net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 struct pending_cmd {
  36         struct list_head list;
  37         __u16 opcode;
  38         int index;
  39         void *param;
  40         struct sock *sk;
  41         void *user_data;
  42 };
  43
  44 static LIST_HEAD(cmd_list);
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51
  52         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  53
  54         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  55         if (!skb)
  56                 return -ENOMEM;
  57
  58         hdr = (void *) skb_put(skb, sizeof(*hdr));
  59
  60         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  61         hdr->index = cpu_to_le16(index);
  62         hdr->len = cpu_to_le16(sizeof(*ev));
  63
  64         ev = (void *) skb_put(skb, sizeof(*ev));
  65         ev->status = status;
  66         put_unaligned_le16(cmd, &ev->opcode);
  67
  68         if (sock_queue_rcv_skb(sk, skb) < 0)
  69                 kfree_skb(skb);
  70
  71         return 0;
  72 }
  73
  74 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  75                                                                 size_t rp_len)
  76 {
  77         struct sk_buff *skb;
  78         struct mgmt_hdr *hdr;
  79         struct mgmt_ev_cmd_complete *ev;
  80
  81         BT_DBG("sock %p", sk);
  82
  83         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  84         if (!skb)
  85                 return -ENOMEM;
  86
  87         hdr = (void *) skb_put(skb, sizeof(*hdr));
  88
  89         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  90         hdr->index = cpu_to_le16(index);
  91         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  92
  93         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  94         put_unaligned_le16(cmd, &ev->opcode);
  95
  96         if (rp)
  97                 memcpy(ev->data, rp, rp_len);
  98
  99         if (sock_queue_rcv_skb(sk, skb) < 0)
 100                 kfree_skb(skb);
 101
 102         return 0;
 103 }
 104
 105 static int read_version(struct sock *sk)
 106 {
 107         struct mgmt_rp_read_version rp;
 108
 109         BT_DBG("sock %p", sk);
 110
 111         rp.version = MGMT_VERSION;
 112         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 113
 114         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 115                                                                 sizeof(rp));
 116 }
 117
 118 static int read_index_list(struct sock *sk)
 119 {
 120         struct mgmt_rp_read_index_list *rp;
 121         struct list_head *p;
 122         size_t rp_len;
 123         u16 count;
 124         int i, err;
 125
 126         BT_DBG("sock %p", sk);
 127
 128         read_lock(&hci_dev_list_lock);
 129
 130         count = 0;
 131         list_for_each(p, &hci_dev_list) {
 132                 count++;
 133         }
 134
 135         rp_len = sizeof(*rp) + (2 * count);
 136         rp = kmalloc(rp_len, GFP_ATOMIC);
 137         if (!rp) {
 138                 read_unlock(&hci_dev_list_lock);
 139                 return -ENOMEM;
 140         }
 141
 142         put_unaligned_le16(count, &rp->num_controllers);
 143
 144         i = 0;
 145         list_for_each(p, &hci_dev_list) {
 146                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 147
 148                 hci_del_off_timer(d);
 149
 150                 if (test_bit(HCI_SETUP, &d->flags))
 151                         continue;
 152
 153                 put_unaligned_le16(d->id, &rp->index[i++]);
 154                 BT_DBG("Added hci%u", d->id);
 155         }
 156
 157         read_unlock(&hci_dev_list_lock);
 158
 159         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 160                                                                         rp_len);
 161
 162         kfree(rp);
 163
 164         return err;
 165 }
 166
 167 static int read_controller_info(struct sock *sk, u16 index)
 168 {
 169         struct mgmt_rp_read_info rp;
 170         struct hci_dev *hdev;
 171
 172         BT_DBG("sock %p hci%u", sk, index);
 173
 174         hdev = hci_dev_get(index);
 175         if (!hdev)
 176                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 177
 178         hci_del_off_timer(hdev);
 179
 180         hci_dev_lock_bh(hdev);
 181
 182         set_bit(HCI_MGMT, &hdev->flags);
 183
 184         memset(&rp, 0, sizeof(rp));
 185
 186         rp.type = hdev->dev_type;
 187
 188         rp.powered = test_bit(HCI_UP, &hdev->flags);
 189         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 190         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 191         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 192
 193         if (test_bit(HCI_AUTH, &hdev->flags))
 194                 rp.sec_mode = 3;
 195         else if (hdev->ssp_mode > 0)
 196                 rp.sec_mode = 4;
 197         else
 198                 rp.sec_mode = 2;
 199
 200         bacpy(&rp.bdaddr, &hdev->bdaddr);
 201         memcpy(rp.features, hdev->features, 8);
 202         memcpy(rp.dev_class, hdev->dev_class, 3);
 203         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 204         rp.hci_ver = hdev->hci_ver;
 205         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 206
 207         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 208
 209         hci_dev_unlock_bh(hdev);
 210         hci_dev_put(hdev);
 211
 212         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 213 }
 214
 215 static void mgmt_pending_free(struct pending_cmd *cmd)
 216 {
 217         sock_put(cmd->sk);
 218         kfree(cmd->param);
 219         kfree(cmd);
 220 }
 221
 222 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 223                                                 u16 index, void *data, u16 len)
 224 {
 225         struct pending_cmd *cmd;
 226
 227         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 228         if (!cmd)
 229                 return NULL;
 230
 231         cmd->opcode = opcode;
 232         cmd->index = index;
 233
 234         cmd->param = kmalloc(len, GFP_ATOMIC);
 235         if (!cmd->param) {
 236                 kfree(cmd);
 237                 return NULL;
 238         }
 239
 240         if (data)
 241                 memcpy(cmd->param, data, len);
 242
 243         cmd->sk = sk;
 244         sock_hold(sk);
 245
 246         list_add(&cmd->list, &cmd_list);
 247
 248         return cmd;
 249 }
 250
 251 static void mgmt_pending_foreach(u16 opcode, int index,
 252                                 void (*cb)(struct pending_cmd *cmd, void *data),
 253                                 void *data)
 254 {
 255         struct list_head *p, *n;
 256
 257         list_for_each_safe(p, n, &cmd_list) {
 258                 struct pending_cmd *cmd;
 259
 260                 cmd = list_entry(p, struct pending_cmd, list);
 261
 262                 if (cmd->opcode != opcode)
 263                         continue;
 264
 265                 if (index >= 0 && cmd->index != index)
 266                         continue;
 267
 268                 cb(cmd, data);
 269         }
 270 }
 271
 272 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 273 {
 274         struct list_head *p;
 275
 276         list_for_each(p, &cmd_list) {
 277                 struct pending_cmd *cmd;
 278
 279                 cmd = list_entry(p, struct pending_cmd, list);
 280
 281                 if (cmd->opcode != opcode)
 282                         continue;
 283
 284                 if (index >= 0 && cmd->index != index)
 285                         continue;
 286
 287                 return cmd;
 288         }
 289
 290         return NULL;
 291 }
 292
 293 static void mgmt_pending_remove(struct pending_cmd *cmd)
 294 {
 295         list_del(&cmd->list);
 296         mgmt_pending_free(cmd);
 297 }
 298
 299 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 300 {
 301         struct mgmt_mode *cp;
 302         struct hci_dev *hdev;
 303         struct pending_cmd *cmd;
 304         int err, up;
 305
 306         cp = (void *) data;
 307
 308         BT_DBG("request for hci%u", index);
 309
 310         if (len != sizeof(*cp))
 311                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 312
 313         hdev = hci_dev_get(index);
 314         if (!hdev)
 315                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 316
 317         hci_dev_lock_bh(hdev);
 318
 319         up = test_bit(HCI_UP, &hdev->flags);
 320         if ((cp->val && up) || (!cp->val && !up)) {
 321                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 322                 goto failed;
 323         }
 324
 325         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 326                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 327                 goto failed;
 328         }
 329
 330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 331         if (!cmd) {
 332                 err = -ENOMEM;
 333                 goto failed;
 334         }
 335
 336         if (cp->val)
 337                 queue_work(hdev->workqueue, &hdev->power_on);
 338         else
 339                 queue_work(hdev->workqueue, &hdev->power_off);
 340
 341         err = 0;
 342
 343 failed:
 344         hci_dev_unlock_bh(hdev);
 345         hci_dev_put(hdev);
 346         return err;
 347 }
 348
