net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51         int err;
  52
  53         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  54
  55         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  56         if (!skb)
  57                 return -ENOMEM;
  58
  59         hdr = (void *) skb_put(skb, sizeof(*hdr));
  60
  61         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  62         hdr->index = cpu_to_le16(index);
  63         hdr->len = cpu_to_le16(sizeof(*ev));
  64
  65         ev = (void *) skb_put(skb, sizeof(*ev));
  66         ev->status = status;
  67         put_unaligned_le16(cmd, &ev->opcode);
  68
  69         err = sock_queue_rcv_skb(sk, skb);
  70         if (err < 0)
  71                 kfree_skb(skb);
  72
  73         return err;
  74 }
  75
  76 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  77                                                                 size_t rp_len)
  78 {
  79         struct sk_buff *skb;
  80         struct mgmt_hdr *hdr;
  81         struct mgmt_ev_cmd_complete *ev;
  82         int err;
  83
  84         BT_DBG("sock %p", sk);
  85
  86         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  87         if (!skb)
  88                 return -ENOMEM;
  89
  90         hdr = (void *) skb_put(skb, sizeof(*hdr));
  91
  92         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  93         hdr->index = cpu_to_le16(index);
  94         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  95
  96         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  97         put_unaligned_le16(cmd, &ev->opcode);
  98
  99         if (rp)
 100                 memcpy(ev->data, rp, rp_len);
 101
 102         err = sock_queue_rcv_skb(sk, skb);
 103         if (err < 0)
 104                 kfree_skb(skb);
 105
 106         return err;;
 107 }
 108
 109 static int read_version(struct sock *sk)
 110 {
 111         struct mgmt_rp_read_version rp;
 112
 113         BT_DBG("sock %p", sk);
 114
 115         rp.version = MGMT_VERSION;
 116         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 117
 118         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 119                                                                 sizeof(rp));
 120 }
 121
 122 static int read_index_list(struct sock *sk)
 123 {
 124         struct mgmt_rp_read_index_list *rp;
 125         struct list_head *p;
 126         struct hci_dev *d;
 127         size_t rp_len;
 128         u16 count;
 129         int i, err;
 130
 131         BT_DBG("sock %p", sk);
 132
 133         read_lock(&hci_dev_list_lock);
 134
 135         count = 0;
 136         list_for_each(p, &hci_dev_list) {
 137                 count++;
 138         }
 139
 140         rp_len = sizeof(*rp) + (2 * count);
 141         rp = kmalloc(rp_len, GFP_ATOMIC);
 142         if (!rp) {
 143                 read_unlock(&hci_dev_list_lock);
 144                 return -ENOMEM;
 145         }
 146
 147         put_unaligned_le16(count, &rp->num_controllers);
 148
 149         i = 0;
 150         list_for_each_entry(d, &hci_dev_list, list) {
 151                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 152                         cancel_delayed_work(&d->power_off);
 153
 154                 if (test_bit(HCI_SETUP, &d->flags))
 155                         continue;
 156
 157                 put_unaligned_le16(d->id, &rp->index[i++]);
 158                 BT_DBG("Added hci%u", d->id);
 159         }
 160
 161         read_unlock(&hci_dev_list_lock);
 162
 163         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 164                                                                         rp_len);
 165
 166         kfree(rp);
 167
 168         return err;
 169 }
 170
 171 static int read_controller_info(struct sock *sk, u16 index)
 172 {
 173         struct mgmt_rp_read_info rp;
 174         struct hci_dev *hdev;
 175
 176         BT_DBG("sock %p hci%u", sk, index);
 177
 178         hdev = hci_dev_get(index);
 179         if (!hdev)
 180                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 181
 182         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 183                 cancel_delayed_work_sync(&hdev->power_off);
 184
 185         hci_dev_lock_bh(hdev);
 186
 187         set_bit(HCI_MGMT, &hdev->flags);
 188
 189         memset(&rp, 0, sizeof(rp));
 190
 191         rp.type = hdev->dev_type;
 192
 193         rp.powered = test_bit(HCI_UP, &hdev->flags);
 194         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 195         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 196         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 197
 198         if (test_bit(HCI_AUTH, &hdev->flags))
 199                 rp.sec_mode = 3;
 200         else if (hdev->ssp_mode > 0)
 201                 rp.sec_mode = 4;
 202         else
 203                 rp.sec_mode = 2;
 204
 205         bacpy(&rp.bdaddr, &hdev->bdaddr);
 206         memcpy(rp.features, hdev->features, 8);
 207         memcpy(rp.dev_class, hdev->dev_class, 3);
 208         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 209         rp.hci_ver = hdev->hci_ver;
 210         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 211
 212         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 213
 214         hci_dev_unlock_bh(hdev);
 215         hci_dev_put(hdev);
 216
 217         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 218 }
 219
 220 static void mgmt_pending_free(struct pending_cmd *cmd)
 221 {
 222         sock_put(cmd->sk);
 223         kfree(cmd->param);
 224         kfree(cmd);
 225 }
 226
 227 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 228                                                         struct hci_dev *hdev,
 229                                                         void *data, u16 len)
 230 {
 231         struct pending_cmd *cmd;
 232
 233         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 234         if (!cmd)
 235                 return NULL;
 236
 237         cmd->opcode = opcode;
 238         cmd->index = hdev->id;
 239
 240         cmd->param = kmalloc(len, GFP_ATOMIC);
 241         if (!cmd->param) {
 242                 kfree(cmd);
 243                 return NULL;
 244         }
 245
 246         if (data)
 247                 memcpy(cmd->param, data, len);
 248
 249         cmd->sk = sk;
 250         sock_hold(sk);
 251
 252         list_add(&cmd->list, &hdev->mgmt_pending);
 253
 254         return cmd;
 255 }
 256
 257 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 258                                 void (*cb)(struct pending_cmd *cmd, void *data),
 259                                 void *data)
 260 {
 261         struct list_head *p, *n;
 262
 263         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 264                 struct pending_cmd *cmd;
 265
 266                 cmd = list_entry(p, struct pending_cmd, list);
 267
 268                 if (opcode > 0 && cmd->opcode != opcode)
 269                         continue;
 270
 271                 cb(cmd, data);
 272         }
 273 }
 274
 275 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 276 {
 277         struct pending_cmd *cmd;
 278
 279         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 280                 if (cmd->opcode == opcode)
 281                         return cmd;
 282         }
 283
 284         return NULL;
 285 }
 286
 287 static void mgmt_pending_remove(struct pending_cmd *cmd)
 288 {
 289         list_del(&cmd->list);
 290         mgmt_pending_free(cmd);
 291 }
 292
 293 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 294 {
 295         struct mgmt_mode *cp;
 296         struct hci_dev *hdev;
 297         struct pending_cmd *cmd;
 298         int err, up;
 299
 300         cp = (void *) data;
 301
 302         BT_DBG("request for hci%u", index);
 303
 304         if (len != sizeof(*cp))
 305                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 306
 307         hdev = hci_dev_get(index);
 308         if (!hdev)
 309                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 310
 311         hci_dev_lock_bh(hdev);
 312
 313         up = test_bit(HCI_UP, &hdev->flags);
 314         if ((cp->val && up) || (!cp->val && !up)) {
 315                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 316                 goto failed;
 317         }
 318
 319         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 320                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 321                 goto failed;
 322         }
 323
 324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 325         if (!cmd) {
 326                 err = -ENOMEM;
 327                 goto failed;
 328         }
 329
 330         if (cp->val)
 331                 queue_work(hdev->workqueue, &hdev->power_on);
 332         else
 333                 queue_work(hdev->workqueue, &hdev->power_off.work);
 334
 335         err = 0;
 336
 337 failed:
 338         hci_dev_unlock_bh(hdev);
 339         hci_dev_put(hdev);
 340         return err;
 341 }
 342
 343 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 344                                                                         u16 len)
 345 {
 346         struct mgmt_cp_set_discoverable *cp;
 347         struct hci_dev *hdev;
 348         struct pending_cmd *cmd;
 349         u8 scan;
 350         int err;
 351
 352         cp = (void *) data;
 353
 354         BT_DBG("request for hci%u", index);
 355
 356         if (len != sizeof(*cp))
 357                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 358
 359         hdev = hci_dev_get(index);
 360         if (!hdev)
