net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         __u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static LIST_HEAD(cmd_list);
  47
  48 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  49 {
  50         struct sk_buff *skb;
  51         struct mgmt_hdr *hdr;
  52         struct mgmt_ev_cmd_status *ev;
  53         int err;
  54
  55         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  56
  57         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  58         if (!skb)
  59                 return -ENOMEM;
  60
  61         hdr = (void *) skb_put(skb, sizeof(*hdr));
  62
  63         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  64         hdr->index = cpu_to_le16(index);
  65         hdr->len = cpu_to_le16(sizeof(*ev));
  66
  67         ev = (void *) skb_put(skb, sizeof(*ev));
  68         ev->status = status;
  69         put_unaligned_le16(cmd, &ev->opcode);
  70
  71         err = sock_queue_rcv_skb(sk, skb);
  72         if (err < 0)
  73                 kfree_skb(skb);
  74
  75         return err;
  76 }
  77
  78 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  79                                                                 size_t rp_len)
  80 {
  81         struct sk_buff *skb;
  82         struct mgmt_hdr *hdr;
  83         struct mgmt_ev_cmd_complete *ev;
  84         int err;
  85
  86         BT_DBG("sock %p", sk);
  87
  88         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  89         if (!skb)
  90                 return -ENOMEM;
  91
  92         hdr = (void *) skb_put(skb, sizeof(*hdr));
  93
  94         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  95         hdr->index = cpu_to_le16(index);
  96         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  97
  98         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  99         put_unaligned_le16(cmd, &ev->opcode);
 100
 101         if (rp)
 102                 memcpy(ev->data, rp, rp_len);
 103
 104         err = sock_queue_rcv_skb(sk, skb);
 105         if (err < 0)
 106                 kfree_skb(skb);
 107
 108         return err;;
 109 }
 110
 111 static int read_version(struct sock *sk)
 112 {
 113         struct mgmt_rp_read_version rp;
 114
 115         BT_DBG("sock %p", sk);
 116
 117         rp.version = MGMT_VERSION;
 118         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 119
 120         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 121                                                                 sizeof(rp));
 122 }
 123
 124 static int read_index_list(struct sock *sk)
 125 {
 126         struct mgmt_rp_read_index_list *rp;
 127         struct list_head *p;
 128         struct hci_dev *d;
 129         size_t rp_len;
 130         u16 count;
 131         int i, err;
 132
 133         BT_DBG("sock %p", sk);
 134
 135         read_lock(&hci_dev_list_lock);
 136
 137         count = 0;
 138         list_for_each(p, &hci_dev_list) {
 139                 count++;
 140         }
 141
 142         rp_len = sizeof(*rp) + (2 * count);
 143         rp = kmalloc(rp_len, GFP_ATOMIC);
 144         if (!rp) {
 145                 read_unlock(&hci_dev_list_lock);
 146                 return -ENOMEM;
 147         }
 148
 149         put_unaligned_le16(count, &rp->num_controllers);
 150
 151         i = 0;
 152         list_for_each_entry(d, &hci_dev_list, list) {
 153                 hci_del_off_timer(d);
 154
 155                 if (test_bit(HCI_SETUP, &d->flags))
 156                         continue;
 157
 158                 put_unaligned_le16(d->id, &rp->index[i++]);
 159                 BT_DBG("Added hci%u", d->id);
 160         }
 161
 162         read_unlock(&hci_dev_list_lock);
 163
 164         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 165                                                                         rp_len);
 166
 167         kfree(rp);
 168
 169         return err;
 170 }
 171
 172 static int read_controller_info(struct sock *sk, u16 index)
 173 {
 174         struct mgmt_rp_read_info rp;
 175         struct hci_dev *hdev;
 176
 177         BT_DBG("sock %p hci%u", sk, index);
 178
 179         hdev = hci_dev_get(index);
 180         if (!hdev)
 181                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 182
 183         hci_del_off_timer(hdev);
 184
 185         hci_dev_lock_bh(hdev);
 186
 187         set_bit(HCI_MGMT, &hdev->flags);
 188
 189         memset(&rp, 0, sizeof(rp));
 190
 191         rp.type = hdev->dev_type;
 192
 193         rp.powered = test_bit(HCI_UP, &hdev->flags);
 194         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 195         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 196         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 197
 198         if (test_bit(HCI_AUTH, &hdev->flags))
 199                 rp.sec_mode = 3;
 200         else if (hdev->ssp_mode > 0)
 201                 rp.sec_mode = 4;
 202         else
 203                 rp.sec_mode = 2;
 204
 205         bacpy(&rp.bdaddr, &hdev->bdaddr);
 206         memcpy(rp.features, hdev->features, 8);
 207         memcpy(rp.dev_class, hdev->dev_class, 3);
 208         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 209         rp.hci_ver = hdev->hci_ver;
 210         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 211
 212         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 213
 214         hci_dev_unlock_bh(hdev);
 215         hci_dev_put(hdev);
 216
 217         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 218 }
 219
 220 static void mgmt_pending_free(struct pending_cmd *cmd)
 221 {
 222         sock_put(cmd->sk);
 223         kfree(cmd->param);
 224         kfree(cmd);
 225 }
 226
 227 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 228                                                 u16 index, void *data, u16 len)
 229 {
 230         struct pending_cmd *cmd;
 231
 232         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 233         if (!cmd)
 234                 return NULL;
 235
 236         cmd->opcode = opcode;
 237         cmd->index = index;
 238
 239         cmd->param = kmalloc(len, GFP_ATOMIC);
 240         if (!cmd->param) {
 241                 kfree(cmd);
 242                 return NULL;
 243         }
 244
 245         if (data)
 246                 memcpy(cmd->param, data, len);
 247
 248         cmd->sk = sk;
 249         sock_hold(sk);
 250
 251         list_add(&cmd->list, &cmd_list);
 252
 253         return cmd;
 254 }
 255
 256 static void mgmt_pending_foreach(u16 opcode, int index,
 257                                 void (*cb)(struct pending_cmd *cmd, void *data),
 258                                 void *data)
 259 {
 260         struct list_head *p, *n;
 261
 262         list_for_each_safe(p, n, &cmd_list) {
 263                 struct pending_cmd *cmd;
 264
 265                 cmd = list_entry(p, struct pending_cmd, list);
 266
 267                 if (opcode > 0 && cmd->opcode != opcode)
 268                         continue;
 269
 270                 if (index >= 0 && cmd->index != index)
 271                         continue;
 272
 273                 cb(cmd, data);
 274         }
 275 }
 276
 277 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 278 {
 279         struct pending_cmd *cmd;
 280
 281         list_for_each_entry(cmd, &cmd_list, list) {
 282                 if (cmd->opcode != opcode)
 283                         continue;
 284
 285                 if (index >= 0 && cmd->index != index)
 286                         continue;
 287
 288                 return cmd;
 289         }
 290
 291         return NULL;
 292 }
 293
 294 static void mgmt_pending_remove(struct pending_cmd *cmd)
 295 {
 296         list_del(&cmd->list);
 297         mgmt_pending_free(cmd);
 298 }
 299
 300 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 301 {
 302         struct mgmt_mode *cp;
 303         struct hci_dev *hdev;
 304         struct pending_cmd *cmd;
 305         int err, up;
 306
 307         cp = (void *) data;
 308
 309         BT_DBG("request for hci%u", index);
 310
 311         if (len != sizeof(*cp))
 312                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 313
 314         hdev = hci_dev_get(index);
 315         if (!hdev)
 316                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 317
 318         hci_dev_lock_bh(hdev);
 319
 320         up = test_bit(HCI_UP, &hdev->flags);
 321         if ((cp->val && up) || (!cp->val && !up)) {
 322                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 323                 goto failed;
 324         }
 325
 326         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 327                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 328                 goto failed;
 329         }
 330
 331         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 332         if (!cmd) {
 333                 err = -ENOMEM;
 334                 goto failed;
 335         }
 336
 337         if (cp->val)
 338                 queue_work(hdev->workqueue, &hdev->power_on);
 339         else
 340                 queue_work(hdev->workqueue, &hdev->power_off);
 341
 342         err = 0;
 343
 344 failed:
 345         hci_dev_unlock_bh(hdev);
 346         hci_dev_put(hdev);
 347         return err;
 348 }
 349
 350 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 351                                                                         u16 len)
 352 {
 353         struct mgmt_cp_set_discoverable *cp;
 354         struct hci_dev *hdev;
 355         struct pending_cmd *cmd;
 356         u8 scan;