 349 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 350                                                                         u16 len)
 351 {
 352         struct mgmt_mode *cp;
 353         struct hci_dev *hdev;
 354         struct pending_cmd *cmd;
 355         u8 scan;
 356         int err;
 357
 358         cp = (void *) data;
 359
 360         BT_DBG("request for hci%u", index);
 361
 362         if (len != sizeof(*cp))
 363                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 364
 365         hdev = hci_dev_get(index);
 366         if (!hdev)
 367                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 368
 369         hci_dev_lock_bh(hdev);
 370
 371         if (!test_bit(HCI_UP, &hdev->flags)) {
 372                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 373                 goto failed;
 374         }
 375
 376         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 377                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 378                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 379                 goto failed;
 380         }
 381
 382         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 383                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 384                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 385                 goto failed;
 386         }
 387
 388         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 389         if (!cmd) {
 390                 err = -ENOMEM;
 391                 goto failed;
 392         }
 393
 394         scan = SCAN_PAGE;
 395
 396         if (cp->val)
 397                 scan |= SCAN_INQUIRY;
 398
 399         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 400         if (err < 0)
 401                 mgmt_pending_remove(cmd);
 402
 403 failed:
 404         hci_dev_unlock_bh(hdev);
 405         hci_dev_put(hdev);
 406
 407         return err;
 408 }
 409
 410 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 411                                                                         u16 len)
 412 {
 413         struct mgmt_mode *cp;
 414         struct hci_dev *hdev;
 415         struct pending_cmd *cmd;
 416         u8 scan;
 417         int err;
 418
 419         cp = (void *) data;
 420
 421         BT_DBG("request for hci%u", index);
 422
 423         if (len != sizeof(*cp))
 424                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 425
 426         hdev = hci_dev_get(index);
 427         if (!hdev)
 428                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 429
 430         hci_dev_lock_bh(hdev);
 431
 432         if (!test_bit(HCI_UP, &hdev->flags)) {
 433                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 434                 goto failed;
 435         }
 436
 437         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 438                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 439                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 440                 goto failed;
 441         }
 442
 443         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 444                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 445                 goto failed;
 446         }
 447
 448         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 449         if (!cmd) {
 450                 err = -ENOMEM;
 451                 goto failed;
 452         }
 453
 454         if (cp->val)
 455                 scan = SCAN_PAGE;
 456         else
 457                 scan = 0;
 458
 459         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 460         if (err < 0)
 461                 mgmt_pending_remove(cmd);
 462
 463 failed:
 464         hci_dev_unlock_bh(hdev);
 465         hci_dev_put(hdev);
 466
 467         return err;
 468 }
 469
 470 static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
 471                                                         struct sock *skip_sk)
 472 {
 473         struct sk_buff *skb;
 474         struct mgmt_hdr *hdr;
 475
 476         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 477         if (!skb)
 478                 return -ENOMEM;
 479
 480         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 481
 482         hdr = (void *) skb_put(skb, sizeof(*hdr));
 483         hdr->opcode = cpu_to_le16(event);
 484         hdr->index = cpu_to_le16(index);
 485         hdr->len = cpu_to_le16(data_len);
 486
 487         if (data)
 488                 memcpy(skb_put(skb, data_len), data, data_len);
 489
 490         hci_send_to_sock(NULL, skb, skip_sk);
 491         kfree_skb(skb);
 492
 493         return 0;
 494 }
 495
 496 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 497 {
 498         struct mgmt_mode rp;
 499
 500         rp.val = val;
 501
 502         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 503 }
 504
 505 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 506                                                                         u16 len)
 507 {
 508         struct mgmt_mode *cp, ev;
 509         struct hci_dev *hdev;
 510         int err;
 511
 512         cp = (void *) data;
 513
 514         BT_DBG("request for hci%u", index);
 515
 516         if (len != sizeof(*cp))
 517                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 518
 519         hdev = hci_dev_get(index);
 520         if (!hdev)
 521                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 522
 523         hci_dev_lock_bh(hdev);
 524
 525         if (cp->val)
 526                 set_bit(HCI_PAIRABLE, &hdev->flags);
 527         else
 528                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 529
 530         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 531         if (err < 0)
 532                 goto failed;
 533
 534         ev.val = cp->val;
 535
 536         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 537
 538 failed:
 539         hci_dev_unlock_bh(hdev);
 540         hci_dev_put(hdev);
 541
 542         return err;
 543 }
 544
 545 #define EIR_FLAGS               0x01 /* flags */
 546 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 547 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 548 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 549 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 550 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 551 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 552 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 553 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 554 #define EIR_TX_POWER            0x0A /* transmit power level */
 555 #define EIR_DEVICE_ID           0x10 /* device ID */
 556
 557 #define PNP_INFO_SVCLASS_ID             0x1200
 558
 559 static u8 bluetooth_base_uuid[] = {
 560                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 561                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 562 };
 563
 564 static u16 get_uuid16(u8 *uuid128)
 565 {
 566         u32 val;
 567         int i;
 568
 569         for (i = 0; i < 12; i++) {
 570                 if (bluetooth_base_uuid[i] != uuid128[i])
 571                         return 0;
 572         }
 573
 574         memcpy(&val, &uuid128[12], 4);
 575
 576         val = le32_to_cpu(val);
 577         if (val > 0xffff)
 578                 return 0;
 579
 580         return (u16) val;
 581 }
 582
 583 static void create_eir(struct hci_dev *hdev, u8 *data)
 584 {
 585         u8 *ptr = data;
 586         u16 eir_len = 0;
 587         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 588         int i, truncated = 0;
 589         struct list_head *p;
 590         size_t name_len;
 591
 592         name_len = strlen(hdev->dev_name);
 593
 594         if (name_len > 0) {
 595                 /* EIR Data type */
 596                 if (name_len > 48) {
 597                         name_len = 48;
 598                         ptr[1] = EIR_NAME_SHORT;
 599                 } else
 600                         ptr[1] = EIR_NAME_COMPLETE;
 601
 602                 /* EIR Data length */
 603                 ptr[0] = name_len + 1;
 604
 605                 memcpy(ptr + 2, hdev->dev_name, name_len);
 606
 607                 eir_len += (name_len + 2);
 608                 ptr += (name_len + 2);
 609         }
 610
 611         memset(uuid16_list, 0, sizeof(uuid16_list));
 612
 613         /* Group all UUID16 types */
 614         list_for_each(p, &hdev->uuids) {
 615                 struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
 616                 u16 uuid16;
 617
 618                 uuid16 = get_uuid16(uuid->uuid);
 619                 if (uuid16 == 0)
 620                         return;
 621
 622                 if (uuid16 < 0x1100)
 623                         continue;
 624
 625                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 626                         continue;
 627
 628                 /* Stop if not enough space to put next UUID */
 629                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 630                         truncated = 1;
 631                         break;
 632                 }
 633
 634                 /* Check for duplicates */
 635                 for (i = 0; uuid16_list[i] != 0; i++)
 636                         if (uuid16_list[i] == uuid16)
 637                                 break;
 638
 639                 if (uuid16_list[i] == 0) {
