net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #define MGMT_VERSION    0
  34 #define MGMT_REVISION   1
  35
  36 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  37
  38 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
  39
  40 struct pending_cmd {
  41         struct list_head list;
  42         u16 opcode;
  43         int index;
  44         void *param;
  45         struct sock *sk;
  46         void *user_data;
  47 };
  48
  49 /* HCI to MGMT error code conversion table */
  50 static u8 mgmt_status_table[] = {
  51         MGMT_STATUS_SUCCESS,
  52         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  53         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  54         MGMT_STATUS_FAILED,             /* Hardware Failure */
  55         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  56         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  57         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  58         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  59         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  60         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  61         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  62         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  63         MGMT_STATUS_BUSY,               /* Command Disallowed */
  64         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  65         MGMT_STATUS_REJECTED,           /* Rejected Security */
  66         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  67         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  68         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  69         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  70         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  71         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  72         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  73         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  74         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  75         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  76         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  77         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  78         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  79         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  80         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  81         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  82         MGMT_STATUS_FAILED,             /* Unspecified Error */
  83         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  84         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  85         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  86         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  87         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  88         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
  89         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
  90         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
  91         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
  92         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
  93         MGMT_STATUS_FAILED,             /* Transaction Collision */
  94         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
  95         MGMT_STATUS_REJECTED,           /* QoS Rejected */
  96         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
  97         MGMT_STATUS_REJECTED,           /* Insufficient Security */
  98         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
  99         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 100         MGMT_STATUS_FAILED,             /* Slot Violation */
 101         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 102         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 103         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 104         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 105         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 106         MGMT_STATUS_BUSY,               /* Controller Busy */
 107         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 108         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 109         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 110         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 111         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 112 };
 113
 114 static u8 mgmt_status(u8 hci_status)
 115 {
 116         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 117                 return mgmt_status_table[hci_status];
 118
 119         return MGMT_STATUS_FAILED;
 120 }
 121
 122 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 123 {
 124         struct sk_buff *skb;
 125         struct mgmt_hdr *hdr;
 126         struct mgmt_ev_cmd_status *ev;
 127         int err;
 128
 129         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 130
 131         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 132         if (!skb)
 133                 return -ENOMEM;
 134
 135         hdr = (void *) skb_put(skb, sizeof(*hdr));
 136
 137         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 138         hdr->index = cpu_to_le16(index);
 139         hdr->len = cpu_to_le16(sizeof(*ev));
 140
 141         ev = (void *) skb_put(skb, sizeof(*ev));
 142         ev->status = status;
 143         put_unaligned_le16(cmd, &ev->opcode);
 144
 145         err = sock_queue_rcv_skb(sk, skb);
 146         if (err < 0)
 147                 kfree_skb(skb);
 148
 149         return err;
 150 }
 151
 152 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 153                                                                 size_t rp_len)
 154 {
 155         struct sk_buff *skb;
 156         struct mgmt_hdr *hdr;
 157         struct mgmt_ev_cmd_complete *ev;
 158         int err;
 159
 160         BT_DBG("sock %p", sk);
 161
 162         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 163         if (!skb)
 164                 return -ENOMEM;
 165
 166         hdr = (void *) skb_put(skb, sizeof(*hdr));
 167
 168         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 169         hdr->index = cpu_to_le16(index);
 170         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 171
 172         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 173         put_unaligned_le16(cmd, &ev->opcode);
 174
 175         if (rp)
 176                 memcpy(ev->data, rp, rp_len);
 177
 178         err = sock_queue_rcv_skb(sk, skb);
 179         if (err < 0)
