net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         __u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51         int err;
  52
  53         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  54
  55         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  56         if (!skb)
  57                 return -ENOMEM;
  58
  59         hdr = (void *) skb_put(skb, sizeof(*hdr));
  60
  61         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  62         hdr->index = cpu_to_le16(index);
  63         hdr->len = cpu_to_le16(sizeof(*ev));
  64
  65         ev = (void *) skb_put(skb, sizeof(*ev));
  66         ev->status = status;
  67         put_unaligned_le16(cmd, &ev->opcode);
  68
  69         err = sock_queue_rcv_skb(sk, skb);
  70         if (err < 0)
  71                 kfree_skb(skb);
  72
  73         return err;
  74 }
  75
  76 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  77                                                                 size_t rp_len)
  78 {
  79         struct sk_buff *skb;
  80         struct mgmt_hdr *hdr;
  81         struct mgmt_ev_cmd_complete *ev;
  82         int err;
  83
  84         BT_DBG("sock %p", sk);
  85
  86         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  87         if (!skb)
  88                 return -ENOMEM;
  89
  90         hdr = (void *) skb_put(skb, sizeof(*hdr));
  91
  92         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  93         hdr->index = cpu_to_le16(index);
  94         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  95
  96         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  97         put_unaligned_le16(cmd, &ev->opcode);
  98
  99         if (rp)
 100                 memcpy(ev->data, rp, rp_len);
 101
 102         err = sock_queue_rcv_skb(sk, skb);
 103         if (err < 0)
 104                 kfree_skb(skb);
 105
 106         return err;;
 107 }
 108
 109 static int read_version(struct sock *sk)
 110 {
 111         struct mgmt_rp_read_version rp;
 112
 113         BT_DBG("sock %p", sk);
 114
 115         rp.version = MGMT_VERSION;
 116         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 117
 118         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 119                                                                 sizeof(rp));
 120 }
 121
 122 static int read_index_list(struct sock *sk)
 123 {
 124         struct mgmt_rp_read_index_list *rp;
 125         struct list_head *p;
 126         struct hci_dev *d;
 127         size_t rp_len;
 128         u16 count;
 129         int i, err;
 130
 131         BT_DBG("sock %p", sk);
 132
 133         read_lock(&hci_dev_list_lock);
 134
 135         count = 0;
 136         list_for_each(p, &hci_dev_list) {
 137                 count++;
 138         }
 139
 140         rp_len = sizeof(*rp) + (2 * count);
 141         rp = kmalloc(rp_len, GFP_ATOMIC);
 142         if (!rp) {
 143                 read_unlock(&hci_dev_list_lock);
 144                 return -ENOMEM;
 145         }
 146
 147         put_unaligned_le16(count, &rp->num_controllers);
 148
 149         i = 0;
 150         list_for_each_entry(d, &hci_dev_list, list) {
 151                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 152                         cancel_delayed_work_sync(&d->power_off);
 153
 154                 if (test_bit(HCI_SETUP, &d->flags))
 155                         continue;
 156
 157                 put_unaligned_le16(d->id, &rp->index[i++]);
 158                 BT_DBG("Added hci%u", d->id);
 159         }
 160
 161         read_unlock(&hci_dev_list_lock);
 162
 163         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 164                                                                         rp_len);
 165
 166         kfree(rp);
 167
 168         return err;
 169 }
 170
 171 static int read_controller_info(struct sock *sk, u16 index)
 172 {
 173         struct mgmt_rp_read_info rp;
 174         struct hci_dev *hdev;
 175
 176         BT_DBG("sock %p hci%u", sk, index);
 177
 178         hdev = hci_dev_get(index);
 179         if (!hdev)
 180                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 181
 182         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 183                 cancel_delayed_work_sync(&hdev->power_off);
 184
 185         hci_dev_lock_bh(hdev);
 186
 187         set_bit(HCI_MGMT, &hdev->flags);
 188
 189         memset(&rp, 0, sizeof(rp));
 190
 191         rp.type = hdev->dev_type;
 192
 193         rp.powered = test_bit(HCI_UP, &hdev->flags);
 194         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 195         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 196         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 197
 198         if (test_bit(HCI_AUTH, &hdev->flags))
 199                 rp.sec_mode = 3;
 200         else if (hdev->ssp_mode > 0)
 201                 rp.sec_mode = 4;
 202         else
 203                 rp.sec_mode = 2;
 204
 205         bacpy(&rp.bdaddr, &hdev->bdaddr);
 206         memcpy(rp.features, hdev->features, 8);
 207         memcpy(rp.dev_class, hdev->dev_class, 3);
 208         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 209         rp.hci_ver = hdev->hci_ver;
 210         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 211
 212         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 213
 214         hci_dev_unlock_bh(hdev);
 215         hci_dev_put(hdev);
 216
 217         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 218 }
 219
 220 static void mgmt_pending_free(struct pending_cmd *cmd)
 221 {
 222         sock_put(cmd->sk);
 223         kfree(cmd->param);
 224         kfree(cmd);
 225 }
 226
 227 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 228                                                         struct hci_dev *hdev,
 229                                                         void *data, u16 len)
 230 {
 231         struct pending_cmd *cmd;
 232
 233         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 234         if (!cmd)
 235                 return NULL;
 236
 237         cmd->opcode = opcode;
 238         cmd->index = hdev->id;
 239
 240         cmd->param = kmalloc(len, GFP_ATOMIC);
 241         if (!cmd->param) {
 242                 kfree(cmd);
 243                 return NULL;
 244         }
 245
 246         if (data)
 247                 memcpy(cmd->param, data, len);
 248
 249         cmd->sk = sk;
 250         sock_hold(sk);
 251
 252         list_add(&cmd->list, &hdev->mgmt_pending);
 253
 254         return cmd;
 255 }
 256
 257 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 258                                 void (*cb)(struct pending_cmd *cmd, void *data),
 259                                 void *data)
 260 {
 261         struct list_head *p, *n;
 262
 263         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 264                 struct pending_cmd *cmd;
 265
 266                 cmd = list_entry(p, struct pending_cmd, list);
 267
 268                 if (opcode > 0 && cmd->opcode != opcode)
 269                         continue;
 270
 271                 if (hdev && cmd->index != hdev->id)
 272                         continue;
 273
 274                 cb(cmd, data);
 275         }
 276 }
 277
 278 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 279 {
 280         struct pending_cmd *cmd;
 281
 282         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 283                 if (cmd->opcode != opcode)
 284                         continue;
 285
 286                 if (hdev && cmd->index != hdev->id)
 287                         continue;
 288
 289                 return cmd;
 290         }
 291
 292         return NULL;
 293 }
 294
 295 static void mgmt_pending_remove(struct pending_cmd *cmd)
 296 {
 297         list_del(&cmd->list);
 298         mgmt_pending_free(cmd);
 299 }
 300
 301 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 302 {
 303         struct mgmt_mode *cp;
 304         struct hci_dev *hdev;
 305         struct pending_cmd *cmd;
 306         int err, up;
 307
 308         cp = (void *) data;
 309
 310         BT_DBG("request for hci%u", index);
 311
 312         if (len != sizeof(*cp))
 313                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 314
 315         hdev = hci_dev_get(index);
 316         if (!hdev)
 317                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 318
 319         hci_dev_lock_bh(hdev);
 320
 321         up = test_bit(HCI_UP, &hdev->flags);
 322         if ((cp->val && up) || (!cp->val && !up)) {
 323                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 324                 goto failed;
 325         }
 326
 327         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 328                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 329                 goto failed;
 330         }
 331
 332         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 333         if (!cmd) {
 334                 err = -ENOMEM;
 335                 goto failed;
 336         }
 337
 338         if (cp->val)
 339                 queue_work(hdev->workqueue, &hdev->power_on);
 340         else
 341                 queue_work(hdev->workqueue, &hdev->power_off.work);
 342
 343         err = 0;
 344
 345 failed:
 346         hci_dev_unlock_bh(hdev);
 347         hci_dev_put(hdev);
 348         return err;
 349 }
 350
 351 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 352                                                                         u16 len)
 353 {
 354         struct mgmt_cp_set_discoverable *cp;
 355         struct hci_dev *hdev;
 356         struct pending_cmd *cmd;
 357         u8 scan;
 358         int err;
 359