 361                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 362
 363         hci_dev_lock_bh(hdev);
 364
 365         if (!test_bit(HCI_UP, &hdev->flags)) {
 366                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 367                 goto failed;
 368         }
 369
 370         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 371                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 372                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 373                 goto failed;
 374         }
 375
 376         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 377                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 378                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 379                 goto failed;
 380         }
 381
 382         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 383         if (!cmd) {
 384                 err = -ENOMEM;
 385                 goto failed;
 386         }
 387
 388         scan = SCAN_PAGE;
 389
 390         if (cp->val)
 391                 scan |= SCAN_INQUIRY;
 392         else
 393                 cancel_delayed_work(&hdev->discov_off);
 394
 395         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 396         if (err < 0)
 397                 mgmt_pending_remove(cmd);
 398
 399         if (cp->val)
 400                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 401
 402 failed:
 403         hci_dev_unlock_bh(hdev);
 404         hci_dev_put(hdev);
 405
 406         return err;
 407 }
 408
 409 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 410                                                                         u16 len)
 411 {
 412         struct mgmt_mode *cp;
 413         struct hci_dev *hdev;
 414         struct pending_cmd *cmd;
 415         u8 scan;
 416         int err;
 417
 418         cp = (void *) data;
 419
 420         BT_DBG("request for hci%u", index);
 421
 422         if (len != sizeof(*cp))
 423                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 424
 425         hdev = hci_dev_get(index);
 426         if (!hdev)
 427                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 428
 429         hci_dev_lock_bh(hdev);
 430
 431         if (!test_bit(HCI_UP, &hdev->flags)) {
 432                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 433                 goto failed;
 434         }
 435
 436         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 437                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 438                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 439                 goto failed;
 440         }
 441
 442         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 443                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 444                 goto failed;
 445         }
 446
 447         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 448         if (!cmd) {
 449                 err = -ENOMEM;
 450                 goto failed;
 451         }
 452
 453         if (cp->val)
 454                 scan = SCAN_PAGE;
 455         else
 456                 scan = 0;
 457
 458         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 459         if (err < 0)
 460                 mgmt_pending_remove(cmd);
 461
 462 failed:
 463         hci_dev_unlock_bh(hdev);
 464         hci_dev_put(hdev);
 465
 466         return err;
 467 }
 468
 469 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 470                                         u16 data_len, struct sock *skip_sk)
 471 {
 472         struct sk_buff *skb;
 473         struct mgmt_hdr *hdr;
 474
 475         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 476         if (!skb)
 477                 return -ENOMEM;
 478
 479         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 480
 481         hdr = (void *) skb_put(skb, sizeof(*hdr));
 482         hdr->opcode = cpu_to_le16(event);
 483         if (hdev)
 484                 hdr->index = cpu_to_le16(hdev->id);
 485         else
 486                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 487         hdr->len = cpu_to_le16(data_len);
 488
 489         if (data)
 490                 memcpy(skb_put(skb, data_len), data, data_len);
 491
 492         hci_send_to_sock(NULL, skb, skip_sk);
 493         kfree_skb(skb);
 494
 495         return 0;
 496 }
 497
 498 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 499 {
 500         struct mgmt_mode rp;
 501
 502         rp.val = val;
 503
 504         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 505 }
 506
 507 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 508                                                                         u16 len)
 509 {
 510         struct mgmt_mode *cp, ev;
 511         struct hci_dev *hdev;
 512         int err;
 513
 514         cp = (void *) data;
 515
 516         BT_DBG("request for hci%u", index);
 517
 518         if (len != sizeof(*cp))
 519                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 520
 521         hdev = hci_dev_get(index);
 522         if (!hdev)
 523                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 524
 525         hci_dev_lock_bh(hdev);
 526
 527         if (cp->val)
 528                 set_bit(HCI_PAIRABLE, &hdev->flags);
 529         else
 530                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 531
 532         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 533         if (err < 0)
 534                 goto failed;
 535
 536         ev.val = cp->val;
 537
 538         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 539
 540 failed:
 541         hci_dev_unlock_bh(hdev);
 542         hci_dev_put(hdev);
 543
 544         return err;
 545 }
 546
 547 #define EIR_FLAGS               0x01 /* flags */
 548 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 549 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 550 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 551 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 552 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 553 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 554 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 555 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 556 #define EIR_TX_POWER            0x0A /* transmit power level */
 557 #define EIR_DEVICE_ID           0x10 /* device ID */
 558
 559 #define PNP_INFO_SVCLASS_ID             0x1200
 560
 561 static u8 bluetooth_base_uuid[] = {
 562                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 563                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 564 };
 565
 566 static u16 get_uuid16(u8 *uuid128)
 567 {
 568         u32 val;
 569         int i;
 570
 571         for (i = 0; i < 12; i++) {
 572                 if (bluetooth_base_uuid[i] != uuid128[i])
 573                         return 0;
 574         }
 575
 576         memcpy(&val, &uuid128[12], 4);
 577
 578         val = le32_to_cpu(val);
 579         if (val > 0xffff)
 580                 return 0;
 581
 582         return (u16) val;
 583 }
 584
 585 static void create_eir(struct hci_dev *hdev, u8 *data)
 586 {
 587         u8 *ptr = data;
 588         u16 eir_len = 0;
 589         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 590         int i, truncated = 0;
 591         struct bt_uuid *uuid;
 592         size_t name_len;
 593
 594         name_len = strlen(hdev->dev_name);
 595
 596         if (name_len > 0) {
 597                 /* EIR Data type */
 598                 if (name_len > 48) {
 599                         name_len = 48;
 600                         ptr[1] = EIR_NAME_SHORT;
 601                 } else
 602                         ptr[1] = EIR_NAME_COMPLETE;
 603
 604                 /* EIR Data length */
 605                 ptr[0] = name_len + 1;
 606
 607                 memcpy(ptr + 2, hdev->dev_name, name_len);
 608
 609                 eir_len += (name_len + 2);
 610                 ptr += (name_len + 2);
 611         }
 612
 613         memset(uuid16_list, 0, sizeof(uuid16_list));
 614
 615         /* Group all UUID16 types */
 616         list_for_each_entry(uuid, &hdev->uuids, list) {
 617                 u16 uuid16;
 618
 619                 uuid16 = get_uuid16(uuid->uuid);
 620                 if (uuid16 == 0)
 621                         return;
 622
 623                 if (uuid16 < 0x1100)
 624                         continue;
 625
 626                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 627                         continue;
 628
 629                 /* Stop if not enough space to put next UUID */
 630                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 631                         truncated = 1;
 632                         break;
 633                 }
 634
 635                 /* Check for duplicates */
 636                 for (i = 0; uuid16_list[i] != 0; i++)
 637                         if (uuid16_list[i] == uuid16)
 638                                 break;
 639
 640                 if (uuid16_list[i] == 0) {
 641                         uuid16_list[i] = uuid16;
 642                         eir_len += sizeof(u16);
 643                 }
 644         }
 645
 646         if (uuid16_list[0] != 0) {
 647                 u8 *length = ptr;
 648
 649                 /* EIR Data type */
 650                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 651
 652                 ptr += 2;
 653                 eir_len += 2;
 654
 655                 for (i = 0; uuid16_list[i] != 0; i++) {
 656                         *ptr++ = (uuid16_list[i] & 0x00ff);