 640                         uuid16_list[i] = uuid16;
 641                         eir_len += sizeof(u16);
 642                 }
 643         }
 644
 645         if (uuid16_list[0] != 0) {
 646                 u8 *length = ptr;
 647
 648                 /* EIR Data type */
 649                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 650
 651                 ptr += 2;
 652                 eir_len += 2;
 653
 654                 for (i = 0; uuid16_list[i] != 0; i++) {
 655                         *ptr++ = (uuid16_list[i] & 0x00ff);
 656                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 657                 }
 658
 659                 /* EIR Data length */
 660                 *length = (i * sizeof(u16)) + 1;
 661         }
 662 }
 663
 664 static int update_eir(struct hci_dev *hdev)
 665 {
 666         struct hci_cp_write_eir cp;
 667
 668         if (!(hdev->features[6] & LMP_EXT_INQ))
 669                 return 0;
 670
 671         if (hdev->ssp_mode == 0)
 672                 return 0;
 673
 674         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 675                 return 0;
 676
 677         memset(&cp, 0, sizeof(cp));
 678
 679         create_eir(hdev, cp.data);
 680
 681         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 682                 return 0;
 683
 684         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 685
 686         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 687 }
 688
 689 static u8 get_service_classes(struct hci_dev *hdev)
 690 {
 691         struct list_head *p;
 692         u8 val = 0;
 693
 694         list_for_each(p, &hdev->uuids) {
 695                 struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
 696
 697                 val |= uuid->svc_hint;
 698         }
 699
 700         return val;
 701 }
 702
 703 static int update_class(struct hci_dev *hdev)
 704 {
 705         u8 cod[3];
 706
 707         BT_DBG("%s", hdev->name);
 708
 709         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 710                 return 0;
 711
 712         cod[0] = hdev->minor_class;
 713         cod[1] = hdev->major_class;
 714         cod[2] = get_service_classes(hdev);
 715
 716         if (memcmp(cod, hdev->dev_class, 3) == 0)
 717                 return 0;
 718
 719         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 720 }
 721
 722 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 723 {
 724         struct mgmt_cp_add_uuid *cp;
 725         struct hci_dev *hdev;
 726         struct bt_uuid *uuid;
 727         int err;
 728
 729         cp = (void *) data;
 730
 731         BT_DBG("request for hci%u", index);
 732
 733         if (len != sizeof(*cp))
 734                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 735
 736         hdev = hci_dev_get(index);
 737         if (!hdev)
 738                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 739
 740         hci_dev_lock_bh(hdev);
 741
 742         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 743         if (!uuid) {
 744                 err = -ENOMEM;
 745                 goto failed;
 746         }
 747
 748         memcpy(uuid->uuid, cp->uuid, 16);
 749         uuid->svc_hint = cp->svc_hint;
 750
 751         list_add(&uuid->list, &hdev->uuids);
 752
 753         err = update_class(hdev);
 754         if (err < 0)
 755                 goto failed;
 756
 757         err = update_eir(hdev);
 758         if (err < 0)
 759                 goto failed;
 760
 761         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 762
 763 failed:
 764         hci_dev_unlock_bh(hdev);
 765         hci_dev_put(hdev);
 766
 767         return err;
 768 }
 769
 770 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 771 {
 772         struct list_head *p, *n;
 773         struct mgmt_cp_remove_uuid *cp;
 774         struct hci_dev *hdev;
 775         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 776         int err, found;
 777
 778         cp = (void *) data;
 779
 780         BT_DBG("request for hci%u", index);
 781
 782         if (len != sizeof(*cp))
 783                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 784
 785         hdev = hci_dev_get(index);
 786         if (!hdev)
 787                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 788
 789         hci_dev_lock_bh(hdev);
 790
 791         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 792                 err = hci_uuids_clear(hdev);
 793                 goto unlock;
 794         }
 795
 796         found = 0;
 797
 798         list_for_each_safe(p, n, &hdev->uuids) {
 799                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 800
 801                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 802                         continue;
 803
 804                 list_del(&match->list);
 805                 found++;
 806         }
 807
 808         if (found == 0) {
 809                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 810                 goto unlock;
 811         }
 812
 813         err = update_class(hdev);
 814         if (err < 0)
 815                 goto unlock;
 816
 817         err = update_eir(hdev);
 818         if (err < 0)
 819                 goto unlock;
 820
 821         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 822
 823 unlock:
 824         hci_dev_unlock_bh(hdev);
 825         hci_dev_put(hdev);
 826
 827         return err;
 828 }
 829
 830 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 831                                                                         u16 len)
 832 {
 833         struct hci_dev *hdev;
 834         struct mgmt_cp_set_dev_class *cp;
 835         int err;
 836
 837         cp = (void *) data;
 838
 839         BT_DBG("request for hci%u", index);
 840
 841         if (len != sizeof(*cp))
 842                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 843
 844         hdev = hci_dev_get(index);
 845         if (!hdev)
 846                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 847
 848         hci_dev_lock_bh(hdev);
 849
 850         hdev->major_class = cp->major;
 851         hdev->minor_class = cp->minor;
 852
 853         err = update_class(hdev);
 854
 855         if (err == 0)
 856                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 857
 858         hci_dev_unlock_bh(hdev);
 859         hci_dev_put(hdev);
 860
 861         return err;
 862 }
 863
 864 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 865                                                                         u16 len)
 866 {
 867         struct hci_dev *hdev;
 868         struct mgmt_cp_set_service_cache *cp;
 869         int err;
 870
 871         cp = (void *) data;
 872
 873         if (len != sizeof(*cp))
 874                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 875
 876         hdev = hci_dev_get(index);
 877         if (!hdev)
 878                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 879
 880         hci_dev_lock_bh(hdev);
 881
 882         BT_DBG("hci%u enable %d", index, cp->enable);
 883
 884         if (cp->enable) {
 885                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 886                 err = 0;
 887         } else {
 888                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 889                 err = update_class(hdev);
 890                 if (err == 0)
 891                         err = update_eir(hdev);
 892         }
 893
 894         if (err == 0)
 895                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 896                                                                         0);
 897
 898         hci_dev_unlock_bh(hdev);
 899         hci_dev_put(hdev);
 900
 901         return err;
 902 }
 903
 904 static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 905 {
 906         struct hci_dev *hdev;
 907         struct mgmt_cp_load_keys *cp;
 908         u16 key_count, expected_len;
 909         int i;
 910
 911         cp = (void *) data;
 912
 913         if (len < sizeof(*cp))
 914                 return -EINVAL;
 915
 916         key_count = get_unaligned_le16(&cp->key_count);
 917
 918         expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
 919         if (expected_len != len) {
 920                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
 921                                                         len, expected_len);
 922                 return -EINVAL;
 923         }
 924
 925         hdev = hci_dev_get(index);
 926         if (!hdev)
 927                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
 928
 929         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 930                                                                 key_count);
 931
 932         hci_dev_lock_bh(hdev);
 933
 934         hci_link_keys_clear(hdev);
 935
 936         set_bit(HCI_LINK_KEYS, &hdev->flags);
 937
 938         if (cp->debug_keys)
 939                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 940         else
 941                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 942
 943         for (i = 0; i < key_count; i++) {
 944                 struct mgmt_key_info *key = &cp->keys[i];
 945
 946                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 947                                                                 key->pin_len);