 360         cp = (void *) data;
 361
 362         BT_DBG("request for hci%u", index);
 363
 364         if (len != sizeof(*cp))
 365                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 366
 367         hdev = hci_dev_get(index);
 368         if (!hdev)
 369                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 370
 371         hci_dev_lock_bh(hdev);
 372
 373         if (!test_bit(HCI_UP, &hdev->flags)) {
 374                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 375                 goto failed;
 376         }
 377
 378         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 379                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 380                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 381                 goto failed;
 382         }
 383
 384         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 385                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 386                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 387                 goto failed;
 388         }
 389
 390         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 391         if (!cmd) {
 392                 err = -ENOMEM;
 393                 goto failed;
 394         }
 395
 396         scan = SCAN_PAGE;
 397
 398         if (cp->val)
 399                 scan |= SCAN_INQUIRY;
 400         else
 401                 cancel_delayed_work_sync(&hdev->discov_off);
 402
 403         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 404         if (err < 0)
 405                 mgmt_pending_remove(cmd);
 406
 407         if (cp->val)
 408                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 409
 410 failed:
 411         hci_dev_unlock_bh(hdev);
 412         hci_dev_put(hdev);
 413
 414         return err;
 415 }
 416
 417 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 418                                                                         u16 len)
 419 {
 420         struct mgmt_mode *cp;
 421         struct hci_dev *hdev;
 422         struct pending_cmd *cmd;
 423         u8 scan;
 424         int err;
 425
 426         cp = (void *) data;
 427
 428         BT_DBG("request for hci%u", index);
 429
 430         if (len != sizeof(*cp))
 431                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 432
 433         hdev = hci_dev_get(index);
 434         if (!hdev)
 435                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 436
 437         hci_dev_lock_bh(hdev);
 438
 439         if (!test_bit(HCI_UP, &hdev->flags)) {
 440                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 441                 goto failed;
 442         }
 443
 444         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 445                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 446                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 447                 goto failed;
 448         }
 449
 450         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 451                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 452                 goto failed;
 453         }
 454
 455         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 456         if (!cmd) {
 457                 err = -ENOMEM;
 458                 goto failed;
 459         }
 460
 461         if (cp->val)
 462                 scan = SCAN_PAGE;
 463         else
 464                 scan = 0;
 465
 466         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 467         if (err < 0)
 468                 mgmt_pending_remove(cmd);
 469
 470 failed:
 471         hci_dev_unlock_bh(hdev);
 472         hci_dev_put(hdev);
 473
 474         return err;
 475 }
 476
 477 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 478                                         u16 data_len, struct sock *skip_sk)
 479 {
 480         struct sk_buff *skb;
 481         struct mgmt_hdr *hdr;
 482
 483         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 484         if (!skb)
 485                 return -ENOMEM;
 486
 487         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 488
 489         hdr = (void *) skb_put(skb, sizeof(*hdr));
 490         hdr->opcode = cpu_to_le16(event);
 491         if (hdev)
 492                 hdr->index = cpu_to_le16(hdev->id);
 493         else
 494                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 495         hdr->len = cpu_to_le16(data_len);
 496
 497         if (data)
 498                 memcpy(skb_put(skb, data_len), data, data_len);
 499
 500         hci_send_to_sock(NULL, skb, skip_sk);
 501         kfree_skb(skb);
 502
 503         return 0;
 504 }
 505
 506 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 507 {
 508         struct mgmt_mode rp;
 509
 510         rp.val = val;
 511
 512         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 513 }
 514
 515 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 516                                                                         u16 len)
 517 {
 518         struct mgmt_mode *cp, ev;
 519         struct hci_dev *hdev;
 520         int err;
 521
 522         cp = (void *) data;
 523
 524         BT_DBG("request for hci%u", index);
 525
 526         if (len != sizeof(*cp))
 527                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 528
 529         hdev = hci_dev_get(index);
 530         if (!hdev)
 531                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 532
 533         hci_dev_lock_bh(hdev);
 534
 535         if (cp->val)
 536                 set_bit(HCI_PAIRABLE, &hdev->flags);
 537         else
 538                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 539
 540         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 541         if (err < 0)
 542                 goto failed;
 543
 544         ev.val = cp->val;
 545
 546         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 547
 548 failed:
 549         hci_dev_unlock_bh(hdev);
 550         hci_dev_put(hdev);
 551
 552         return err;
 553 }
 554
 555 #define EIR_FLAGS               0x01 /* flags */
 556 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 557 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 558 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 559 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 560 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 561 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 562 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 563 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 564 #define EIR_TX_POWER            0x0A /* transmit power level */
 565 #define EIR_DEVICE_ID           0x10 /* device ID */
 566
 567 #define PNP_INFO_SVCLASS_ID             0x1200
 568
 569 static u8 bluetooth_base_uuid[] = {
 570                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 571                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 572 };
 573
 574 static u16 get_uuid16(u8 *uuid128)
 575 {
 576         u32 val;
 577         int i;
 578
 579         for (i = 0; i < 12; i++) {
 580                 if (bluetooth_base_uuid[i] != uuid128[i])
 581                         return 0;
 582         }
 583
 584         memcpy(&val, &uuid128[12], 4);
 585
 586         val = le32_to_cpu(val);
 587         if (val > 0xffff)
 588                 return 0;
 589
 590         return (u16) val;
 591 }
 592
 593 static void create_eir(struct hci_dev *hdev, u8 *data)
 594 {
 595         u8 *ptr = data;
 596         u16 eir_len = 0;
 597         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 598         int i, truncated = 0;
 599         struct bt_uuid *uuid;
 600         size_t name_len;
 601
 602         name_len = strlen(hdev->dev_name);
 603
 604         if (name_len > 0) {
 605                 /* EIR Data type */
 606                 if (name_len > 48) {
 607                         name_len = 48;
 608                         ptr[1] = EIR_NAME_SHORT;
 609                 } else
 610                         ptr[1] = EIR_NAME_COMPLETE;
 611
 612                 /* EIR Data length */
 613                 ptr[0] = name_len + 1;
 614
 615                 memcpy(ptr + 2, hdev->dev_name, name_len);
 616
 617                 eir_len += (name_len + 2);
 618                 ptr += (name_len + 2);
 619         }
 620
 621         memset(uuid16_list, 0, sizeof(uuid16_list));
 622
 623         /* Group all UUID16 types */
 624         list_for_each_entry(uuid, &hdev->uuids, list) {
 625                 u16 uuid16;
 626
 627                 uuid16 = get_uuid16(uuid->uuid);
 628                 if (uuid16 == 0)
 629                         return;
 630
 631                 if (uuid16 < 0x1100)
 632                         continue;
 633
 634                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 635                         continue;
 636
 637                 /* Stop if not enough space to put next UUID */
 638                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 639                         truncated = 1;
 640                         break;
 641                 }
 642
 643                 /* Check for duplicates */
 644                 for (i = 0; uuid16_list[i] != 0; i++)
 645                         if (uuid16_list[i] == uuid16)
 646                                 break;
 647
 648                 if (uuid16_list[i] == 0) {
 649                         uuid16_list[i] = uuid16;
 650                         eir_len += sizeof(u16);
 651                 }
 652         }
 653
 654         if (uuid16_list[0] != 0) {
 655                 u8 *length = ptr;
 656
 657                 /* EIR Data type */
 658                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 659
