net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    0
  36 #define MGMT_REVISION   1
  37
  38 /*
  39  * These LE scan and inquiry parameters were chosen according to LE General
  40  * Discovery Procedure specification.
  41  */
  42 #define LE_SCAN_TYPE                    0x01
  43 #define LE_SCAN_WIN                     0x12
  44 #define LE_SCAN_INT                     0x12
  45 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
  46
  47 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
  48
  49 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
  50
  51 struct pending_cmd {
  52         struct list_head list;
  53         u16 opcode;
  54         int index;
  55         void *param;
  56         struct sock *sk;
  57         void *user_data;
  58 };
  59
  60 /* HCI to MGMT error code conversion table */
  61 static u8 mgmt_status_table[] = {
  62         MGMT_STATUS_SUCCESS,
  63         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  64         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  65         MGMT_STATUS_FAILED,             /* Hardware Failure */
  66         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  67         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  68         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  69         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  70         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  71         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  72         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  73         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  74         MGMT_STATUS_BUSY,               /* Command Disallowed */
  75         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  76         MGMT_STATUS_REJECTED,           /* Rejected Security */
  77         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  78         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  79         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  80         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  81         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  82         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  83         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  84         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  85         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  86         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  87         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  88         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  89         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  90         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  91         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  92         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  93         MGMT_STATUS_FAILED,             /* Unspecified Error */
  94         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  95         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  96         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  97         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  98         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  99         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 100         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 101         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 102         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 103         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 104         MGMT_STATUS_FAILED,             /* Transaction Collision */
 105         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 106         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 107         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 108         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 109         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 110         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 111         MGMT_STATUS_FAILED,             /* Slot Violation */
 112         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 113         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 114         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 115         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 116         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 117         MGMT_STATUS_BUSY,               /* Controller Busy */
 118         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 119         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 120         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 121         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 122         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 123 };
 124
 125 static u8 mgmt_status(u8 hci_status)
 126 {
 127         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 128                 return mgmt_status_table[hci_status];
 129
 130         return MGMT_STATUS_FAILED;
 131 }
 132
 133 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 134 {
 135         struct sk_buff *skb;
 136         struct mgmt_hdr *hdr;
 137         struct mgmt_ev_cmd_status *ev;
 138         int err;
 139
 140         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 141
 142         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 143         if (!skb)
 144                 return -ENOMEM;
 145
 146         hdr = (void *) skb_put(skb, sizeof(*hdr));
 147
 148         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 149         hdr->index = cpu_to_le16(index);
 150         hdr->len = cpu_to_le16(sizeof(*ev));
 151
 152         ev = (void *) skb_put(skb, sizeof(*ev));
 153         ev->status = status;
 154         put_unaligned_le16(cmd, &ev->opcode);
 155
 156         err = sock_queue_rcv_skb(sk, skb);
 157         if (err < 0)
 158                 kfree_skb(skb);
 159
 160         return err;
 161 }
 162
 163 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 164                                                                 size_t rp_len)
 165 {
 166         struct sk_buff *skb;
 167         struct mgmt_hdr *hdr;
 168         struct mgmt_ev_cmd_complete *ev;
 169         int err;
 170
 171         BT_DBG("sock %p", sk);
 172
 173         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 174         if (!skb)
 175                 return -ENOMEM;
 176
 177         hdr = (void *) skb_put(skb, sizeof(*hdr));
 178
 179         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 180         hdr->index = cpu_to_le16(index);
 181         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 182
 183         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 184         put_unaligned_le16(cmd, &ev->opcode);
 185
 186         if (rp)
 187                 memcpy(ev->data, rp, rp_len);
 188
 189         err = sock_queue_rcv_skb(sk, skb);
 190         if (err < 0)
 191                 kfree_skb(skb);
 192
 193         return err;;
 194 }
 195
 196 static int read_version(struct sock *sk)
 197 {
 198         struct mgmt_rp_read_version rp;
 199
 200         BT_DBG("sock %p", sk);
 201
 202         rp.version = MGMT_VERSION;
 203         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 204
 205         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 206                                                                 sizeof(rp));
 207 }
 208
 209 static int read_index_list(struct sock *sk)
 210 {
 211         struct mgmt_rp_read_index_list *rp;
 212         struct list_head *p;
 213         struct hci_dev *d;
 214         size_t rp_len;
 215         u16 count;
 216         int i, err;
 217
 218         BT_DBG("sock %p", sk);
 219
 220         read_lock(&hci_dev_list_lock);
 221
 222         count = 0;
 223         list_for_each(p, &hci_dev_list) {
 224                 count++;
 225         }
 226
 227         rp_len = sizeof(*rp) + (2 * count);
 228         rp = kmalloc(rp_len, GFP_ATOMIC);
 229         if (!rp) {
 230                 read_unlock(&hci_dev_list_lock);
 231                 return -ENOMEM;
 232         }
 233
 234         put_unaligned_le16(count, &rp->num_controllers);
 235
 236         i = 0;
 237         list_for_each_entry(d, &hci_dev_list, list) {
 238                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->dev_flags))
 239                         cancel_delayed_work(&d->power_off);
 240
 241                 if (test_bit(HCI_SETUP, &d->dev_flags))
 242                         continue;
 243
 244                 put_unaligned_le16(d->id, &rp->index[i++]);
 245                 BT_DBG("Added hci%u", d->id);
 246         }
 247
 248         read_unlock(&hci_dev_list_lock);
 249
 250         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 251                                                                         rp_len);
 252
 253         kfree(rp);
 254
 255         return err;
 256 }
 257
 258 static u32 get_supported_settings(struct hci_dev *hdev)
 259 {
 260         u32 settings = 0;
 261
 262         settings |= MGMT_SETTING_POWERED;
 263         settings |= MGMT_SETTING_CONNECTABLE;
 264         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 265         settings |= MGMT_SETTING_DISCOVERABLE;
 266         settings |= MGMT_SETTING_PAIRABLE;
 267
 268         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 269                 settings |= MGMT_SETTING_SSP;
 270
 271         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 272                 settings |= MGMT_SETTING_BREDR;
 273                 settings |= MGMT_SETTING_LINK_SECURITY;
 274         }
 275
 276         if (hdev->features[4] & LMP_LE)
 277                 settings |= MGMT_SETTING_LE;
 278
 279         return settings;
 280 }
 281
 282 static u32 get_current_settings(struct hci_dev *hdev)
 283 {
 284         u32 settings = 0;
 285
 286         if (test_bit(HCI_UP, &hdev->flags))
 287                 settings |= MGMT_SETTING_POWERED;
 288         else
 289                 return settings;
 290
 291         if (test_bit(HCI_PSCAN, &hdev->flags))
 292                 settings |= MGMT_SETTING_CONNECTABLE;
 293
 294         if (test_bit(HCI_ISCAN, &hdev->flags))
 295                 settings |= MGMT_SETTING_DISCOVERABLE;
 296
 297         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 298                 settings |= MGMT_SETTING_PAIRABLE;
 299
 300         if (!(hdev->features[4] & LMP_NO_BREDR))
 301                 settings |= MGMT_SETTING_BREDR;
 302
 303         if (hdev->host_features[0] & LMP_HOST_LE)
 304                 settings |= MGMT_SETTING_LE;
 305
 306         if (test_bit(HCI_AUTH, &hdev->flags))
 307                 settings |= MGMT_SETTING_LINK_SECURITY;
 308
 309         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 310                 settings |= MGMT_SETTING_SSP;
 311
 312         return settings;
 313 }
 314
 315 #define PNP_INFO_SVCLASS_ID             0x1200
 316
 317 static u8 bluetooth_base_uuid[] = {
 318                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 319                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 320 };
 321
 322 static u16 get_uuid16(u8 *uuid128)
 323 {
 324         u32 val;
 325         int i;
 326
 327         for (i = 0; i < 12; i++) {
 328                 if (bluetooth_base_uuid[i] != uuid128[i])
 329                         return 0;
 330         }
 331
 332         memcpy(&val, &uuid128[12], 4);
 333
 334         val = le32_to_cpu(val);
 335         if (val > 0xffff)
 336                 return 0;
 337
 338         return (u16) val;
 339 }
 340
 341 static void create_eir(struct hci_dev *hdev, u8 *data)
 342 {
 343         u8 *ptr = data;
 344         u16 eir_len = 0;
 345         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 346         int i, truncated = 0;
 347         struct bt_uuid *uuid;
 348         size_t name_len;
 349
 350         name_len = strlen(hdev->dev_name);
 351
 352         if (name_len > 0) {
 353                 /* EIR Data type */
 354                 if (name_len > 48) {
 355                         name_len = 48;
 356                         ptr[1] = EIR_NAME_SHORT;
 357                 } else
 358                         ptr[1] = EIR_NAME_COMPLETE;
 359
 360                 /* EIR Data length */
 361                 ptr[0] = name_len + 1;
 362
 363                 memcpy(ptr + 2, hdev->dev_name, name_len);
 364
 365                 eir_len += (name_len + 2);
 366                 ptr += (name_len + 2);
 367         }
 368
 369         memset(uuid16_list, 0, sizeof(uuid16_list));
 370
 371         /* Group all UUID16 types */
 372         list_for_each_entry(uuid, &hdev->uuids, list) {
 373                 u16 uuid16;
 374
 375                 uuid16 = get_uuid16(uuid->uuid);
 376                 if (uuid16 == 0)
 377                         return;
 378
 379                 if (uuid16 < 0x1100)
 380                         continue;
 381
 382                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 383                         continue;
 384
 385                 /* Stop if not enough space to put next UUID */
 386                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 387                         truncated = 1;
 388                         break;
 389                 }
 390
 391                 /* Check for duplicates */
 392                 for (i = 0; uuid16_list[i] != 0; i++)
 393                         if (uuid16_list[i] == uuid16)
 394                                 break;
 395
 396                 if (uuid16_list[i] == 0) {
 397                         uuid16_list[i] = uuid16;
 398                         eir_len += sizeof(u16);
 399                 }
 400         }
 401
 402         if (uuid16_list[0] != 0) {
 403                 u8 *length = ptr;
 404
 405                 /* EIR Data type */
 406                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 407
 408                 ptr += 2;
 409                 eir_len += 2;
 410
 411                 for (i = 0; uuid16_list[i] != 0; i++) {