 180                 kfree_skb(skb);
 181
 182         return err;;
 183 }
 184
 185 static int read_version(struct sock *sk)
 186 {
 187         struct mgmt_rp_read_version rp;
 188
 189         BT_DBG("sock %p", sk);
 190
 191         rp.version = MGMT_VERSION;
 192         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 193
 194         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 195                                                                 sizeof(rp));
 196 }
 197
 198 static int read_index_list(struct sock *sk)
 199 {
 200         struct mgmt_rp_read_index_list *rp;
 201         struct list_head *p;
 202         struct hci_dev *d;
 203         size_t rp_len;
 204         u16 count;
 205         int i, err;
 206
 207         BT_DBG("sock %p", sk);
 208
 209         read_lock(&hci_dev_list_lock);
 210
 211         count = 0;
 212         list_for_each(p, &hci_dev_list) {
 213                 count++;
 214         }
 215
 216         rp_len = sizeof(*rp) + (2 * count);
 217         rp = kmalloc(rp_len, GFP_ATOMIC);
 218         if (!rp) {
 219                 read_unlock(&hci_dev_list_lock);
 220                 return -ENOMEM;
 221         }
 222
 223         put_unaligned_le16(count, &rp->num_controllers);
 224
 225         i = 0;
 226         list_for_each_entry(d, &hci_dev_list, list) {
 227                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 228                         cancel_delayed_work(&d->power_off);
 229
 230                 if (test_bit(HCI_SETUP, &d->flags))
 231                         continue;
 232
 233                 put_unaligned_le16(d->id, &rp->index[i++]);
 234                 BT_DBG("Added hci%u", d->id);
 235         }
 236
 237         read_unlock(&hci_dev_list_lock);
 238
 239         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 240                                                                         rp_len);
 241
 242         kfree(rp);
 243
 244         return err;
 245 }
 246
 247 static u32 get_supported_settings(struct hci_dev *hdev)
 248 {
 249         u32 settings = 0;
 250
 251         settings |= MGMT_SETTING_POWERED;
 252         settings |= MGMT_SETTING_CONNECTABLE;
 253         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 254         settings |= MGMT_SETTING_DISCOVERABLE;
 255         settings |= MGMT_SETTING_PAIRABLE;
 256
 257         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 258                 settings |= MGMT_SETTING_SSP;
 259
 260         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 261                 settings |= MGMT_SETTING_BREDR;
 262                 settings |= MGMT_SETTING_LINK_SECURITY;
 263         }
 264
 265         if (hdev->features[4] & LMP_LE)
 266                 settings |= MGMT_SETTING_LE;
 267
 268         return settings;
 269 }
 270
 271 static u32 get_current_settings(struct hci_dev *hdev)
 272 {
 273         u32 settings = 0;
 274
 275         if (test_bit(HCI_UP, &hdev->flags))
 276                 settings |= MGMT_SETTING_POWERED;
 277         else
 278                 return settings;
 279
 280         if (test_bit(HCI_PSCAN, &hdev->flags))
 281                 settings |= MGMT_SETTING_CONNECTABLE;
 282
 283         if (test_bit(HCI_ISCAN, &hdev->flags))
 284                 settings |= MGMT_SETTING_DISCOVERABLE;
 285
 286         if (test_bit(HCI_PAIRABLE, &hdev->flags))
 287                 settings |= MGMT_SETTING_PAIRABLE;
 288
 289         if (!(hdev->features[4] & LMP_NO_BREDR))
 290                 settings |= MGMT_SETTING_BREDR;
 291
 292         if (hdev->extfeatures[0] & LMP_HOST_LE)
 293                 settings |= MGMT_SETTING_LE;
 294
 295         if (test_bit(HCI_AUTH, &hdev->flags))
 296                 settings |= MGMT_SETTING_LINK_SECURITY;
 297
 298         if (hdev->ssp_mode > 0)
 299                 settings |= MGMT_SETTING_SSP;
 300
 301         return settings;
 302 }
 303
 304 #define EIR_FLAGS               0x01 /* flags */
 305 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 306 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 307 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 308 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 309 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 310 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 311 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 312 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 313 #define EIR_TX_POWER            0x0A /* transmit power level */
 314 #define EIR_DEVICE_ID           0x10 /* device ID */
 315
 316 #define PNP_INFO_SVCLASS_ID             0x1200
 317
 318 static u8 bluetooth_base_uuid[] = {
 319                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 320                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 321 };
 322
 323 static u16 get_uuid16(u8 *uuid128)
 324 {
 325         u32 val;
 326         int i;
 327
 328         for (i = 0; i < 12; i++) {
 329                 if (bluetooth_base_uuid[i] != uuid128[i])
 330                         return 0;
 331         }
 332
 333         memcpy(&val, &uuid128[12], 4);
 334
 335         val = le32_to_cpu(val);
 336         if (val > 0xffff)
 337                 return 0;
 338
 339         return (u16) val;
 340 }
 341
 342 static void create_eir(struct hci_dev *hdev, u8 *data)
 343 {
 344         u8 *ptr = data;
 345         u16 eir_len = 0;
 346         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 347         int i, truncated = 0;
 348         struct bt_uuid *uuid;
 349         size_t name_len;
 350
 351         name_len = strlen(hdev->dev_name);
 352
 353         if (name_len > 0) {
 354                 /* EIR Data type */
 355                 if (name_len > 48) {
 356                         name_len = 48;
 357                         ptr[1] = EIR_NAME_SHORT;
 358                 } else
 359                         ptr[1] = EIR_NAME_COMPLETE;
 360
 361                 /* EIR Data length */
 362                 ptr[0] = name_len + 1;
 363
 364                 memcpy(ptr + 2, hdev->dev_name, name_len);
 365
 366                 eir_len += (name_len + 2);
 367                 ptr += (name_len + 2);
 368         }
 369
 370         memset(uuid16_list, 0, sizeof(uuid16_list));
 371
 372         /* Group all UUID16 types */
 373         list_for_each_entry(uuid, &hdev->uuids, list) {
 374                 u16 uuid16;
 375
 376                 uuid16 = get_uuid16(uuid->uuid);
 377                 if (uuid16 == 0)
 378                         return;
 379
 380                 if (uuid16 < 0x1100)
 381                         continue;
 382
 383                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 384                         continue;