 657                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 658                 }
 659
 660                 /* EIR Data length */
 661                 *length = (i * sizeof(u16)) + 1;
 662         }
 663 }
 664
 665 static int update_eir(struct hci_dev *hdev)
 666 {
 667         struct hci_cp_write_eir cp;
 668
 669         if (!(hdev->features[6] & LMP_EXT_INQ))
 670                 return 0;
 671
 672         if (hdev->ssp_mode == 0)
 673                 return 0;
 674
 675         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 676                 return 0;
 677
 678         memset(&cp, 0, sizeof(cp));
 679
 680         create_eir(hdev, cp.data);
 681
 682         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 683                 return 0;
 684
 685         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 686
 687         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 688 }
 689
 690 static u8 get_service_classes(struct hci_dev *hdev)
 691 {
 692         struct bt_uuid *uuid;
 693         u8 val = 0;
 694
 695         list_for_each_entry(uuid, &hdev->uuids, list)
 696                 val |= uuid->svc_hint;
 697
 698         return val;
 699 }
 700
 701 static int update_class(struct hci_dev *hdev)
 702 {
 703         u8 cod[3];
 704
 705         BT_DBG("%s", hdev->name);
 706
 707         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 708                 return 0;
 709
 710         cod[0] = hdev->minor_class;
 711         cod[1] = hdev->major_class;
 712         cod[2] = get_service_classes(hdev);
 713
 714         if (memcmp(cod, hdev->dev_class, 3) == 0)
 715                 return 0;
 716
 717         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 718 }
 719
 720 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 721 {
 722         struct mgmt_cp_add_uuid *cp;
 723         struct hci_dev *hdev;
 724         struct bt_uuid *uuid;
 725         int err;
 726
 727         cp = (void *) data;
 728
 729         BT_DBG("request for hci%u", index);
 730
 731         if (len != sizeof(*cp))
 732                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 733
 734         hdev = hci_dev_get(index);
 735         if (!hdev)
 736                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 737
 738         hci_dev_lock_bh(hdev);
 739
 740         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 741         if (!uuid) {
 742                 err = -ENOMEM;
 743                 goto failed;
 744         }
 745
 746         memcpy(uuid->uuid, cp->uuid, 16);
 747         uuid->svc_hint = cp->svc_hint;
 748
 749         list_add(&uuid->list, &hdev->uuids);
 750
 751         err = update_class(hdev);
 752         if (err < 0)
 753                 goto failed;
 754
 755         err = update_eir(hdev);
 756         if (err < 0)
 757                 goto failed;
 758
 759         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 760
 761 failed:
 762         hci_dev_unlock_bh(hdev);
 763         hci_dev_put(hdev);
 764
 765         return err;
 766 }
 767
 768 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 769 {
 770         struct list_head *p, *n;
 771         struct mgmt_cp_remove_uuid *cp;
 772         struct hci_dev *hdev;
 773         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 774         int err, found;
 775
 776         cp = (void *) data;
 777
 778         BT_DBG("request for hci%u", index);
 779
 780         if (len != sizeof(*cp))
 781                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 782
 783         hdev = hci_dev_get(index);
 784         if (!hdev)
 785                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 786
 787         hci_dev_lock_bh(hdev);
 788
 789         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 790                 err = hci_uuids_clear(hdev);
 791                 goto unlock;
 792         }
 793
 794         found = 0;
 795
 796         list_for_each_safe(p, n, &hdev->uuids) {
 797                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 798
 799                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 800                         continue;
 801
 802                 list_del(&match->list);
 803                 found++;
 804         }
 805
 806         if (found == 0) {
 807                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 808                 goto unlock;
 809         }
 810
 811         err = update_class(hdev);
 812         if (err < 0)
 813                 goto unlock;
 814
 815         err = update_eir(hdev);
 816         if (err < 0)
 817                 goto unlock;
 818
 819         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 820
 821 unlock:
 822         hci_dev_unlock_bh(hdev);
 823         hci_dev_put(hdev);
 824
 825         return err;
 826 }
 827
 828 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 829                                                                         u16 len)
 830 {
 831         struct hci_dev *hdev;
 832         struct mgmt_cp_set_dev_class *cp;
 833         int err;
 834
 835         cp = (void *) data;
 836
 837         BT_DBG("request for hci%u", index);
 838
 839         if (len != sizeof(*cp))
 840                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 841
 842         hdev = hci_dev_get(index);
 843         if (!hdev)
 844                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 845
 846         hci_dev_lock_bh(hdev);
 847
 848         hdev->major_class = cp->major;
 849         hdev->minor_class = cp->minor;
 850
 851         err = update_class(hdev);
 852
 853         if (err == 0)
 854                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 855
 856         hci_dev_unlock_bh(hdev);
 857         hci_dev_put(hdev);
 858
 859         return err;
 860 }
 861
 862 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 863                                                                         u16 len)
 864 {
 865         struct hci_dev *hdev;
 866         struct mgmt_cp_set_service_cache *cp;
 867         int err;
 868
 869         cp = (void *) data;
 870
 871         if (len != sizeof(*cp))
 872                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 873
 874         hdev = hci_dev_get(index);
 875         if (!hdev)
 876                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 877
 878         hci_dev_lock_bh(hdev);
 879
 880         BT_DBG("hci%u enable %d", index, cp->enable);
 881
 882         if (cp->enable) {
 883                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 884                 err = 0;
 885         } else {
 886                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 887                 err = update_class(hdev);
 888                 if (err == 0)
 889                         err = update_eir(hdev);
 890         }
 891
 892         if (err == 0)
 893                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 894                                                                         0);
 895         else
 896                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 897
 898
 899         hci_dev_unlock_bh(hdev);
 900         hci_dev_put(hdev);
 901
 902         return err;
 903 }
 904
 905 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 906                                                                 u16 len)
 907 {
 908         struct hci_dev *hdev;
 909         struct mgmt_cp_load_link_keys *cp;
 910         u16 key_count, expected_len;
 911         int i;
 912
 913         cp = (void *) data;
 914
 915         if (len < sizeof(*cp))
 916                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 917
 918         key_count = get_unaligned_le16(&cp->key_count);
 919
 920         expected_len = sizeof(*cp) + key_count *
 921                                         sizeof(struct mgmt_link_key_info);
 922         if (expected_len != len) {
 923                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 924                                                         len, expected_len);
 925                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 926         }
 927
 928         hdev = hci_dev_get(index);
 929         if (!hdev)
 930                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 931
 932         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 933                                                                 key_count);
 934
 935         hci_dev_lock_bh(hdev);
 936
 937         hci_link_keys_clear(hdev);
 938
 939         set_bit(HCI_LINK_KEYS, &hdev->flags);
 940
 941         if (cp->debug_keys)
 942                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 943         else
 944                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 945
 946         for (i = 0; i < key_count; i++) {
 947                 struct mgmt_link_key_info *key = &cp->keys[i];
 948
 949                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 950                                                                 key->pin_len);
 951         }
 952
 953         hci_dev_unlock_bh(hdev);
 954         hci_dev_put(hdev);
 955
 956         return 0;
 957 }
 958
 959 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 960                                                                 u16 len)
 961 {
 962         struct hci_dev *hdev;
 963         struct mgmt_cp_remove_keys *cp;
 964         struct hci_conn *conn;
 965         int err;
 966
 967         cp = (void *) data;
 968
 969         if (len != sizeof(*cp))
 970                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 971
 972         hdev = hci_dev_get(index);
 973         if (!hdev)