 412                         *ptr++ = (uuid16_list[i] & 0x00ff);
 413                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 414                 }
 415
 416                 /* EIR Data length */
 417                 *length = (i * sizeof(u16)) + 1;
 418         }
 419 }
 420
 421 static int update_eir(struct hci_dev *hdev)
 422 {
 423         struct hci_cp_write_eir cp;
 424
 425         if (!(hdev->features[6] & LMP_EXT_INQ))
 426                 return 0;
 427
 428         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 429                 return 0;
 430
 431         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 432                 return 0;
 433
 434         memset(&cp, 0, sizeof(cp));
 435
 436         create_eir(hdev, cp.data);
 437
 438         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 439                 return 0;
 440
 441         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 442
 443         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 444 }
 445
 446 static u8 get_service_classes(struct hci_dev *hdev)
 447 {
 448         struct bt_uuid *uuid;
 449         u8 val = 0;
 450
 451         list_for_each_entry(uuid, &hdev->uuids, list)
 452                 val |= uuid->svc_hint;
 453
 454         return val;
 455 }
 456
 457 static int update_class(struct hci_dev *hdev)
 458 {
 459         u8 cod[3];
 460
 461         BT_DBG("%s", hdev->name);
 462
 463         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 464                 return 0;
 465
 466         cod[0] = hdev->minor_class;
 467         cod[1] = hdev->major_class;
 468         cod[2] = get_service_classes(hdev);
 469
 470         if (memcmp(cod, hdev->dev_class, 3) == 0)
 471                 return 0;
 472
 473         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 474 }
 475
 476 static void service_cache_off(struct work_struct *work)
 477 {
 478         struct hci_dev *hdev = container_of(work, struct hci_dev,
 479                                                         service_cache.work);
 480
 481         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 482                 return;
 483
 484         hci_dev_lock(hdev);
 485
 486         update_eir(hdev);
 487         update_class(hdev);
 488
 489         hci_dev_unlock(hdev);
 490 }
 491
 492 static void mgmt_init_hdev(struct hci_dev *hdev)
 493 {
 494         if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 495                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 496
 497         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 498                 schedule_delayed_work(&hdev->service_cache,
 499                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 500 }
 501
 502 static int read_controller_info(struct sock *sk, u16 index)
 503 {
 504         struct mgmt_rp_read_info rp;
 505         struct hci_dev *hdev;
 506
 507         BT_DBG("sock %p hci%u", sk, index);
 508
 509         hdev = hci_dev_get(index);
 510         if (!hdev)
 511                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 512                                                 MGMT_STATUS_INVALID_PARAMS);
 513
 514         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 515                 cancel_delayed_work_sync(&hdev->power_off);
 516
 517         hci_dev_lock(hdev);
 518
 519         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 520                 mgmt_init_hdev(hdev);
 521
 522         memset(&rp, 0, sizeof(rp));
 523
 524         bacpy(&rp.bdaddr, &hdev->bdaddr);
 525
 526         rp.version = hdev->hci_ver;
 527
 528         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 529
 530         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 531         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 532
 533         memcpy(rp.dev_class, hdev->dev_class, 3);
 534
 535         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 536
 537         hci_dev_unlock(hdev);
 538         hci_dev_put(hdev);
 539
 540         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 541 }
 542
 543 static void mgmt_pending_free(struct pending_cmd *cmd)
 544 {
 545         sock_put(cmd->sk);
 546         kfree(cmd->param);
 547         kfree(cmd);
 548 }
 549
 550 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 551                                                         struct hci_dev *hdev,
 552                                                         void *data, u16 len)
 553 {
 554         struct pending_cmd *cmd;
 555
 556         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 557         if (!cmd)
 558                 return NULL;
 559
 560         cmd->opcode = opcode;
 561         cmd->index = hdev->id;
 562
 563         cmd->param = kmalloc(len, GFP_ATOMIC);
 564         if (!cmd->param) {
 565                 kfree(cmd);
 566                 return NULL;
 567         }
 568
 569         if (data)
 570                 memcpy(cmd->param, data, len);
 571
 572         cmd->sk = sk;
 573         sock_hold(sk);
 574
 575         list_add(&cmd->list, &hdev->mgmt_pending);
 576
 577         return cmd;
 578 }
 579
 580 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 581                                 void (*cb)(struct pending_cmd *cmd, void *data),
 582                                 void *data)
 583 {
 584         struct list_head *p, *n;
 585
 586         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 587                 struct pending_cmd *cmd;
 588
 589                 cmd = list_entry(p, struct pending_cmd, list);
 590
 591                 if (opcode > 0 && cmd->opcode != opcode)
 592                         continue;
 593
 594                 cb(cmd, data);
 595         }
 596 }
 597
 598 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 599 {
 600         struct pending_cmd *cmd;
 601
 602         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 603                 if (cmd->opcode == opcode)
 604                         return cmd;
 605         }
 606
 607         return NULL;
 608 }
 609
 610 static void mgmt_pending_remove(struct pending_cmd *cmd)
 611 {
 612         list_del(&cmd->list);
 613         mgmt_pending_free(cmd);
 614 }
 615
 616 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 617 {
 618         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 619
 620         return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
 621 }
 622
 623 static int set_powered(struct sock *sk, u16 index, void *data, u16 len)
 624 {
 625         struct mgmt_mode *cp = data;
 626         struct hci_dev *hdev;
 627         struct pending_cmd *cmd;
 628         int err, up;
 629
 630         BT_DBG("request for hci%u", index);
 631
 632         if (len != sizeof(*cp))
 633                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 634                                                 MGMT_STATUS_INVALID_PARAMS);
 635
 636         hdev = hci_dev_get(index);
 637         if (!hdev)
 638                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 639                                                 MGMT_STATUS_INVALID_PARAMS);
 640
 641         hci_dev_lock(hdev);
 642
 643         up = test_bit(HCI_UP, &hdev->flags);
 644         if ((cp->val && up) || (!cp->val && !up)) {
 645                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 646                 goto failed;
 647         }
 648
 649         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 650                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 651                                                         MGMT_STATUS_BUSY);
 652                 goto failed;
 653         }
 654
 655         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 656         if (!cmd) {
 657                 err = -ENOMEM;
 658                 goto failed;
 659         }
 660
 661         if (cp->val)
 662                 schedule_work(&hdev->power_on);
 663         else
 664                 schedule_work(&hdev->power_off.work);
 665
 666         err = 0;
 667
 668 failed:
 669         hci_dev_unlock(hdev);
 670         hci_dev_put(hdev);
 671         return err;
 672 }
 673
 674 static int set_discoverable(struct sock *sk, u16 index, void *data, u16 len)
 675 {
 676         struct mgmt_cp_set_discoverable *cp = data;
 677         struct hci_dev *hdev;
 678         struct pending_cmd *cmd;
 679         u8 scan;
 680         int err;
 681
 682         BT_DBG("request for hci%u", index);
 683
 684         if (len != sizeof(*cp))
 685                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 686                                                 MGMT_STATUS_INVALID_PARAMS);
 687
 688         hdev = hci_dev_get(index);
 689         if (!hdev)
 690                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 691                                                 MGMT_STATUS_INVALID_PARAMS);
 692
 693         hci_dev_lock(hdev);
 694
 695         if (!test_bit(HCI_UP, &hdev->flags)) {
 696                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 697                                                 MGMT_STATUS_NOT_POWERED);
 698                 goto failed;
 699         }
 700
 701         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 702                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 703                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 704                                                         MGMT_STATUS_BUSY);
 705                 goto failed;
 706         }
 707
 708         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 709                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 710                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 711                 goto failed;
 712         }
 713
 714         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 715         if (!cmd) {
 716                 err = -ENOMEM;
 717                 goto failed;
 718         }
 719
 720         scan = SCAN_PAGE;
 721
 722         if (cp->val)
 723                 scan |= SCAN_INQUIRY;
 724         else
 725                 cancel_delayed_work(&hdev->discov_off);
 726
 727         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 728         if (err < 0)
 729                 mgmt_pending_remove(cmd);
 730
 731         if (cp->val)
 732                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 733
 734 failed:
 735         hci_dev_unlock(hdev);
 736         hci_dev_put(hdev);
 737
 738         return err;
 739 }
 740
 741 static int set_connectable(struct sock *sk, u16 index, void *data, u16 len)
 742 {
 743         struct mgmt_mode *cp = data;
 744         struct hci_dev *hdev;
 745         struct pending_cmd *cmd;
 746         u8 scan;
 747         int err;
 748
 749         BT_DBG("request for hci%u", index);
 750
 751         if (len != sizeof(*cp))
 752                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 753                                                 MGMT_STATUS_INVALID_PARAMS);
 754
 755         hdev = hci_dev_get(index);
 756         if (!hdev)
 757                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 758                                                 MGMT_STATUS_INVALID_PARAMS);
 759
 760         hci_dev_lock(hdev);
 761
 762         if (!test_bit(HCI_UP, &hdev->flags)) {
 763                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 764                                                 MGMT_STATUS_NOT_POWERED);
 765                 goto failed;
 766         }
 767
 768         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 769                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 770                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 771                                                         MGMT_STATUS_BUSY);
 772                 goto failed;
 773         }
 774
 775         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 776                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 777                 goto failed;
 778         }
 779
 780         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 781         if (!cmd) {
 782                 err = -ENOMEM;
 783                 goto failed;
 784         }
 785
 786         if (cp->val)
 787                 scan = SCAN_PAGE;
 788         else
 789                 scan = 0;
 790
 791         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 792         if (err < 0)
 793                 mgmt_pending_remove(cmd);
 794
 795 failed:
 796         hci_dev_unlock(hdev);
 797         hci_dev_put(hdev);
 798
 799         return err;
 800 }
 801
 802 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 803                                         u16 data_len, struct sock *skip_sk)
 804 {
 805         struct sk_buff *skb;
 806         struct mgmt_hdr *hdr;
 807
 808         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 809         if (!skb)
 810                 return -ENOMEM;
 811
 812         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 813
 814         hdr = (void *) skb_put(skb, sizeof(*hdr));
 815         hdr->opcode = cpu_to_le16(event);
 816         if (hdev)
 817                 hdr->index = cpu_to_le16(hdev->id);
 818         else
 819                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 820         hdr->len = cpu_to_le16(data_len);
 821
 822         if (data)
 823                 memcpy(skb_put(skb, data_len), data, data_len);
 824
 825         hci_send_to_sock(NULL, skb, skip_sk);
 826         kfree_skb(skb);
 827
 828         return 0;
 829 }
 830
 831 static int set_pairable(struct sock *sk, u16 index, void *data, u16 len)
 832 {
 833         struct mgmt_mode *cp = data;
 834         struct hci_dev *hdev;
 835         __le32 ev;
 836         int err;
 837
 838         BT_DBG("request for hci%u", index);
 839
 840         if (len != sizeof(*cp))
 841                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 842                                                 MGMT_STATUS_INVALID_PARAMS);
 843
 844         hdev = hci_dev_get(index);