 385
 386                 /* Stop if not enough space to put next UUID */
 387                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 388                         truncated = 1;
 389                         break;
 390                 }
 391
 392                 /* Check for duplicates */
 393                 for (i = 0; uuid16_list[i] != 0; i++)
 394                         if (uuid16_list[i] == uuid16)
 395                                 break;
 396
 397                 if (uuid16_list[i] == 0) {
 398                         uuid16_list[i] = uuid16;
 399                         eir_len += sizeof(u16);
 400                 }
 401         }
 402
 403         if (uuid16_list[0] != 0) {
 404                 u8 *length = ptr;
 405
 406                 /* EIR Data type */
 407                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 408
 409                 ptr += 2;
 410                 eir_len += 2;
 411
 412                 for (i = 0; uuid16_list[i] != 0; i++) {
 413                         *ptr++ = (uuid16_list[i] & 0x00ff);
 414                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 415                 }
 416
 417                 /* EIR Data length */
 418                 *length = (i * sizeof(u16)) + 1;
 419         }
 420 }
 421
 422 static int update_eir(struct hci_dev *hdev)
 423 {
 424         struct hci_cp_write_eir cp;
 425
 426         if (!(hdev->features[6] & LMP_EXT_INQ))
 427                 return 0;
 428
 429         if (hdev->ssp_mode == 0)
 430                 return 0;
 431
 432         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 433                 return 0;
 434
 435         memset(&cp, 0, sizeof(cp));
 436
 437         create_eir(hdev, cp.data);
 438
 439         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 440                 return 0;
 441
 442         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 443
 444         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 445 }
 446
 447 static u8 get_service_classes(struct hci_dev *hdev)
 448 {
 449         struct bt_uuid *uuid;
 450         u8 val = 0;
 451
 452         list_for_each_entry(uuid, &hdev->uuids, list)
 453                 val |= uuid->svc_hint;
 454
 455         return val;
 456 }
 457
 458 static int update_class(struct hci_dev *hdev)
 459 {
 460         u8 cod[3];
 461
 462         BT_DBG("%s", hdev->name);
 463
 464         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 465                 return 0;
 466
 467         cod[0] = hdev->minor_class;
 468         cod[1] = hdev->major_class;
 469         cod[2] = get_service_classes(hdev);
 470
 471         if (memcmp(cod, hdev->dev_class, 3) == 0)
 472                 return 0;
 473
 474         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 475 }
 476
 477 static void service_cache_off(struct work_struct *work)
 478 {
 479         struct hci_dev *hdev = container_of(work, struct hci_dev,
 480                                                         service_cache.work);
 481
 482         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
 483                 return;
 484
 485         hci_dev_lock(hdev);
 486
 487         update_eir(hdev);
 488         update_class(hdev);
 489
 490         hci_dev_unlock(hdev);
 491 }
 492
 493 static void mgmt_init_hdev(struct hci_dev *hdev)
 494 {
 495         if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
 496                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 497
 498         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
 499                 schedule_delayed_work(&hdev->service_cache,
 500                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 501 }
 502
 503 static int read_controller_info(struct sock *sk, u16 index)
 504 {
 505         struct mgmt_rp_read_info rp;
 506         struct hci_dev *hdev;
 507
 508         BT_DBG("sock %p hci%u", sk, index);
 509
 510         hdev = hci_dev_get(index);
 511         if (!hdev)
 512                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 513                                                 MGMT_STATUS_INVALID_PARAMS);
 514
 515         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 516                 cancel_delayed_work_sync(&hdev->power_off);
 517
 518         hci_dev_lock(hdev);
 519
 520         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 521                 mgmt_init_hdev(hdev);
 522
 523         memset(&rp, 0, sizeof(rp));
 524
 525         bacpy(&rp.bdaddr, &hdev->bdaddr);
 526
 527         rp.version = hdev->hci_ver;
 528
 529         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 530
 531         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 532         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 533
 534         memcpy(rp.dev_class, hdev->dev_class, 3);
 535
 536         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 537
 538         hci_dev_unlock(hdev);
 539         hci_dev_put(hdev);
 540
 541         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 542 }
 543
 544 static void mgmt_pending_free(struct pending_cmd *cmd)
 545 {
 546         sock_put(cmd->sk);
 547         kfree(cmd->param);
 548         kfree(cmd);
 549 }
 550
 551 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 552                                                         struct hci_dev *hdev,
 553                                                         void *data, u16 len)
 554 {
 555         struct pending_cmd *cmd;
 556
 557         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 558         if (!cmd)
 559                 return NULL;
 560
 561         cmd->opcode = opcode;
 562         cmd->index = hdev->id;
 563
 564         cmd->param = kmalloc(len, GFP_ATOMIC);
 565         if (!cmd->param) {
 566                 kfree(cmd);
 567                 return NULL;
 568         }
 569
 570         if (data)
 571                 memcpy(cmd->param, data, len);
 572
 573         cmd->sk = sk;
 574         sock_hold(sk);
 575
 576         list_add(&cmd->list, &hdev->mgmt_pending);
 577
 578         return cmd;
 579 }
 580
 581 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 582                                 void (*cb)(struct pending_cmd *cmd, void *data),
 583                                 void *data)
 584 {
 585         struct list_head *p, *n;
 586
 587         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 588                 struct pending_cmd *cmd;
 589
 590                 cmd = list_entry(p, struct pending_cmd, list);
 591
 592                 if (opcode > 0 && cmd->opcode != opcode)
 593                         continue;
 594
 595                 cb(cmd, data);