 948         }
 949
 950         hci_dev_unlock_bh(hdev);
 951         hci_dev_put(hdev);
 952
 953         return 0;
 954 }
 955
 956 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 957 {
 958         struct hci_dev *hdev;
 959         struct mgmt_cp_remove_key *cp;
 960         struct hci_conn *conn;
 961         int err;
 962
 963         cp = (void *) data;
 964
 965         if (len != sizeof(*cp))
 966                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
 967
 968         hdev = hci_dev_get(index);
 969         if (!hdev)
 970                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 971
 972         hci_dev_lock_bh(hdev);
 973
 974         err = hci_remove_link_key(hdev, &cp->bdaddr);
 975         if (err < 0) {
 976                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
 977                 goto unlock;
 978         }
 979
 980         err = 0;
 981
 982         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 983                 goto unlock;
 984
 985         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 986         if (conn) {
 987                 struct hci_cp_disconnect dc;
 988
 989                 put_unaligned_le16(conn->handle, &dc.handle);
 990                 dc.reason = 0x13; /* Remote User Terminated Connection */
 991                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
 992         }
 993
 994 unlock:
 995         hci_dev_unlock_bh(hdev);
 996         hci_dev_put(hdev);
 997
 998         return err;
 999 }
1000
1001 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1002 {
1003         struct hci_dev *hdev;
1004         struct mgmt_cp_disconnect *cp;
1005         struct hci_cp_disconnect dc;
1006         struct pending_cmd *cmd;
1007         struct hci_conn *conn;
1008         int err;
1009
1010         BT_DBG("");
1011
1012         cp = (void *) data;
1013
1014         if (len != sizeof(*cp))
1015                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1016
1017         hdev = hci_dev_get(index);
1018         if (!hdev)
1019                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1020
1021         hci_dev_lock_bh(hdev);
1022
1023         if (!test_bit(HCI_UP, &hdev->flags)) {
1024                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1025                 goto failed;
1026         }
1027
1028         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
1029                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1030                 goto failed;
1031         }
1032
1033         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1034         if (!conn)
1035                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1036
1037         if (!conn) {
1038                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1039                 goto failed;
1040         }
1041
1042         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
1043         if (!cmd) {
1044                 err = -ENOMEM;
1045                 goto failed;
1046         }
1047
1048         put_unaligned_le16(conn->handle, &dc.handle);
1049         dc.reason = 0x13; /* Remote User Terminated Connection */
1050
1051         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1052         if (err < 0)
1053                 mgmt_pending_remove(cmd);
1054
1055 failed:
1056         hci_dev_unlock_bh(hdev);
1057         hci_dev_put(hdev);
1058
1059         return err;
1060 }
1061
1062 static int get_connections(struct sock *sk, u16 index)
1063 {
1064         struct mgmt_rp_get_connections *rp;
1065         struct hci_dev *hdev;
1066         struct list_head *p;
1067         size_t rp_len;
1068         u16 count;
1069         int i, err;
1070
1071         BT_DBG("");
1072
1073         hdev = hci_dev_get(index);
1074         if (!hdev)
1075                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1076
1077         hci_dev_lock_bh(hdev);
1078
1079         count = 0;
1080         list_for_each(p, &hdev->conn_hash.list) {
1081                 count++;
1082         }
1083
1084         rp_len = sizeof(*rp) + (count * sizeof(bdaddr_t));
1085         rp = kmalloc(rp_len, GFP_ATOMIC);
1086         if (!rp) {
1087                 err = -ENOMEM;
1088                 goto unlock;
1089         }
1090
1091         put_unaligned_le16(count, &rp->conn_count);
1092
1093         i = 0;
1094         list_for_each(p, &hdev->conn_hash.list) {
1095                 struct hci_conn *c = list_entry(p, struct hci_conn, list);
1096
1097                 bacpy(&rp->conn[i++], &c->dst);
1098         }
1099
1100         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1101
1102 unlock:
1103         kfree(rp);
1104         hci_dev_unlock_bh(hdev);
1105         hci_dev_put(hdev);
1106         return err;
1107 }
1108
1109 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1110                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1111 {
1112         struct pending_cmd *cmd;
1113         int err;
1114
1115         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
1116                                                                 sizeof(*cp));
1117         if (!cmd)
1118                 return -ENOMEM;
1119
1120         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1121                                                                 &cp->bdaddr);
1122         if (err < 0)
1123                 mgmt_pending_remove(cmd);
1124
1125         return err;
1126 }
1127
1128 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1129                                                                         u16 len)
1130 {
1131         struct hci_dev *hdev;
1132         struct hci_conn *conn;
1133         struct mgmt_cp_pin_code_reply *cp;
1134         struct mgmt_cp_pin_code_neg_reply ncp;
1135         struct hci_cp_pin_code_reply reply;
1136         struct pending_cmd *cmd;
1137         int err;
1138
1139         BT_DBG("");
1140
1141         cp = (void *) data;
1142
1143         if (len != sizeof(*cp))
1144                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1145
1146         hdev = hci_dev_get(index);
1147         if (!hdev)
1148                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1149
1150         hci_dev_lock_bh(hdev);
1151
1152         if (!test_bit(HCI_UP, &hdev->flags)) {
1153                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1154                 goto failed;
1155         }
1156
1157         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1158         if (!conn) {
1159                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1160                 goto failed;
1161         }
1162
1163         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1164                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1165
1166                 BT_ERR("PIN code is not 16 bytes long");
1167
1168                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1169                 if (err >= 0)
1170                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1171                                                                 EINVAL);
1172
1173                 goto failed;
1174         }
1175
1176         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
1177         if (!cmd) {
1178                 err = -ENOMEM;
1179                 goto failed;
1180         }
1181
1182         bacpy(&reply.bdaddr, &cp->bdaddr);
1183         reply.pin_len = cp->pin_len;
1184         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1185
1186         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1187         if (err < 0)
1188                 mgmt_pending_remove(cmd);
1189
1190 failed:
1191         hci_dev_unlock_bh(hdev);
1192         hci_dev_put(hdev);
1193
1194         return err;
1195 }
1196
1197 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1198                                                                         u16 len)
1199 {
1200         struct hci_dev *hdev;
1201         struct mgmt_cp_pin_code_neg_reply *cp;
1202         int err;
1203
1204         BT_DBG("");
1205
1206         cp = (void *) data;
1207
1208         if (len != sizeof(*cp))
1209                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1210                                                                         EINVAL);
1211
1212         hdev = hci_dev_get(index);
1213         if (!hdev)
1214                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1215                                                                         ENODEV);
1216
1217         hci_dev_lock_bh(hdev);
1218
1219         if (!test_bit(HCI_UP, &hdev->flags)) {
1220                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1221                                                                 ENETDOWN);
1222                 goto failed;
1223         }
1224
1225         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1226
1227 failed:
1228         hci_dev_unlock_bh(hdev);
1229         hci_dev_put(hdev);
1230
1231         return err;
1232 }
1233
1234 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1235                                                                         u16 len)
1236 {
1237         struct hci_dev *hdev;
1238         struct mgmt_cp_set_io_capability *cp;
1239
1240         BT_DBG("");
1241
1242         cp = (void *) data;
1243
1244         if (len != sizeof(*cp))