 660                 ptr += 2;
 661                 eir_len += 2;
 662
 663                 for (i = 0; uuid16_list[i] != 0; i++) {
 664                         *ptr++ = (uuid16_list[i] & 0x00ff);
 665                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 666                 }
 667
 668                 /* EIR Data length */
 669                 *length = (i * sizeof(u16)) + 1;
 670         }
 671 }
 672
 673 static int update_eir(struct hci_dev *hdev)
 674 {
 675         struct hci_cp_write_eir cp;
 676
 677         if (!(hdev->features[6] & LMP_EXT_INQ))
 678                 return 0;
 679
 680         if (hdev->ssp_mode == 0)
 681                 return 0;
 682
 683         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 684                 return 0;
 685
 686         memset(&cp, 0, sizeof(cp));
 687
 688         create_eir(hdev, cp.data);
 689
 690         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 691                 return 0;
 692
 693         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 694
 695         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 696 }
 697
 698 static u8 get_service_classes(struct hci_dev *hdev)
 699 {
 700         struct bt_uuid *uuid;
 701         u8 val = 0;
 702
 703         list_for_each_entry(uuid, &hdev->uuids, list)
 704                 val |= uuid->svc_hint;
 705
 706         return val;
 707 }
 708
 709 static int update_class(struct hci_dev *hdev)
 710 {
 711         u8 cod[3];
 712
 713         BT_DBG("%s", hdev->name);
 714
 715         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 716                 return 0;
 717
 718         cod[0] = hdev->minor_class;
 719         cod[1] = hdev->major_class;
 720         cod[2] = get_service_classes(hdev);
 721
 722         if (memcmp(cod, hdev->dev_class, 3) == 0)
 723                 return 0;
 724
 725         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 726 }
 727
 728 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 729 {
 730         struct mgmt_cp_add_uuid *cp;
 731         struct hci_dev *hdev;
 732         struct bt_uuid *uuid;
 733         int err;
 734
 735         cp = (void *) data;
 736
 737         BT_DBG("request for hci%u", index);
 738
 739         if (len != sizeof(*cp))
 740                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 741
 742         hdev = hci_dev_get(index);
 743         if (!hdev)
 744                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 745
 746         hci_dev_lock_bh(hdev);
 747
 748         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 749         if (!uuid) {
 750                 err = -ENOMEM;
 751                 goto failed;
 752         }
 753
 754         memcpy(uuid->uuid, cp->uuid, 16);
 755         uuid->svc_hint = cp->svc_hint;
 756
 757         list_add(&uuid->list, &hdev->uuids);
 758
 759         err = update_class(hdev);
 760         if (err < 0)
 761                 goto failed;
 762
 763         err = update_eir(hdev);
 764         if (err < 0)
 765                 goto failed;
 766
 767         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 768
 769 failed:
 770         hci_dev_unlock_bh(hdev);
 771         hci_dev_put(hdev);
 772
 773         return err;
 774 }
 775
 776 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 777 {
 778         struct list_head *p, *n;
 779         struct mgmt_cp_remove_uuid *cp;
 780         struct hci_dev *hdev;
 781         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 782         int err, found;
 783
 784         cp = (void *) data;
 785
 786         BT_DBG("request for hci%u", index);
 787
 788         if (len != sizeof(*cp))
 789                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 790
 791         hdev = hci_dev_get(index);
 792         if (!hdev)
 793                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 794
 795         hci_dev_lock_bh(hdev);
 796
 797         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 798                 err = hci_uuids_clear(hdev);
 799                 goto unlock;
 800         }
 801
 802         found = 0;
 803
 804         list_for_each_safe(p, n, &hdev->uuids) {
 805                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 806
 807                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 808                         continue;
 809
 810                 list_del(&match->list);
 811                 found++;
 812         }
 813
 814         if (found == 0) {
 815                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 816                 goto unlock;
 817         }
 818
 819         err = update_class(hdev);
 820         if (err < 0)
 821                 goto unlock;
 822
 823         err = update_eir(hdev);
 824         if (err < 0)
 825                 goto unlock;
 826
 827         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 828
 829 unlock:
 830         hci_dev_unlock_bh(hdev);
 831         hci_dev_put(hdev);
 832
 833         return err;
 834 }
 835
 836 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 837                                                                         u16 len)
 838 {
 839         struct hci_dev *hdev;
 840         struct mgmt_cp_set_dev_class *cp;
 841         int err;
 842
 843         cp = (void *) data;
 844
 845         BT_DBG("request for hci%u", index);
 846
 847         if (len != sizeof(*cp))
 848                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 849
 850         hdev = hci_dev_get(index);
 851         if (!hdev)
 852                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 853
 854         hci_dev_lock_bh(hdev);
 855
 856         hdev->major_class = cp->major;
 857         hdev->minor_class = cp->minor;
 858
 859         err = update_class(hdev);
 860
 861         if (err == 0)
 862                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 863
 864         hci_dev_unlock_bh(hdev);
 865         hci_dev_put(hdev);
 866
 867         return err;
 868 }
 869
 870 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 871                                                                         u16 len)
 872 {
 873         struct hci_dev *hdev;
 874         struct mgmt_cp_set_service_cache *cp;
 875         int err;
 876
 877         cp = (void *) data;
 878
 879         if (len != sizeof(*cp))
 880                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 881
 882         hdev = hci_dev_get(index);
 883         if (!hdev)
 884                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 885
 886         hci_dev_lock_bh(hdev);
 887
 888         BT_DBG("hci%u enable %d", index, cp->enable);
 889
 890         if (cp->enable) {
 891                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 892                 err = 0;
 893         } else {
 894                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 895                 err = update_class(hdev);
 896                 if (err == 0)
 897                         err = update_eir(hdev);
 898         }
 899
 900         if (err == 0)
 901                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 902                                                                         0);
 903         else
 904                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 905
 906
 907         hci_dev_unlock_bh(hdev);
 908         hci_dev_put(hdev);
 909
 910         return err;
 911 }
 912
 913 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 914                                                                 u16 len)
 915 {
 916         struct hci_dev *hdev;
 917         struct mgmt_cp_load_link_keys *cp;
 918         u16 key_count, expected_len;
 919         int i;
 920
 921         cp = (void *) data;
 922
 923         if (len < sizeof(*cp))
 924                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 925
 926         key_count = get_unaligned_le16(&cp->key_count);
 927
 928         expected_len = sizeof(*cp) + key_count *
 929                                         sizeof(struct mgmt_link_key_info);
 930         if (expected_len != len) {
 931                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 932                                                         len, expected_len);
 933                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 934         }
 935
 936         hdev = hci_dev_get(index);
 937         if (!hdev)
 938                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 939
 940         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 941                                                                 key_count);
 942
 943         hci_dev_lock_bh(hdev);
 944
 945         hci_link_keys_clear(hdev);
 946
 947         set_bit(HCI_LINK_KEYS, &hdev->flags);
 948
 949         if (cp->debug_keys)
 950                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 951         else
 952                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 953
 954         for (i = 0; i < key_count; i++) {
 955                 struct mgmt_link_key_info *key = &cp->keys[i];
 956
 957                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 958                                                                 key->pin_len);
 959         }
 960
 961         hci_dev_unlock_bh(hdev);
 962         hci_dev_put(hdev);
 963
 964         return 0;
 965 }
 966
 967 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 968                                                                 u16 len)
 969 {
 970         struct hci_dev *hdev;
 971         struct mgmt_cp_remove_keys *cp;
 972         struct hci_conn *conn;
 973         int err;
 974
 975         cp = (void *) data;
 976