 596         }
 597 }
 598
 599 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 600 {
 601         struct pending_cmd *cmd;
 602
 603         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 604                 if (cmd->opcode == opcode)
 605                         return cmd;
 606         }
 607
 608         return NULL;
 609 }
 610
 611 static void mgmt_pending_remove(struct pending_cmd *cmd)
 612 {
 613         list_del(&cmd->list);
 614         mgmt_pending_free(cmd);
 615 }
 616
 617 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 618 {
 619         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 620
 621         return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
 622 }
 623
 624 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 625 {
 626         struct mgmt_mode *cp;
 627         struct hci_dev *hdev;
 628         struct pending_cmd *cmd;
 629         int err, up;
 630
 631         cp = (void *) data;
 632
 633         BT_DBG("request for hci%u", index);
 634
 635         if (len != sizeof(*cp))
 636                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 637                                                 MGMT_STATUS_INVALID_PARAMS);
 638
 639         hdev = hci_dev_get(index);
 640         if (!hdev)
 641                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 642                                                 MGMT_STATUS_INVALID_PARAMS);
 643
 644         hci_dev_lock(hdev);
 645
 646         up = test_bit(HCI_UP, &hdev->flags);
 647         if ((cp->val && up) || (!cp->val && !up)) {
 648                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 649                 goto failed;
 650         }
 651
 652         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 653                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 654                                                         MGMT_STATUS_BUSY);
 655                 goto failed;
 656         }
 657
 658         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 659         if (!cmd) {
 660                 err = -ENOMEM;
 661                 goto failed;
 662         }
 663
 664         if (cp->val)
 665                 schedule_work(&hdev->power_on);
 666         else
 667                 schedule_work(&hdev->power_off.work);
 668
 669         err = 0;
 670
 671 failed:
 672         hci_dev_unlock(hdev);
 673         hci_dev_put(hdev);
 674         return err;
 675 }
 676
 677 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 678                                                                         u16 len)
 679 {
 680         struct mgmt_cp_set_discoverable *cp;
 681         struct hci_dev *hdev;
 682         struct pending_cmd *cmd;
 683         u8 scan;
 684         int err;
 685
 686         cp = (void *) data;
 687
 688         BT_DBG("request for hci%u", index);
 689
 690         if (len != sizeof(*cp))
 691                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 692                                                 MGMT_STATUS_INVALID_PARAMS);
 693
 694         hdev = hci_dev_get(index);
 695         if (!hdev)
 696                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 697                                                 MGMT_STATUS_INVALID_PARAMS);
 698
 699         hci_dev_lock(hdev);
 700
 701         if (!test_bit(HCI_UP, &hdev->flags)) {
 702                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 703                                                 MGMT_STATUS_NOT_POWERED);
 704                 goto failed;
 705         }
 706
 707         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 708                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 709                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 710                                                         MGMT_STATUS_BUSY);
 711                 goto failed;
 712         }
 713
 714         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 715                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 716                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 717                 goto failed;
 718         }
 719
 720         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 721         if (!cmd) {
 722                 err = -ENOMEM;
 723                 goto failed;
 724         }
 725
 726         scan = SCAN_PAGE;
 727
 728         if (cp->val)
 729                 scan |= SCAN_INQUIRY;
 730         else
 731                 cancel_delayed_work(&hdev->discov_off);
 732
 733         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 734         if (err < 0)
 735                 mgmt_pending_remove(cmd);
 736
 737         if (cp->val)
 738                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 739
 740 failed:
 741         hci_dev_unlock(hdev);
 742         hci_dev_put(hdev);
 743
 744         return err;
 745 }
 746
 747 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 748                                                                         u16 len)
 749 {
 750         struct mgmt_mode *cp;
 751         struct hci_dev *hdev;
 752         struct pending_cmd *cmd;
 753         u8 scan;
 754         int err;
 755
 756         cp = (void *) data;
 757
 758         BT_DBG("request for hci%u", index);
 759
 760         if (len != sizeof(*cp))
 761                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 762                                                 MGMT_STATUS_INVALID_PARAMS);
 763
 764         hdev = hci_dev_get(index);
 765         if (!hdev)
 766                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 767                                                 MGMT_STATUS_INVALID_PARAMS);
 768
 769         hci_dev_lock(hdev);
 770
 771         if (!test_bit(HCI_UP, &hdev->flags)) {
 772                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 773                                                 MGMT_STATUS_NOT_POWERED);
 774                 goto failed;
 775         }
 776
 777         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 778                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 779                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 780                                                         MGMT_STATUS_BUSY);
 781                 goto failed;
 782         }
 783
 784         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 785                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 786                 goto failed;
 787         }
 788
 789         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 790         if (!cmd) {