 357         int err;
 358
 359         cp = (void *) data;
 360
 361         BT_DBG("request for hci%u", index);
 362
 363         if (len != sizeof(*cp))
 364                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 365
 366         hdev = hci_dev_get(index);
 367         if (!hdev)
 368                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 369
 370         hci_dev_lock_bh(hdev);
 371
 372         if (!test_bit(HCI_UP, &hdev->flags)) {
 373                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 374                 goto failed;
 375         }
 376
 377         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 378                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 379                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 380                 goto failed;
 381         }
 382
 383         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 384                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 385                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 386                 goto failed;
 387         }
 388
 389         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 390         if (!cmd) {
 391                 err = -ENOMEM;
 392                 goto failed;
 393         }
 394
 395         scan = SCAN_PAGE;
 396
 397         if (cp->val)
 398                 scan |= SCAN_INQUIRY;
 399         else
 400                 cancel_delayed_work_sync(&hdev->discov_off);
 401
 402         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 403         if (err < 0)
 404                 mgmt_pending_remove(cmd);
 405
 406         if (cp->val)
 407                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 408
 409 failed:
 410         hci_dev_unlock_bh(hdev);
 411         hci_dev_put(hdev);
 412
 413         return err;
 414 }
 415
 416 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 417                                                                         u16 len)
 418 {
 419         struct mgmt_mode *cp;
 420         struct hci_dev *hdev;
 421         struct pending_cmd *cmd;
 422         u8 scan;
 423         int err;
 424
 425         cp = (void *) data;
 426
 427         BT_DBG("request for hci%u", index);
 428
 429         if (len != sizeof(*cp))
 430                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 431
 432         hdev = hci_dev_get(index);
 433         if (!hdev)
 434                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 435
 436         hci_dev_lock_bh(hdev);
 437
 438         if (!test_bit(HCI_UP, &hdev->flags)) {
 439                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 440                 goto failed;
 441         }
 442
 443         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 444                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 445                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 446                 goto failed;
 447         }
 448
 449         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 450                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 451                 goto failed;
 452         }
 453
 454         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 455         if (!cmd) {
 456                 err = -ENOMEM;
 457                 goto failed;
 458         }
 459
 460         if (cp->val)
 461                 scan = SCAN_PAGE;
 462         else
 463                 scan = 0;
 464
 465         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 466         if (err < 0)
 467                 mgmt_pending_remove(cmd);
 468
 469 failed:
 470         hci_dev_unlock_bh(hdev);
 471         hci_dev_put(hdev);
 472
 473         return err;
 474 }
 475
 476 static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
 477                                                         struct sock *skip_sk)
 478 {
 479         struct sk_buff *skb;
 480         struct mgmt_hdr *hdr;
 481
 482         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 483         if (!skb)
 484                 return -ENOMEM;
 485
 486         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 487
 488         hdr = (void *) skb_put(skb, sizeof(*hdr));
 489         hdr->opcode = cpu_to_le16(event);
 490         hdr->index = cpu_to_le16(index);
 491         hdr->len = cpu_to_le16(data_len);
 492
 493         if (data)
 494                 memcpy(skb_put(skb, data_len), data, data_len);
 495
 496         hci_send_to_sock(NULL, skb, skip_sk);
 497         kfree_skb(skb);
 498
 499         return 0;
 500 }
 501
 502 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 503 {
 504         struct mgmt_mode rp;
 505
 506         rp.val = val;
 507
 508         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 509 }
 510
 511 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 512                                                                         u16 len)
 513 {
 514         struct mgmt_mode *cp, ev;
 515         struct hci_dev *hdev;
 516         int err;
 517
 518         cp = (void *) data;
 519
 520         BT_DBG("request for hci%u", index);
 521
 522         if (len != sizeof(*cp))
 523                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 524
 525         hdev = hci_dev_get(index);
 526         if (!hdev)
 527                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 528
 529         hci_dev_lock_bh(hdev);
 530
 531         if (cp->val)
 532                 set_bit(HCI_PAIRABLE, &hdev->flags);
 533         else
 534                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 535
 536         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 537         if (err < 0)
 538                 goto failed;
 539
 540         ev.val = cp->val;
 541
 542         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 543
 544 failed:
 545         hci_dev_unlock_bh(hdev);
 546         hci_dev_put(hdev);
 547
 548         return err;
 549 }
 550
 551 #define EIR_FLAGS               0x01 /* flags */
 552 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 553 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 554 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 555 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 556 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 557 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 558 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 559 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 560 #define EIR_TX_POWER            0x0A /* transmit power level */
 561 #define EIR_DEVICE_ID           0x10 /* device ID */
 562
 563 #define PNP_INFO_SVCLASS_ID             0x1200
 564
 565 static u8 bluetooth_base_uuid[] = {
 566                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 567                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 568 };
 569
 570 static u16 get_uuid16(u8 *uuid128)
 571 {
 572         u32 val;
 573         int i;
 574
 575         for (i = 0; i < 12; i++) {
 576                 if (bluetooth_base_uuid[i] != uuid128[i])
 577                         return 0;
 578         }
 579
 580         memcpy(&val, &uuid128[12], 4);
 581
 582         val = le32_to_cpu(val);
 583         if (val > 0xffff)
 584                 return 0;
 585
 586         return (u16) val;
 587 }
 588
 589 static void create_eir(struct hci_dev *hdev, u8 *data)
 590 {
 591         u8 *ptr = data;
 592         u16 eir_len = 0;
 593         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 594         int i, truncated = 0;
 595         struct bt_uuid *uuid;
 596         size_t name_len;
 597
 598         name_len = strlen(hdev->dev_name);
 599
 600         if (name_len > 0) {
 601                 /* EIR Data type */
 602                 if (name_len > 48) {
 603                         name_len = 48;
 604                         ptr[1] = EIR_NAME_SHORT;
 605                 } else
 606                         ptr[1] = EIR_NAME_COMPLETE;
 607
 608                 /* EIR Data length */
 609                 ptr[0] = name_len + 1;
 610
 611                 memcpy(ptr + 2, hdev->dev_name, name_len);
 612
 613                 eir_len += (name_len + 2);
 614                 ptr += (name_len + 2);
 615         }
 616
 617         memset(uuid16_list, 0, sizeof(uuid16_list));
 618
 619         /* Group all UUID16 types */
 620         list_for_each_entry(uuid, &hdev->uuids, list) {
 621                 u16 uuid16;
 622
 623                 uuid16 = get_uuid16(uuid->uuid);
 624                 if (uuid16 == 0)
 625                         return;
 626
 627                 if (uuid16 < 0x1100)
 628                         continue;
 629
 630                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 631                         continue;
 632
 633                 /* Stop if not enough space to put next UUID */
 634                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 635                         truncated = 1;
 636                         break;
 637                 }
 638
 639                 /* Check for duplicates */
 640                 for (i = 0; uuid16_list[i] != 0; i++)
 641                         if (uuid16_list[i] == uuid16)
 642                                 break;
 643
 644                 if (uuid16_list[i] == 0) {
 645                         uuid16_list[i] = uuid16;
 646                         eir_len += sizeof(u16);
 647                 }
 648         }
 649
 650         if (uuid16_list[0] != 0) {
 651                 u8 *length = ptr;
 652
 653                 /* EIR Data type */