 977         if (len != sizeof(*cp))
 978                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 979
 980         hdev = hci_dev_get(index);
 981         if (!hdev)
 982                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 983
 984         hci_dev_lock_bh(hdev);
 985
 986         err = hci_remove_link_key(hdev, &cp->bdaddr);
 987         if (err < 0) {
 988                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 989                 goto unlock;
 990         }
 991
 992         err = 0;
 993
 994         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 995                 goto unlock;
 996
 997         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 998         if (conn) {
 999                 struct hci_cp_disconnect dc;
1000
1001                 put_unaligned_le16(conn->handle, &dc.handle);
1002                 dc.reason = 0x13; /* Remote User Terminated Connection */
1003                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1004         }
1005
1006 unlock:
1007         hci_dev_unlock_bh(hdev);
1008         hci_dev_put(hdev);
1009
1010         return err;
1011 }
1012
1013 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1014 {
1015         struct hci_dev *hdev;
1016         struct mgmt_cp_disconnect *cp;
1017         struct hci_cp_disconnect dc;
1018         struct pending_cmd *cmd;
1019         struct hci_conn *conn;
1020         int err;
1021
1022         BT_DBG("");
1023
1024         cp = (void *) data;
1025
1026         if (len != sizeof(*cp))
1027                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1028
1029         hdev = hci_dev_get(index);
1030         if (!hdev)
1031                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1032
1033         hci_dev_lock_bh(hdev);
1034
1035         if (!test_bit(HCI_UP, &hdev->flags)) {
1036                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1037                 goto failed;
1038         }
1039
1040         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1041                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1042                 goto failed;
1043         }
1044
1045         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1046         if (!conn)
1047                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1048
1049         if (!conn) {
1050                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1051                 goto failed;
1052         }
1053
1054         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1055         if (!cmd) {
1056                 err = -ENOMEM;
1057                 goto failed;
1058         }
1059
1060         put_unaligned_le16(conn->handle, &dc.handle);
1061         dc.reason = 0x13; /* Remote User Terminated Connection */
1062
1063         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1064         if (err < 0)
1065                 mgmt_pending_remove(cmd);
1066
1067 failed:
1068         hci_dev_unlock_bh(hdev);
1069         hci_dev_put(hdev);
1070
1071         return err;
1072 }
1073
1074 static u8 link_to_mgmt(u8 link_type)
1075 {
1076         switch (link_type) {
1077         case LE_LINK:
1078                 return MGMT_ADDR_LE;
1079         case ACL_LINK:
1080                 return MGMT_ADDR_BREDR;
1081         default:
1082                 return MGMT_ADDR_INVALID;
1083         }
1084 }
1085
1086 static int get_connections(struct sock *sk, u16 index)
1087 {
1088         struct mgmt_rp_get_connections *rp;
1089         struct hci_dev *hdev;
1090         struct hci_conn *c;
1091         struct list_head *p;
1092         size_t rp_len;
1093         u16 count;
1094         int i, err;
1095
1096         BT_DBG("");
1097
1098         hdev = hci_dev_get(index);
1099         if (!hdev)
1100                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1101
1102         hci_dev_lock_bh(hdev);
1103
1104         count = 0;
1105         list_for_each(p, &hdev->conn_hash.list) {
1106                 count++;
1107         }
1108
1109         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1110         rp = kmalloc(rp_len, GFP_ATOMIC);
1111         if (!rp) {
1112                 err = -ENOMEM;
1113                 goto unlock;
1114         }
1115
1116         put_unaligned_le16(count, &rp->conn_count);
1117
1118         i = 0;
1119         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1120                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1121                 rp->addr[i].type = link_to_mgmt(c->type);
1122                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1123                         continue;
1124                 i++;
1125         }
1126
1127         /* Recalculate length in case of filtered SCO connections, etc */
1128         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1129
1130         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1131
1132 unlock:
1133         kfree(rp);
1134         hci_dev_unlock_bh(hdev);
1135         hci_dev_put(hdev);
1136         return err;
1137 }
1138
1139 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1140                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1141 {
1142         struct pending_cmd *cmd;
1143         int err;
1144
1145         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1146                                                                 sizeof(*cp));
1147         if (!cmd)
1148                 return -ENOMEM;
1149
1150         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1151                                                                 &cp->bdaddr);
1152         if (err < 0)
1153                 mgmt_pending_remove(cmd);
1154
1155         return err;
1156 }
1157
1158 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1159                                                                         u16 len)
1160 {
1161         struct hci_dev *hdev;
1162         struct hci_conn *conn;
1163         struct mgmt_cp_pin_code_reply *cp;
1164         struct mgmt_cp_pin_code_neg_reply ncp;
1165         struct hci_cp_pin_code_reply reply;
1166         struct pending_cmd *cmd;
1167         int err;
1168
1169         BT_DBG("");
1170
1171         cp = (void *) data;
1172
1173         if (len != sizeof(*cp))
1174                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1175
1176         hdev = hci_dev_get(index);
1177         if (!hdev)
1178                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1179
1180         hci_dev_lock_bh(hdev);
1181
1182         if (!test_bit(HCI_UP, &hdev->flags)) {
1183                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1184                 goto failed;
1185         }
1186
1187         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1188         if (!conn) {
1189                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1190                 goto failed;
1191         }
1192
1193         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1194                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1195
1196                 BT_ERR("PIN code is not 16 bytes long");
1197
1198                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1199                 if (err >= 0)
1200                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1201                                                                 EINVAL);
1202
1203                 goto failed;
1204         }
1205
1206         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1207         if (!cmd) {
1208                 err = -ENOMEM;
1209                 goto failed;
1210         }
1211
1212         bacpy(&reply.bdaddr, &cp->bdaddr);
1213         reply.pin_len = cp->pin_len;
1214         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1215
1216         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1217         if (err < 0)
1218                 mgmt_pending_remove(cmd);
1219
1220 failed:
1221         hci_dev_unlock_bh(hdev);
1222         hci_dev_put(hdev);
1223
1224         return err;
1225 }
1226
1227 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1228                                                                         u16 len)
1229 {
1230         struct hci_dev *hdev;
1231         struct mgmt_cp_pin_code_neg_reply *cp;
1232         int err;
1233
1234         BT_DBG("");
1235
1236         cp = (void *) data;
1237
1238         if (len != sizeof(*cp))
1239                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1240                                                                         EINVAL);
1241
1242         hdev = hci_dev_get(index);
1243         if (!hdev)
1244                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1245                                                                         ENODEV);
1246
1247         hci_dev_lock_bh(hdev);
1248
1249         if (!test_bit(HCI_UP, &hdev->flags)) {
1250                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1251                                                                 ENETDOWN);
1252                 goto failed;
1253         }
1254
1255         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1256
1257 failed:
1258         hci_dev_unlock_bh(hdev);
1259         hci_dev_put(hdev);
1260
1261         return err;
1262 }
1263
1264 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1265                                                                         u16 len)
1266 {
1267         struct hci_dev *hdev;
1268         struct mgmt_cp_set_io_capability *cp;
1269
1270         BT_DBG("");
1271
1272         cp = (void *) data;
1273
1274         if (len != sizeof(*cp))
1275                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1276
1277         hdev = hci_dev_get(index);
