
2112         struct mgmt_cp_disconnect *cp = cmd->param;
2113         struct sock **sk = data;
2114         struct mgmt_rp_disconnect rp;
2115
2116         bacpy(&rp.bdaddr, &cp->bdaddr);
2117
2118         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2119
2120         *sk = cmd->sk;
2121         sock_hold(*sk);
2122
2123         mgmt_pending_remove(cmd);
2124 }
2125
2126 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2127 {
2128         struct mgmt_addr_info ev;
2129         struct sock *sk = NULL;
2130         int err;
2131
2132         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2133
2134         bacpy(&ev.bdaddr, bdaddr);
2135         ev.type = link_to_mgmt(type);
2136
2137         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2138
2139         if (sk)
2140                 sock_put(sk);
2141
2142         return err;
2143 }
2144
2145 int mgmt_disconnect_failed(struct hci_dev *hdev)
2146 {
2147         struct pending_cmd *cmd;
2148         int err;
2149
2150         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev->id);
2151         if (!cmd)
2152                 return -ENOENT;
2153
2154         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT, EIO);
2155
2156         mgmt_pending_remove(cmd);
2157
2158         return err;
2159 }
2160
2161 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2162                                                                 u8 status)
2163 {
2164         struct mgmt_ev_connect_failed ev;
2165
2166         bacpy(&ev.addr.bdaddr, bdaddr);
2167         ev.addr.type = link_to_mgmt(type);
2168         ev.status = status;
2169
2170         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2171 }
2172
2173 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2174 {
2175         struct mgmt_ev_pin_code_request ev;
2176
2177         bacpy(&ev.bdaddr, bdaddr);
2178         ev.secure = secure;
2179
2180         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2181                                                                         NULL);
2182 }
2183
2184 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2185                                                                 u8 status)
2186 {
2187         struct pending_cmd *cmd;
2188         struct mgmt_rp_pin_code_reply rp;
2189         int err;
2190
2191         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev->id);
2192         if (!cmd)
2193                 return -ENOENT;
2194
2195         bacpy(&rp.bdaddr, bdaddr);
2196         rp.status = status;
2197
2198         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2199                                                                 sizeof(rp));
2200
2201         mgmt_pending_remove(cmd);
2202
2203         return err;
2204 }
2205
2206 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2207                                                                 u8 status)
2208 {
2209         struct pending_cmd *cmd;
2210         struct mgmt_rp_pin_code_reply rp;
2211         int err;
2212
2213         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev->id);
2214         if (!cmd)
2215                 return -ENOENT;
2216
2217         bacpy(&rp.bdaddr, bdaddr);
2218         rp.status = status;
2219
2220         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2221                                                                 sizeof(rp));
2222
2223         mgmt_pending_remove(cmd);
2224
2225         return err;
2226 }
2227
2228 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2229                                                 __le32 value, u8 confirm_hint)
2230 {
2231         struct mgmt_ev_user_confirm_request ev;
2232
2233         BT_DBG("%s", hdev->name);
2234
2235         bacpy(&ev.bdaddr, bdaddr);
2236         ev.confirm_hint = confirm_hint;
2237         put_unaligned_le32(value, &ev.value);
2238
2239         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2240                                                                         NULL);
2241 }
2242
2243 static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2244                                                         u8 status, u8 opcode)
2245 {
2246         struct pending_cmd *cmd;
2247         struct mgmt_rp_user_confirm_reply rp;
2248         int err;
2249
2250         cmd = mgmt_pending_find(opcode, hdev->id);
2251         if (!cmd)
2252                 return -ENOENT;
2253
2254         bacpy(&rp.bdaddr, bdaddr);
2255         rp.status = status;
2256         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2257
2258         mgmt_pending_remove(cmd);
2259
2260         return err;
2261 }
2262
2263 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2264                                                                 u8 status)
2265 {
2266         return confirm_reply_complete(hdev, bdaddr, status,
2267                                                 MGMT_OP_USER_CONFIRM_REPLY);
2268 }
2269
2270 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2271                                                 bdaddr_t *bdaddr, u8 status)
2272 {
2273         return confirm_reply_complete(hdev, bdaddr, status,
2274                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2275 }
2276
2277 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2278 {
2279         struct mgmt_ev_auth_failed ev;
2280
2281         bacpy(&ev.bdaddr, bdaddr);
2282         ev.status = status;