 845         if (!hdev)
 846                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 847                                                 MGMT_STATUS_INVALID_PARAMS);
 848
 849         hci_dev_lock(hdev);
 850
 851         if (cp->val)
 852                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 853         else
 854                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 855
 856         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
 857         if (err < 0)
 858                 goto failed;
 859
 860         ev = cpu_to_le32(get_current_settings(hdev));
 861
 862         err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
 863
 864 failed:
 865         hci_dev_unlock(hdev);
 866         hci_dev_put(hdev);
 867
 868         return err;
 869 }
 870
 871 static int add_uuid(struct sock *sk, u16 index, void *data, u16 len)
 872 {
 873         struct mgmt_cp_add_uuid *cp = data;
 874         struct hci_dev *hdev;
 875         struct bt_uuid *uuid;
 876         int err;
 877
 878         BT_DBG("request for hci%u", index);
 879
 880         if (len != sizeof(*cp))
 881                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 882                                                 MGMT_STATUS_INVALID_PARAMS);
 883
 884         hdev = hci_dev_get(index);
 885         if (!hdev)
 886                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 887                                                 MGMT_STATUS_INVALID_PARAMS);
 888
 889         hci_dev_lock(hdev);
 890
 891         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 892         if (!uuid) {
 893                 err = -ENOMEM;
 894                 goto failed;
 895         }
 896
 897         memcpy(uuid->uuid, cp->uuid, 16);
 898         uuid->svc_hint = cp->svc_hint;
 899
 900         list_add(&uuid->list, &hdev->uuids);
 901
 902         err = update_class(hdev);
 903         if (err < 0)
 904                 goto failed;
 905
 906         err = update_eir(hdev);
 907         if (err < 0)
 908                 goto failed;
 909
 910         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 911
 912 failed:
 913         hci_dev_unlock(hdev);
 914         hci_dev_put(hdev);
 915
 916         return err;
 917 }
 918
 919 static int remove_uuid(struct sock *sk, u16 index, void *data, u16 len)
 920 {
 921         struct mgmt_cp_remove_uuid *cp = data;
 922         struct list_head *p, *n;
 923         struct hci_dev *hdev;
 924         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 925         int err, found;
 926
 927         BT_DBG("request for hci%u", index);
 928
 929         if (len != sizeof(*cp))
 930                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 931                                                 MGMT_STATUS_INVALID_PARAMS);
 932
 933         hdev = hci_dev_get(index);
 934         if (!hdev)
 935                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 936                                                 MGMT_STATUS_INVALID_PARAMS);
 937
 938         hci_dev_lock(hdev);
 939
 940         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 941                 err = hci_uuids_clear(hdev);
 942                 goto unlock;
 943         }
 944
 945         found = 0;
 946
 947         list_for_each_safe(p, n, &hdev->uuids) {
 948                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 949
 950                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 951                         continue;
 952
 953                 list_del(&match->list);
 954                 found++;
 955         }
 956
 957         if (found == 0) {
 958                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 959                                                 MGMT_STATUS_INVALID_PARAMS);
 960                 goto unlock;
 961         }
 962
 963         err = update_class(hdev);
 964         if (err < 0)
 965                 goto unlock;
 966
 967         err = update_eir(hdev);
 968         if (err < 0)
 969                 goto unlock;
 970
 971         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 972
 973 unlock:
 974         hci_dev_unlock(hdev);
 975         hci_dev_put(hdev);
 976
 977         return err;
 978 }
 979
 980 static int set_dev_class(struct sock *sk, u16 index, void *data, u16 len)
 981 {
 982         struct hci_dev *hdev;
 983         struct mgmt_cp_set_dev_class *cp = data;
 984         int err;
 985
 986         BT_DBG("request for hci%u", index);
 987
 988         if (len != sizeof(*cp))
 989                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 990                                                 MGMT_STATUS_INVALID_PARAMS);
 991
 992         hdev = hci_dev_get(index);
 993         if (!hdev)
 994                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 995                                                 MGMT_STATUS_INVALID_PARAMS);
 996
 997         hci_dev_lock(hdev);
 998
 999         hdev->major_class = cp->major;
1000         hdev->minor_class = cp->minor;
1001
1002         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1003                 hci_dev_unlock(hdev);
1004                 cancel_delayed_work_sync(&hdev->service_cache);
1005                 hci_dev_lock(hdev);
1006                 update_eir(hdev);
1007         }
1008
1009         err = update_class(hdev);
1010
1011         if (err == 0)
1012                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
1013
1014         hci_dev_unlock(hdev);
1015         hci_dev_put(hdev);
1016
1017         return err;
1018 }
1019
1020 static int load_link_keys(struct sock *sk, u16 index, void *data, u16 len)
1021 {
1022         struct hci_dev *hdev;
1023         struct mgmt_cp_load_link_keys *cp = data;
1024         u16 key_count, expected_len;
1025         int i;
1026
1027         if (len < sizeof(*cp))
1028                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1029                                                 MGMT_STATUS_INVALID_PARAMS);
1030
1031         key_count = get_unaligned_le16(&cp->key_count);
1032
1033         expected_len = sizeof(*cp) + key_count *
1034                                         sizeof(struct mgmt_link_key_info);
1035         if (expected_len != len) {
1036                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1037                                                         len, expected_len);
1038                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1039                                                 MGMT_STATUS_INVALID_PARAMS);
1040         }
1041
1042         hdev = hci_dev_get(index);
1043         if (!hdev)
1044                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1045                                                 MGMT_STATUS_INVALID_PARAMS);
1046
1047         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1048                                                                 key_count);
1049
1050         hci_dev_lock(hdev);
1051
1052         hci_link_keys_clear(hdev);
1053
1054         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1055
1056         if (cp->debug_keys)
1057                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1058         else
1059                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1060
1061         for (i = 0; i < key_count; i++) {
1062                 struct mgmt_link_key_info *key = &cp->keys[i];
1063
1064                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1065                                                                 key->pin_len);
1066         }
1067
1068         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1069
1070         hci_dev_unlock(hdev);
1071         hci_dev_put(hdev);
1072
1073         return 0;
1074 }
1075
1076 static int remove_keys(struct sock *sk, u16 index, void *data, u16 len)
1077 {
1078         struct hci_dev *hdev;
1079         struct mgmt_cp_remove_keys *cp = data;
1080         struct mgmt_rp_remove_keys rp;
1081         struct hci_cp_disconnect dc;
1082         struct pending_cmd *cmd;
1083         struct hci_conn *conn;
1084         int err;
1085
1086         if (len != sizeof(*cp))
1087                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1088                                                 MGMT_STATUS_INVALID_PARAMS);
1089
1090         hdev = hci_dev_get(index);
1091         if (!hdev)
1092                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1093                                                 MGMT_STATUS_INVALID_PARAMS);
1094
1095         hci_dev_lock(hdev);
1096
1097         memset(&rp, 0, sizeof(rp));
1098         bacpy(&rp.bdaddr, &cp->bdaddr);
1099         rp.status = MGMT_STATUS_FAILED;
1100
1101         err = hci_remove_ltk(hdev, &cp->bdaddr);
1102         if (err < 0) {
1103                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
1104                 goto unlock;
1105         }
1106
1107         err = hci_remove_link_key(hdev, &cp->bdaddr);
1108         if (err < 0) {
1109                 rp.status = MGMT_STATUS_NOT_PAIRED;
1110                 goto unlock;
1111         }
1112
1113         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1114                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1115                                                                 sizeof(rp));
1116                 goto unlock;
1117         }
1118
1119         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1120         if (!conn) {
1121                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1122                                                                 sizeof(rp));
1123                 goto unlock;
1124         }
1125
1126         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1127         if (!cmd) {
1128                 err = -ENOMEM;
1129                 goto unlock;
1130         }
1131
1132         put_unaligned_le16(conn->handle, &dc.handle);
1133         dc.reason = 0x13; /* Remote User Terminated Connection */
1134         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1135         if (err < 0)
1136                 mgmt_pending_remove(cmd);
1137
1138 unlock:
1139         if (err < 0)
1140                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1141                                                                 sizeof(rp));
1142         hci_dev_unlock(hdev);
1143         hci_dev_put(hdev);
1144
1145         return err;
1146 }
1147
1148 static int disconnect(struct sock *sk, u16 index, void *data, u16 len)
1149 {
1150         struct hci_dev *hdev;
1151         struct mgmt_cp_disconnect *cp = data;
1152         struct hci_cp_disconnect dc;
1153         struct pending_cmd *cmd;
1154         struct hci_conn *conn;
1155         int err;
1156
1157         BT_DBG("");
1158
1159         if (len != sizeof(*cp))
1160                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1161                                                 MGMT_STATUS_INVALID_PARAMS);
1162
1163         hdev = hci_dev_get(index);
1164         if (!hdev)
1165                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1166                                                 MGMT_STATUS_INVALID_PARAMS);
1167
1168         hci_dev_lock(hdev);
1169
1170         if (!test_bit(HCI_UP, &hdev->flags)) {
1171                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1172                                                 MGMT_STATUS_NOT_POWERED);
1173                 goto failed;
1174         }
1175
1176         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1177                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1178                                                         MGMT_STATUS_BUSY);
1179                 goto failed;
1180         }
1181
1182         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1183         if (!conn)
1184                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1185
1186         if (!conn) {
1187                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1188                                                 MGMT_STATUS_NOT_CONNECTED);
1189                 goto failed;
1190         }
1191
1192         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1193         if (!cmd) {
1194                 err = -ENOMEM;
1195                 goto failed;
1196         }
1197
1198         put_unaligned_le16(conn->handle, &dc.handle);
1199         dc.reason = 0x13; /* Remote User Terminated Connection */
1200
1201         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1202         if (err < 0)
1203                 mgmt_pending_remove(cmd);
1204
1205 failed:
1206         hci_dev_unlock(hdev);
1207         hci_dev_put(hdev);
1208
1209         return err;
1210 }
1211
1212 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1213 {
1214         switch (link_type) {
1215         case LE_LINK:
1216                 switch (addr_type) {
1217                 case ADDR_LE_DEV_PUBLIC:
1218                         return MGMT_ADDR_LE_PUBLIC;
1219                 case ADDR_LE_DEV_RANDOM:
1220                         return MGMT_ADDR_LE_RANDOM;
1221                 default:
1222                         return MGMT_ADDR_INVALID;
1223                 }
1224         case ACL_LINK:
1225                 return MGMT_ADDR_BREDR;
1226         default:
1227                 return MGMT_ADDR_INVALID;
1228         }
1229 }
1230
1231 static int get_connections(struct sock *sk, u16 index)
1232 {
1233         struct mgmt_rp_get_connections *rp;
1234         struct hci_dev *hdev;
1235         struct hci_conn *c;
1236         size_t rp_len;
1237         u16 count;
1238         int i, err;
1239
1240         BT_DBG("");
1241
1242         hdev = hci_dev_get(index);
1243         if (!hdev)
1244                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1245                                                 MGMT_STATUS_INVALID_PARAMS);
1246
1247         hci_dev_lock(hdev);
1248
1249         count = 0;
1250         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1251                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1252                         count++;