 974                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 975
 976         hci_dev_lock_bh(hdev);
 977
 978         err = hci_remove_link_key(hdev, &cp->bdaddr);
 979         if (err < 0) {
 980                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 981                 goto unlock;
 982         }
 983
 984         err = 0;
 985
 986         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 987                 goto unlock;
 988
 989         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 990         if (conn) {
 991                 struct hci_cp_disconnect dc;
 992
 993                 put_unaligned_le16(conn->handle, &dc.handle);
 994                 dc.reason = 0x13; /* Remote User Terminated Connection */
 995                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
 996         }
 997
 998 unlock:
 999         hci_dev_unlock_bh(hdev);
1000         hci_dev_put(hdev);
1001
1002         return err;
1003 }
1004
1005 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1006 {
1007         struct hci_dev *hdev;
1008         struct mgmt_cp_disconnect *cp;
1009         struct hci_cp_disconnect dc;
1010         struct pending_cmd *cmd;
1011         struct hci_conn *conn;
1012         int err;
1013
1014         BT_DBG("");
1015
1016         cp = (void *) data;
1017
1018         if (len != sizeof(*cp))
1019                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1020
1021         hdev = hci_dev_get(index);
1022         if (!hdev)
1023                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1024
1025         hci_dev_lock_bh(hdev);
1026
1027         if (!test_bit(HCI_UP, &hdev->flags)) {
1028                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1029                 goto failed;
1030         }
1031
1032         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1033                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1034                 goto failed;
1035         }
1036
1037         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1038         if (!conn)
1039                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1040
1041         if (!conn) {
1042                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1043                 goto failed;
1044         }
1045
1046         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1047         if (!cmd) {
1048                 err = -ENOMEM;
1049                 goto failed;
1050         }
1051
1052         put_unaligned_le16(conn->handle, &dc.handle);
1053         dc.reason = 0x13; /* Remote User Terminated Connection */
1054
1055         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1056         if (err < 0)
1057                 mgmt_pending_remove(cmd);
1058
1059 failed:
1060         hci_dev_unlock_bh(hdev);
1061         hci_dev_put(hdev);
1062
1063         return err;
1064 }
1065
1066 static u8 link_to_mgmt(u8 link_type)
1067 {
1068         switch (link_type) {
1069         case LE_LINK:
1070                 return MGMT_ADDR_LE;
1071         case ACL_LINK:
1072                 return MGMT_ADDR_BREDR;
1073         default:
1074                 return MGMT_ADDR_INVALID;
1075         }
1076 }
1077
1078 static int get_connections(struct sock *sk, u16 index)
1079 {
1080         struct mgmt_rp_get_connections *rp;
1081         struct hci_dev *hdev;
1082         struct hci_conn *c;
1083         struct list_head *p;
1084         size_t rp_len;
1085         u16 count;
1086         int i, err;
1087
1088         BT_DBG("");
1089
1090         hdev = hci_dev_get(index);
1091         if (!hdev)
1092                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1093
1094         hci_dev_lock_bh(hdev);
1095
1096         count = 0;
1097         list_for_each(p, &hdev->conn_hash.list) {
1098                 count++;
1099         }
1100
1101         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1102         rp = kmalloc(rp_len, GFP_ATOMIC);
1103         if (!rp) {
1104                 err = -ENOMEM;
1105                 goto unlock;
1106         }
1107
1108         put_unaligned_le16(count, &rp->conn_count);
1109
1110         i = 0;
1111         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1112                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1113                 rp->addr[i].type = link_to_mgmt(c->type);
1114                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1115                         continue;
1116                 i++;
1117         }
1118
1119         /* Recalculate length in case of filtered SCO connections, etc */
1120         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1121
1122         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1123
1124 unlock:
1125         kfree(rp);
1126         hci_dev_unlock_bh(hdev);
1127         hci_dev_put(hdev);
1128         return err;
1129 }
1130
1131 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1132                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1133 {
1134         struct pending_cmd *cmd;
1135         int err;
1136
1137         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1138                                                                 sizeof(*cp));
1139         if (!cmd)
1140                 return -ENOMEM;
1141
1142         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1143                                                                 &cp->bdaddr);
1144         if (err < 0)
1145                 mgmt_pending_remove(cmd);
1146
1147         return err;
1148 }
1149
1150 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1151                                                                         u16 len)
1152 {
1153         struct hci_dev *hdev;
1154         struct hci_conn *conn;
1155         struct mgmt_cp_pin_code_reply *cp;
1156         struct mgmt_cp_pin_code_neg_reply ncp;
1157         struct hci_cp_pin_code_reply reply;
1158         struct pending_cmd *cmd;
1159         int err;
1160
1161         BT_DBG("");
1162
1163         cp = (void *) data;
1164
1165         if (len != sizeof(*cp))
1166                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1167
1168         hdev = hci_dev_get(index);
1169         if (!hdev)
1170                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1171
1172         hci_dev_lock_bh(hdev);
1173
1174         if (!test_bit(HCI_UP, &hdev->flags)) {
1175                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1176                 goto failed;
1177         }
1178
1179         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1180         if (!conn) {
1181                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1182                 goto failed;
1183         }
1184
1185         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1186                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1187
1188                 BT_ERR("PIN code is not 16 bytes long");
1189
1190                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1191                 if (err >= 0)
1192                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1193                                                                 EINVAL);
1194
1195                 goto failed;
1196         }
1197
1198         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1199         if (!cmd) {
1200                 err = -ENOMEM;
1201                 goto failed;
1202         }
1203
1204         bacpy(&reply.bdaddr, &cp->bdaddr);
1205         reply.pin_len = cp->pin_len;
1206         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1207
1208         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1209         if (err < 0)
1210                 mgmt_pending_remove(cmd);
1211
1212 failed:
1213         hci_dev_unlock_bh(hdev);
1214         hci_dev_put(hdev);
1215
1216         return err;
1217 }
1218
1219 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1220                                                                         u16 len)
1221 {
1222         struct hci_dev *hdev;
1223         struct mgmt_cp_pin_code_neg_reply *cp;
1224         int err;
1225
1226         BT_DBG("");
1227
1228         cp = (void *) data;
1229
1230         if (len != sizeof(*cp))
1231                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1232                                                                         EINVAL);
1233
1234         hdev = hci_dev_get(index);
1235         if (!hdev)
1236                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1237                                                                         ENODEV);
1238
1239         hci_dev_lock_bh(hdev);
1240
1241         if (!test_bit(HCI_UP, &hdev->flags)) {
1242                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1243                                                                 ENETDOWN);
1244                 goto failed;
1245         }
1246
1247         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1248
1249 failed:
1250         hci_dev_unlock_bh(hdev);
1251         hci_dev_put(hdev);
1252
1253         return err;
1254 }
1255
1256 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1257                                                                         u16 len)
1258 {
1259         struct hci_dev *hdev;
1260         struct mgmt_cp_set_io_capability *cp;
1261
1262         BT_DBG("");
1263
1264         cp = (void *) data;
1265
1266         if (len != sizeof(*cp))
1267                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1268
1269         hdev = hci_dev_get(index);
1270         if (!hdev)
1271                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1272
1273         hci_dev_lock_bh(hdev);