2283
2284         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2285 }
2286
2287 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2288 {
2289         struct pending_cmd *cmd;
2290         struct mgmt_cp_set_local_name ev;
2291         int err;
2292
2293         memset(&ev, 0, sizeof(ev));
2294         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2295
2296         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev->id);
2297         if (!cmd)
2298                 goto send_event;
2299
2300         if (status) {
2301                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2302                                                                         EIO);
2303                 goto failed;
2304         }
2305
2306         hci_dev_lock_bh(hdev);
2307         update_eir(hdev);
2308         hci_dev_unlock_bh(hdev);
2309
2310         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2311                                                                 sizeof(ev));
2312         if (err < 0)
2313                 goto failed;
2314
2315 send_event:
2316         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2317                                                         cmd ? cmd->sk : NULL);
2318
2319 failed:
2320         if (cmd)
2321                 mgmt_pending_remove(cmd);
2322         return err;
2323 }
2324
2325 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2326                                                 u8 *randomizer, u8 status)
2327 {
2328         struct pending_cmd *cmd;
2329         int err;
2330
2331         BT_DBG("%s status %u", hdev->name, status);
2332
2333         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev->id);
2334         if (!cmd)
2335                 return -ENOENT;
2336
2337         if (status) {
2338                 err = cmd_status(cmd->sk, hdev->id,
2339                                         MGMT_OP_READ_LOCAL_OOB_DATA, EIO);
2340         } else {
2341                 struct mgmt_rp_read_local_oob_data rp;
2342
2343                 memcpy(rp.hash, hash, sizeof(rp.hash));
2344                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2345
2346                 err = cmd_complete(cmd->sk, hdev->id,
2347                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2348                                                 &rp, sizeof(rp));
2349         }
2350
2351         mgmt_pending_remove(cmd);
2352
2353         return err;
2354 }
2355
2356 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2357                                         u8 *dev_class, s8 rssi, u8 *eir)
2358 {
2359         struct mgmt_ev_device_found ev;
2360
2361         memset(&ev, 0, sizeof(ev));
2362
2363         bacpy(&ev.addr.bdaddr, bdaddr);
2364         ev.addr.type = link_to_mgmt(type);
2365         ev.rssi = rssi;
2366
2367         if (eir)
2368                 memcpy(ev.eir, eir, sizeof(ev.eir));
2369
2370         if (dev_class)
2371                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2372
2373         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2374 }
2375
2376 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2377 {
2378         struct mgmt_ev_remote_name ev;
2379
2380         memset(&ev, 0, sizeof(ev));
2381
2382         bacpy(&ev.bdaddr, bdaddr);
2383         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2384
2385         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2386 }
2387
2388 int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status)
2389 {
2390         struct pending_cmd *cmd;
2391         int err;
2392
2393         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev->id);
2394         if (!cmd)
2395                 return -ENOENT;
2396
2397         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2398         mgmt_pending_remove(cmd);
2399
2400         return err;
2401 }
2402
2403 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2404 {
2405         struct pending_cmd *cmd;
2406
2407         if (discovering)
2408                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev->id);
2409         else
2410                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev->id);
2411
2412         if (cmd != NULL) {
2413                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2414                 mgmt_pending_remove(cmd);
2415         }
2416
2417         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2418                                                 sizeof(discovering), NULL);
2419 }
2420
2421 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2422 {
2423         struct pending_cmd *cmd;
2424         struct mgmt_ev_device_blocked ev;
2425
2426         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev->id);
2427
2428         bacpy(&ev.bdaddr, bdaddr);
2429
2430         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2431                                                         cmd ? cmd->sk : NULL);
2432 }
2433
2434 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2435 {
2436         struct pending_cmd *cmd;
2437         struct mgmt_ev_device_unblocked ev;
2438
2439         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev->id);
2440
2441         bacpy(&ev.bdaddr, bdaddr);
2442
2443         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2444                                                         cmd ? cmd->sk : NULL);
2445 }