1253         }
1254
1255         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1256         rp = kmalloc(rp_len, GFP_ATOMIC);
1257         if (!rp) {
1258                 err = -ENOMEM;
1259                 goto unlock;
1260         }
1261
1262         put_unaligned_le16(count, &rp->conn_count);
1263
1264         i = 0;
1265         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1266                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1267                         continue;
1268                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1269                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1270                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1271                         continue;
1272                 i++;
1273         }
1274
1275         /* Recalculate length in case of filtered SCO connections, etc */
1276         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1277
1278         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1279
1280 unlock:
1281         kfree(rp);
1282         hci_dev_unlock(hdev);
1283         hci_dev_put(hdev);
1284         return err;
1285 }
1286
1287 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1288                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1289 {
1290         struct pending_cmd *cmd;
1291         int err;
1292
1293         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1294                                                                 sizeof(*cp));
1295         if (!cmd)
1296                 return -ENOMEM;
1297
1298         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1299                                                                 &cp->bdaddr);
1300         if (err < 0)
1301                 mgmt_pending_remove(cmd);
1302
1303         return err;
1304 }
1305
1306 static int pin_code_reply(struct sock *sk, u16 index, void *data, u16 len)
1307 {
1308         struct hci_dev *hdev;
1309         struct hci_conn *conn;
1310         struct mgmt_cp_pin_code_reply *cp = data;
1311         struct mgmt_cp_pin_code_neg_reply ncp;
1312         struct hci_cp_pin_code_reply reply;
1313         struct pending_cmd *cmd;
1314         int err;
1315
1316         BT_DBG("");
1317
1318         if (len != sizeof(*cp))
1319                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1320                                                 MGMT_STATUS_INVALID_PARAMS);
1321
1322         hdev = hci_dev_get(index);
1323         if (!hdev)
1324                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1325                                                 MGMT_STATUS_INVALID_PARAMS);
1326
1327         hci_dev_lock(hdev);
1328
1329         if (!test_bit(HCI_UP, &hdev->flags)) {
1330                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1331                                                 MGMT_STATUS_NOT_POWERED);
1332                 goto failed;
1333         }
1334
1335         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1336         if (!conn) {
1337                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1338                                                 MGMT_STATUS_NOT_CONNECTED);
1339                 goto failed;
1340         }
1341
1342         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1343                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1344
1345                 BT_ERR("PIN code is not 16 bytes long");
1346
1347                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1348                 if (err >= 0)
1349                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1350                                                 MGMT_STATUS_INVALID_PARAMS);
1351
1352                 goto failed;
1353         }
1354
1355         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data,
1356                                                                         len);
1357         if (!cmd) {
1358                 err = -ENOMEM;
1359                 goto failed;
1360         }
1361
1362         bacpy(&reply.bdaddr, &cp->bdaddr);
1363         reply.pin_len = cp->pin_len;
1364         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1365
1366         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1367         if (err < 0)
1368                 mgmt_pending_remove(cmd);
1369
1370 failed:
1371         hci_dev_unlock(hdev);
1372         hci_dev_put(hdev);
1373
1374         return err;
1375 }
1376
1377 static int pin_code_neg_reply(struct sock *sk, u16 index, void *data, u16 len)
1378 {
1379         struct hci_dev *hdev;
1380         struct mgmt_cp_pin_code_neg_reply *cp = data;
1381         int err;
1382
1383         BT_DBG("");
1384
1385         if (len != sizeof(*cp))
1386                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1387                                                 MGMT_STATUS_INVALID_PARAMS);
1388
1389         hdev = hci_dev_get(index);
1390         if (!hdev)
1391                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1392                                                 MGMT_STATUS_INVALID_PARAMS);
1393
1394         hci_dev_lock(hdev);
1395
1396         if (!test_bit(HCI_UP, &hdev->flags)) {
1397                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1398                                                 MGMT_STATUS_NOT_POWERED);
1399                 goto failed;
1400         }
1401
1402         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1403
1404 failed:
1405         hci_dev_unlock(hdev);
1406         hci_dev_put(hdev);
1407
1408         return err;
1409 }
1410
1411 static int set_io_capability(struct sock *sk, u16 index, void *data, u16 len)
1412 {
1413         struct hci_dev *hdev;
1414         struct mgmt_cp_set_io_capability *cp = data;
1415
1416         BT_DBG("");
1417
1418         if (len != sizeof(*cp))
1419                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1420                                                 MGMT_STATUS_INVALID_PARAMS);
1421
1422         hdev = hci_dev_get(index);
1423         if (!hdev)
1424                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1425                                                 MGMT_STATUS_INVALID_PARAMS);
1426
1427         hci_dev_lock(hdev);
1428
1429         hdev->io_capability = cp->io_capability;
1430
1431         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1432                                                         hdev->io_capability);
1433
1434         hci_dev_unlock(hdev);
1435         hci_dev_put(hdev);
1436
1437         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1438 }
1439
1440 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1441 {
1442         struct hci_dev *hdev = conn->hdev;
1443         struct pending_cmd *cmd;
1444
1445         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1446                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1447                         continue;
1448
1449                 if (cmd->user_data != conn)
1450                         continue;
1451
1452                 return cmd;
1453         }
1454
1455         return NULL;
1456 }
1457
1458 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1459 {
1460         struct mgmt_rp_pair_device rp;
1461         struct hci_conn *conn = cmd->user_data;
1462
1463         bacpy(&rp.addr.bdaddr, &conn->dst);
1464         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1465         rp.status = status;
1466
1467         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1468
1469         /* So we don't get further callbacks for this connection */
1470         conn->connect_cfm_cb = NULL;
1471         conn->security_cfm_cb = NULL;
1472         conn->disconn_cfm_cb = NULL;
1473
1474         hci_conn_put(conn);
1475
1476         mgmt_pending_remove(cmd);
1477 }
1478
1479 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1480 {
1481         struct pending_cmd *cmd;
1482
1483         BT_DBG("status %u", status);
1484
1485         cmd = find_pairing(conn);
1486         if (!cmd)
1487                 BT_DBG("Unable to find a pending command");
1488         else
1489                 pairing_complete(cmd, status);
1490 }
1491
1492 static int pair_device(struct sock *sk, u16 index, void *data, u16 len)
1493 {
1494         struct hci_dev *hdev;
1495         struct mgmt_cp_pair_device *cp = data;
1496         struct mgmt_rp_pair_device rp;
1497         struct pending_cmd *cmd;
1498         u8 sec_level, auth_type;
1499         struct hci_conn *conn;
1500         int err;
1501
1502         BT_DBG("");
1503
1504         if (len != sizeof(*cp))
1505                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1506                                                 MGMT_STATUS_INVALID_PARAMS);
1507
1508         hdev = hci_dev_get(index);
1509         if (!hdev)
1510                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1511                                                 MGMT_STATUS_INVALID_PARAMS);
1512
1513         hci_dev_lock(hdev);
1514
1515         sec_level = BT_SECURITY_MEDIUM;
1516         if (cp->io_cap == 0x03)
1517                 auth_type = HCI_AT_DEDICATED_BONDING;
1518         else
1519                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1520
1521         if (cp->addr.type == MGMT_ADDR_BREDR)
1522                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1523                                                                 auth_type);
1524         else
1525                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1526                                                                 auth_type);
1527
1528         memset(&rp, 0, sizeof(rp));
1529         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1530         rp.addr.type = cp->addr.type;
1531
1532         if (IS_ERR(conn)) {
1533                 rp.status = -PTR_ERR(conn);
1534                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1535                                                         &rp, sizeof(rp));
1536                 goto unlock;
1537         }
1538
1539         if (conn->connect_cfm_cb) {
1540                 hci_conn_put(conn);
1541                 rp.status = EBUSY;
1542                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1543                                                         &rp, sizeof(rp));
1544                 goto unlock;
1545         }
1546
1547         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1548         if (!cmd) {
1549                 err = -ENOMEM;
1550                 hci_conn_put(conn);
1551                 goto unlock;
1552         }
1553
1554         /* For LE, just connecting isn't a proof that the pairing finished */
1555         if (cp->addr.type == MGMT_ADDR_BREDR)
1556                 conn->connect_cfm_cb = pairing_complete_cb;
1557
1558         conn->security_cfm_cb = pairing_complete_cb;
1559         conn->disconn_cfm_cb = pairing_complete_cb;
1560         conn->io_capability = cp->io_cap;
1561         cmd->user_data = conn;
1562
1563         if (conn->state == BT_CONNECTED &&
1564                                 hci_conn_security(conn, sec_level, auth_type))
1565                 pairing_complete(cmd, 0);
1566
1567         err = 0;
1568
1569 unlock:
1570         hci_dev_unlock(hdev);
1571         hci_dev_put(hdev);
1572
1573         return err;
1574 }
1575
1576 static int cancel_pair_device(struct sock *sk, u16 index,
1577                                                 unsigned char *data, u16 len)
1578 {
1579         struct mgmt_addr_info *addr = (void *) data;
1580         struct hci_dev *hdev;
1581         struct pending_cmd *cmd;
1582         struct hci_conn *conn;
1583         int err;
1584
1585         BT_DBG("");
1586
1587         if (len != sizeof(*addr))
1588                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1589                                                 MGMT_STATUS_INVALID_PARAMS);
1590
1591         hdev = hci_dev_get(index);
1592         if (!hdev)
1593                 return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1594                                                 MGMT_STATUS_INVALID_PARAMS);
1595
1596         hci_dev_lock(hdev);
1597
1598         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1599         if (!cmd) {
1600                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1601                                                 MGMT_STATUS_INVALID_PARAMS);
1602                 goto unlock;
1603         }
1604
1605         conn = cmd->user_data;
1606
1607         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1608                 err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
1609                                                 MGMT_STATUS_INVALID_PARAMS);
1610                 goto unlock;
1611         }
1612
1613         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1614
1615         err = cmd_complete(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE, addr,
1616                                                                 sizeof(*addr));
1617 unlock:
1618         hci_dev_unlock(hdev);
1619         hci_dev_put(hdev);
1620
1621         return err;
1622 }
1623
1624 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1625                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1626 {
1627         struct pending_cmd *cmd;
1628         struct hci_dev *hdev;
1629         struct hci_conn *conn;
1630         int err;
1631
1632         hdev = hci_dev_get(index);
1633         if (!hdev)
1634                 return cmd_status(sk, index, mgmt_op,
1635                                                 MGMT_STATUS_INVALID_PARAMS);
1636
1637         hci_dev_lock(hdev);
1638
1639         if (!test_bit(HCI_UP, &hdev->flags)) {
1640                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1641                 goto done;
1642         }
1643
1644         /*
1645          * Check for an existing ACL link, if present pair via
1646          * HCI commands.