1245                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1246
1247         hdev = hci_dev_get(index);
1248         if (!hdev)
1249                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1250
1251         hci_dev_lock_bh(hdev);
1252
1253         hdev->io_capability = cp->io_capability;
1254
1255         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1256                                                         hdev->io_capability);
1257
1258         hci_dev_unlock_bh(hdev);
1259         hci_dev_put(hdev);
1260
1261         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1262 }
1263
1264 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1265 {
1266         struct hci_dev *hdev = conn->hdev;
1267         struct list_head *p;
1268
1269         list_for_each(p, &cmd_list) {
1270                 struct pending_cmd *cmd;
1271
1272                 cmd = list_entry(p, struct pending_cmd, list);
1273
1274                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1275                         continue;
1276
1277                 if (cmd->index != hdev->id)
1278                         continue;
1279
1280                 if (cmd->user_data != conn)
1281                         continue;
1282
1283                 return cmd;
1284         }
1285
1286         return NULL;
1287 }
1288
1289 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1290 {
1291         struct mgmt_rp_pair_device rp;
1292         struct hci_conn *conn = cmd->user_data;
1293
1294         bacpy(&rp.bdaddr, &conn->dst);
1295         rp.status = status;
1296
1297         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1298
1299         /* So we don't get further callbacks for this connection */
1300         conn->connect_cfm_cb = NULL;
1301         conn->security_cfm_cb = NULL;
1302         conn->disconn_cfm_cb = NULL;
1303
1304         hci_conn_put(conn);
1305
1306         mgmt_pending_remove(cmd);
1307 }
1308
1309 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1310 {
1311         struct pending_cmd *cmd;
1312
1313         BT_DBG("status %u", status);
1314
1315         cmd = find_pairing(conn);
1316         if (!cmd) {
1317                 BT_DBG("Unable to find a pending command");
1318                 return;
1319         }
1320
1321         pairing_complete(cmd, status);
1322 }
1323
1324 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1325 {
1326         struct hci_dev *hdev;
1327         struct mgmt_cp_pair_device *cp;
1328         struct pending_cmd *cmd;
1329         struct adv_entry *entry;
1330         u8 sec_level, auth_type;
1331         struct hci_conn *conn;
1332         int err;
1333
1334         BT_DBG("");
1335
1336         cp = (void *) data;
1337
1338         if (len != sizeof(*cp))
1339                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1340
1341         hdev = hci_dev_get(index);
1342         if (!hdev)
1343                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1344
1345         hci_dev_lock_bh(hdev);
1346
1347         sec_level = BT_SECURITY_MEDIUM;
1348         if (cp->io_cap == 0x03)
1349                 auth_type = HCI_AT_DEDICATED_BONDING;
1350         else
1351                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1352
1353         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1354         if (entry)
1355                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1356                                                                 auth_type);
1357         else
1358                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1359                                                                 auth_type);
1360
1361         if (IS_ERR(conn)) {
1362                 err = PTR_ERR(conn);
1363                 goto unlock;
1364         }
1365
1366         if (conn->connect_cfm_cb) {
1367                 hci_conn_put(conn);
1368                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1369                 goto unlock;
1370         }
1371
1372         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1373         if (!cmd) {
1374                 err = -ENOMEM;
1375                 hci_conn_put(conn);
1376                 goto unlock;
1377         }
1378
1379         /* For LE, just connecting isn't a proof that the pairing finished */
1380         if (!entry)
1381                 conn->connect_cfm_cb = pairing_complete_cb;
1382
1383         conn->security_cfm_cb = pairing_complete_cb;
1384         conn->disconn_cfm_cb = pairing_complete_cb;
1385         conn->io_capability = cp->io_cap;
1386         cmd->user_data = conn;
1387
1388         if (conn->state == BT_CONNECTED &&
1389                                 hci_conn_security(conn, sec_level, auth_type))
1390                 pairing_complete(cmd, 0);
1391
1392         err = 0;
1393
1394 unlock:
1395         hci_dev_unlock_bh(hdev);
1396         hci_dev_put(hdev);
1397
1398         return err;
1399 }
1400
1401 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1402                                                         u16 len, int success)
1403 {
1404         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1405         u16 mgmt_op, hci_op;
1406         struct pending_cmd *cmd;
1407         struct hci_dev *hdev;
1408         int err;
1409
1410         BT_DBG("");
1411
1412         if (success) {
1413                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1414                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1415         } else {
1416                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1417                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1418         }
1419
1420         if (len != sizeof(*cp))
1421                 return cmd_status(sk, index, mgmt_op, EINVAL);
1422
1423         hdev = hci_dev_get(index);
1424         if (!hdev)
1425                 return cmd_status(sk, index, mgmt_op, ENODEV);
1426
1427         hci_dev_lock_bh(hdev);
1428
1429         if (!test_bit(HCI_UP, &hdev->flags)) {
1430                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1431                 goto failed;
1432         }
1433
1434         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1435         if (!cmd) {
1436                 err = -ENOMEM;
1437                 goto failed;
1438         }
1439
1440         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1441         if (err < 0)
1442                 mgmt_pending_remove(cmd);
1443
1444 failed:
1445         hci_dev_unlock_bh(hdev);
1446         hci_dev_put(hdev);
1447
1448         return err;
1449 }
1450
1451 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1452                                                                 u16 len)
1453 {
1454         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1455         struct hci_cp_write_local_name hci_cp;
1456         struct hci_dev *hdev;
1457         struct pending_cmd *cmd;
1458         int err;
1459
1460         BT_DBG("");
1461
1462         if (len != sizeof(*mgmt_cp))
1463                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1464
1465         hdev = hci_dev_get(index);
1466         if (!hdev)
1467                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1468
1469         hci_dev_lock_bh(hdev);
1470
1471         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
1472         if (!cmd) {
1473                 err = -ENOMEM;
1474                 goto failed;
1475         }
1476
1477         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1478         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1479                                                                 &hci_cp);
1480         if (err < 0)
1481                 mgmt_pending_remove(cmd);
1482
1483 failed:
1484         hci_dev_unlock_bh(hdev);
1485         hci_dev_put(hdev);
1486
1487         return err;
1488 }
1489
1490 static int read_local_oob_data(struct sock *sk, u16 index)
1491 {
1492         struct hci_dev *hdev;
1493         struct pending_cmd *cmd;
1494         int err;
1495
1496         BT_DBG("hci%u", index);
1497
1498         hdev = hci_dev_get(index);
1499         if (!hdev)
1500                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1501                                                                         ENODEV);
1502
1503         hci_dev_lock_bh(hdev);
1504
1505         if (!test_bit(HCI_UP, &hdev->flags)) {
1506                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1507                                                                 ENETDOWN);
1508                 goto unlock;
1509         }
1510
1511         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1512                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1513                                                                 EOPNOTSUPP);
1514                 goto unlock;
1515         }
1516
1517         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
1518                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1519                 goto unlock;
1520         }
1521
1522         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
1523         if (!cmd) {
1524                 err = -ENOMEM;
1525                 goto unlock;
1526         }
1527
1528         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1529         if (err < 0)
1530                 mgmt_pending_remove(cmd);
1531
1532 unlock:
1533         hci_dev_unlock_bh(hdev);
1534         hci_dev_put(hdev);
1535
1536         return err;
1537 }
1538
1539 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1540                                                                         u16 len)
1541 {
1542         struct hci_dev *hdev;
1543         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1544         int err;
1545
1546         BT_DBG("hci%u ", index);
1547
1548         if (len != sizeof(*cp))
1549                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1550                                                                         EINVAL);
1551
1552         hdev = hci_dev_get(index);
1553         if (!hdev)
1554                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1555                                                                         ENODEV);
1556
1557         hci_dev_lock_bh(hdev);
1558
1559         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1560                                                                 cp->randomizer);
1561         if (err < 0)
1562                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1563         else
1564                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1565                                                                         0);
1566
1567         hci_dev_unlock_bh(hdev);
1568         hci_dev_put(hdev);
1569
1570         return err;
1571 }
1572
1573 static int remove_remote_oob_data(struct sock *sk, u16 index,
1574                                                 unsigned char *data, u16 len)
1575 {
1576         struct hci_dev *hdev;
1577         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1578         int err;
1579
1580         BT_DBG("hci%u ", index);
1581
1582         if (len != sizeof(*cp))
1583                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1584                                                                         EINVAL);
1585
1586         hdev = hci_dev_get(index);
1587         if (!hdev)
1588                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1589                                                                         ENODEV);
1590
1591         hci_dev_lock_bh(hdev);
1592
1593         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1594         if (err < 0)
1595                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1596                                                                         -err);
1597         else
1598                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1599                                                                 NULL, 0);
1600
1601         hci_dev_unlock_bh(hdev);
1602         hci_dev_put(hdev);
1603
1604         return err;
1605 }
1606
1607 static int start_discovery(struct sock *sk, u16 index)
1608 {
1609         u8 lap[3] = { 0x33, 0x8b, 0x9e };
1610         struct hci_cp_inquiry cp;
1611         struct pending_cmd *cmd;
1612         struct hci_dev *hdev;
1613         int err;
1614
1615         BT_DBG("hci%u", index);
1616
1617         hdev = hci_dev_get(index);
1618         if (!hdev)
1619                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1620
1621         hci_dev_lock_bh(hdev);
1622
1623         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
1624         if (!cmd) {
1625                 err = -ENOMEM;
1626                 goto failed;
1627         }
1628
1629         memset(&cp, 0, sizeof(cp));
1630         memcpy(&cp.lap, lap, 3);
1631         cp.length  = 0x08;
1632         cp.num_rsp = 0x00;
1633
1634         err = hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1635         if (err < 0)
1636                 mgmt_pending_remove(cmd);
1637
1638 failed:
1639         hci_dev_unlock_bh(hdev);
1640         hci_dev_put(hdev);
1641
1642         return err;
1643 }
1644
1645 static int stop_discovery(struct sock *sk, u16 index)
1646 {
1647         struct hci_dev *hdev;
1648         struct pending_cmd *cmd;
1649         int err;
1650
1651         BT_DBG("hci%u", index);
1652
1653         hdev = hci_dev_get(index);
1654         if (!hdev)
1655                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1656
1657         hci_dev_lock_bh(hdev);
1658
1659         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
1660         if (!cmd) {
1661                 err = -ENOMEM;
1662                 goto failed;
1663         }
1664
1665         err = hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1666         if (err < 0)
1667                 mgmt_pending_remove(cmd);
1668
1669 failed:
1670         hci_dev_unlock_bh(hdev);
1671         hci_dev_put(hdev);
1672
1673         return err;
1674 }
1675
1676 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1677                                                                 u16 len)
1678 {
1679         struct hci_dev *hdev;
1680         struct pending_cmd *cmd;
1681         struct mgmt_cp_block_device *cp = (void *) data;
1682         int err;
1683
1684         BT_DBG("hci%u", index);
1685
1686         if (len != sizeof(*cp))
1687                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1688                                                         EINVAL);
1689
1690         hdev = hci_dev_get(index);
1691         if (!hdev)
1692                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1693                                                         ENODEV);
1694
1695         hci_dev_lock_bh(hdev);
1696
1697         cmd = mgmt_pending_add(sk, MGMT_OP_BLOCK_DEVICE, index, NULL, 0);
1698         if (!cmd) {
1699                 err = -ENOMEM;
1700                 goto failed;
1701         }
1702
1703         err = hci_blacklist_add(hdev, &cp->bdaddr);
1704
1705         if (err < 0)
1706                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1707         else
1708                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1709                                                         NULL, 0);
1710
1711         mgmt_pending_remove(cmd);
1712
1713 failed:
1714         hci_dev_unlock_bh(hdev);
1715         hci_dev_put(hdev);
1716
1717         return err;
1718 }
1719
1720 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1721                                                                 u16 len)
1722 {
1723         struct hci_dev *hdev;
1724         struct pending_cmd *cmd;
1725         struct mgmt_cp_unblock_device *cp = (void *) data;
1726         int err;
1727
1728         BT_DBG("hci%u", index);
1729
1730         if (len != sizeof(*cp))
1731                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1732                                                                 EINVAL);
1733
1734         hdev = hci_dev_get(index);
1735         if (!hdev)
1736                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1737                                                                 ENODEV);
1738
1739         hci_dev_lock_bh(hdev);
1740
1741         cmd = mgmt_pending_add(sk, MGMT_OP_UNBLOCK_DEVICE, index, NULL, 0);
1742         if (!cmd) {
1743                 err = -ENOMEM;
1744                 goto failed;
1745         }
1746
1747         err = hci_blacklist_del(hdev, &cp->bdaddr);
1748
1749         if (err < 0)
1750                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1751         else
1752                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1753                                                                 NULL, 0);
1754
1755         mgmt_pending_remove(cmd);
1756
1757 failed:
1758         hci_dev_unlock_bh(hdev);
1759         hci_dev_put(hdev);
1760
1761         return err;
1762 }
1763
1764 static int set_fast_connectable(struct sock *sk, u16 index,
1765                                         unsigned char *data, u16 len)
1766 {
1767         struct hci_dev *hdev;
1768         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1769         struct hci_cp_write_page_scan_activity acp;
1770         u8 type;
1771         int err;
1772
1773         BT_DBG("hci%u", index);
1774
1775         if (len != sizeof(*cp))
1776                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1777                                                                 EINVAL);
1778
1779         hdev = hci_dev_get(index);
1780         if (!hdev)
1781                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1782                                                                 ENODEV);
1783
1784         hci_dev_lock(hdev);
1785
1786         if (cp->enable) {
1787                 type = PAGE_SCAN_TYPE_INTERLACED;
1788                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1789         } else {
1790                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1791                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1792         }
1793
1794         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1795
1796         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1797                                                 sizeof(acp), &acp);
1798         if (err < 0) {
1799                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1800                                                                 -err);
1801                 goto done;
1802         }
1803
1804         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1805         if (err < 0) {