 654                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 655
 656                 ptr += 2;
 657                 eir_len += 2;
 658
 659                 for (i = 0; uuid16_list[i] != 0; i++) {
 660                         *ptr++ = (uuid16_list[i] & 0x00ff);
 661                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 662                 }
 663
 664                 /* EIR Data length */
 665                 *length = (i * sizeof(u16)) + 1;
 666         }
 667 }
 668
 669 static int update_eir(struct hci_dev *hdev)
 670 {
 671         struct hci_cp_write_eir cp;
 672
 673         if (!(hdev->features[6] & LMP_EXT_INQ))
 674                 return 0;
 675
 676         if (hdev->ssp_mode == 0)
 677                 return 0;
 678
 679         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 680                 return 0;
 681
 682         memset(&cp, 0, sizeof(cp));
 683
 684         create_eir(hdev, cp.data);
 685
 686         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 687                 return 0;
 688
 689         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 690
 691         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 692 }
 693
 694 static u8 get_service_classes(struct hci_dev *hdev)
 695 {
 696         struct bt_uuid *uuid;
 697         u8 val = 0;
 698
 699         list_for_each_entry(uuid, &hdev->uuids, list)
 700                 val |= uuid->svc_hint;
 701
 702         return val;
 703 }
 704
 705 static int update_class(struct hci_dev *hdev)
 706 {
 707         u8 cod[3];
 708
 709         BT_DBG("%s", hdev->name);
 710
 711         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 712                 return 0;
 713
 714         cod[0] = hdev->minor_class;
 715         cod[1] = hdev->major_class;
 716         cod[2] = get_service_classes(hdev);
 717
 718         if (memcmp(cod, hdev->dev_class, 3) == 0)
 719                 return 0;
 720
 721         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 722 }
 723
 724 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 725 {
 726         struct mgmt_cp_add_uuid *cp;
 727         struct hci_dev *hdev;
 728         struct bt_uuid *uuid;
 729         int err;
 730
 731         cp = (void *) data;
 732
 733         BT_DBG("request for hci%u", index);
 734
 735         if (len != sizeof(*cp))
 736                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 737
 738         hdev = hci_dev_get(index);
 739         if (!hdev)
 740                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 741
 742         hci_dev_lock_bh(hdev);
 743
 744         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 745         if (!uuid) {
 746                 err = -ENOMEM;
 747                 goto failed;
 748         }
 749
 750         memcpy(uuid->uuid, cp->uuid, 16);
 751         uuid->svc_hint = cp->svc_hint;
 752
 753         list_add(&uuid->list, &hdev->uuids);
 754
 755         err = update_class(hdev);
 756         if (err < 0)
 757                 goto failed;
 758
 759         err = update_eir(hdev);
 760         if (err < 0)
 761                 goto failed;
 762
 763         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 764
 765 failed:
 766         hci_dev_unlock_bh(hdev);
 767         hci_dev_put(hdev);
 768
 769         return err;
 770 }
 771
 772 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 773 {
 774         struct list_head *p, *n;
 775         struct mgmt_cp_remove_uuid *cp;
 776         struct hci_dev *hdev;
 777         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 778         int err, found;
 779
 780         cp = (void *) data;
 781
 782         BT_DBG("request for hci%u", index);
 783
 784         if (len != sizeof(*cp))
 785                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 786
 787         hdev = hci_dev_get(index);
 788         if (!hdev)
 789                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 790
 791         hci_dev_lock_bh(hdev);
 792
 793         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 794                 err = hci_uuids_clear(hdev);
 795                 goto unlock;
 796         }
 797
 798         found = 0;
 799
 800         list_for_each_safe(p, n, &hdev->uuids) {
 801                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 802
 803                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 804                         continue;
 805
 806                 list_del(&match->list);
 807                 found++;
 808         }
 809
 810         if (found == 0) {
 811                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 812                 goto unlock;
 813         }
 814
 815         err = update_class(hdev);
 816         if (err < 0)
 817                 goto unlock;
 818
 819         err = update_eir(hdev);
 820         if (err < 0)
 821                 goto unlock;
 822
 823         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 824
 825 unlock:
 826         hci_dev_unlock_bh(hdev);
 827         hci_dev_put(hdev);
 828
 829         return err;
 830 }
 831
 832 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 833                                                                         u16 len)
 834 {
 835         struct hci_dev *hdev;
 836         struct mgmt_cp_set_dev_class *cp;
 837         int err;
 838
 839         cp = (void *) data;
 840
 841         BT_DBG("request for hci%u", index);
 842
 843         if (len != sizeof(*cp))
 844                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 845
 846         hdev = hci_dev_get(index);
 847         if (!hdev)
 848                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 849
 850         hci_dev_lock_bh(hdev);
 851
 852         hdev->major_class = cp->major;
 853         hdev->minor_class = cp->minor;
 854
 855         err = update_class(hdev);
 856
 857         if (err == 0)
 858                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 859
 860         hci_dev_unlock_bh(hdev);
 861         hci_dev_put(hdev);
 862
 863         return err;
 864 }
 865
 866 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 867                                                                         u16 len)
 868 {
 869         struct hci_dev *hdev;
 870         struct mgmt_cp_set_service_cache *cp;
 871         int err;
 872
 873         cp = (void *) data;
 874
 875         if (len != sizeof(*cp))
 876                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 877
 878         hdev = hci_dev_get(index);
 879         if (!hdev)
 880                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 881
 882         hci_dev_lock_bh(hdev);
 883
 884         BT_DBG("hci%u enable %d", index, cp->enable);
 885
 886         if (cp->enable) {
 887                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 888                 err = 0;
 889         } else {
 890                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 891                 err = update_class(hdev);
 892                 if (err == 0)
 893                         err = update_eir(hdev);
 894         }
 895
 896         if (err == 0)
 897                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 898                                                                         0);
 899         else
 900                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 901
 902
 903         hci_dev_unlock_bh(hdev);
 904         hci_dev_put(hdev);
 905
 906         return err;
 907 }
 908
 909 static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 910 {
 911         struct hci_dev *hdev;
 912         struct mgmt_cp_load_keys *cp;
 913         u16 key_count, expected_len;
 914         int i;
 915
 916         cp = (void *) data;
 917
 918         if (len < sizeof(*cp))
 919                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, EINVAL);
 920
 921         key_count = get_unaligned_le16(&cp->key_count);
 922
 923         expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
 924         if (expected_len != len) {
 925                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
 926                                                         len, expected_len);
 927                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, EINVAL);
 928         }
 929
 930         hdev = hci_dev_get(index);
 931         if (!hdev)
 932                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
 933
 934         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 935                                                                 key_count);
 936
 937         hci_dev_lock_bh(hdev);
 938
 939         hci_link_keys_clear(hdev);
 940
 941         set_bit(HCI_LINK_KEYS, &hdev->flags);
 942
 943         if (cp->debug_keys)
 944                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 945         else
 946                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 947
 948         for (i = 0; i < key_count; i++) {
 949                 struct mgmt_key_info *key = &cp->keys[i];
 950
 951                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 952                                                                 key->pin_len);
 953         }
 954
 955         hci_dev_unlock_bh(hdev);
 956         hci_dev_put(hdev);
 957
 958         return 0;
 959 }
 960
 961 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 962 {
 963         struct hci_dev *hdev;
 964         struct mgmt_cp_remove_key *cp;
 965         struct hci_conn *conn;
 966         int err;
 967
 968         cp = (void *) data;
 969