1647          *
1648          * If no ACL link is present, check for an LE link and if
1649          * present, pair via the SMP engine.
1650          *
1651          * If neither ACL nor LE links are present, fail with error.
1652          */
1653         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1654         if (!conn) {
1655                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1656                 if (!conn) {
1657                         err = cmd_status(sk, index, mgmt_op,
1658                                                 MGMT_STATUS_NOT_CONNECTED);
1659                         goto done;
1660                 }
1661
1662                 /* Continue with pairing via SMP */
1663                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
1664
1665                 if (!err)
1666                         err = cmd_status(sk, index, mgmt_op,
1667                                                         MGMT_STATUS_SUCCESS);
1668                 else
1669                         err = cmd_status(sk, index, mgmt_op,
1670                                                         MGMT_STATUS_FAILED);
1671
1672                 goto done;
1673         }
1674
1675         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1676         if (!cmd) {
1677                 err = -ENOMEM;
1678                 goto done;
1679         }
1680
1681         /* Continue with pairing via HCI */
1682         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1683                 struct hci_cp_user_passkey_reply cp;
1684
1685                 bacpy(&cp.bdaddr, bdaddr);
1686                 cp.passkey = passkey;
1687                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1688         } else
1689                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1690
1691         if (err < 0)
1692                 mgmt_pending_remove(cmd);
1693
1694 done:
1695         hci_dev_unlock(hdev);
1696         hci_dev_put(hdev);
1697
1698         return err;
1699 }
1700
1701 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1702 {
1703         struct mgmt_cp_user_confirm_reply *cp = data;
1704
1705         BT_DBG("");
1706
1707         if (len != sizeof(*cp))
1708                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1709                                                 MGMT_STATUS_INVALID_PARAMS);
1710
1711         return user_pairing_resp(sk, index, &cp->bdaddr,
1712                         MGMT_OP_USER_CONFIRM_REPLY,
1713                         HCI_OP_USER_CONFIRM_REPLY, 0);
1714 }
1715
1716 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1717                                                                         u16 len)
1718 {
1719         struct mgmt_cp_user_confirm_neg_reply *cp = data;
1720
1721         BT_DBG("");
1722
1723         if (len != sizeof(*cp))
1724                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1725                                                 MGMT_STATUS_INVALID_PARAMS);
1726
1727         return user_pairing_resp(sk, index, &cp->bdaddr,
1728                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1729                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1730 }
1731
1732 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1733 {
1734         struct mgmt_cp_user_passkey_reply *cp = data;
1735
1736         BT_DBG("");
1737
1738         if (len != sizeof(*cp))
1739                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1740                                                                         EINVAL);
1741
1742         return user_pairing_resp(sk, index, &cp->bdaddr,
1743                         MGMT_OP_USER_PASSKEY_REPLY,
1744                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1745 }
1746
1747 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1748                                                                         u16 len)
1749 {
1750         struct mgmt_cp_user_passkey_neg_reply *cp = data;
1751
1752         BT_DBG("");
1753
1754         if (len != sizeof(*cp))
1755                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1756                                                                         EINVAL);
1757
1758         return user_pairing_resp(sk, index, &cp->bdaddr,
1759                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1760                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1761 }
1762
1763 static int set_local_name(struct sock *sk, u16 index, void *data,
1764                                                                 u16 len)
1765 {
1766         struct mgmt_cp_set_local_name *mgmt_cp = data;
1767         struct hci_cp_write_local_name hci_cp;
1768         struct hci_dev *hdev;
1769         struct pending_cmd *cmd;
1770         int err;
1771
1772         BT_DBG("");
1773
1774         if (len != sizeof(*mgmt_cp))
1775                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1776                                                 MGMT_STATUS_INVALID_PARAMS);
1777
1778         hdev = hci_dev_get(index);
1779         if (!hdev)
1780                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1781                                                 MGMT_STATUS_INVALID_PARAMS);
1782
1783         hci_dev_lock(hdev);
1784
1785         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data,
1786                                                                         len);
1787         if (!cmd) {
1788                 err = -ENOMEM;
1789                 goto failed;
1790         }
1791
1792         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1793         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1794                                                                 &hci_cp);
1795         if (err < 0)
1796                 mgmt_pending_remove(cmd);
1797
1798 failed:
1799         hci_dev_unlock(hdev);
1800         hci_dev_put(hdev);
1801
1802         return err;
1803 }
1804
1805 static int read_local_oob_data(struct sock *sk, u16 index)
1806 {
1807         struct hci_dev *hdev;
1808         struct pending_cmd *cmd;
1809         int err;
1810
1811         BT_DBG("hci%u", index);
1812
1813         hdev = hci_dev_get(index);
1814         if (!hdev)
1815                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1816                                                 MGMT_STATUS_INVALID_PARAMS);
1817
1818         hci_dev_lock(hdev);
1819
1820         if (!test_bit(HCI_UP, &hdev->flags)) {
1821                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1822                                                 MGMT_STATUS_NOT_POWERED);
1823                 goto unlock;
1824         }
1825
1826         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1827                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1828                                                 MGMT_STATUS_NOT_SUPPORTED);
1829                 goto unlock;
1830         }
1831
1832         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1833                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1834                                                         MGMT_STATUS_BUSY);
1835                 goto unlock;
1836         }
1837
1838         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1839         if (!cmd) {
1840                 err = -ENOMEM;
1841                 goto unlock;
1842         }
1843
1844         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1845         if (err < 0)
1846                 mgmt_pending_remove(cmd);
1847
1848 unlock:
1849         hci_dev_unlock(hdev);
1850         hci_dev_put(hdev);
1851
1852         return err;
1853 }
1854
1855 static int add_remote_oob_data(struct sock *sk, u16 index, void *data,
1856                                                                 u16 len)
1857 {
1858         struct hci_dev *hdev;
1859         struct mgmt_cp_add_remote_oob_data *cp = data;
1860         int err;
1861
1862         BT_DBG("hci%u ", index);
1863
1864         if (len != sizeof(*cp))
1865                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1866                                                 MGMT_STATUS_INVALID_PARAMS);
1867
1868         hdev = hci_dev_get(index);
1869         if (!hdev)
1870                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1871                                                 MGMT_STATUS_INVALID_PARAMS);
1872
1873         hci_dev_lock(hdev);
1874
1875         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1876                                                                 cp->randomizer);
1877         if (err < 0)
1878                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1879                                                         MGMT_STATUS_FAILED);
1880         else
1881                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1882                                                                         0);
1883
1884         hci_dev_unlock(hdev);
1885         hci_dev_put(hdev);
1886
1887         return err;
1888 }
1889
1890 static int remove_remote_oob_data(struct sock *sk, u16 index,
1891                                                 void *data, u16 len)
1892 {
1893         struct hci_dev *hdev;
1894         struct mgmt_cp_remove_remote_oob_data *cp = data;
1895         int err;
1896
1897         BT_DBG("hci%u ", index);
1898
1899         if (len != sizeof(*cp))
1900                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1901                                                 MGMT_STATUS_INVALID_PARAMS);
1902
1903         hdev = hci_dev_get(index);
1904         if (!hdev)
1905                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1906                                                 MGMT_STATUS_INVALID_PARAMS);
1907
1908         hci_dev_lock(hdev);
1909
1910         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1911         if (err < 0)
1912                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1913                                                 MGMT_STATUS_INVALID_PARAMS);
1914         else
1915                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1916                                                                 NULL, 0);
1917
1918         hci_dev_unlock(hdev);
1919         hci_dev_put(hdev);
1920
1921         return err;
1922 }
1923
1924 static int start_discovery(struct sock *sk, u16 index,
1925                                                 void *data, u16 len)
1926 {
1927         struct mgmt_cp_start_discovery *cp = data;
1928         unsigned long discov_type = cp->type;
1929         struct pending_cmd *cmd;
1930         struct hci_dev *hdev;
1931         int err;
1932
1933         BT_DBG("hci%u", index);
1934
1935         if (len != sizeof(*cp))
1936                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1937                                                 MGMT_STATUS_INVALID_PARAMS);
1938
1939         hdev = hci_dev_get(index);
1940         if (!hdev)
1941                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1942                                                 MGMT_STATUS_INVALID_PARAMS);
1943
1944         hci_dev_lock(hdev);
1945
1946         if (!test_bit(HCI_UP, &hdev->flags)) {
1947                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1948                                                 MGMT_STATUS_NOT_POWERED);
1949                 goto failed;
1950         }
1951
1952         if (hdev->discovery.state != DISCOVERY_STOPPED) {
1953                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1954                                                 MGMT_STATUS_BUSY);
1955                 goto failed;
1956         }
1957
1958         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1959         if (!cmd) {
1960                 err = -ENOMEM;
1961                 goto failed;
1962         }
1963
1964         if (test_bit(MGMT_ADDR_BREDR, &discov_type))
1965                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1966         else if (test_bit(MGMT_ADDR_LE_PUBLIC, &discov_type) &&
1967                                 test_bit(MGMT_ADDR_LE_RANDOM, &discov_type))
1968                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
1969                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
1970         else
1971                 err = -EINVAL;
1972
1973         if (err < 0)
1974                 mgmt_pending_remove(cmd);
1975         else