1274
1275         hdev->io_capability = cp->io_capability;
1276
1277         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1278                                                         hdev->io_capability);
1279
1280         hci_dev_unlock_bh(hdev);
1281         hci_dev_put(hdev);
1282
1283         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1284 }
1285
1286 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1287 {
1288         struct hci_dev *hdev = conn->hdev;
1289         struct pending_cmd *cmd;
1290
1291         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1292                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1293                         continue;
1294
1295                 if (cmd->user_data != conn)
1296                         continue;
1297
1298                 return cmd;
1299         }
1300
1301         return NULL;
1302 }
1303
1304 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1305 {
1306         struct mgmt_rp_pair_device rp;
1307         struct hci_conn *conn = cmd->user_data;
1308
1309         bacpy(&rp.bdaddr, &conn->dst);
1310         rp.status = status;
1311
1312         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1313
1314         /* So we don't get further callbacks for this connection */
1315         conn->connect_cfm_cb = NULL;
1316         conn->security_cfm_cb = NULL;
1317         conn->disconn_cfm_cb = NULL;
1318
1319         hci_conn_put(conn);
1320
1321         mgmt_pending_remove(cmd);
1322 }
1323
1324 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1325 {
1326         struct pending_cmd *cmd;
1327         struct hci_dev *hdev = conn->hdev;
1328
1329         BT_DBG("status %u", status);
1330
1331         hci_dev_lock_bh(hdev);
1332
1333         cmd = find_pairing(conn);
1334         if (!cmd)
1335                 BT_DBG("Unable to find a pending command");
1336         else
1337                 pairing_complete(cmd, status);
1338
1339         hci_dev_unlock_bh(hdev);
1340 }
1341
1342 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1343 {
1344         struct hci_dev *hdev;
1345         struct mgmt_cp_pair_device *cp;
1346         struct pending_cmd *cmd;
1347         struct adv_entry *entry;
1348         u8 sec_level, auth_type;
1349         struct hci_conn *conn;
1350         int err;
1351
1352         BT_DBG("");
1353
1354         cp = (void *) data;
1355
1356         if (len != sizeof(*cp))
1357                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1358
1359         hdev = hci_dev_get(index);
1360         if (!hdev)
1361                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1362
1363         hci_dev_lock_bh(hdev);
1364
1365         sec_level = BT_SECURITY_MEDIUM;
1366         if (cp->io_cap == 0x03)
1367                 auth_type = HCI_AT_DEDICATED_BONDING;
1368         else
1369                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1370
1371         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1372         if (entry)
1373                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1374                                                                 auth_type);
1375         else
1376                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1377                                                                 auth_type);
1378
1379         if (IS_ERR(conn)) {
1380                 err = PTR_ERR(conn);
1381                 goto unlock;
1382         }
1383
1384         if (conn->connect_cfm_cb) {
1385                 hci_conn_put(conn);
1386                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1387                 goto unlock;
1388         }
1389
1390         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1391         if (!cmd) {
1392                 err = -ENOMEM;
1393                 hci_conn_put(conn);
1394                 goto unlock;
1395         }
1396
1397         /* For LE, just connecting isn't a proof that the pairing finished */
1398         if (!entry)
1399                 conn->connect_cfm_cb = pairing_complete_cb;
1400
1401         conn->security_cfm_cb = pairing_complete_cb;
1402         conn->disconn_cfm_cb = pairing_complete_cb;
1403         conn->io_capability = cp->io_cap;
1404         cmd->user_data = conn;
1405
1406         if (conn->state == BT_CONNECTED &&
1407                                 hci_conn_security(conn, sec_level, auth_type))
1408                 pairing_complete(cmd, 0);
1409
1410         err = 0;
1411
1412 unlock:
1413         hci_dev_unlock_bh(hdev);
1414         hci_dev_put(hdev);
1415
1416         return err;
1417 }
1418
1419 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1420                                                         u16 len, int success)
1421 {
1422         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1423         u16 mgmt_op, hci_op;
1424         struct pending_cmd *cmd;
1425         struct hci_dev *hdev;
1426         int err;
1427
1428         BT_DBG("");
1429
1430         if (success) {
1431                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1432                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1433         } else {
1434                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1435                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1436         }
1437
1438         if (len != sizeof(*cp))
1439                 return cmd_status(sk, index, mgmt_op, EINVAL);
1440
1441         hdev = hci_dev_get(index);
1442         if (!hdev)
1443                 return cmd_status(sk, index, mgmt_op, ENODEV);
1444
1445         hci_dev_lock_bh(hdev);
1446
1447         if (!test_bit(HCI_UP, &hdev->flags)) {
1448                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1449                 goto failed;
1450         }
1451
1452         cmd = mgmt_pending_add(sk, mgmt_op, hdev, data, len);
1453         if (!cmd) {
1454                 err = -ENOMEM;
1455                 goto failed;
1456         }
1457
1458         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1459         if (err < 0)
1460                 mgmt_pending_remove(cmd);
1461
1462 failed:
1463         hci_dev_unlock_bh(hdev);
1464         hci_dev_put(hdev);
1465
1466         return err;
1467 }
1468
1469 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1470                                                                 u16 len)
1471 {
1472         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1473         struct hci_cp_write_local_name hci_cp;
1474         struct hci_dev *hdev;
1475         struct pending_cmd *cmd;
1476         int err;
1477
1478         BT_DBG("");
1479
1480         if (len != sizeof(*mgmt_cp))
1481                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1482
1483         hdev = hci_dev_get(index);
1484         if (!hdev)
1485                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1486
1487         hci_dev_lock_bh(hdev);
1488
1489         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1490         if (!cmd) {
1491                 err = -ENOMEM;
1492                 goto failed;
1493         }
1494
1495         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1496         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1497                                                                 &hci_cp);
1498         if (err < 0)
1499                 mgmt_pending_remove(cmd);
1500
1501 failed:
1502         hci_dev_unlock_bh(hdev);
1503         hci_dev_put(hdev);
1504
1505         return err;
1506 }
1507
1508 static int read_local_oob_data(struct sock *sk, u16 index)
1509 {
1510         struct hci_dev *hdev;
1511         struct pending_cmd *cmd;
1512         int err;
1513
1514         BT_DBG("hci%u", index);
1515
1516         hdev = hci_dev_get(index);
1517         if (!hdev)
1518                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1519                                                                         ENODEV);
1520
1521         hci_dev_lock_bh(hdev);
1522
1523         if (!test_bit(HCI_UP, &hdev->flags)) {
1524                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1525                                                                 ENETDOWN);
1526                 goto unlock;
1527         }
1528
1529         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1530                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1531                                                                 EOPNOTSUPP);
1532                 goto unlock;
1533         }
1534
1535         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1536                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1537                 goto unlock;
1538         }
1539
1540         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1541         if (!cmd) {
1542                 err = -ENOMEM;
1543                 goto unlock;
1544         }
1545
1546         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1547         if (err < 0)
1548                 mgmt_pending_remove(cmd);
1549
1550 unlock:
1551         hci_dev_unlock_bh(hdev);
1552         hci_dev_put(hdev);
1553
1554         return err;
1555 }
1556
1557 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1558                                                                         u16 len)
1559 {
1560         struct hci_dev *hdev;
1561         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1562         int err;
1563
1564         BT_DBG("hci%u ", index);
1565
1566         if (len != sizeof(*cp))
1567                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1568                                                                         EINVAL);