1806                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1807                                                                 -err);
1808                 goto done;
1809         }
1810
1811         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1812                                                         NULL, 0);
1813 done:
1814         hci_dev_unlock(hdev);
1815         hci_dev_put(hdev);
1816
1817         return err;
1818 }
1819
1820 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1821 {
1822         unsigned char *buf;
1823         struct mgmt_hdr *hdr;
1824         u16 opcode, index, len;
1825         int err;
1826
1827         BT_DBG("got %zu bytes", msglen);
1828
1829         if (msglen < sizeof(*hdr))
1830                 return -EINVAL;
1831
1832         buf = kmalloc(msglen, GFP_KERNEL);
1833         if (!buf)
1834                 return -ENOMEM;
1835
1836         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1837                 err = -EFAULT;
1838                 goto done;
1839         }
1840
1841         hdr = (struct mgmt_hdr *) buf;
1842         opcode = get_unaligned_le16(&hdr->opcode);
1843         index = get_unaligned_le16(&hdr->index);
1844         len = get_unaligned_le16(&hdr->len);
1845
1846         if (len != msglen - sizeof(*hdr)) {
1847                 err = -EINVAL;
1848                 goto done;
1849         }
1850
1851         switch (opcode) {
1852         case MGMT_OP_READ_VERSION:
1853                 err = read_version(sk);
1854                 break;
1855         case MGMT_OP_READ_INDEX_LIST:
1856                 err = read_index_list(sk);
1857                 break;
1858         case MGMT_OP_READ_INFO:
1859                 err = read_controller_info(sk, index);
1860                 break;
1861         case MGMT_OP_SET_POWERED:
1862                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1863                 break;
1864         case MGMT_OP_SET_DISCOVERABLE:
1865                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1866                 break;
1867         case MGMT_OP_SET_CONNECTABLE:
1868                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1869                 break;
1870         case MGMT_OP_SET_PAIRABLE:
1871                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1872                 break;
1873         case MGMT_OP_ADD_UUID:
1874                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1875                 break;
1876         case MGMT_OP_REMOVE_UUID:
1877                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1878                 break;
1879         case MGMT_OP_SET_DEV_CLASS:
1880                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1881                 break;
1882         case MGMT_OP_SET_SERVICE_CACHE:
1883                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1884                 break;
1885         case MGMT_OP_LOAD_KEYS:
1886                 err = load_keys(sk, index, buf + sizeof(*hdr), len);
1887                 break;
1888         case MGMT_OP_REMOVE_KEY:
1889                 err = remove_key(sk, index, buf + sizeof(*hdr), len);
1890                 break;
1891         case MGMT_OP_DISCONNECT:
1892                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1893                 break;
1894         case MGMT_OP_GET_CONNECTIONS:
1895                 err = get_connections(sk, index);
1896                 break;
1897         case MGMT_OP_PIN_CODE_REPLY:
1898                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1899                 break;
1900         case MGMT_OP_PIN_CODE_NEG_REPLY:
1901                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1902                 break;
1903         case MGMT_OP_SET_IO_CAPABILITY:
1904                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1905                 break;
1906         case MGMT_OP_PAIR_DEVICE:
1907                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1908                 break;
1909         case MGMT_OP_USER_CONFIRM_REPLY:
1910                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1911                 break;
1912         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1913                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1914                 break;
1915         case MGMT_OP_SET_LOCAL_NAME:
1916                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1917                 break;
1918         case MGMT_OP_READ_LOCAL_OOB_DATA:
1919                 err = read_local_oob_data(sk, index);
1920                 break;
1921         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1922                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1923                 break;
1924         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1925                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1926                                                                         len);
1927                 break;
1928         case MGMT_OP_START_DISCOVERY:
1929                 err = start_discovery(sk, index);
1930                 break;
1931         case MGMT_OP_STOP_DISCOVERY:
1932                 err = stop_discovery(sk, index);
1933                 break;
1934         case MGMT_OP_BLOCK_DEVICE:
1935                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1936                 break;
1937         case MGMT_OP_UNBLOCK_DEVICE:
1938                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1939                 break;
1940         case MGMT_OP_SET_FAST_CONNECTABLE:
1941                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1942                                                                 len);
1943                 break;
1944         default:
1945                 BT_DBG("Unknown op %u", opcode);
1946                 err = cmd_status(sk, index, opcode, 0x01);
1947                 break;
1948         }
1949
1950         if (err < 0)
1951                 goto done;
1952
1953         err = msglen;
1954
1955 done:
1956         kfree(buf);
1957         return err;
1958 }
1959
1960 int mgmt_index_added(u16 index)
1961 {
1962         return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
1963 }
1964
1965 int mgmt_index_removed(u16 index)
1966 {
1967         return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
1968 }
1969
1970 struct cmd_lookup {
1971         u8 val;
1972         struct sock *sk;
1973 };
1974
1975 static void mode_rsp(struct pending_cmd *cmd, void *data)
1976 {
1977         struct mgmt_mode *cp = cmd->param;
1978         struct cmd_lookup *match = data;
1979
1980         if (cp->val != match->val)
1981                 return;
1982
1983         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1984
1985         list_del(&cmd->list);
1986
1987         if (match->sk == NULL) {
1988                 match->sk = cmd->sk;
1989                 sock_hold(match->sk);
1990         }
1991
1992         mgmt_pending_free(cmd);
1993 }
1994
1995 int mgmt_powered(u16 index, u8 powered)
1996 {
1997         struct mgmt_mode ev;
1998         struct cmd_lookup match = { powered, NULL };
1999         int ret;
2000
2001         mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
2002
2003         ev.val = powered;
2004
2005         ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
2006
2007         if (match.sk)
2008                 sock_put(match.sk);
2009
2010         return ret;
2011 }
2012
2013 int mgmt_discoverable(u16 index, u8 discoverable)
2014 {
2015         struct mgmt_mode ev;
2016         struct cmd_lookup match = { discoverable, NULL };
2017         int ret;
2018
2019         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
2020
2021         ev.val = discoverable;
2022
2023         ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
2024                                                                 match.sk);
2025
2026         if (match.sk)
2027                 sock_put(match.sk);
2028
2029         return ret;
2030 }
2031
2032 int mgmt_connectable(u16 index, u8 connectable)
2033 {
2034         struct mgmt_mode ev;
2035         struct cmd_lookup match = { connectable, NULL };
2036         int ret;
2037
2038         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
2039
2040         ev.val = connectable;
2041
2042         ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
2043
2044         if (match.sk)
2045                 sock_put(match.sk);
2046
2047         return ret;
2048 }
2049
2050 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
2051 {
2052         struct mgmt_ev_new_key ev;
2053
2054         memset(&ev, 0, sizeof(ev));
2055
2056         ev.store_hint = persistent;
2057         bacpy(&ev.key.bdaddr, &key->bdaddr);
2058         ev.key.type = key->type;
2059         memcpy(ev.key.val, key->val, 16);
2060         ev.key.pin_len = key->pin_len;
2061
2062         return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
2063 }
2064
2065 int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type)
2066 {
2067         struct mgmt_ev_connected ev;
2068
2069         bacpy(&ev.bdaddr, bdaddr);
2070         ev.link_type = link_type;
2071
2072         return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
2073 }
2074
2075 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2076 {
2077         struct mgmt_cp_disconnect *cp = cmd->param;
2078         struct sock **sk = data;