1976                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
1977
1978 failed:
1979         hci_dev_unlock(hdev);
1980         hci_dev_put(hdev);
1981
1982         return err;
1983 }
1984
1985 static int stop_discovery(struct sock *sk, u16 index)
1986 {
1987         struct hci_dev *hdev;
1988         struct pending_cmd *cmd;
1989         struct hci_cp_remote_name_req_cancel cp;
1990         struct inquiry_entry *e;
1991         int err;
1992
1993         BT_DBG("hci%u", index);
1994
1995         hdev = hci_dev_get(index);
1996         if (!hdev)
1997                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1998                                                 MGMT_STATUS_INVALID_PARAMS);
1999
2000         hci_dev_lock(hdev);
2001
2002         if (!hci_discovery_active(hdev)) {
2003                 err = cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
2004                                                 MGMT_STATUS_REJECTED);
2005                 goto unlock;
2006         }
2007
2008         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2009         if (!cmd) {
2010                 err = -ENOMEM;
2011                 goto unlock;
2012         }
2013
2014         if (hdev->discovery.state == DISCOVERY_INQUIRY) {
2015                 err = hci_cancel_inquiry(hdev);
2016                 if (err < 0)
2017                         mgmt_pending_remove(cmd);
2018                 else
2019                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2020                 goto unlock;
2021         }
2022
2023         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2024         if (!e) {
2025                 mgmt_pending_remove(cmd);
2026                 err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY, NULL, 0);
2027                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2028                 goto unlock;
2029         }
2030
2031         bacpy(&cp.bdaddr, &e->data.bdaddr);
2032         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2033                                                         sizeof(cp), &cp);
2034         if (err < 0)
2035                 mgmt_pending_remove(cmd);
2036         else
2037                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2038
2039 unlock:
2040         hci_dev_unlock(hdev);
2041         hci_dev_put(hdev);
2042
2043         return err;
2044 }
2045
2046 static int confirm_name(struct sock *sk, u16 index, void *data, u16 len)
2047 {
2048         struct mgmt_cp_confirm_name *cp = data;
2049         struct inquiry_entry *e;
2050         struct hci_dev *hdev;
2051         int err;
2052
2053         BT_DBG("hci%u", index);
2054
2055         if (len != sizeof(*cp))
2056                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2057                                 MGMT_STATUS_INVALID_PARAMS);
2058
2059         hdev = hci_dev_get(index);
2060         if (!hdev)
2061                 return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2062                                 MGMT_STATUS_INVALID_PARAMS);
2063
2064         hci_dev_lock(hdev);
2065
2066         if (!hci_discovery_active(hdev)) {
2067                 err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
2068                                                         MGMT_STATUS_FAILED);
2069                 goto failed;
2070         }
2071
2072         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->bdaddr);
2073         if (!e) {
2074                 err = cmd_status (sk, index, MGMT_OP_CONFIRM_NAME,
2075                                 MGMT_STATUS_INVALID_PARAMS);
2076                 goto failed;
2077         }
2078
2079         if (cp->name_known) {
2080                 e->name_state = NAME_KNOWN;
2081                 list_del(&e->list);
2082         } else {
2083                 e->name_state = NAME_NEEDED;
2084                 hci_inquiry_cache_update_resolve(hdev, e);
2085         }
2086
2087         err = 0;
2088
2089 failed:
2090         hci_dev_unlock(hdev);
2091
2092         return err;
2093 }
2094
2095 static int block_device(struct sock *sk, u16 index, void *data, u16 len)
2096 {
2097         struct hci_dev *hdev;
2098         struct mgmt_cp_block_device *cp = data;
2099         int err;
2100
2101         BT_DBG("hci%u", index);
2102
2103         if (len != sizeof(*cp))
2104                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2105                                                 MGMT_STATUS_INVALID_PARAMS);
2106
2107         hdev = hci_dev_get(index);
2108         if (!hdev)
2109                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2110                                                 MGMT_STATUS_INVALID_PARAMS);
2111
2112         hci_dev_lock(hdev);
2113
2114         err = hci_blacklist_add(hdev, &cp->bdaddr);
2115         if (err < 0)
2116                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
2117                                                         MGMT_STATUS_FAILED);
2118         else
2119                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
2120                                                         NULL, 0);
2121
2122         hci_dev_unlock(hdev);
2123         hci_dev_put(hdev);
2124
2125         return err;
2126 }
2127
2128 static int unblock_device(struct sock *sk, u16 index, void *data, u16 len)
2129 {
2130         struct hci_dev *hdev;
2131         struct mgmt_cp_unblock_device *cp = data;
2132         int err;
2133
2134         BT_DBG("hci%u", index);
2135
2136         if (len != sizeof(*cp))
2137                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2138                                                 MGMT_STATUS_INVALID_PARAMS);
2139
2140         hdev = hci_dev_get(index);
2141         if (!hdev)
2142                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2143                                                 MGMT_STATUS_INVALID_PARAMS);
2144
2145         hci_dev_lock(hdev);
2146
2147         err = hci_blacklist_del(hdev, &cp->bdaddr);
2148
2149         if (err < 0)
2150                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2151                                                 MGMT_STATUS_INVALID_PARAMS);
2152         else
2153                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2154                                                                 NULL, 0);
2155
2156         hci_dev_unlock(hdev);
2157         hci_dev_put(hdev);
2158
2159         return err;
2160 }
2161
2162 static int set_fast_connectable(struct sock *sk, u16 index,
2163                                         void *data, u16 len)
2164 {
2165         struct hci_dev *hdev;
2166         struct mgmt_mode *cp = data;
2167         struct hci_cp_write_page_scan_activity acp;
2168         u8 type;
2169         int err;
2170
2171         BT_DBG("hci%u", index);
2172
2173         if (len != sizeof(*cp))
2174                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2175                                                 MGMT_STATUS_INVALID_PARAMS);
2176
2177         hdev = hci_dev_get(index);
2178         if (!hdev)
2179                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2180                                                 MGMT_STATUS_INVALID_PARAMS);
2181
2182         hci_dev_lock(hdev);
2183
2184         if (cp->val) {
2185                 type = PAGE_SCAN_TYPE_INTERLACED;
2186                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2187         } else {
2188                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2189                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2190         }
2191
2192         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2193
2194         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2195                                                 sizeof(acp), &acp);
2196         if (err < 0) {
2197                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2198                                                         MGMT_STATUS_FAILED);
2199                 goto done;
2200         }
2201
2202         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2203         if (err < 0) {
2204                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2205                                                         MGMT_STATUS_FAILED);
2206                 goto done;
2207         }
2208
2209         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2210                                                         NULL, 0);
2211 done:
2212         hci_dev_unlock(hdev);
2213         hci_dev_put(hdev);
2214
2215         return err;
2216 }
2217
2218 static int load_long_term_keys(struct sock *sk, u16 index,
2219                                         void *cp_data, u16 len)
2220 {
2221         struct hci_dev *hdev;
2222         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2223         u16 key_count, expected_len;
2224         int i;
2225
2226         if (len < sizeof(*cp))
2227                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2228                                                                 EINVAL);
2229
2230         key_count = get_unaligned_le16(&cp->key_count);
2231
2232         expected_len = sizeof(*cp) + key_count *
2233                                         sizeof(struct mgmt_ltk_info);
2234         if (expected_len != len) {
2235                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2236                                                         len, expected_len);
2237                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2238                                                                 EINVAL);
2239         }
2240
2241         hdev = hci_dev_get(index);
2242         if (!hdev)
2243                 return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
2244                                                                 ENODEV);
2245
2246         BT_DBG("hci%u key_count %u", index, key_count);
2247
2248         hci_dev_lock(hdev);
2249
2250         hci_smp_ltks_clear(hdev);
2251
2252         for (i = 0; i < key_count; i++) {
2253                 struct mgmt_ltk_info *key = &cp->keys[i];
2254                 u8 type;
2255
2256                 if (key->master)
2257                         type = HCI_SMP_LTK;
2258                 else
2259                         type = HCI_SMP_LTK_SLAVE;
2260
2261                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2262                                         type, 0, key->authenticated, key->val,
2263                                         key->enc_size, key->ediv, key->rand);
2264         }
2265
2266         hci_dev_unlock(hdev);
2267         hci_dev_put(hdev);
2268
2269         return 0;
2270 }
2271
2272 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2273 {
2274         void *buf;
2275         u8 *cp;
2276         struct mgmt_hdr *hdr;
2277         u16 opcode, index, len;
2278         int err;
2279
2280         BT_DBG("got %zu bytes", msglen);
2281
2282         if (msglen < sizeof(*hdr))
2283                 return -EINVAL;
2284
2285         buf = kmalloc(msglen, GFP_KERNEL);
2286         if (!buf)
2287                 return -ENOMEM;
2288
2289         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2290                 err = -EFAULT;
2291                 goto done;
2292         }
2293
2294         hdr = buf;
2295         opcode = get_unaligned_le16(&hdr->opcode);
2296         index = get_unaligned_le16(&hdr->index);
2297         len = get_unaligned_le16(&hdr->len);
2298
2299         if (len != msglen - sizeof(*hdr)) {
2300                 err = -EINVAL;
2301                 goto done;
2302         }
2303
2304         cp = buf + sizeof(*hdr);
2305
2306         switch (opcode) {
2307         case MGMT_OP_READ_VERSION:
2308                 err = read_version(sk);
2309                 break;
2310         case MGMT_OP_READ_INDEX_LIST:
2311                 err = read_index_list(sk);
2312                 break;
2313         case MGMT_OP_READ_INFO:
2314                 err = read_controller_info(sk, index);
2315                 break;
2316         case MGMT_OP_SET_POWERED:
2317                 err = set_powered(sk, index, cp, len);
2318                 break;
2319         case MGMT_OP_SET_DISCOVERABLE:
2320                 err = set_discoverable(sk, index, cp, len);
2321                 break;
2322         case MGMT_OP_SET_CONNECTABLE:
2323                 err = set_connectable(sk, index, cp, len);
2324                 break;
2325         case MGMT_OP_SET_FAST_CONNECTABLE:
2326                 err = set_fast_connectable(sk, index, cp, len);
2327                 break;
2328         case MGMT_OP_SET_PAIRABLE:
2329                 err = set_pairable(sk, index, cp, len);
2330                 break;
2331         case MGMT_OP_ADD_UUID:
2332                 err = add_uuid(sk, index, cp, len);
2333                 break;
2334         case MGMT_OP_REMOVE_UUID:
2335                 err = remove_uuid(sk, index, cp, len);
2336                 break;
2337         case MGMT_OP_SET_DEV_CLASS:
2338                 err = set_dev_class(sk, index, cp, len);
2339                 break;
2340         case MGMT_OP_LOAD_LINK_KEYS:
2341                 err = load_link_keys(sk, index, cp, len);
2342                 break;
2343         case MGMT_OP_REMOVE_KEYS:
2344                 err = remove_keys(sk, index, cp, len);
2345                 break;
2346         case MGMT_OP_DISCONNECT:
2347                 err = disconnect(sk, index, cp, len);
2348                 break;
2349         case MGMT_OP_GET_CONNECTIONS:
2350                 err = get_connections(sk, index);
2351                 break;
2352         case MGMT_OP_PIN_CODE_REPLY:
2353                 err = pin_code_reply(sk, index, cp, len);
2354                 break;
2355         case MGMT_OP_PIN_CODE_NEG_REPLY:
2356                 err = pin_code_neg_reply(sk, index, cp, len);
2357                 break;
2358         case MGMT_OP_SET_IO_CAPABILITY:
2359                 err = set_io_capability(sk, index, cp, len);
2360                 break;
2361         case MGMT_OP_PAIR_DEVICE:
2362                 err = pair_device(sk, index, cp, len);
2363                 break;
2364         case MGMT_OP_CANCEL_PAIR_DEVICE:
2365                 err = cancel_pair_device(sk, index, buf + sizeof(*hdr), len);
2366                 break;
2367         case MGMT_OP_USER_CONFIRM_REPLY:
2368                 err = user_confirm_reply(sk, index, cp, len);
2369                 break;
2370         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2371                 err = user_confirm_neg_reply(sk, index, cp, len);
2372                 break;
2373         case MGMT_OP_USER_PASSKEY_REPLY:
2374                 err = user_passkey_reply(sk, index, cp, len);
2375                 break;
2376         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2377                 err = user_passkey_neg_reply(sk, index, cp, len);
2378                 break;
2379         case MGMT_OP_SET_LOCAL_NAME:
2380                 err = set_local_name(sk, index, cp, len);
2381                 break;
2382         case MGMT_OP_READ_LOCAL_OOB_DATA:
2383                 err = read_local_oob_data(sk, index);
2384                 break;
2385         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2386                 err = add_remote_oob_data(sk, index, cp, len);
2387                 break;
2388         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2389                 err = remove_remote_oob_data(sk, index, cp, len);
2390                 break;
2391         case MGMT_OP_START_DISCOVERY:
2392                 err = start_discovery(sk, index, cp, len);
2393                 break;
2394         case MGMT_OP_STOP_DISCOVERY:
2395                 err = stop_discovery(sk, index);
2396                 break;
2397         case MGMT_OP_CONFIRM_NAME:
2398                 err = confirm_name(sk, index, cp, len);
2399                 break;
2400         case MGMT_OP_BLOCK_DEVICE:
2401                 err = block_device(sk, index, cp, len);
2402                 break;
2403         case MGMT_OP_UNBLOCK_DEVICE:
2404                 err = unblock_device(sk, index, cp, len);
2405                 break;
2406         case MGMT_OP_LOAD_LONG_TERM_KEYS:
2407                 err = load_long_term_keys(sk, index, cp, len);
2408                 break;
2409         default:
2410                 BT_DBG("Unknown op %u", opcode);
2411                 err = cmd_status(sk, index, opcode,
2412                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2413                 break;
2414         }
2415
2416         if (err < 0)
2417                 goto done;
2418
2419         err = msglen;
2420
2421 done:
2422         kfree(buf);
2423         return err;
2424 }
2425
2426 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2427 {
2428         u8 *status = data;
2429
2430         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2431         mgmt_pending_remove(cmd);
2432 }
2433
2434 int mgmt_index_added(struct hci_dev *hdev)
2435 {
2436         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2437 }
2438
2439 int mgmt_index_removed(struct hci_dev *hdev)
2440 {
2441         u8 status = ENODEV;
2442
2443         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2444
2445         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2446 }
2447
2448 struct cmd_lookup {
2449         u8 val;
2450         struct sock *sk;
2451         struct hci_dev *hdev;
2452 };
2453
2454 static void settings_rsp(struct pending_cmd *cmd, void *data)
2455 {
2456         struct cmd_lookup *match = data;
2457
2458         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2459
2460         list_del(&cmd->list);
2461
2462         if (match->sk == NULL) {
2463                 match->sk = cmd->sk;
2464                 sock_hold(match->sk);
2465         }
2466
2467         mgmt_pending_free(cmd);
2468 }
2469
2470 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2471 {
2472         struct cmd_lookup match = { powered, NULL, hdev };
2473         __le32 ev;
2474         int ret;
2475
2476         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2477
2478         if (!powered) {
2479                 u8 status = ENETDOWN;
2480                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2481         }
2482
2483         ev = cpu_to_le32(get_current_settings(hdev));
2484
2485         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2486                                                                 match.sk);
2487
2488         if (match.sk)
2489                 sock_put(match.sk);
2490
2491         return ret;
2492 }
2493
2494 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2495 {
2496         struct cmd_lookup match = { discoverable, NULL, hdev };
2497         __le32 ev;
2498         int ret;
2499
2500         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
2501
2502         ev = cpu_to_le32(get_current_settings(hdev));
2503
2504         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2505                                                                 match.sk);
2506         if (match.sk)
2507                 sock_put(match.sk);
2508
2509         return ret;
2510 }
2511
2512 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2513 {
2514         __le32 ev;
2515         struct cmd_lookup match = { connectable, NULL, hdev };
2516         int ret;
2517
2518         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2519                                                                 &match);
2520
2521         ev = cpu_to_le32(get_current_settings(hdev));
2522
2523         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
2524
2525         if (match.sk)
2526                 sock_put(match.sk);
2527
2528         return ret;
2529 }
2530
2531 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2532 {
2533         u8 mgmt_err = mgmt_status(status);
2534
2535         if (scan & SCAN_PAGE)
2536                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2537                                                 cmd_status_rsp, &mgmt_err);
2538
2539         if (scan & SCAN_INQUIRY)
2540                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2541                                                 cmd_status_rsp, &mgmt_err);
2542
2543         return 0;
2544 }
2545
2546 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2547                                                                 u8 persistent)
2548 {
2549         struct mgmt_ev_new_link_key ev;
2550
2551         memset(&ev, 0, sizeof(ev));
2552
2553         ev.store_hint = persistent;
2554         bacpy(&ev.key.bdaddr, &key->bdaddr);
2555         ev.key.type = key->type;
2556         memcpy(ev.key.val, key->val, 16);
2557         ev.key.pin_len = key->pin_len;
2558
2559         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2560 }
2561
2562 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2563 {
2564         struct mgmt_ev_new_long_term_key ev;
2565
2566         memset(&ev, 0, sizeof(ev));
2567
2568         ev.store_hint = persistent;
2569         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2570         ev.key.addr.type = key->bdaddr_type;
2571         ev.key.authenticated = key->authenticated;
2572         ev.key.enc_size = key->enc_size;
2573         ev.key.ediv = key->ediv;
2574
2575         if (key->type == HCI_SMP_LTK)
2576                 ev.key.master = 1;
2577
2578         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2579         memcpy(ev.key.val, key->val, sizeof(key->val));
2580
2581         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
2582                                                 &ev, sizeof(ev), NULL);
2583 }
2584
2585 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2586                                         u8 addr_type, u8 *name, u8 name_len,
2587                                         u8 *dev_class)
2588 {
2589         char buf[512];
2590         struct mgmt_ev_device_connected *ev = (void *) buf;
2591         u16 eir_len = 0;
2592
2593         bacpy(&ev->addr.bdaddr, bdaddr);
2594         ev->addr.type = link_to_mgmt(link_type, addr_type);
2595
2596         if (name_len > 0)
2597                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2598                                                                 name, name_len);
2599
2600         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2601                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
2602                                         EIR_CLASS_OF_DEV, dev_class, 3);
2603
2604         put_unaligned_le16(eir_len, &ev->eir_len);
2605
2606         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2607                                                 sizeof(*ev) + eir_len, NULL);
2608 }
2609
2610 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2611 {
2612         struct mgmt_cp_disconnect *cp = cmd->param;
2613         struct sock **sk = data;
2614         struct mgmt_rp_disconnect rp;
2615
2616         bacpy(&rp.bdaddr, &cp->bdaddr);
2617         rp.status = 0;
2618
2619         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2620
2621         *sk = cmd->sk;
2622         sock_hold(*sk);
2623
2624         mgmt_pending_remove(cmd);
2625 }
2626
2627 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2628 {
2629         u8 *status = data;
2630         struct mgmt_cp_remove_keys *cp = cmd->param;
2631         struct mgmt_rp_remove_keys rp;
2632
2633         memset(&rp, 0, sizeof(rp));
2634         bacpy(&rp.bdaddr, &cp->bdaddr);
2635         if (status != NULL)
2636                 rp.status = *status;
2637
2638         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2639                                                                 sizeof(rp));
2640
2641         mgmt_pending_remove(cmd);
2642 }
2643
2644 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
2645                                                 u8 link_type, u8 addr_type)
2646 {
2647         struct mgmt_addr_info ev;
2648         struct sock *sk = NULL;
2649         int err;
2650
2651         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2652
2653         bacpy(&ev.bdaddr, bdaddr);
2654         ev.type = link_to_mgmt(link_type, addr_type);
2655
2656         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
2657                                                                         sk);
2658
2659         if (sk)
2660                 sock_put(sk);
2661
2662         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2663
2664         return err;
2665 }
2666
2667 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2668 {
2669         struct pending_cmd *cmd;
2670         u8 mgmt_err = mgmt_status(status);
2671         int err;
2672
2673         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2674         if (!cmd)
2675                 return -ENOENT;
2676
2677         if (bdaddr) {
2678                 struct mgmt_rp_disconnect rp;
2679
2680                 bacpy(&rp.bdaddr, bdaddr);
2681                 rp.status = status;
2682