 970         if (len != sizeof(*cp))
 971                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
 972
 973         hdev = hci_dev_get(index);
 974         if (!hdev)
 975                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 976
 977         hci_dev_lock_bh(hdev);
 978
 979         err = hci_remove_link_key(hdev, &cp->bdaddr);
 980         if (err < 0) {
 981                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
 982                 goto unlock;
 983         }
 984
 985         err = 0;
 986
 987         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 988                 goto unlock;
 989
 990         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 991         if (conn) {
 992                 struct hci_cp_disconnect dc;
 993
 994                 put_unaligned_le16(conn->handle, &dc.handle);
 995                 dc.reason = 0x13; /* Remote User Terminated Connection */
 996                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
 997         }
 998
 999 unlock:
1000         hci_dev_unlock_bh(hdev);
1001         hci_dev_put(hdev);
1002
1003         return err;
1004 }
1005
1006 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1007 {
1008         struct hci_dev *hdev;
1009         struct mgmt_cp_disconnect *cp;
1010         struct hci_cp_disconnect dc;
1011         struct pending_cmd *cmd;
1012         struct hci_conn *conn;
1013         int err;
1014
1015         BT_DBG("");
1016
1017         cp = (void *) data;
1018
1019         if (len != sizeof(*cp))
1020                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1021
1022         hdev = hci_dev_get(index);
1023         if (!hdev)
1024                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1025
1026         hci_dev_lock_bh(hdev);
1027
1028         if (!test_bit(HCI_UP, &hdev->flags)) {
1029                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1030                 goto failed;
1031         }
1032
1033         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
1034                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1035                 goto failed;
1036         }
1037
1038         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1039         if (!conn)
1040                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1041
1042         if (!conn) {
1043                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1044                 goto failed;
1045         }
1046
1047         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
1048         if (!cmd) {
1049                 err = -ENOMEM;
1050                 goto failed;
1051         }
1052
1053         put_unaligned_le16(conn->handle, &dc.handle);
1054         dc.reason = 0x13; /* Remote User Terminated Connection */
1055
1056         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1057         if (err < 0)
1058                 mgmt_pending_remove(cmd);
1059
1060 failed:
1061         hci_dev_unlock_bh(hdev);
1062         hci_dev_put(hdev);
1063
1064         return err;
1065 }
1066
1067 static int get_connections(struct sock *sk, u16 index)
1068 {
1069         struct mgmt_rp_get_connections *rp;
1070         struct hci_dev *hdev;
1071         struct hci_conn *c;
1072         struct list_head *p;
1073         size_t rp_len;
1074         u16 count;
1075         int i, err;
1076
1077         BT_DBG("");
1078
1079         hdev = hci_dev_get(index);
1080         if (!hdev)
1081                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1082
1083         hci_dev_lock_bh(hdev);
1084
1085         count = 0;
1086         list_for_each(p, &hdev->conn_hash.list) {
1087                 count++;
1088         }
1089
1090         rp_len = sizeof(*rp) + (count * sizeof(bdaddr_t));
1091         rp = kmalloc(rp_len, GFP_ATOMIC);
1092         if (!rp) {
1093                 err = -ENOMEM;
1094                 goto unlock;
1095         }
1096
1097         put_unaligned_le16(count, &rp->conn_count);
1098
1099         i = 0;
1100         list_for_each_entry(c, &hdev->conn_hash.list, list)
1101                 bacpy(&rp->conn[i++], &c->dst);
1102
1103         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1104
1105 unlock:
1106         kfree(rp);
1107         hci_dev_unlock_bh(hdev);
1108         hci_dev_put(hdev);
1109         return err;
1110 }
1111
1112 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1113                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1114 {
1115         struct pending_cmd *cmd;
1116         int err;
1117
1118         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
1119                                                                 sizeof(*cp));
1120         if (!cmd)
1121                 return -ENOMEM;
1122
1123         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1124                                                                 &cp->bdaddr);
1125         if (err < 0)
1126                 mgmt_pending_remove(cmd);
1127
1128         return err;
1129 }
1130
1131 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1132                                                                         u16 len)
1133 {
1134         struct hci_dev *hdev;
1135         struct hci_conn *conn;
1136         struct mgmt_cp_pin_code_reply *cp;
1137         struct mgmt_cp_pin_code_neg_reply ncp;
1138         struct hci_cp_pin_code_reply reply;
1139         struct pending_cmd *cmd;
1140         int err;
1141
1142         BT_DBG("");
1143
1144         cp = (void *) data;
1145
1146         if (len != sizeof(*cp))
1147                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1148
1149         hdev = hci_dev_get(index);
1150         if (!hdev)
1151                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1152
1153         hci_dev_lock_bh(hdev);
1154
1155         if (!test_bit(HCI_UP, &hdev->flags)) {
1156                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1157                 goto failed;
1158         }
1159
1160         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1161         if (!conn) {
1162                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1163                 goto failed;
1164         }
1165
1166         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1167                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1168
1169                 BT_ERR("PIN code is not 16 bytes long");
1170
1171                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1172                 if (err >= 0)
1173                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1174                                                                 EINVAL);
1175
1176                 goto failed;
1177         }
1178
1179         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
1180         if (!cmd) {
1181                 err = -ENOMEM;
1182                 goto failed;
1183         }
1184
1185         bacpy(&reply.bdaddr, &cp->bdaddr);
1186         reply.pin_len = cp->pin_len;
1187         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1188
1189         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1190         if (err < 0)
1191                 mgmt_pending_remove(cmd);
1192
1193 failed:
1194         hci_dev_unlock_bh(hdev);
1195         hci_dev_put(hdev);
1196
1197         return err;
1198 }
1199
1200 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1201                                                                         u16 len)
1202 {
1203         struct hci_dev *hdev;
1204         struct mgmt_cp_pin_code_neg_reply *cp;
1205         int err;
1206
1207         BT_DBG("");
1208
1209         cp = (void *) data;
1210
1211         if (len != sizeof(*cp))
1212                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1213                                                                         EINVAL);
1214
1215         hdev = hci_dev_get(index);
1216         if (!hdev)
1217                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1218                                                                         ENODEV);
1219
1220         hci_dev_lock_bh(hdev);
1221
1222         if (!test_bit(HCI_UP, &hdev->flags)) {
1223                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1224                                                                 ENETDOWN);
1225                 goto failed;
1226         }
1227
1228         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1229
1230 failed:
1231         hci_dev_unlock_bh(hdev);
1232         hci_dev_put(hdev);
1233
1234         return err;
1235 }
1236
1237 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1238                                                                         u16 len)
1239 {
1240         struct hci_dev *hdev;
1241         struct mgmt_cp_set_io_capability *cp;
1242
1243         BT_DBG("");
1244
1245         cp = (void *) data;
1246
1247         if (len != sizeof(*cp))
1248                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1249
1250         hdev = hci_dev_get(index);
1251         if (!hdev)
1252                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1253
1254         hci_dev_lock_bh(hdev);
1255
1256         hdev->io_capability = cp->io_capability;
1257
1258         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1259                                                         hdev->io_capability);
1260
1261         hci_dev_unlock_bh(hdev);
1262         hci_dev_put(hdev);
1263
1264         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1265 }
1266
1267 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1268 {