2079         struct mgmt_rp_disconnect rp;
2080
2081         bacpy(&rp.bdaddr, &cp->bdaddr);
2082
2083         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2084
2085         *sk = cmd->sk;
2086         sock_hold(*sk);
2087
2088         mgmt_pending_remove(cmd);
2089 }
2090
2091 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr)
2092 {
2093         struct mgmt_ev_disconnected ev;
2094         struct sock *sk = NULL;
2095         int err;
2096
2097         mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
2098
2099         bacpy(&ev.bdaddr, bdaddr);
2100
2101         err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
2102
2103         if (sk)
2104                 sock_put(sk);
2105
2106         return err;
2107 }
2108
2109 int mgmt_disconnect_failed(u16 index)
2110 {
2111         struct pending_cmd *cmd;
2112         int err;
2113
2114         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
2115         if (!cmd)
2116                 return -ENOENT;
2117
2118         err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
2119
2120         mgmt_pending_remove(cmd);
2121
2122         return err;
2123 }
2124
2125 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2126 {
2127         struct mgmt_ev_connect_failed ev;
2128
2129         bacpy(&ev.bdaddr, bdaddr);
2130         ev.status = status;
2131
2132         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
2133 }
2134
2135 int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
2136 {
2137         struct mgmt_ev_pin_code_request ev;
2138
2139         bacpy(&ev.bdaddr, bdaddr);
2140         ev.secure = secure;
2141
2142         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
2143                                                                         NULL);
2144 }
2145
2146 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2147 {
2148         struct pending_cmd *cmd;
2149         struct mgmt_rp_pin_code_reply rp;
2150         int err;
2151
2152         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
2153         if (!cmd)
2154                 return -ENOENT;
2155
2156         bacpy(&rp.bdaddr, bdaddr);
2157         rp.status = status;
2158
2159         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
2160                                                                 sizeof(rp));
2161
2162         mgmt_pending_remove(cmd);
2163
2164         return err;
2165 }
2166
2167 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2168 {
2169         struct pending_cmd *cmd;
2170         struct mgmt_rp_pin_code_reply rp;
2171         int err;
2172
2173         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
2174         if (!cmd)
2175                 return -ENOENT;
2176
2177         bacpy(&rp.bdaddr, bdaddr);
2178         rp.status = status;
2179
2180         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2181                                                                 sizeof(rp));
2182
2183         mgmt_pending_remove(cmd);
2184
2185         return err;
2186 }
2187
2188 int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
2189                                                         u8 confirm_hint)
2190 {
2191         struct mgmt_ev_user_confirm_request ev;
2192
2193         BT_DBG("hci%u", index);
2194
2195         bacpy(&ev.bdaddr, bdaddr);
2196         ev.confirm_hint = confirm_hint;
2197         put_unaligned_le32(value, &ev.value);
2198
2199         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
2200                                                                         NULL);
2201 }
2202
2203 static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
2204                                                                 u8 opcode)
2205 {
2206         struct pending_cmd *cmd;
2207         struct mgmt_rp_user_confirm_reply rp;
2208         int err;
2209
2210         cmd = mgmt_pending_find(opcode, index);
2211         if (!cmd)
2212                 return -ENOENT;
2213
2214         bacpy(&rp.bdaddr, bdaddr);
2215         rp.status = status;
2216         err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
2217
2218         mgmt_pending_remove(cmd);
2219
2220         return err;
2221 }
2222
2223 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2224 {
2225         return confirm_reply_complete(index, bdaddr, status,
2226                                                 MGMT_OP_USER_CONFIRM_REPLY);
2227 }
2228
2229 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2230 {
2231         return confirm_reply_complete(index, bdaddr, status,
2232                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2233 }
2234
2235 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2236 {
2237         struct mgmt_ev_auth_failed ev;
2238
2239         bacpy(&ev.bdaddr, bdaddr);
2240         ev.status = status;
2241
2242         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
2243 }
2244
2245 int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
2246 {
2247         struct pending_cmd *cmd;
2248         struct hci_dev *hdev;
2249         struct mgmt_cp_set_local_name ev;
2250         int err;
2251
2252         memset(&ev, 0, sizeof(ev));
2253         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2254
2255         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
2256         if (!cmd)
2257                 goto send_event;
2258
2259         if (status) {
2260                 err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
2261                 goto failed;
2262         }
2263
2264         hdev = hci_dev_get(index);
2265         if (hdev) {
2266                 hci_dev_lock_bh(hdev);
2267                 update_eir(hdev);
2268                 hci_dev_unlock_bh(hdev);
2269                 hci_dev_put(hdev);
2270         }
2271
2272         err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
2273                                                                 sizeof(ev));
2274         if (err < 0)
2275                 goto failed;
2276
2277 send_event:
2278         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
2279                                                         cmd ? cmd->sk : NULL);
2280
2281 failed:
2282         if (cmd)
2283                 mgmt_pending_remove(cmd);
2284         return err;
2285 }
2286
2287 int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
2288                                                                 u8 status)
2289 {
2290         struct pending_cmd *cmd;
2291         int err;
2292
2293         BT_DBG("hci%u status %u", index, status);
2294
2295         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
2296         if (!cmd)
2297                 return -ENOENT;
2298
2299         if (status) {
2300                 err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2301                                                                         EIO);
2302         } else {
2303                 struct mgmt_rp_read_local_oob_data rp;
2304
2305                 memcpy(rp.hash, hash, sizeof(rp.hash));
2306                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2307
2308                 err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2309                                                         &rp, sizeof(rp));
2310         }
2311
2312         mgmt_pending_remove(cmd);
2313
2314         return err;
2315 }
2316
2317 int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
2318                                                                 u8 *eir)
2319 {
2320         struct mgmt_ev_device_found ev;
2321
2322         memset(&ev, 0, sizeof(ev));
2323
2324         bacpy(&ev.bdaddr, bdaddr);
2325         ev.rssi = rssi;
2326
2327         if (eir)
2328                 memcpy(ev.eir, eir, sizeof(ev.eir));
2329
2330         if (dev_class)
2331                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2332
2333         return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
2334 }
2335
2336 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
2337 {
2338         struct mgmt_ev_remote_name ev;
2339
2340         memset(&ev, 0, sizeof(ev));
2341
2342         bacpy(&ev.bdaddr, bdaddr);
2343         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2344
2345         return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
2346 }
2347
2348 int mgmt_discovering(u16 index, u8 discovering)
2349 {
2350         return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
2351                                                 sizeof(discovering), NULL);
2352 }
2353
2354 int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr)
2355 {
2356         struct pending_cmd *cmd;
2357         struct mgmt_ev_device_blocked ev;
2358
2359         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, index);
2360
2361         bacpy(&ev.bdaddr, bdaddr);
2362
2363         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, index, &ev, sizeof(ev),
2364                                                 cmd ? cmd->sk : NULL);
2365 }
2366
2367 int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr)
2368 {
2369         struct pending_cmd *cmd;
2370         struct mgmt_ev_device_unblocked ev;
2371
2372         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, index);
2373
2374         bacpy(&ev.bdaddr, bdaddr);
2375
2376         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, index, &ev, sizeof(ev),
2377                                                 cmd ? cmd->sk : NULL);
2378 }