1278         if (!hdev)
1279                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1280
1281         hci_dev_lock_bh(hdev);
1282
1283         hdev->io_capability = cp->io_capability;
1284
1285         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1286                                                         hdev->io_capability);
1287
1288         hci_dev_unlock_bh(hdev);
1289         hci_dev_put(hdev);
1290
1291         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1292 }
1293
1294 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1295 {
1296         struct hci_dev *hdev = conn->hdev;
1297         struct pending_cmd *cmd;
1298
1299         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1300                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1301                         continue;
1302
1303                 if (cmd->index != hdev->id)
1304                         continue;
1305
1306                 if (cmd->user_data != conn)
1307                         continue;
1308
1309                 return cmd;
1310         }
1311
1312         return NULL;
1313 }
1314
1315 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1316 {
1317         struct mgmt_rp_pair_device rp;
1318         struct hci_conn *conn = cmd->user_data;
1319
1320         bacpy(&rp.bdaddr, &conn->dst);
1321         rp.status = status;
1322
1323         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1324
1325         /* So we don't get further callbacks for this connection */
1326         conn->connect_cfm_cb = NULL;
1327         conn->security_cfm_cb = NULL;
1328         conn->disconn_cfm_cb = NULL;
1329
1330         hci_conn_put(conn);
1331
1332         mgmt_pending_remove(cmd);
1333 }
1334
1335 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1336 {
1337         struct pending_cmd *cmd;
1338
1339         BT_DBG("status %u", status);
1340
1341         cmd = find_pairing(conn);
1342         if (!cmd) {
1343                 BT_DBG("Unable to find a pending command");
1344                 return;
1345         }
1346
1347         pairing_complete(cmd, status);
1348 }
1349
1350 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1351 {
1352         struct hci_dev *hdev;
1353         struct mgmt_cp_pair_device *cp;
1354         struct pending_cmd *cmd;
1355         struct adv_entry *entry;
1356         u8 sec_level, auth_type;
1357         struct hci_conn *conn;
1358         int err;
1359
1360         BT_DBG("");
1361
1362         cp = (void *) data;
1363
1364         if (len != sizeof(*cp))
1365                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1366
1367         hdev = hci_dev_get(index);
1368         if (!hdev)
1369                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1370
1371         hci_dev_lock_bh(hdev);
1372
1373         sec_level = BT_SECURITY_MEDIUM;
1374         if (cp->io_cap == 0x03)
1375                 auth_type = HCI_AT_DEDICATED_BONDING;
1376         else
1377                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1378
1379         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1380         if (entry)
1381                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1382                                                                 auth_type);
1383         else
1384                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1385                                                                 auth_type);
1386
1387         if (IS_ERR(conn)) {
1388                 err = PTR_ERR(conn);
1389                 goto unlock;
1390         }
1391
1392         if (conn->connect_cfm_cb) {
1393                 hci_conn_put(conn);
1394                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1395                 goto unlock;
1396         }
1397
1398         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1399         if (!cmd) {
1400                 err = -ENOMEM;
1401                 hci_conn_put(conn);
1402                 goto unlock;
1403         }
1404
1405         /* For LE, just connecting isn't a proof that the pairing finished */
1406         if (!entry)
1407                 conn->connect_cfm_cb = pairing_complete_cb;
1408
1409         conn->security_cfm_cb = pairing_complete_cb;
1410         conn->disconn_cfm_cb = pairing_complete_cb;
1411         conn->io_capability = cp->io_cap;
1412         cmd->user_data = conn;
1413
1414         if (conn->state == BT_CONNECTED &&
1415                                 hci_conn_security(conn, sec_level, auth_type))
1416                 pairing_complete(cmd, 0);
1417
1418         err = 0;
1419
1420 unlock:
1421         hci_dev_unlock_bh(hdev);
1422         hci_dev_put(hdev);
1423
1424         return err;
1425 }
1426
1427 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1428                                                         u16 len, int success)
1429 {
1430         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1431         u16 mgmt_op, hci_op;
1432         struct pending_cmd *cmd;
1433         struct hci_dev *hdev;
1434         int err;
1435
1436         BT_DBG("");
1437
1438         if (success) {
1439                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1440                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1441         } else {
1442                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1443                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1444         }
1445
1446         if (len != sizeof(*cp))
1447                 return cmd_status(sk, index, mgmt_op, EINVAL);
1448
1449         hdev = hci_dev_get(index);
1450         if (!hdev)
1451                 return cmd_status(sk, index, mgmt_op, ENODEV);
1452
1453         hci_dev_lock_bh(hdev);
1454
1455         if (!test_bit(HCI_UP, &hdev->flags)) {
1456                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1457                 goto failed;
1458         }
1459
1460         cmd = mgmt_pending_add(sk, mgmt_op, hdev, data, len);
1461         if (!cmd) {
1462                 err = -ENOMEM;
1463                 goto failed;
1464         }
1465
1466         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1467         if (err < 0)
1468                 mgmt_pending_remove(cmd);
1469
1470 failed:
1471         hci_dev_unlock_bh(hdev);
1472         hci_dev_put(hdev);
1473
1474         return err;
1475 }
1476
1477 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1478                                                                 u16 len)
1479 {
1480         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1481         struct hci_cp_write_local_name hci_cp;
1482         struct hci_dev *hdev;
1483         struct pending_cmd *cmd;
1484         int err;
1485
1486         BT_DBG("");
1487
1488         if (len != sizeof(*mgmt_cp))
1489                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1490
1491         hdev = hci_dev_get(index);
1492         if (!hdev)
1493                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1494
1495         hci_dev_lock_bh(hdev);
1496
1497         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1498         if (!cmd) {
1499                 err = -ENOMEM;
1500                 goto failed;
1501         }
1502
1503         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1504         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1505                                                                 &hci_cp);
1506         if (err < 0)
1507                 mgmt_pending_remove(cmd);
1508
1509 failed:
1510         hci_dev_unlock_bh(hdev);
1511         hci_dev_put(hdev);
1512
1513         return err;
1514 }
1515
1516 static int read_local_oob_data(struct sock *sk, u16 index)
1517 {
1518         struct hci_dev *hdev;
1519         struct pending_cmd *cmd;
1520         int err;
1521
1522         BT_DBG("hci%u", index);
1523
1524         hdev = hci_dev_get(index);
1525         if (!hdev)
1526                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1527                                                                         ENODEV);
1528
1529         hci_dev_lock_bh(hdev);
1530
1531         if (!test_bit(HCI_UP, &hdev->flags)) {
1532                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1533                                                                 ENETDOWN);
1534                 goto unlock;
1535         }
1536
1537         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1538                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1539                                                                 EOPNOTSUPP);
1540                 goto unlock;
1541         }
1542
1543         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1544                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1545                 goto unlock;
1546         }
1547
1548         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1549         if (!cmd) {
1550                 err = -ENOMEM;
1551                 goto unlock;
1552         }
1553
1554         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1555         if (err < 0)
1556                 mgmt_pending_remove(cmd);
1557
1558 unlock:
1559         hci_dev_unlock_bh(hdev);
1560         hci_dev_put(hdev);
1561
1562         return err;
1563 }
1564
1565 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1566                                                                         u16 len)
1567 {
1568         struct hci_dev *hdev;
1569         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1570         int err;
1571
1572         BT_DBG("hci%u ", index);
1573
1574         if (len != sizeof(*cp))
1575                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1576                                                                         EINVAL);