1569
1570         hdev = hci_dev_get(index);
1571         if (!hdev)
1572                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1573                                                                         ENODEV);
1574
1575         hci_dev_lock_bh(hdev);
1576
1577         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1578                                                                 cp->randomizer);
1579         if (err < 0)
1580                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1581         else
1582                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1583                                                                         0);
1584
1585         hci_dev_unlock_bh(hdev);
1586         hci_dev_put(hdev);
1587
1588         return err;
1589 }
1590
1591 static int remove_remote_oob_data(struct sock *sk, u16 index,
1592                                                 unsigned char *data, u16 len)
1593 {
1594         struct hci_dev *hdev;
1595         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1596         int err;
1597
1598         BT_DBG("hci%u ", index);
1599
1600         if (len != sizeof(*cp))
1601                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1602                                                                         EINVAL);
1603
1604         hdev = hci_dev_get(index);
1605         if (!hdev)
1606                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1607                                                                         ENODEV);
1608
1609         hci_dev_lock_bh(hdev);
1610
1611         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1612         if (err < 0)
1613                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1614                                                                         -err);
1615         else
1616                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1617                                                                 NULL, 0);
1618
1619         hci_dev_unlock_bh(hdev);
1620         hci_dev_put(hdev);
1621
1622         return err;
1623 }
1624
1625 static int start_discovery(struct sock *sk, u16 index)
1626 {
1627         struct pending_cmd *cmd;
1628         struct hci_dev *hdev;
1629         int err;
1630
1631         BT_DBG("hci%u", index);
1632
1633         hdev = hci_dev_get(index);
1634         if (!hdev)
1635                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1636
1637         hci_dev_lock_bh(hdev);
1638
1639         if (!test_bit(HCI_UP, &hdev->flags)) {
1640                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1641                 goto failed;
1642         }
1643
1644         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1645         if (!cmd) {
1646                 err = -ENOMEM;
1647                 goto failed;
1648         }
1649
1650         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1651         if (err < 0)
1652                 mgmt_pending_remove(cmd);
1653
1654 failed:
1655         hci_dev_unlock_bh(hdev);
1656         hci_dev_put(hdev);
1657
1658         return err;
1659 }
1660
1661 static int stop_discovery(struct sock *sk, u16 index)
1662 {
1663         struct hci_dev *hdev;
1664         struct pending_cmd *cmd;
1665         int err;
1666
1667         BT_DBG("hci%u", index);
1668
1669         hdev = hci_dev_get(index);
1670         if (!hdev)
1671                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1672
1673         hci_dev_lock_bh(hdev);
1674
1675         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1676         if (!cmd) {
1677                 err = -ENOMEM;
1678                 goto failed;
1679         }
1680
1681         err = hci_cancel_inquiry(hdev);
1682         if (err < 0)
1683                 mgmt_pending_remove(cmd);
1684
1685 failed:
1686         hci_dev_unlock_bh(hdev);
1687         hci_dev_put(hdev);
1688
1689         return err;
1690 }
1691
1692 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1693                                                                 u16 len)
1694 {
1695         struct hci_dev *hdev;
1696         struct mgmt_cp_block_device *cp = (void *) data;
1697         int err;
1698
1699         BT_DBG("hci%u", index);
1700
1701         if (len != sizeof(*cp))
1702                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1703                                                         EINVAL);
1704
1705         hdev = hci_dev_get(index);
1706         if (!hdev)
1707                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1708                                                         ENODEV);
1709
1710         hci_dev_lock_bh(hdev);
1711
1712         err = hci_blacklist_add(hdev, &cp->bdaddr);
1713         if (err < 0)
1714                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1715         else
1716                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1717                                                         NULL, 0);
1718
1719         hci_dev_unlock_bh(hdev);
1720         hci_dev_put(hdev);
1721
1722         return err;
1723 }
1724
1725 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1726                                                                 u16 len)
1727 {
1728         struct hci_dev *hdev;
1729         struct mgmt_cp_unblock_device *cp = (void *) data;
1730         int err;
1731
1732         BT_DBG("hci%u", index);
1733
1734         if (len != sizeof(*cp))
1735                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1736                                                                 EINVAL);
1737
1738         hdev = hci_dev_get(index);
1739         if (!hdev)
1740                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1741                                                                 ENODEV);
1742
1743         hci_dev_lock_bh(hdev);
1744
1745         err = hci_blacklist_del(hdev, &cp->bdaddr);
1746
1747         if (err < 0)
1748                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1749         else
1750                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1751                                                                 NULL, 0);
1752
1753         hci_dev_unlock_bh(hdev);
1754         hci_dev_put(hdev);
1755
1756         return err;
1757 }
1758
1759 static int set_fast_connectable(struct sock *sk, u16 index,
1760                                         unsigned char *data, u16 len)
1761 {
1762         struct hci_dev *hdev;
1763         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1764         struct hci_cp_write_page_scan_activity acp;
1765         u8 type;
1766         int err;
1767
1768         BT_DBG("hci%u", index);
1769
1770         if (len != sizeof(*cp))
1771                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1772                                                                 EINVAL);
1773
1774         hdev = hci_dev_get(index);
1775         if (!hdev)
1776                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1777                                                                 ENODEV);
1778
1779         hci_dev_lock(hdev);
1780
1781         if (cp->enable) {
1782                 type = PAGE_SCAN_TYPE_INTERLACED;
1783                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1784         } else {
1785                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1786                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1787         }
1788
1789         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1790
1791         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1792                                                 sizeof(acp), &acp);
1793         if (err < 0) {
1794                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1795                                                                 -err);
1796                 goto done;
1797         }
1798
1799         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1800         if (err < 0) {
1801                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1802                                                                 -err);
1803                 goto done;
1804         }
1805
1806         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1807                                                         NULL, 0);
1808 done:
1809         hci_dev_unlock(hdev);
1810         hci_dev_put(hdev);
1811
1812         return err;
1813 }
1814
1815 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1816 {
1817         unsigned char *buf;
1818         struct mgmt_hdr *hdr;
1819         u16 opcode, index, len;
1820         int err;
1821
1822         BT_DBG("got %zu bytes", msglen);
1823
1824         if (msglen < sizeof(*hdr))
1825                 return -EINVAL;
1826
1827         buf = kmalloc(msglen, GFP_KERNEL);
1828         if (!buf)
1829                 return -ENOMEM;
1830
1831         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1832                 err = -EFAULT;
1833                 goto done;
1834         }
1835
1836         hdr = (struct mgmt_hdr *) buf;
1837         opcode = get_unaligned_le16(&hdr->opcode);
1838         index = get_unaligned_le16(&hdr->index);
1839         len = get_unaligned_le16(&hdr->len);
1840
1841         if (len != msglen - sizeof(*hdr)) {
1842                 err = -EINVAL;
1843                 goto done;
1844         }
1845
1846         switch (opcode) {
1847         case MGMT_OP_READ_VERSION:
1848                 err = read_version(sk);
1849                 break;
1850         case MGMT_OP_READ_INDEX_LIST:
1851                 err = read_index_list(sk);