1269         struct hci_dev *hdev = conn->hdev;
1270         struct pending_cmd *cmd;
1271
1272         list_for_each_entry(cmd, &cmd_list, list) {
1273                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1274                         continue;
1275
1276                 if (cmd->index != hdev->id)
1277                         continue;
1278
1279                 if (cmd->user_data != conn)
1280                         continue;
1281
1282                 return cmd;
1283         }
1284
1285         return NULL;
1286 }
1287
1288 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1289 {
1290         struct mgmt_rp_pair_device rp;
1291         struct hci_conn *conn = cmd->user_data;
1292
1293         bacpy(&rp.bdaddr, &conn->dst);
1294         rp.status = status;
1295
1296         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1297
1298         /* So we don't get further callbacks for this connection */
1299         conn->connect_cfm_cb = NULL;
1300         conn->security_cfm_cb = NULL;
1301         conn->disconn_cfm_cb = NULL;
1302
1303         hci_conn_put(conn);
1304
1305         mgmt_pending_remove(cmd);
1306 }
1307
1308 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1309 {
1310         struct pending_cmd *cmd;
1311
1312         BT_DBG("status %u", status);
1313
1314         cmd = find_pairing(conn);
1315         if (!cmd) {
1316                 BT_DBG("Unable to find a pending command");
1317                 return;
1318         }
1319
1320         pairing_complete(cmd, status);
1321 }
1322
1323 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1324 {
1325         struct hci_dev *hdev;
1326         struct mgmt_cp_pair_device *cp;
1327         struct pending_cmd *cmd;
1328         struct adv_entry *entry;
1329         u8 sec_level, auth_type;
1330         struct hci_conn *conn;
1331         int err;
1332
1333         BT_DBG("");
1334
1335         cp = (void *) data;
1336
1337         if (len != sizeof(*cp))
1338                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1339
1340         hdev = hci_dev_get(index);
1341         if (!hdev)
1342                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1343
1344         hci_dev_lock_bh(hdev);
1345
1346         sec_level = BT_SECURITY_MEDIUM;
1347         if (cp->io_cap == 0x03)
1348                 auth_type = HCI_AT_DEDICATED_BONDING;
1349         else
1350                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1351
1352         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1353         if (entry)
1354                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1355                                                                 auth_type);
1356         else
1357                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1358                                                                 auth_type);
1359
1360         if (IS_ERR(conn)) {
1361                 err = PTR_ERR(conn);
1362                 goto unlock;
1363         }
1364
1365         if (conn->connect_cfm_cb) {
1366                 hci_conn_put(conn);
1367                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1368                 goto unlock;
1369         }
1370
1371         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1372         if (!cmd) {
1373                 err = -ENOMEM;
1374                 hci_conn_put(conn);
1375                 goto unlock;
1376         }
1377
1378         /* For LE, just connecting isn't a proof that the pairing finished */
1379         if (!entry)
1380                 conn->connect_cfm_cb = pairing_complete_cb;
1381
1382         conn->security_cfm_cb = pairing_complete_cb;
1383         conn->disconn_cfm_cb = pairing_complete_cb;
1384         conn->io_capability = cp->io_cap;
1385         cmd->user_data = conn;
1386
1387         if (conn->state == BT_CONNECTED &&
1388                                 hci_conn_security(conn, sec_level, auth_type))
1389                 pairing_complete(cmd, 0);
1390
1391         err = 0;
1392
1393 unlock:
1394         hci_dev_unlock_bh(hdev);
1395         hci_dev_put(hdev);
1396
1397         return err;
1398 }
1399
1400 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1401                                                         u16 len, int success)
1402 {
1403         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1404         u16 mgmt_op, hci_op;
1405         struct pending_cmd *cmd;
1406         struct hci_dev *hdev;
1407         int err;
1408
1409         BT_DBG("");
1410
1411         if (success) {
1412                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1413                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1414         } else {
1415                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1416                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1417         }
1418
1419         if (len != sizeof(*cp))
1420                 return cmd_status(sk, index, mgmt_op, EINVAL);
1421
1422         hdev = hci_dev_get(index);
1423         if (!hdev)
1424                 return cmd_status(sk, index, mgmt_op, ENODEV);
1425
1426         hci_dev_lock_bh(hdev);
1427
1428         if (!test_bit(HCI_UP, &hdev->flags)) {
1429                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1430                 goto failed;
1431         }
1432
1433         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1434         if (!cmd) {
1435                 err = -ENOMEM;
1436                 goto failed;
1437         }
1438
1439         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1440         if (err < 0)
1441                 mgmt_pending_remove(cmd);
1442
1443 failed:
1444         hci_dev_unlock_bh(hdev);
1445         hci_dev_put(hdev);
1446
1447         return err;
1448 }
1449
1450 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1451                                                                 u16 len)
1452 {
1453         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1454         struct hci_cp_write_local_name hci_cp;
1455         struct hci_dev *hdev;
1456         struct pending_cmd *cmd;
1457         int err;
1458
1459         BT_DBG("");
1460
1461         if (len != sizeof(*mgmt_cp))
1462                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1463
1464         hdev = hci_dev_get(index);
1465         if (!hdev)
1466                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1467
1468         hci_dev_lock_bh(hdev);
1469
1470         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
1471         if (!cmd) {
1472                 err = -ENOMEM;
1473                 goto failed;
1474         }
1475
1476         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1477         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1478                                                                 &hci_cp);
1479         if (err < 0)
1480                 mgmt_pending_remove(cmd);
1481
1482 failed:
1483         hci_dev_unlock_bh(hdev);
1484         hci_dev_put(hdev);
1485
1486         return err;
1487 }
1488
1489 static int read_local_oob_data(struct sock *sk, u16 index)
1490 {
1491         struct hci_dev *hdev;
1492         struct pending_cmd *cmd;
1493         int err;
1494
1495         BT_DBG("hci%u", index);
1496
1497         hdev = hci_dev_get(index);
1498         if (!hdev)
1499                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1500                                                                         ENODEV);
1501
1502         hci_dev_lock_bh(hdev);
1503
1504         if (!test_bit(HCI_UP, &hdev->flags)) {
1505                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1506                                                                 ENETDOWN);
1507                 goto unlock;
1508         }
1509
1510         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1511                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1512                                                                 EOPNOTSUPP);
1513                 goto unlock;
1514         }
1515
1516         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
1517                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1518                 goto unlock;
1519         }
1520
1521         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
1522         if (!cmd) {
1523                 err = -ENOMEM;
1524                 goto unlock;
1525         }
1526
1527         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1528         if (err < 0)
1529                 mgmt_pending_remove(cmd);
1530
1531 unlock:
1532         hci_dev_unlock_bh(hdev);
1533         hci_dev_put(hdev);
1534
1535         return err;
1536 }
1537
1538 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1539                                                                         u16 len)
1540 {
1541         struct hci_dev *hdev;
1542         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1543         int err;
1544
1545         BT_DBG("hci%u ", index);
1546
1547         if (len != sizeof(*cp))
1548                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1549                                                                         EINVAL);
1550
1551         hdev = hci_dev_get(index);
1552         if (!hdev)
1553                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1554                                                                         ENODEV);
1555
1556         hci_dev_lock_bh(hdev);
1557