1577
1578         hdev = hci_dev_get(index);
1579         if (!hdev)
1580                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1581                                                                         ENODEV);
1582
1583         hci_dev_lock_bh(hdev);
1584
1585         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1586                                                                 cp->randomizer);
1587         if (err < 0)
1588                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1589         else
1590                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1591                                                                         0);
1592
1593         hci_dev_unlock_bh(hdev);
1594         hci_dev_put(hdev);
1595
1596         return err;
1597 }
1598
1599 static int remove_remote_oob_data(struct sock *sk, u16 index,
1600                                                 unsigned char *data, u16 len)
1601 {
1602         struct hci_dev *hdev;
1603         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1604         int err;
1605
1606         BT_DBG("hci%u ", index);
1607
1608         if (len != sizeof(*cp))
1609                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1610                                                                         EINVAL);
1611
1612         hdev = hci_dev_get(index);
1613         if (!hdev)
1614                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1615                                                                         ENODEV);
1616
1617         hci_dev_lock_bh(hdev);
1618
1619         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1620         if (err < 0)
1621                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1622                                                                         -err);
1623         else
1624                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1625                                                                 NULL, 0);
1626
1627         hci_dev_unlock_bh(hdev);
1628         hci_dev_put(hdev);
1629
1630         return err;
1631 }
1632
1633 static int start_discovery(struct sock *sk, u16 index)
1634 {
1635         struct pending_cmd *cmd;
1636         struct hci_dev *hdev;
1637         int err;
1638
1639         BT_DBG("hci%u", index);
1640
1641         hdev = hci_dev_get(index);
1642         if (!hdev)
1643                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1644
1645         hci_dev_lock_bh(hdev);
1646
1647         if (!test_bit(HCI_UP, &hdev->flags)) {
1648                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1649                 goto failed;
1650         }
1651
1652         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1653         if (!cmd) {
1654                 err = -ENOMEM;
1655                 goto failed;
1656         }
1657
1658         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1659         if (err < 0)
1660                 mgmt_pending_remove(cmd);
1661
1662 failed:
1663         hci_dev_unlock_bh(hdev);
1664         hci_dev_put(hdev);
1665
1666         return err;
1667 }
1668
1669 static int stop_discovery(struct sock *sk, u16 index)
1670 {
1671         struct hci_dev *hdev;
1672         struct pending_cmd *cmd;
1673         int err;
1674
1675         BT_DBG("hci%u", index);
1676
1677         hdev = hci_dev_get(index);
1678         if (!hdev)
1679                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1680
1681         hci_dev_lock_bh(hdev);
1682
1683         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1684         if (!cmd) {
1685                 err = -ENOMEM;
1686                 goto failed;
1687         }
1688
1689         err = hci_cancel_inquiry(hdev);
1690         if (err < 0)
1691                 mgmt_pending_remove(cmd);
1692
1693 failed:
1694         hci_dev_unlock_bh(hdev);
1695         hci_dev_put(hdev);
1696
1697         return err;
1698 }
1699
1700 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1701                                                                 u16 len)
1702 {
1703         struct hci_dev *hdev;
1704         struct mgmt_cp_block_device *cp = (void *) data;
1705         int err;
1706
1707         BT_DBG("hci%u", index);
1708
1709         if (len != sizeof(*cp))
1710                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1711                                                         EINVAL);
1712
1713         hdev = hci_dev_get(index);
1714         if (!hdev)
1715                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1716                                                         ENODEV);
1717
1718         hci_dev_lock_bh(hdev);
1719
1720         err = hci_blacklist_add(hdev, &cp->bdaddr);
1721         if (err < 0)
1722                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1723         else
1724                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1725                                                         NULL, 0);
1726
1727         hci_dev_unlock_bh(hdev);
1728         hci_dev_put(hdev);
1729
1730         return err;
1731 }
1732
1733 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1734                                                                 u16 len)
1735 {
1736         struct hci_dev *hdev;
1737         struct mgmt_cp_unblock_device *cp = (void *) data;
1738         int err;
1739
1740         BT_DBG("hci%u", index);
1741
1742         if (len != sizeof(*cp))
1743                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1744                                                                 EINVAL);
1745
1746         hdev = hci_dev_get(index);
1747         if (!hdev)
1748                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1749                                                                 ENODEV);
1750
1751         hci_dev_lock_bh(hdev);
1752
1753         err = hci_blacklist_del(hdev, &cp->bdaddr);
1754
1755         if (err < 0)
1756                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1757         else
1758                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1759                                                                 NULL, 0);
1760
1761         hci_dev_unlock_bh(hdev);
1762         hci_dev_put(hdev);
1763
1764         return err;
1765 }
1766
1767 static int set_fast_connectable(struct sock *sk, u16 index,
1768                                         unsigned char *data, u16 len)
1769 {
1770         struct hci_dev *hdev;
1771         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1772         struct hci_cp_write_page_scan_activity acp;
1773         u8 type;
1774         int err;
1775
1776         BT_DBG("hci%u", index);
1777
1778         if (len != sizeof(*cp))
1779                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1780                                                                 EINVAL);
1781
1782         hdev = hci_dev_get(index);
1783         if (!hdev)
1784                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1785                                                                 ENODEV);
1786
1787         hci_dev_lock(hdev);
1788
1789         if (cp->enable) {
1790                 type = PAGE_SCAN_TYPE_INTERLACED;
1791                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1792         } else {
1793                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1794                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1795         }
1796
1797         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1798
1799         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1800                                                 sizeof(acp), &acp);
1801         if (err < 0) {
1802                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1803                                                                 -err);
1804                 goto done;
1805         }
1806
1807         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1808         if (err < 0) {
1809                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1810                                                                 -err);
1811                 goto done;
1812         }
1813
1814         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1815                                                         NULL, 0);
1816 done:
1817         hci_dev_unlock(hdev);
1818         hci_dev_put(hdev);
1819
1820         return err;
1821 }
1822
1823 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1824 {
1825         unsigned char *buf;
1826         struct mgmt_hdr *hdr;
1827         u16 opcode, index, len;
1828         int err;
1829
1830         BT_DBG("got %zu bytes", msglen);
1831
1832         if (msglen < sizeof(*hdr))
1833                 return -EINVAL;
1834
1835         buf = kmalloc(msglen, GFP_KERNEL);
1836         if (!buf)
1837                 return -ENOMEM;
1838
1839         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1840                 err = -EFAULT;
1841                 goto done;
1842         }
1843
1844         hdr = (struct mgmt_hdr *) buf;
1845         opcode = get_unaligned_le16(&hdr->opcode);
1846         index = get_unaligned_le16(&hdr->index);
1847         len = get_unaligned_le16(&hdr->len);
1848
1849         if (len != msglen - sizeof(*hdr)) {
1850                 err = -EINVAL;
1851                 goto done;
1852         }
1853
1854         switch (opcode) {
1855         case MGMT_OP_READ_VERSION:
1856                 err = read_version(sk);
1857                 break;
1858         case MGMT_OP_READ_INDEX_LIST:
1859                 err = read_index_list(sk);