1852                 break;
1853         case MGMT_OP_READ_INFO:
1854                 err = read_controller_info(sk, index);
1855                 break;
1856         case MGMT_OP_SET_POWERED:
1857                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1858                 break;
1859         case MGMT_OP_SET_DISCOVERABLE:
1860                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1861                 break;
1862         case MGMT_OP_SET_CONNECTABLE:
1863                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1864                 break;
1865         case MGMT_OP_SET_PAIRABLE:
1866                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1867                 break;
1868         case MGMT_OP_ADD_UUID:
1869                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1870                 break;
1871         case MGMT_OP_REMOVE_UUID:
1872                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1873                 break;
1874         case MGMT_OP_SET_DEV_CLASS:
1875                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1876                 break;
1877         case MGMT_OP_SET_SERVICE_CACHE:
1878                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1879                 break;
1880         case MGMT_OP_LOAD_LINK_KEYS:
1881                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1882                 break;
1883         case MGMT_OP_REMOVE_KEYS:
1884                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1885                 break;
1886         case MGMT_OP_DISCONNECT:
1887                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1888                 break;
1889         case MGMT_OP_GET_CONNECTIONS:
1890                 err = get_connections(sk, index);
1891                 break;
1892         case MGMT_OP_PIN_CODE_REPLY:
1893                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1894                 break;
1895         case MGMT_OP_PIN_CODE_NEG_REPLY:
1896                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1897                 break;
1898         case MGMT_OP_SET_IO_CAPABILITY:
1899                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1900                 break;
1901         case MGMT_OP_PAIR_DEVICE:
1902                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1903                 break;
1904         case MGMT_OP_USER_CONFIRM_REPLY:
1905                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1906                 break;
1907         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1908                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1909                 break;
1910         case MGMT_OP_SET_LOCAL_NAME:
1911                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1912                 break;
1913         case MGMT_OP_READ_LOCAL_OOB_DATA:
1914                 err = read_local_oob_data(sk, index);
1915                 break;
1916         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1917                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1918                 break;
1919         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1920                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1921                                                                         len);
1922                 break;
1923         case MGMT_OP_START_DISCOVERY:
1924                 err = start_discovery(sk, index);
1925                 break;
1926         case MGMT_OP_STOP_DISCOVERY:
1927                 err = stop_discovery(sk, index);
1928                 break;
1929         case MGMT_OP_BLOCK_DEVICE:
1930                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1931                 break;
1932         case MGMT_OP_UNBLOCK_DEVICE:
1933                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1934                 break;
1935         case MGMT_OP_SET_FAST_CONNECTABLE:
1936                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1937                                                                 len);
1938                 break;
1939         default:
1940                 BT_DBG("Unknown op %u", opcode);
1941                 err = cmd_status(sk, index, opcode, 0x01);
1942                 break;
1943         }
1944
1945         if (err < 0)
1946                 goto done;
1947
1948         err = msglen;
1949
1950 done:
1951         kfree(buf);
1952         return err;
1953 }
1954
1955 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1956 {
1957         u8 *status = data;
1958
1959         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1960         mgmt_pending_remove(cmd);
1961 }
1962
1963 int mgmt_index_added(struct hci_dev *hdev)
1964 {
1965         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
1966 }
1967
1968 int mgmt_index_removed(struct hci_dev *hdev)
1969 {
1970         u8 status = ENODEV;
1971
1972         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
1973
1974         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
1975 }
1976
1977 struct cmd_lookup {
1978         u8 val;
1979         struct sock *sk;
1980 };
1981
1982 static void mode_rsp(struct pending_cmd *cmd, void *data)
1983 {
1984         struct mgmt_mode *cp = cmd->param;
1985         struct cmd_lookup *match = data;
1986
1987         if (cp->val != match->val)
1988                 return;
1989
1990         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1991
1992         list_del(&cmd->list);
1993
1994         if (match->sk == NULL) {
1995                 match->sk = cmd->sk;
1996                 sock_hold(match->sk);
1997         }
1998
1999         mgmt_pending_free(cmd);
2000 }
2001
2002 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2003 {
2004         struct mgmt_mode ev;
2005         struct cmd_lookup match = { powered, NULL };
2006         int ret;
2007
2008         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2009
2010         if (!powered) {
2011                 u8 status = ENETDOWN;
2012                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2013         }
2014
2015         ev.val = powered;
2016
2017         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2018
2019         if (match.sk)
2020                 sock_put(match.sk);
2021
2022         return ret;
2023 }
2024
2025 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2026 {
2027         struct mgmt_mode ev;
2028         struct cmd_lookup match = { discoverable, NULL };
2029         int ret;
2030
2031         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2032
2033         ev.val = discoverable;
2034
2035         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2036                                                                 match.sk);
2037
2038         if (match.sk)
2039                 sock_put(match.sk);
2040
2041         return ret;
2042 }
2043
2044 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2045 {
2046         struct mgmt_mode ev;
2047         struct cmd_lookup match = { connectable, NULL };
2048         int ret;
2049
2050         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2051
2052         ev.val = connectable;
2053
2054         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2055
2056         if (match.sk)
2057                 sock_put(match.sk);
2058
2059         return ret;
2060 }
2061
2062 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2063 {
2064         if (scan & SCAN_PAGE)
2065                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2066                                                 cmd_status_rsp, &status);
2067
2068         if (scan & SCAN_INQUIRY)
2069                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2070                                                 cmd_status_rsp, &status);
2071
2072         return 0;
2073 }
2074
2075 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2076                                                                 u8 persistent)
2077 {
2078         struct mgmt_ev_new_link_key ev;
2079
2080         memset(&ev, 0, sizeof(ev));
2081
2082         ev.store_hint = persistent;
2083         bacpy(&ev.key.bdaddr, &key->bdaddr);
2084         ev.key.type = key->type;
2085         memcpy(ev.key.val, key->val, 16);
2086         ev.key.pin_len = key->pin_len;
2087
2088         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2089 }
2090
2091 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type)
2092 {
2093         struct mgmt_addr_info ev;
2094
2095         bacpy(&ev.bdaddr, bdaddr);
2096         ev.type = link_to_mgmt(link_type);
2097
2098         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2099 }
2100
2101 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2102 {
2103         struct mgmt_cp_disconnect *cp = cmd->param;
2104         struct sock **sk = data;
2105         struct mgmt_rp_disconnect rp;
2106
2107         bacpy(&rp.bdaddr, &cp->bdaddr);
2108
2109         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2110
2111         *sk = cmd->sk;
2112         sock_hold(*sk);
2113
2114         mgmt_pending_remove(cmd);
2115 }
2116
2117 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2118 {
2119         struct mgmt_addr_info ev;
2120         struct sock *sk = NULL;
2121         int err;
2122
2123         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2124
2125         bacpy(&ev.bdaddr, bdaddr);
2126         ev.type = link_to_mgmt(type);
2127
2128         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2129
2130         if (sk)
2131                 sock_put(sk);
2132
2133         return err;
2134 }
2135
2136 int mgmt_disconnect_failed(struct hci_dev *hdev)
2137 {