 791                 err = -ENOMEM;
 792                 goto failed;
 793         }
 794
 795         if (cp->val)
 796                 scan = SCAN_PAGE;
 797         else
 798                 scan = 0;
 799
 800         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 801         if (err < 0)
 802                 mgmt_pending_remove(cmd);
 803
 804 failed:
 805         hci_dev_unlock(hdev);
 806         hci_dev_put(hdev);
 807
 808         return err;
 809 }
 810
 811 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 812                                         u16 data_len, struct sock *skip_sk)
 813 {
 814         struct sk_buff *skb;
 815         struct mgmt_hdr *hdr;
 816
 817         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 818         if (!skb)
 819                 return -ENOMEM;
 820
 821         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 822
 823         hdr = (void *) skb_put(skb, sizeof(*hdr));
 824         hdr->opcode = cpu_to_le16(event);
 825         if (hdev)
 826                 hdr->index = cpu_to_le16(hdev->id);
 827         else
 828                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 829         hdr->len = cpu_to_le16(data_len);
 830
 831         if (data)
 832                 memcpy(skb_put(skb, data_len), data, data_len);
 833
 834         hci_send_to_sock(NULL, skb, skip_sk);
 835         kfree_skb(skb);
 836
 837         return 0;
 838 }
 839
 840 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 841                                                                         u16 len)
 842 {
 843         struct mgmt_mode *cp;
 844         struct hci_dev *hdev;
 845         __le32 ev;
 846         int err;
 847
 848         cp = (void *) data;
 849
 850         BT_DBG("request for hci%u", index);
 851
 852         if (len != sizeof(*cp))
 853                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 854                                                 MGMT_STATUS_INVALID_PARAMS);
 855
 856         hdev = hci_dev_get(index);
 857         if (!hdev)
 858                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 859                                                 MGMT_STATUS_INVALID_PARAMS);
 860
 861         hci_dev_lock(hdev);
 862
 863         if (cp->val)
 864                 set_bit(HCI_PAIRABLE, &hdev->flags);
 865         else
 866                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 867
 868         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
 869         if (err < 0)
 870                 goto failed;
 871
 872         ev = cpu_to_le32(get_current_settings(hdev));
 873
 874         err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
 875
 876 failed:
 877         hci_dev_unlock(hdev);
 878         hci_dev_put(hdev);
 879
 880         return err;
 881 }
 882
 883 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 884 {
 885         struct mgmt_cp_add_uuid *cp;
 886         struct hci_dev *hdev;
 887         struct bt_uuid *uuid;
 888         int err;
 889
 890         cp = (void *) data;
 891
 892         BT_DBG("request for hci%u", index);
 893
 894         if (len != sizeof(*cp))
 895                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 896                                                 MGMT_STATUS_INVALID_PARAMS);
 897
 898         hdev = hci_dev_get(index);
 899         if (!hdev)
 900                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 901                                                 MGMT_STATUS_INVALID_PARAMS);
 902
 903         hci_dev_lock(hdev);
 904
 905         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 906         if (!uuid) {
 907                 err = -ENOMEM;
 908                 goto failed;
 909         }
 910
 911         memcpy(uuid->uuid, cp->uuid, 16);
 912         uuid->svc_hint = cp->svc_hint;
 913
 914         list_add(&uuid->list, &hdev->uuids);
 915
 916         err = update_class(hdev);
 917         if (err < 0)
 918                 goto failed;
 919
 920         err = update_eir(hdev);
 921         if (err < 0)
 922                 goto failed;
 923
 924         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 925
 926 failed:
 927         hci_dev_unlock(hdev);
 928         hci_dev_put(hdev);
 929
 930         return err;
 931 }
 932
 933 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 934 {
 935         struct list_head *p, *n;
 936         struct mgmt_cp_remove_uuid *cp;
 937         struct hci_dev *hdev;
 938         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 939         int err, found;
 940
 941         cp = (void *) data;
 942
 943         BT_DBG("request for hci%u", index);
 944
 945         if (len != sizeof(*cp))
 946                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 947                                                 MGMT_STATUS_INVALID_PARAMS);
 948
 949         hdev = hci_dev_get(index);
 950         if (!hdev)
 951                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 952                                                 MGMT_STATUS_INVALID_PARAMS);
 953
 954         hci_dev_lock(hdev);
 955
 956         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 957                 err = hci_uuids_clear(hdev);
 958                 goto unlock;
 959         }
 960
 961         found = 0;
 962
 963         list_for_each_safe(p, n, &hdev->uuids) {
 964                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 965
 966                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 967                         continue;
 968
 969                 list_del(&match->list);
 970                 found++;
 971         }
 972
 973         if (found == 0) {
 974                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 975                                                 MGMT_STATUS_INVALID_PARAMS);
 976                 goto unlock;
 977         }
 978
 979         err = update_class(hdev);
 980         if (err < 0)
 981                 goto unlock;
 982
 983         err = update_eir(hdev);
 984         if (err < 0)
 985                 goto unlock;
 986
 987         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 988
 989 unlock:
 990         hci_dev_unlock(hdev);
 991         hci_dev_put(hdev);
 992
 993         return err;
 994 }
 995
 996 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 997                                                                         u16 len)
 998 {
 999         struct hci_dev *hdev;
1000         struct mgmt_cp_set_dev_class *cp;
1001         int err;
1002
1003         cp = (void *) data;
1004
1005         BT_DBG("request for hci%u", index);
1006
1007         if (len != sizeof(*cp))