1558         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1559                                                                 cp->randomizer);
1560         if (err < 0)
1561                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1562         else
1563                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1564                                                                         0);
1565
1566         hci_dev_unlock_bh(hdev);
1567         hci_dev_put(hdev);
1568
1569         return err;
1570 }
1571
1572 static int remove_remote_oob_data(struct sock *sk, u16 index,
1573                                                 unsigned char *data, u16 len)
1574 {
1575         struct hci_dev *hdev;
1576         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1577         int err;
1578
1579         BT_DBG("hci%u ", index);
1580
1581         if (len != sizeof(*cp))
1582                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1583                                                                         EINVAL);
1584
1585         hdev = hci_dev_get(index);
1586         if (!hdev)
1587                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1588                                                                         ENODEV);
1589
1590         hci_dev_lock_bh(hdev);
1591
1592         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1593         if (err < 0)
1594                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1595                                                                         -err);
1596         else
1597                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1598                                                                 NULL, 0);
1599
1600         hci_dev_unlock_bh(hdev);
1601         hci_dev_put(hdev);
1602
1603         return err;
1604 }
1605
1606 static int start_discovery(struct sock *sk, u16 index)
1607 {
1608         struct pending_cmd *cmd;
1609         struct hci_dev *hdev;
1610         int err;
1611
1612         BT_DBG("hci%u", index);
1613
1614         hdev = hci_dev_get(index);
1615         if (!hdev)
1616                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1617
1618         hci_dev_lock_bh(hdev);
1619
1620         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
1621         if (!cmd) {
1622                 err = -ENOMEM;
1623                 goto failed;
1624         }
1625
1626         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1627         if (err < 0)
1628                 mgmt_pending_remove(cmd);
1629
1630 failed:
1631         hci_dev_unlock_bh(hdev);
1632         hci_dev_put(hdev);
1633
1634         return err;
1635 }
1636
1637 static int stop_discovery(struct sock *sk, u16 index)
1638 {
1639         struct hci_dev *hdev;
1640         struct pending_cmd *cmd;
1641         int err;
1642
1643         BT_DBG("hci%u", index);
1644
1645         hdev = hci_dev_get(index);
1646         if (!hdev)
1647                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1648
1649         hci_dev_lock_bh(hdev);
1650
1651         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
1652         if (!cmd) {
1653                 err = -ENOMEM;
1654                 goto failed;
1655         }
1656
1657         err = hci_cancel_inquiry(hdev);
1658         if (err < 0)
1659                 mgmt_pending_remove(cmd);
1660
1661 failed:
1662         hci_dev_unlock_bh(hdev);
1663         hci_dev_put(hdev);
1664
1665         return err;
1666 }
1667
1668 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1669                                                                 u16 len)
1670 {
1671         struct hci_dev *hdev;
1672         struct pending_cmd *cmd;
1673         struct mgmt_cp_block_device *cp = (void *) data;
1674         int err;
1675
1676         BT_DBG("hci%u", index);
1677
1678         if (len != sizeof(*cp))
1679                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1680                                                         EINVAL);
1681
1682         hdev = hci_dev_get(index);
1683         if (!hdev)
1684                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1685                                                         ENODEV);
1686
1687         hci_dev_lock_bh(hdev);
1688
1689         cmd = mgmt_pending_add(sk, MGMT_OP_BLOCK_DEVICE, index, NULL, 0);
1690         if (!cmd) {
1691                 err = -ENOMEM;
1692                 goto failed;
1693         }
1694
1695         err = hci_blacklist_add(hdev, &cp->bdaddr);
1696
1697         if (err < 0)
1698                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1699         else
1700                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1701                                                         NULL, 0);
1702
1703         mgmt_pending_remove(cmd);
1704
1705 failed:
1706         hci_dev_unlock_bh(hdev);
1707         hci_dev_put(hdev);
1708
1709         return err;
1710 }
1711
1712 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1713                                                                 u16 len)
1714 {
1715         struct hci_dev *hdev;
1716         struct pending_cmd *cmd;
1717         struct mgmt_cp_unblock_device *cp = (void *) data;
1718         int err;
1719
1720         BT_DBG("hci%u", index);
1721
1722         if (len != sizeof(*cp))
1723                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1724                                                                 EINVAL);
1725
1726         hdev = hci_dev_get(index);
1727         if (!hdev)
1728                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1729                                                                 ENODEV);
1730
1731         hci_dev_lock_bh(hdev);
1732
1733         cmd = mgmt_pending_add(sk, MGMT_OP_UNBLOCK_DEVICE, index, NULL, 0);
1734         if (!cmd) {
1735                 err = -ENOMEM;
1736                 goto failed;
1737         }
1738
1739         err = hci_blacklist_del(hdev, &cp->bdaddr);
1740
1741         if (err < 0)
1742                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1743         else
1744                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1745                                                                 NULL, 0);
1746
1747         mgmt_pending_remove(cmd);
1748
1749 failed:
1750         hci_dev_unlock_bh(hdev);
1751         hci_dev_put(hdev);
1752
1753         return err;
1754 }
1755
1756 static int set_fast_connectable(struct sock *sk, u16 index,
1757                                         unsigned char *data, u16 len)
1758 {
1759         struct hci_dev *hdev;
1760         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1761         struct hci_cp_write_page_scan_activity acp;
1762         u8 type;
1763         int err;
1764
1765         BT_DBG("hci%u", index);
1766
1767         if (len != sizeof(*cp))
1768                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1769                                                                 EINVAL);
1770
1771         hdev = hci_dev_get(index);
1772         if (!hdev)
1773                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1774                                                                 ENODEV);
1775
1776         hci_dev_lock(hdev);
1777
1778         if (cp->enable) {
1779                 type = PAGE_SCAN_TYPE_INTERLACED;
1780                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1781         } else {
1782                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1783                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1784         }
1785
1786         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1787
1788         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1789                                                 sizeof(acp), &acp);
1790         if (err < 0) {
1791                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1792                                                                 -err);
1793                 goto done;
1794         }
1795
1796         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1797         if (err < 0) {
1798                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1799                                                                 -err);
1800                 goto done;
1801         }
1802
1803         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1804                                                         NULL, 0);
1805 done:
1806         hci_dev_unlock(hdev);
1807         hci_dev_put(hdev);
1808
1809         return err;
1810 }
1811
1812 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1813 {
1814         unsigned char *buf;
1815         struct mgmt_hdr *hdr;
1816         u16 opcode, index, len;
1817         int err;
1818
1819         BT_DBG("got %zu bytes", msglen);
1820
1821         if (msglen < sizeof(*hdr))
1822                 return -EINVAL;
1823
1824         buf = kmalloc(msglen, GFP_KERNEL);
1825         if (!buf)
1826                 return -ENOMEM;
1827
1828         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1829                 err = -EFAULT;
1830                 goto done;
1831         }
1832
1833         hdr = (struct mgmt_hdr *) buf;
1834         opcode = get_unaligned_le16(&hdr->opcode);
1835         index = get_unaligned_le16(&hdr->index);
1836         len = get_unaligned_le16(&hdr->len);
1837
1838         if (len != msglen - sizeof(*hdr)) {
1839                 err = -EINVAL;
1840                 goto done;
1841         }
1842
1843         switch (opcode) {
1844         case MGMT_OP_READ_VERSION:
1845                 err = read_version(sk);
1846                 break;
1847         case MGMT_OP_READ_INDEX_LIST:
1848                 err = read_index_list(sk);
1849                 break;
1850         case MGMT_OP_READ_INFO:
1851                 err = read_controller_info(sk, index);
1852                 break;
1853         case MGMT_OP_SET_POWERED:
1854                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1855                 break;
1856         case MGMT_OP_SET_DISCOVERABLE:
1857                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1858                 break;
1859         case MGMT_OP_SET_CONNECTABLE:
1860                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1861                 break;
1862         case MGMT_OP_SET_PAIRABLE:
1863                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1864                 break;
1865         case MGMT_OP_ADD_UUID:
1866                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1867                 break;
1868         case MGMT_OP_REMOVE_UUID:
1869                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1870                 break;
1871         case MGMT_OP_SET_DEV_CLASS:
1872                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1873                 break;
1874         case MGMT_OP_SET_SERVICE_CACHE:
1875                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1876                 break;
1877         case MGMT_OP_LOAD_KEYS:
1878                 err = load_keys(sk, index, buf + sizeof(*hdr), len);
1879                 break;
1880         case MGMT_OP_REMOVE_KEY:
1881                 err = remove_key(sk, index, buf + sizeof(*hdr), len);
1882                 break;
1883         case MGMT_OP_DISCONNECT:
1884                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1885                 break;
1886         case MGMT_OP_GET_CONNECTIONS:
1887                 err = get_connections(sk, index);
1888                 break;
1889         case MGMT_OP_PIN_CODE_REPLY:
1890                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1891                 break;
1892         case MGMT_OP_PIN_CODE_NEG_REPLY:
1893                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1894                 break;
1895         case MGMT_OP_SET_IO_CAPABILITY:
1896                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1897                 break;
1898         case MGMT_OP_PAIR_DEVICE:
1899                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1900                 break;
1901         case MGMT_OP_USER_CONFIRM_REPLY:
1902                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1903                 break;
1904         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1905                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1906                 break;
1907         case MGMT_OP_SET_LOCAL_NAME:
1908                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1909                 break;
1910         case MGMT_OP_READ_LOCAL_OOB_DATA:
1911                 err = read_local_oob_data(sk, index);
1912                 break;
1913         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1914                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1915                 break;
1916         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1917                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1918                                                                         len);
1919                 break;
1920         case MGMT_OP_START_DISCOVERY:
1921                 err = start_discovery(sk, index);
1922                 break;
1923         case MGMT_OP_STOP_DISCOVERY:
1924                 err = stop_discovery(sk, index);
1925                 break;
1926         case MGMT_OP_BLOCK_DEVICE:
1927                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1928                 break;
1929         case MGMT_OP_UNBLOCK_DEVICE:
1930                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1931                 break;
1932         case MGMT_OP_SET_FAST_CONNECTABLE:
1933                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1934                                                                 len);
1935                 break;
1936         default:
1937                 BT_DBG("Unknown op %u", opcode);
1938                 err = cmd_status(sk, index, opcode, 0x01);
1939                 break;
1940         }
1941
1942         if (err < 0)
1943                 goto done;
1944
1945         err = msglen;
1946
1947 done:
1948         kfree(buf);
1949         return err;
1950 }
1951
1952 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1953 {
1954         u8 *status = data;
1955
1956         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1957         mgmt_pending_remove(cmd);
1958 }
1959
1960 int mgmt_index_added(u16 index)
1961 {
1962         return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
1963 }
1964
1965 int mgmt_index_removed(u16 index)
1966 {
1967         u8 status = ENODEV;
1968
1969         mgmt_pending_foreach(0, index, cmd_status_rsp, &status);
1970
1971         return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
1972 }
1973
1974 struct cmd_lookup {
1975         u8 val;
1976         struct sock *sk;
1977 };
1978
1979 static void mode_rsp(struct pending_cmd *cmd, void *data)
1980 {
1981         struct mgmt_mode *cp = cmd->param;
1982         struct cmd_lookup *match = data;
1983
1984         if (cp->val != match->val)
1985                 return;
1986
1987         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1988
1989         list_del(&cmd->list);
1990
1991         if (match->sk == NULL) {
1992                 match->sk = cmd->sk;
1993                 sock_hold(match->sk);
1994         }
1995
1996         mgmt_pending_free(cmd);
1997 }
1998
1999 int mgmt_powered(u16 index, u8 powered)
2000 {
2001         struct mgmt_mode ev;
2002         struct cmd_lookup match = { powered, NULL };
2003         int ret;
2004
2005         mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
2006
2007         if (!powered) {
2008                 u8 status = ENETDOWN;
2009                 mgmt_pending_foreach(0, index, cmd_status_rsp, &status);
2010         }
2011
2012         ev.val = powered;
2013
2014         ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
2015
2016         if (match.sk)
2017                 sock_put(match.sk);
2018
2019         return ret;
2020 }
2021
2022 int mgmt_discoverable(u16 index, u8 discoverable)
2023 {
2024         struct mgmt_mode ev;
2025         struct cmd_lookup match = { discoverable, NULL };
2026         int ret;
2027
2028         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
2029
2030         ev.val = discoverable;
2031
2032         ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
2033                                                                 match.sk);
2034
2035         if (match.sk)
2036                 sock_put(match.sk);
2037
2038         return ret;
2039 }
2040
2041 int mgmt_connectable(u16 index, u8 connectable)
2042 {
2043         struct mgmt_mode ev;
2044         struct cmd_lookup match = { connectable, NULL };
2045         int ret;
2046
2047         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
2048
2049         ev.val = connectable;
2050
2051         ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
2052
2053         if (match.sk)
2054                 sock_put(match.sk);
2055
2056         return ret;
2057 }
2058
2059 int mgmt_write_scan_failed(u16 index, u8 scan, u8 status)
2060 {
2061         if (scan & SCAN_PAGE)
2062                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index,
2063                                                 cmd_status_rsp, &status);
2064
2065         if (scan & SCAN_INQUIRY)
2066                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index,
2067                                                 cmd_status_rsp, &status);
2068
2069         return 0;
2070 }
2071
2072 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
2073 {
2074         struct mgmt_ev_new_key ev;
2075
2076         memset(&ev, 0, sizeof(ev));
2077
2078         ev.store_hint = persistent;
2079         bacpy(&ev.key.bdaddr, &key->bdaddr);
2080         ev.key.type = key->type;
2081         memcpy(ev.key.val, key->val, 16);
2082         ev.key.pin_len = key->pin_len;
2083
2084         return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
2085 }
2086
2087 int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type)
2088 {
2089         struct mgmt_ev_connected ev;
2090
2091         bacpy(&ev.bdaddr, bdaddr);
2092         ev.link_type = link_type;
2093
2094         return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
2095 }
2096
2097 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2098 {
2099         struct mgmt_cp_disconnect *cp = cmd->param;
2100         struct sock **sk = data;
2101         struct mgmt_rp_disconnect rp;
2102
2103         bacpy(&rp.bdaddr, &cp->bdaddr);
2104
2105         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2106
2107         *sk = cmd->sk;
2108         sock_hold(*sk);
2109
2110         mgmt_pending_remove(cmd);
2111 }
2112
2113 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr)
2114 {
2115         struct mgmt_ev_disconnected ev;
2116         struct sock *sk = NULL;
2117         int err;
2118
2119         mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
2120
2121         bacpy(&ev.bdaddr, bdaddr);
2122
2123         err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
2124