2683                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2684                                                         &rp, sizeof(rp));
2685         } else
2686                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2687                                                                 mgmt_err);
2688
2689         mgmt_pending_remove(cmd);
2690
2691         return err;
2692 }
2693
2694 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2695                                                 u8 addr_type, u8 status)
2696 {
2697         struct mgmt_ev_connect_failed ev;
2698
2699         bacpy(&ev.addr.bdaddr, bdaddr);
2700         ev.addr.type = link_to_mgmt(link_type, addr_type);
2701         ev.status = mgmt_status(status);
2702
2703         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2704 }
2705
2706 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2707 {
2708         struct mgmt_ev_pin_code_request ev;
2709
2710         bacpy(&ev.bdaddr, bdaddr);
2711         ev.secure = secure;
2712
2713         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2714                                                                         NULL);
2715 }
2716
2717 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2718                                                                 u8 status)
2719 {
2720         struct pending_cmd *cmd;
2721         struct mgmt_rp_pin_code_reply rp;
2722         int err;
2723
2724         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2725         if (!cmd)
2726                 return -ENOENT;
2727
2728         bacpy(&rp.bdaddr, bdaddr);
2729         rp.status = mgmt_status(status);
2730
2731         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2732                                                                 sizeof(rp));
2733
2734         mgmt_pending_remove(cmd);
2735
2736         return err;
2737 }
2738
2739 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2740                                                                 u8 status)
2741 {
2742         struct pending_cmd *cmd;
2743         struct mgmt_rp_pin_code_reply rp;
2744         int err;
2745
2746         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2747         if (!cmd)
2748                 return -ENOENT;
2749
2750         bacpy(&rp.bdaddr, bdaddr);
2751         rp.status = mgmt_status(status);
2752
2753         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2754                                                                 sizeof(rp));
2755
2756         mgmt_pending_remove(cmd);
2757
2758         return err;
2759 }
2760
2761 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2762                                                 __le32 value, u8 confirm_hint)
2763 {
2764         struct mgmt_ev_user_confirm_request ev;
2765
2766         BT_DBG("%s", hdev->name);
2767
2768         bacpy(&ev.bdaddr, bdaddr);
2769         ev.confirm_hint = confirm_hint;
2770         put_unaligned_le32(value, &ev.value);
2771
2772         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2773                                                                         NULL);
2774 }
2775
2776 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2777 {
2778         struct mgmt_ev_user_passkey_request ev;
2779
2780         BT_DBG("%s", hdev->name);
2781
2782         bacpy(&ev.bdaddr, bdaddr);
2783
2784         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2785                                                                         NULL);
2786 }
2787
2788 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2789                                                         u8 status, u8 opcode)
2790 {
2791         struct pending_cmd *cmd;
2792         struct mgmt_rp_user_confirm_reply rp;
2793         int err;
2794
2795         cmd = mgmt_pending_find(opcode, hdev);
2796         if (!cmd)
2797                 return -ENOENT;
2798
2799         bacpy(&rp.bdaddr, bdaddr);
2800         rp.status = mgmt_status(status);
2801         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2802
2803         mgmt_pending_remove(cmd);
2804
2805         return err;
2806 }
2807
2808 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2809                                                                 u8 status)
2810 {
2811         return user_pairing_resp_complete(hdev, bdaddr, status,
2812                                                 MGMT_OP_USER_CONFIRM_REPLY);
2813 }
2814
2815 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2816                                                 bdaddr_t *bdaddr, u8 status)
2817 {
2818         return user_pairing_resp_complete(hdev, bdaddr, status,
2819                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2820 }
2821
2822 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2823                                                                 u8 status)
2824 {
2825         return user_pairing_resp_complete(hdev, bdaddr, status,
2826                                                 MGMT_OP_USER_PASSKEY_REPLY);
2827 }
2828
2829 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2830                                                 bdaddr_t *bdaddr, u8 status)
2831 {
2832         return user_pairing_resp_complete(hdev, bdaddr, status,
2833                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2834 }
2835
2836 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2837 {
2838         struct mgmt_ev_auth_failed ev;
2839
2840         bacpy(&ev.bdaddr, bdaddr);
2841         ev.status = mgmt_status(status);
2842
2843         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2844 }
2845
2846 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2847 {
2848         struct pending_cmd *cmd;
2849         struct mgmt_cp_set_local_name ev;
2850         int err;
2851
2852         memset(&ev, 0, sizeof(ev));
2853         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2854
2855         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2856         if (!cmd)
2857                 goto send_event;
2858
2859         if (status) {
2860                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2861                                                         mgmt_status(status));
2862                 goto failed;
2863         }
2864
2865         update_eir(hdev);
2866
2867         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2868                                                                 sizeof(ev));
2869         if (err < 0)
2870                 goto failed;
2871
2872 send_event:
2873         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2874                                                         cmd ? cmd->sk : NULL);
2875
2876 failed:
2877         if (cmd)
2878                 mgmt_pending_remove(cmd);
2879         return err;
2880 }
2881
2882 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2883                                                 u8 *randomizer, u8 status)
2884 {
2885         struct pending_cmd *cmd;
2886         int err;
2887
2888         BT_DBG("%s status %u", hdev->name, status);
2889
2890         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2891         if (!cmd)
2892                 return -ENOENT;
2893
2894         if (status) {
2895                 err = cmd_status(cmd->sk, hdev->id,
2896                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2897                                                 mgmt_status(status));
2898         } else {
2899                 struct mgmt_rp_read_local_oob_data rp;
2900
2901                 memcpy(rp.hash, hash, sizeof(rp.hash));
2902                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2903
2904                 err = cmd_complete(cmd->sk, hdev->id,
2905                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2906                                                 &rp, sizeof(rp));
2907         }
2908
2909         mgmt_pending_remove(cmd);
2910
2911         return err;
2912 }
2913
2914 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2915                                 u8 addr_type, u8 *dev_class, s8 rssi,
2916                                 u8 cfm_name, u8 *eir, u16 eir_len)
2917 {
2918         char buf[512];
2919         struct mgmt_ev_device_found *ev = (void *) buf;
2920         size_t ev_size;
2921
2922         /* Leave 5 bytes for a potential CoD field */
2923         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
2924                 return -EINVAL;
2925
2926         memset(buf, 0, sizeof(buf));
2927
2928         bacpy(&ev->addr.bdaddr, bdaddr);
2929         ev->addr.type = link_to_mgmt(link_type, addr_type);
2930         ev->rssi = rssi;
2931         ev->confirm_name = cfm_name;
2932
2933         if (eir_len > 0)
2934                 memcpy(ev->eir, eir, eir_len);
2935
2936         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
2937                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
2938                                                                 dev_class, 3);
2939
2940         put_unaligned_le16(eir_len, &ev->eir_len);
2941
2942         ev_size = sizeof(*ev) + eir_len;
2943
2944         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
2945 }
2946
2947 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2948                                 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
2949 {
2950         struct mgmt_ev_device_found *ev;
2951         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
2952         u16 eir_len;
2953
2954         ev = (struct mgmt_ev_device_found *) buf;
2955
2956         memset(buf, 0, sizeof(buf));
2957
2958         bacpy(&ev->addr.bdaddr, bdaddr);
2959         ev->addr.type = link_to_mgmt(link_type, addr_type);
2960         ev->rssi = rssi;
2961
2962         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
2963                                                                 name_len);
2964
2965         put_unaligned_le16(eir_len, &ev->eir_len);
2966
2967         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
2968                                                 sizeof(*ev) + eir_len, NULL);
2969 }
2970
2971 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2972 {
2973         struct pending_cmd *cmd;
2974         int err;
2975
2976         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2977         if (!cmd)
2978                 return -ENOENT;
2979
2980         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2981         mgmt_pending_remove(cmd);
2982
2983         return err;
2984 }
2985
2986 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2987 {
2988         struct pending_cmd *cmd;
2989         int err;
2990
2991         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2992         if (!cmd)
2993                 return -ENOENT;
2994
2995         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2996         mgmt_pending_remove(cmd);
2997
2998         return err;
2999 }
3000
3001 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3002 {
3003         struct pending_cmd *cmd;
3004
3005         BT_DBG("%s discovering %u", hdev->name, discovering);
3006
3007         if (discovering)
3008                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3009         else
3010                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3011
3012         if (cmd != NULL) {
3013                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
3014                 mgmt_pending_remove(cmd);
3015         }
3016
3017         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
3018                                                 sizeof(discovering), NULL);
3019 }
3020
3021 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
3022 {
3023         struct pending_cmd *cmd;
3024         struct mgmt_ev_device_blocked ev;
3025
3026         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3027
3028         bacpy(&ev.bdaddr, bdaddr);
3029
3030         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3031                                                         cmd ? cmd->sk : NULL);
3032 }
3033
3034 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
3035 {
3036         struct pending_cmd *cmd;
3037         struct mgmt_ev_device_unblocked ev;
3038
3039         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3040
3041         bacpy(&ev.bdaddr, bdaddr);
3042
3043         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3044                                                         cmd ? cmd->sk : NULL);
3045 }