1008                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1009                                                 MGMT_STATUS_INVALID_PARAMS);
1010
1011         hdev = hci_dev_get(index);
1012         if (!hdev)
1013                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1014                                                 MGMT_STATUS_INVALID_PARAMS);
1015
1016         hci_dev_lock(hdev);
1017
1018         hdev->major_class = cp->major;
1019         hdev->minor_class = cp->minor;
1020
1021         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
1022                 hci_dev_unlock(hdev);
1023                 cancel_delayed_work_sync(&hdev->service_cache);
1024                 hci_dev_lock(hdev);
1025                 update_eir(hdev);
1026         }
1027
1028         err = update_class(hdev);
1029
1030         if (err == 0)
1031                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
1032
1033         hci_dev_unlock(hdev);
1034         hci_dev_put(hdev);
1035
1036         return err;
1037 }
1038
1039 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
1040                                                                 u16 len)
1041 {
1042         struct hci_dev *hdev;
1043         struct mgmt_cp_load_link_keys *cp;
1044         u16 key_count, expected_len;
1045         int i;
1046
1047         cp = (void *) data;
1048
1049         if (len < sizeof(*cp))
1050                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1051                                                 MGMT_STATUS_INVALID_PARAMS);
1052
1053         key_count = get_unaligned_le16(&cp->key_count);
1054
1055         expected_len = sizeof(*cp) + key_count *
1056                                         sizeof(struct mgmt_link_key_info);
1057         if (expected_len != len) {
1058                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1059                                                         len, expected_len);
1060                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1061                                                 MGMT_STATUS_INVALID_PARAMS);
1062         }
1063
1064         hdev = hci_dev_get(index);
1065         if (!hdev)
1066                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1067                                                 MGMT_STATUS_INVALID_PARAMS);
1068
1069         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1070                                                                 key_count);
1071
1072         hci_dev_lock(hdev);
1073
1074         hci_link_keys_clear(hdev);
1075
1076         set_bit(HCI_LINK_KEYS, &hdev->flags);
1077
1078         if (cp->debug_keys)
1079                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
1080         else
1081                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
1082
1083         for (i = 0; i < key_count; i++) {
1084                 struct mgmt_link_key_info *key = &cp->keys[i];
1085
1086                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1087                                                                 key->pin_len);
1088         }
1089
1090         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1091
1092         hci_dev_unlock(hdev);
1093         hci_dev_put(hdev);
1094
1095         return 0;
1096 }
1097
1098 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
1099                                                                 u16 len)
1100 {
1101         struct hci_dev *hdev;
1102         struct mgmt_cp_remove_keys *cp;
1103         struct mgmt_rp_remove_keys rp;
1104         struct hci_cp_disconnect dc;
1105         struct pending_cmd *cmd;
1106         struct hci_conn *conn;
1107         int err;
1108
1109         cp = (void *) data;
1110
1111         if (len != sizeof(*cp))
1112                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1113                                                 MGMT_STATUS_INVALID_PARAMS);
1114
1115         hdev = hci_dev_get(index);
1116         if (!hdev)
1117                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1118                                                 MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         memset(&rp, 0, sizeof(rp));
1123         bacpy(&rp.bdaddr, &cp->bdaddr);
1124         rp.status = MGMT_STATUS_FAILED;
1125
1126         err = hci_remove_link_key(hdev, &cp->bdaddr);
1127         if (err < 0) {
1128                 rp.status = MGMT_STATUS_NOT_PAIRED;
1129                 goto unlock;
1130         }
1131
1132         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1133                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1134                                                                 sizeof(rp));
1135                 goto unlock;
1136         }
1137
1138         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1139         if (!conn) {
1140                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1141                                                                 sizeof(rp));
1142                 goto unlock;
1143         }
1144
1145         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1146         if (!cmd) {
1147                 err = -ENOMEM;
1148                 goto unlock;
1149         }
1150
1151         put_unaligned_le16(conn->handle, &dc.handle);
1152         dc.reason = 0x13; /* Remote User Terminated Connection */
1153         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1154         if (err < 0)
1155                 mgmt_pending_remove(cmd);
1156
1157 unlock:
1158         if (err < 0)
1159                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1160                                                                 sizeof(rp));
1161         hci_dev_unlock(hdev);
1162         hci_dev_put(hdev);
1163
1164         return err;
1165 }
1166
1167 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1168 {
1169         struct hci_dev *hdev;
1170         struct mgmt_cp_disconnect *cp;
1171         struct hci_cp_disconnect dc;
1172         struct pending_cmd *cmd;
1173         struct hci_conn *conn;
1174         int err;
1175
1176         BT_DBG("");
1177
1178         cp = (void *) data;
1179
1180         if (len != sizeof(*cp))
1181                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1182                                                 MGMT_STATUS_INVALID_PARAMS);
1183
1184         hdev = hci_dev_get(index);
1185         if (!hdev)
1186                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1187                                                 MGMT_STATUS_INVALID_PARAMS);
1188
1189         hci_dev_lock(hdev);
1190