2125         if (sk)
2126                 sock_put(sk);
2127
2128         return err;
2129 }
2130
2131 int mgmt_disconnect_failed(u16 index)
2132 {
2133         struct pending_cmd *cmd;
2134         int err;
2135
2136         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
2137         if (!cmd)
2138                 return -ENOENT;
2139
2140         err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
2141
2142         mgmt_pending_remove(cmd);
2143
2144         return err;
2145 }
2146
2147 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2148 {
2149         struct mgmt_ev_connect_failed ev;
2150
2151         bacpy(&ev.bdaddr, bdaddr);
2152         ev.status = status;
2153
2154         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
2155 }
2156
2157 int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
2158 {
2159         struct mgmt_ev_pin_code_request ev;
2160
2161         bacpy(&ev.bdaddr, bdaddr);
2162         ev.secure = secure;
2163
2164         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
2165                                                                         NULL);
2166 }
2167
2168 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2169 {
2170         struct pending_cmd *cmd;
2171         struct mgmt_rp_pin_code_reply rp;
2172         int err;
2173
2174         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
2175         if (!cmd)
2176                 return -ENOENT;
2177
2178         bacpy(&rp.bdaddr, bdaddr);
2179         rp.status = status;
2180
2181         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
2182                                                                 sizeof(rp));
2183
2184         mgmt_pending_remove(cmd);
2185
2186         return err;
2187 }
2188
2189 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2190 {
2191         struct pending_cmd *cmd;
2192         struct mgmt_rp_pin_code_reply rp;
2193         int err;
2194
2195         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
2196         if (!cmd)
2197                 return -ENOENT;
2198
2199         bacpy(&rp.bdaddr, bdaddr);
2200         rp.status = status;
2201
2202         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2203                                                                 sizeof(rp));
2204
2205         mgmt_pending_remove(cmd);
2206
2207         return err;
2208 }
2209
2210 int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
2211                                                         u8 confirm_hint)
2212 {
2213         struct mgmt_ev_user_confirm_request ev;
2214
2215         BT_DBG("hci%u", index);
2216
2217         bacpy(&ev.bdaddr, bdaddr);
2218         ev.confirm_hint = confirm_hint;
2219         put_unaligned_le32(value, &ev.value);
2220
2221         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
2222                                                                         NULL);
2223 }
2224
2225 static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
2226                                                                 u8 opcode)
2227 {
2228         struct pending_cmd *cmd;
2229         struct mgmt_rp_user_confirm_reply rp;
2230         int err;
2231
2232         cmd = mgmt_pending_find(opcode, index);
2233         if (!cmd)
2234                 return -ENOENT;
2235
2236         bacpy(&rp.bdaddr, bdaddr);
2237         rp.status = status;
2238         err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
2239
2240         mgmt_pending_remove(cmd);
2241
2242         return err;
2243 }
2244
2245 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2246 {
2247         return confirm_reply_complete(index, bdaddr, status,
2248                                                 MGMT_OP_USER_CONFIRM_REPLY);
2249 }
2250
2251 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2252 {
2253         return confirm_reply_complete(index, bdaddr, status,
2254                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2255 }
2256
2257 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2258 {
2259         struct mgmt_ev_auth_failed ev;
2260
2261         bacpy(&ev.bdaddr, bdaddr);
2262         ev.status = status;
2263
2264         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
2265 }
2266
2267 int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
2268 {
2269         struct pending_cmd *cmd;
2270         struct hci_dev *hdev;
2271         struct mgmt_cp_set_local_name ev;
2272         int err;
2273
2274         memset(&ev, 0, sizeof(ev));
2275         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2276
2277         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
2278         if (!cmd)
2279                 goto send_event;
2280
2281         if (status) {
2282                 err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
2283                 goto failed;
2284         }
2285
2286         hdev = hci_dev_get(index);
2287         if (hdev) {
2288                 hci_dev_lock_bh(hdev);
2289                 update_eir(hdev);
2290                 hci_dev_unlock_bh(hdev);
2291                 hci_dev_put(hdev);
2292         }
2293
2294         err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
2295                                                                 sizeof(ev));
2296         if (err < 0)
2297                 goto failed;
2298
2299 send_event:
2300         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
2301                                                         cmd ? cmd->sk : NULL);
2302
2303 failed:
2304         if (cmd)
2305                 mgmt_pending_remove(cmd);
2306         return err;
2307 }
2308
2309 int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
2310                                                                 u8 status)
2311 {
2312         struct pending_cmd *cmd;
2313         int err;
2314
2315         BT_DBG("hci%u status %u", index, status);
2316
2317         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
2318         if (!cmd)
2319                 return -ENOENT;
2320
2321         if (status) {
2322                 err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2323                                                                         EIO);
2324         } else {
2325                 struct mgmt_rp_read_local_oob_data rp;
2326
2327                 memcpy(rp.hash, hash, sizeof(rp.hash));
2328                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2329
2330                 err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2331                                                         &rp, sizeof(rp));
2332         }
2333
2334         mgmt_pending_remove(cmd);
2335
2336         return err;
2337 }
2338
2339 int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
2340                                                                 u8 *eir)
2341 {
2342         struct mgmt_ev_device_found ev;
2343
2344         memset(&ev, 0, sizeof(ev));
2345
2346         bacpy(&ev.bdaddr, bdaddr);
2347         ev.rssi = rssi;
2348
2349         if (eir)
2350                 memcpy(ev.eir, eir, sizeof(ev.eir));
2351
2352         if (dev_class)
2353                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2354
2355         return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
2356 }
2357
2358 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
2359 {
2360         struct mgmt_ev_remote_name ev;
2361
2362         memset(&ev, 0, sizeof(ev));
2363
2364         bacpy(&ev.bdaddr, bdaddr);
2365         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2366
2367         return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
2368 }
2369
2370 int mgmt_inquiry_failed(u16 index, u8 status)
2371 {
2372         struct pending_cmd *cmd;
2373         int err;
2374
2375         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, index);
2376         if (!cmd)
2377                 return -ENOENT;
2378
2379         err = cmd_status(cmd->sk, index, cmd->opcode, status);
2380         mgmt_pending_remove(cmd);
2381
2382         return err;
2383 }
2384
2385 int mgmt_discovering(u16 index, u8 discovering)
2386 {
2387         struct pending_cmd *cmd;
2388
2389         if (discovering)
2390                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, index);
2391         else
2392                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, index);
2393
2394         if (cmd != NULL) {
2395                 cmd_complete(cmd->sk, index, cmd->opcode, NULL, 0);
2396                 mgmt_pending_remove(cmd);
2397         }
2398
2399         return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
2400                                                 sizeof(discovering), NULL);
2401 }
2402
2403 int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr)
2404 {
2405         struct pending_cmd *cmd;
2406         struct mgmt_ev_device_blocked ev;
2407
2408         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, index);
2409
2410         bacpy(&ev.bdaddr, bdaddr);
2411
2412         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, index, &ev, sizeof(ev),
2413                                                 cmd ? cmd->sk : NULL);
2414 }
2415
2416 int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr)
2417 {
2418         struct pending_cmd *cmd;
2419         struct mgmt_ev_device_unblocked ev;
2420
2421         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, index);
2422
2423         bacpy(&ev.bdaddr, bdaddr);
2424
2425         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, index, &ev, sizeof(ev),
2426                                                 cmd ? cmd->sk : NULL);
2427 }