2138         struct pending_cmd *cmd;
2139         int err;
2140
2141         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2142         if (!cmd)
2143                 return -ENOENT;
2144
2145         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT, EIO);
2146
2147         mgmt_pending_remove(cmd);
2148
2149         return err;
2150 }
2151
2152 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2153                                                                 u8 status)
2154 {
2155         struct mgmt_ev_connect_failed ev;
2156
2157         bacpy(&ev.addr.bdaddr, bdaddr);
2158         ev.addr.type = link_to_mgmt(type);
2159         ev.status = status;
2160
2161         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2162 }
2163
2164 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2165 {
2166         struct mgmt_ev_pin_code_request ev;
2167
2168         bacpy(&ev.bdaddr, bdaddr);
2169         ev.secure = secure;
2170
2171         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2172                                                                         NULL);
2173 }
2174
2175 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2176                                                                 u8 status)
2177 {
2178         struct pending_cmd *cmd;
2179         struct mgmt_rp_pin_code_reply rp;
2180         int err;
2181
2182         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2183         if (!cmd)
2184                 return -ENOENT;
2185
2186         bacpy(&rp.bdaddr, bdaddr);
2187         rp.status = status;
2188
2189         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2190                                                                 sizeof(rp));
2191
2192         mgmt_pending_remove(cmd);
2193
2194         return err;
2195 }
2196
2197 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2198                                                                 u8 status)
2199 {
2200         struct pending_cmd *cmd;
2201         struct mgmt_rp_pin_code_reply rp;
2202         int err;
2203
2204         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2205         if (!cmd)
2206                 return -ENOENT;
2207
2208         bacpy(&rp.bdaddr, bdaddr);
2209         rp.status = status;
2210
2211         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2212                                                                 sizeof(rp));
2213
2214         mgmt_pending_remove(cmd);
2215
2216         return err;
2217 }
2218
2219 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2220                                                 __le32 value, u8 confirm_hint)
2221 {
2222         struct mgmt_ev_user_confirm_request ev;
2223
2224         BT_DBG("%s", hdev->name);
2225
2226         bacpy(&ev.bdaddr, bdaddr);
2227         ev.confirm_hint = confirm_hint;
2228         put_unaligned_le32(value, &ev.value);
2229
2230         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2231                                                                         NULL);
2232 }
2233
2234 static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2235                                                         u8 status, u8 opcode)
2236 {
2237         struct pending_cmd *cmd;
2238         struct mgmt_rp_user_confirm_reply rp;
2239         int err;
2240
2241         cmd = mgmt_pending_find(opcode, hdev);
2242         if (!cmd)
2243                 return -ENOENT;
2244
2245         bacpy(&rp.bdaddr, bdaddr);
2246         rp.status = status;
2247         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2248
2249         mgmt_pending_remove(cmd);
2250
2251         return err;
2252 }
2253
2254 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2255                                                                 u8 status)
2256 {
2257         return confirm_reply_complete(hdev, bdaddr, status,
2258                                                 MGMT_OP_USER_CONFIRM_REPLY);
2259 }
2260
2261 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2262                                                 bdaddr_t *bdaddr, u8 status)
2263 {
2264         return confirm_reply_complete(hdev, bdaddr, status,
2265                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2266 }
2267
2268 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2269 {
2270         struct mgmt_ev_auth_failed ev;
2271
2272         bacpy(&ev.bdaddr, bdaddr);
2273         ev.status = status;
2274
2275         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2276 }
2277
2278 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2279 {
2280         struct pending_cmd *cmd;
2281         struct mgmt_cp_set_local_name ev;
2282         int err;
2283
2284         memset(&ev, 0, sizeof(ev));
2285         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2286
2287         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2288         if (!cmd)
2289                 goto send_event;
2290
2291         if (status) {
2292                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2293                                                                         EIO);
2294                 goto failed;
2295         }
2296
2297         update_eir(hdev);
2298
2299         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2300                                                                 sizeof(ev));
2301         if (err < 0)
2302                 goto failed;
2303
2304 send_event:
2305         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2306                                                         cmd ? cmd->sk : NULL);
2307
2308 failed:
2309         if (cmd)
2310                 mgmt_pending_remove(cmd);
2311         return err;
2312 }
2313
2314 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2315                                                 u8 *randomizer, u8 status)
2316 {
2317         struct pending_cmd *cmd;
2318         int err;
2319
2320         BT_DBG("%s status %u", hdev->name, status);
2321
2322         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2323         if (!cmd)
2324                 return -ENOENT;
2325
2326         if (status) {
2327                 err = cmd_status(cmd->sk, hdev->id,
2328                                         MGMT_OP_READ_LOCAL_OOB_DATA, EIO);
2329         } else {
2330                 struct mgmt_rp_read_local_oob_data rp;
2331
2332                 memcpy(rp.hash, hash, sizeof(rp.hash));
2333                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2334
2335                 err = cmd_complete(cmd->sk, hdev->id,
2336                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2337                                                 &rp, sizeof(rp));
2338         }
2339
2340         mgmt_pending_remove(cmd);
2341
2342         return err;
2343 }
2344
2345 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2346                                         u8 *dev_class, s8 rssi, u8 *eir)
2347 {
2348         struct mgmt_ev_device_found ev;
2349
2350         memset(&ev, 0, sizeof(ev));
2351
2352         bacpy(&ev.addr.bdaddr, bdaddr);
2353         ev.addr.type = link_to_mgmt(type);
2354         ev.rssi = rssi;
2355
2356         if (eir)
2357                 memcpy(ev.eir, eir, sizeof(ev.eir));
2358
2359         if (dev_class)
2360                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2361
2362         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2363 }
2364
2365 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2366 {
2367         struct mgmt_ev_remote_name ev;
2368
2369         memset(&ev, 0, sizeof(ev));
2370
2371         bacpy(&ev.bdaddr, bdaddr);
2372         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2373
2374         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2375 }
2376
2377 int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status)
2378 {
2379         struct pending_cmd *cmd;
2380         int err;
2381
2382         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2383         if (!cmd)
2384                 return -ENOENT;
2385
2386         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2387         mgmt_pending_remove(cmd);
2388
2389         return err;
2390 }
2391
2392 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2393 {
2394         struct pending_cmd *cmd;
2395
2396         if (discovering)
2397                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2398         else
2399                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2400
2401         if (cmd != NULL) {
2402                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2403                 mgmt_pending_remove(cmd);
2404         }
2405
2406         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2407                                                 sizeof(discovering), NULL);
2408 }
2409
2410 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2411 {
2412         struct pending_cmd *cmd;
2413         struct mgmt_ev_device_blocked ev;
2414
2415         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2416
2417         bacpy(&ev.bdaddr, bdaddr);
2418
2419         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2420                                                         cmd ? cmd->sk : NULL);
2421 }
2422
2423 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2424 {
2425         struct pending_cmd *cmd;
2426         struct mgmt_ev_device_unblocked ev;
2427
2428         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2429
2430         bacpy(&ev.bdaddr, bdaddr);
2431
2432         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2433                                                         cmd ? cmd->sk : NULL);
2434 }