1191         if (!test_bit(HCI_UP, &hdev->flags)) {
1192                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1193                                                 MGMT_STATUS_NOT_POWERED);
1194                 goto failed;
1195         }
1196
1197         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1198                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1199                                                         MGMT_STATUS_BUSY);
1200                 goto failed;
1201         }
1202
1203         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1204         if (!conn)
1205                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1206
1207         if (!conn) {
1208                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1209                                                 MGMT_STATUS_NOT_CONNECTED);
1210                 goto failed;
1211         }
1212
1213         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1214         if (!cmd) {
1215                 err = -ENOMEM;
1216                 goto failed;
1217         }
1218
1219         put_unaligned_le16(conn->handle, &dc.handle);
1220         dc.reason = 0x13; /* Remote User Terminated Connection */
1221
1222         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1223         if (err < 0)
1224                 mgmt_pending_remove(cmd);
1225
1226 failed:
1227         hci_dev_unlock(hdev);
1228         hci_dev_put(hdev);
1229
1230         return err;
1231 }
1232
1233 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1234 {
1235         switch (link_type) {
1236         case LE_LINK:
1237                 switch (addr_type) {
1238                 case ADDR_LE_DEV_PUBLIC:
1239                         return MGMT_ADDR_LE_PUBLIC;
1240                 case ADDR_LE_DEV_RANDOM:
1241                         return MGMT_ADDR_LE_RANDOM;
1242                 default:
1243                         return MGMT_ADDR_INVALID;
1244                 }
1245         case ACL_LINK:
1246                 return MGMT_ADDR_BREDR;
1247         default:
1248                 return MGMT_ADDR_INVALID;
1249         }
1250 }
1251
1252 static int get_connections(struct sock *sk, u16 index)
1253 {
1254         struct mgmt_rp_get_connections *rp;
1255         struct hci_dev *hdev;
1256         struct hci_conn *c;
1257         struct list_head *p;
1258         size_t rp_len;
1259         u16 count;
1260         int i, err;
1261
1262         BT_DBG("");
1263
1264         hdev = hci_dev_get(index);
1265         if (!hdev)
1266                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1267                                                 MGMT_STATUS_INVALID_PARAMS);
1268
1269         hci_dev_lock(hdev);
1270
1271         count = 0;
1272         list_for_each(p, &hdev->conn_hash.list) {
1273                 count++;
1274         }
1275
1276         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1277         rp = kmalloc(rp_len, GFP_ATOMIC);
1278         if (!rp) {
1279                 err = -ENOMEM;
1280                 goto unlock;
1281         }
1282
1283         put_unaligned_le16(count, &rp->conn_count);
1284
1285         i = 0;
1286         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1287                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1288                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1289                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1290                         continue;
1291                 i++;
1292         }
1293
1294         /* Recalculate length in case of filtered SCO connections, etc */
1295         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1296
1297         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1298
1299 unlock:
1300         kfree(rp);
1301         hci_dev_unlock(hdev);
1302         hci_dev_put(hdev);
1303         return err;
1304 }
1305
1306 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1307                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1308 {
1309         struct pending_cmd *cmd;
1310         int err;
1311
1312         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1313                                                                 sizeof(*cp));
1314         if (!cmd)
1315                 return -ENOMEM;
1316
1317         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1318                                                                 &cp->bdaddr);
1319         if (err < 0)
1320                 mgmt_pending_remove(cmd);
1321
1322         return err;
1323 }
1324
1325 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1326                                                                         u16 len)
1327 {
1328         struct hci_dev *hdev;
1329         struct hci_conn *conn;
1330         struct mgmt_cp_pin_code_reply *cp;
1331         struct mgmt_cp_pin_code_neg_reply ncp;
1332         struct hci_cp_pin_code_reply reply;
1333         struct pending_cmd *cmd;
1334         int err;
1335
1336         BT_DBG("");
1337
1338         cp = (void *) data;
1339
1340         if (len != sizeof(*cp))
1341                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1342                                                 MGMT_STATUS_INVALID_PARAMS);
1343
1344         hdev = hci_dev_get(index);
1345         if (!hdev)
1346                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1347                                                 MGMT_STATUS_INVALID_PARAMS);
1348
1349         hci_dev_lock(hdev);
1350
1351         if (!test_bit(HCI_UP, &hdev->flags)) {
1352                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1353                                                 MGMT_STATUS_NOT_POWERED);
1354                 goto failed;
1355         }
1356
1357         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1358         if (!conn) {
1359                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1360                                                 MGMT_STATUS_NOT_CONNECTED);
1361                 goto failed;
1362         }
1363
1364         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1365                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1366
1367                 BT_ERR("PIN code is not 16 bytes long");
1368
1369                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1370                 if (err >= 0)
1371                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1372                                                 MGMT_STATUS_INVALID_PARAMS);
1373
1374                 goto failed;
1375         }
1376
1377         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1378         if (!cmd) {