1860                 break;
1861         case MGMT_OP_READ_INFO:
1862                 err = read_controller_info(sk, index);
1863                 break;
1864         case MGMT_OP_SET_POWERED:
1865                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1866                 break;
1867         case MGMT_OP_SET_DISCOVERABLE:
1868                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1869                 break;
1870         case MGMT_OP_SET_CONNECTABLE:
1871                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1872                 break;
1873         case MGMT_OP_SET_PAIRABLE:
1874                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1875                 break;
1876         case MGMT_OP_ADD_UUID:
1877                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1878                 break;
1879         case MGMT_OP_REMOVE_UUID:
1880                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1881                 break;
1882         case MGMT_OP_SET_DEV_CLASS:
1883                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1884                 break;
1885         case MGMT_OP_SET_SERVICE_CACHE:
1886                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1887                 break;
1888         case MGMT_OP_LOAD_LINK_KEYS:
1889                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1890                 break;
1891         case MGMT_OP_REMOVE_KEYS:
1892                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1893                 break;
1894         case MGMT_OP_DISCONNECT:
1895                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1896                 break;
1897         case MGMT_OP_GET_CONNECTIONS:
1898                 err = get_connections(sk, index);
1899                 break;
1900         case MGMT_OP_PIN_CODE_REPLY:
1901                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1902                 break;
1903         case MGMT_OP_PIN_CODE_NEG_REPLY:
1904                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1905                 break;
1906         case MGMT_OP_SET_IO_CAPABILITY:
1907                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1908                 break;
1909         case MGMT_OP_PAIR_DEVICE:
1910                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1911                 break;
1912         case MGMT_OP_USER_CONFIRM_REPLY:
1913                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1914                 break;
1915         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1916                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1917                 break;
1918         case MGMT_OP_SET_LOCAL_NAME:
1919                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1920                 break;
1921         case MGMT_OP_READ_LOCAL_OOB_DATA:
1922                 err = read_local_oob_data(sk, index);
1923                 break;
1924         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1925                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1926                 break;
1927         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1928                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1929                                                                         len);
1930                 break;
1931         case MGMT_OP_START_DISCOVERY:
1932                 err = start_discovery(sk, index);
1933                 break;
1934         case MGMT_OP_STOP_DISCOVERY:
1935                 err = stop_discovery(sk, index);
1936                 break;
1937         case MGMT_OP_BLOCK_DEVICE:
1938                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1939                 break;
1940         case MGMT_OP_UNBLOCK_DEVICE:
1941                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1942                 break;
1943         case MGMT_OP_SET_FAST_CONNECTABLE:
1944                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1945                                                                 len);
1946                 break;
1947         default:
1948                 BT_DBG("Unknown op %u", opcode);
1949                 err = cmd_status(sk, index, opcode, 0x01);
1950                 break;
1951         }
1952
1953         if (err < 0)
1954                 goto done;
1955
1956         err = msglen;
1957
1958 done:
1959         kfree(buf);
1960         return err;
1961 }
1962
1963 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1964 {
1965         u8 *status = data;
1966
1967         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1968         mgmt_pending_remove(cmd);
1969 }
1970
1971 int mgmt_index_added(struct hci_dev *hdev)
1972 {
1973         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
1974 }
1975
1976 int mgmt_index_removed(struct hci_dev *hdev)
1977 {
1978         u8 status = ENODEV;
1979
1980         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
1981
1982         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
1983 }
1984
1985 struct cmd_lookup {
1986         u8 val;
1987         struct sock *sk;
1988 };
1989
1990 static void mode_rsp(struct pending_cmd *cmd, void *data)
1991 {
1992         struct mgmt_mode *cp = cmd->param;
1993         struct cmd_lookup *match = data;
1994
1995         if (cp->val != match->val)
1996                 return;
1997
1998         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1999
2000         list_del(&cmd->list);
2001
2002         if (match->sk == NULL) {
2003                 match->sk = cmd->sk;
2004                 sock_hold(match->sk);
2005         }
2006
2007         mgmt_pending_free(cmd);
2008 }
2009
2010 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2011 {
2012         struct mgmt_mode ev;
2013         struct cmd_lookup match = { powered, NULL };
2014         int ret;
2015
2016         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2017
2018         if (!powered) {
2019                 u8 status = ENETDOWN;
2020                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2021         }
2022
2023         ev.val = powered;
2024
2025         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2026
2027         if (match.sk)
2028                 sock_put(match.sk);
2029
2030         return ret;
2031 }
2032
2033 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2034 {
2035         struct mgmt_mode ev;
2036         struct cmd_lookup match = { discoverable, NULL };
2037         int ret;
2038
2039         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2040
2041         ev.val = discoverable;
2042
2043         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2044                                                                 match.sk);
2045
2046         if (match.sk)
2047                 sock_put(match.sk);
2048
2049         return ret;
2050 }
2051
2052 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2053 {
2054         struct mgmt_mode ev;
2055         struct cmd_lookup match = { connectable, NULL };
2056         int ret;
2057
2058         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2059
2060         ev.val = connectable;
2061
2062         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2063
2064         if (match.sk)
2065                 sock_put(match.sk);
2066
2067         return ret;
2068 }
2069
2070 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2071 {
2072         if (scan & SCAN_PAGE)
2073                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2074                                                 cmd_status_rsp, &status);
2075
2076         if (scan & SCAN_INQUIRY)
2077                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2078                                                 cmd_status_rsp, &status);
2079
2080         return 0;
2081 }
2082
2083 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2084                                                                 u8 persistent)
2085 {
2086         struct mgmt_ev_new_link_key ev;
2087
2088         memset(&ev, 0, sizeof(ev));
2089
2090         ev.store_hint = persistent;
2091         bacpy(&ev.key.bdaddr, &key->bdaddr);
2092         ev.key.type = key->type;
2093         memcpy(ev.key.val, key->val, 16);
2094         ev.key.pin_len = key->pin_len;
2095
2096         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2097 }
2098
2099 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type)
2100 {
2101         struct mgmt_addr_info ev;
2102
2103         bacpy(&ev.bdaddr, bdaddr);
2104         ev.type = link_to_mgmt(link_type);
2105
2106         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2107 }
2108
2109 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2110 {
2111         struct mgmt_cp_disconnect *cp = cmd->param;
2112         struct sock **sk = data;
2113         struct mgmt_rp_disconnect rp;
2114
2115         bacpy(&rp.bdaddr, &cp->bdaddr);
2116
2117         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2118
2119         *sk = cmd->sk;
2120         sock_hold(*sk);
2121
2122         mgmt_pending_remove(cmd);
2123 }
2124
2125 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2126 {
2127         struct mgmt_addr_info ev;
2128         struct sock *sk = NULL;
2129         int err;
2130
2131         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2132
2133         bacpy(&ev.bdaddr, bdaddr);
2134         ev.type = link_to_mgmt(type);
2135
2136         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2137
2138         if (sk)
2139                 sock_put(sk);
2140
2141         return err;
2142 }
2143
2144 int mgmt_disconnect_failed(struct hci_dev *hdev)
2145 {
2146         struct pending_cmd *cmd;
2147         int err;
2148
2149         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2150         if (!cmd)
2151                 return -ENOENT;
2152
2153         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT, EIO);
2154
2155         mgmt_pending_remove(cmd);
2156
2157         return err;
2158 }
2159
2160 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2161                                                                 u8 status)
2162 {
2163         struct mgmt_ev_connect_failed ev;
2164
2165         bacpy(&ev.addr.bdaddr, bdaddr);
2166         ev.addr.type = link_to_mgmt(type);
2167         ev.status = status;
2168
2169         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2170 }
2171
2172 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2173 {
2174         struct mgmt_ev_pin_code_request ev;
2175
2176         bacpy(&ev.bdaddr, bdaddr);
2177         ev.secure = secure;
2178
2179         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2180                                                                         NULL);
2181 }
2182
2183 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2184                                                                 u8 status)
2185 {
2186         struct pending_cmd *cmd;
2187         struct mgmt_rp_pin_code_reply rp;
2188         int err;
2189
2190         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2191         if (!cmd)
2192                 return -ENOENT;
2193
2194         bacpy(&rp.bdaddr, bdaddr);
2195         rp.status = status;
2196
2197         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2198                                                                 sizeof(rp));
2199
2200         mgmt_pending_remove(cmd);
2201
2202         return err;
2203 }
2204
2205 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2206                                                                 u8 status)
2207 {
2208         struct pending_cmd *cmd;
2209         struct mgmt_rp_pin_code_reply rp;
2210         int err;
2211
2212         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2213         if (!cmd)
2214                 return -ENOENT;
2215
2216         bacpy(&rp.bdaddr, bdaddr);
2217         rp.status = status;
2218
2219         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2220                                                                 sizeof(rp));
2221
2222         mgmt_pending_remove(cmd);
2223
2224         return err;
2225 }
2226
2227 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2228                                                 __le32 value, u8 confirm_hint)
2229 {
2230         struct mgmt_ev_user_confirm_request ev;
2231
2232         BT_DBG("%s", hdev->name);
2233
2234         bacpy(&ev.bdaddr, bdaddr);
2235         ev.confirm_hint = confirm_hint;
2236         put_unaligned_le32(value, &ev.value);
2237
2238         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2239                                                                         NULL);
2240 }
2241
2242 static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2243                                                         u8 status, u8 opcode)
2244 {
2245         struct pending_cmd *cmd;
2246         struct mgmt_rp_user_confirm_reply rp;
2247         int err;
2248
2249         cmd = mgmt_pending_find(opcode, hdev);
2250         if (!cmd)
2251                 return -ENOENT;
2252
2253         bacpy(&rp.bdaddr, bdaddr);
2254         rp.status = status;
2255         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2256
2257         mgmt_pending_remove(cmd);
2258
2259         return err;
2260 }
2261
2262 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2263                                                                 u8 status)
2264 {
2265         return confirm_reply_complete(hdev, bdaddr, status,
2266                                                 MGMT_OP_USER_CONFIRM_REPLY);
2267 }
2268
2269 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2270                                                 bdaddr_t *bdaddr, u8 status)
2271 {
2272         return confirm_reply_complete(hdev, bdaddr, status,
2273                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2274 }
2275
2276 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2277 {
2278         struct mgmt_ev_auth_failed ev;
2279
2280         bacpy(&ev.bdaddr, bdaddr);
2281         ev.status = status;
2282
2283         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2284 }
2285
2286 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2287 {
2288         struct pending_cmd *cmd;
2289         struct mgmt_cp_set_local_name ev;
2290         int err;
2291
2292         memset(&ev, 0, sizeof(ev));
2293         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2294
2295         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2296         if (!cmd)
2297                 goto send_event;
2298
2299         if (status) {
2300                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2301                                                                         EIO);
2302                 goto failed;
2303         }
2304
2305         hci_dev_lock_bh(hdev);
2306         update_eir(hdev);
2307         hci_dev_unlock_bh(hdev);
2308
2309         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2310                                                                 sizeof(ev));
2311         if (err < 0)
2312                 goto failed;
2313
2314 send_event:
2315         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2316                                                         cmd ? cmd->sk : NULL);
2317
2318 failed:
2319         if (cmd)
2320                 mgmt_pending_remove(cmd);
2321         return err;
2322 }
2323
2324 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2325                                                 u8 *randomizer, u8 status)
2326 {
2327         struct pending_cmd *cmd;
2328         int err;
2329
2330         BT_DBG("%s status %u", hdev->name, status);
2331
2332         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2333         if (!cmd)
2334                 return -ENOENT;
2335
2336         if (status) {
2337                 err = cmd_status(cmd->sk, hdev->id,
2338                                         MGMT_OP_READ_LOCAL_OOB_DATA, EIO);
2339         } else {
2340                 struct mgmt_rp_read_local_oob_data rp;
2341
2342                 memcpy(rp.hash, hash, sizeof(rp.hash));
2343                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2344
2345                 err = cmd_complete(cmd->sk, hdev->id,
2346                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2347                                                 &rp, sizeof(rp));
2348         }
2349
2350         mgmt_pending_remove(cmd);
2351
2352         return err;
2353 }
2354
2355 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2356                                         u8 *dev_class, s8 rssi, u8 *eir)
2357 {
2358         struct mgmt_ev_device_found ev;
2359
2360         memset(&ev, 0, sizeof(ev));
2361
2362         bacpy(&ev.addr.bdaddr, bdaddr);
2363         ev.addr.type = link_to_mgmt(type);
2364         ev.rssi = rssi;
2365
2366         if (eir)
2367                 memcpy(ev.eir, eir, sizeof(ev.eir));
2368
2369         if (dev_class)
2370                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2371
2372         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2373 }
2374
2375 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2376 {
2377         struct mgmt_ev_remote_name ev;
2378
2379         memset(&ev, 0, sizeof(ev));
2380
2381         bacpy(&ev.bdaddr, bdaddr);
2382         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2383
2384         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2385 }
2386
2387 int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status)
2388 {
2389         struct pending_cmd *cmd;
2390         int err;
2391
2392         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2393         if (!cmd)
2394                 return -ENOENT;
2395
2396         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2397         mgmt_pending_remove(cmd);
2398
2399         return err;
2400 }
2401
2402 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2403 {
2404         struct pending_cmd *cmd;
2405
2406         if (discovering)
2407                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2408         else
2409                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2410
2411         if (cmd != NULL) {
2412                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2413                 mgmt_pending_remove(cmd);
2414         }
2415
2416         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2417                                                 sizeof(discovering), NULL);
2418 }
2419
2420 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2421 {
2422         struct pending_cmd *cmd;
2423         struct mgmt_ev_device_blocked ev;
2424
2425         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2426
2427         bacpy(&ev.bdaddr, bdaddr);
2428
2429         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2430                                                         cmd ? cmd->sk : NULL);
2431 }
2432
2433 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2434 {
2435         struct pending_cmd *cmd;
2436         struct mgmt_ev_device_unblocked ev;
2437
2438         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2439
2440         bacpy(&ev.bdaddr, bdaddr);
2441
2442         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2443                                                         cmd ? cmd->sk : NULL);
2444 }