1379                 err = -ENOMEM;
1380                 goto failed;
1381         }
1382
1383         bacpy(&reply.bdaddr, &cp->bdaddr);
1384         reply.pin_len = cp->pin_len;
1385         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1386
1387         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1388         if (err < 0)
1389                 mgmt_pending_remove(cmd);
1390
1391 failed:
1392         hci_dev_unlock(hdev);
1393         hci_dev_put(hdev);
1394
1395         return err;
1396 }
1397
1398 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1399                                                                         u16 len)
1400 {
1401         struct hci_dev *hdev;
1402         struct mgmt_cp_pin_code_neg_reply *cp;
1403         int err;
1404
1405         BT_DBG("");
1406
1407         cp = (void *) data;
1408
1409         if (len != sizeof(*cp))
1410                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1411                                                 MGMT_STATUS_INVALID_PARAMS);
1412
1413         hdev = hci_dev_get(index);
1414         if (!hdev)
1415                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1416                                                 MGMT_STATUS_INVALID_PARAMS);
1417
1418         hci_dev_lock(hdev);
1419
1420         if (!test_bit(HCI_UP, &hdev->flags)) {
1421                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1422                                                 MGMT_STATUS_NOT_POWERED);
1423                 goto failed;
1424         }
1425
1426         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1427
1428 failed:
1429         hci_dev_unlock(hdev);
1430         hci_dev_put(hdev);
1431
1432         return err;
1433 }
1434
1435 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1436                                                                         u16 len)
1437 {
1438         struct hci_dev *hdev;
1439         struct mgmt_cp_set_io_capability *cp;
1440
1441         BT_DBG("");
1442
1443         cp = (void *) data;
1444
1445         if (len != sizeof(*cp))
1446                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1447                                                 MGMT_STATUS_INVALID_PARAMS);
1448
1449         hdev = hci_dev_get(index);
1450         if (!hdev)
1451                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1452                                                 MGMT_STATUS_INVALID_PARAMS);
1453
1454         hci_dev_lock(hdev);
1455
1456         hdev->io_capability = cp->io_capability;
1457
1458         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1459                                                         hdev->io_capability);
1460
1461         hci_dev_unlock(hdev);
1462         hci_dev_put(hdev);
1463
1464         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1465 }
1466
1467 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1468 {
1469         struct hci_dev *hdev = conn->hdev;
1470         struct pending_cmd *cmd;
1471
1472         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1473                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1474                         continue;
1475
1476                 if (cmd->user_data != conn)
1477                         continue;
1478
1479                 return cmd;
1480         }
1481
1482         return NULL;
1483 }
1484
1485 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1486 {
1487         struct mgmt_rp_pair_device rp;
1488         struct hci_conn *conn = cmd->user_data;
1489
1490         bacpy(&rp.addr.bdaddr, &conn->dst);
1491         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1492         rp.status = status;
1493
1494         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1495
1496         /* So we don't get further callbacks for this connection */
1497         conn->connect_cfm_cb = NULL;
1498         conn->security_cfm_cb = NULL;
1499         conn->disconn_cfm_cb = NULL;
1500
1501         hci_conn_put(conn);
1502
1503         mgmt_pending_remove(cmd);
1504 }
1505
1506 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1507 {
1508         struct pending_cmd *cmd;
1509
1510         BT_DBG("status %u", status);
1511
1512         cmd = find_pairing(conn);
1513         if (!cmd)
1514                 BT_DBG("Unable to find a pending command");
1515         else
1516                 pairing_complete(cmd, status);
1517 }
1518
1519 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1520 {
1521         struct hci_dev *hdev;
1522         struct mgmt_cp_pair_device *cp;
1523         struct mgmt_rp_pair_device rp;
1524         struct pending_cmd *cmd;
1525         u8 sec_level, auth_type;
1526         struct hci_conn *conn;
1527         int err;
1528
1529         BT_DBG("");
1530
1531         cp = (void *) data;
1532
1533         if (len != sizeof(*cp))
1534                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1535                                                 MGMT_STATUS_INVALID_PARAMS);
1536
1537         hdev = hci_dev_get(index);
1538         if (!hdev)
1539                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1540                                                 MGMT_STATUS_INVALID_PARAMS);
1541
1542         hci_dev_lock(hdev);
1543
1544         sec_level = BT_SECURITY_MEDIUM;
1545         if (cp->io_cap == 0x03)
1546                 auth_type = HCI_AT_DEDICATED_BONDING;
1547         else
1548                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1549
1550         if (cp->addr.type == MGMT_ADDR_BREDR)
1551                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1552                                                                 auth_type);
1553         else
1554                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1555                                                                 auth_type);
1556
1557         memset(&rp, 0, sizeof(rp));
1558         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1559         rp.addr.type = cp->addr.type;
1560
1561         if (IS_ERR(conn)) {
1562                 rp.status = -PTR_ERR(conn);
1563                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1564                                                         &rp, sizeof(rp));
1565                 goto unlock;
1566         }
1567
1568         if (conn->connect_cfm_cb) {
1569                 hci_conn_put(conn);
1570                 rp.status = EBUSY;
1571                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1572                                                         &rp, sizeof(rp));
1573                 goto unlock;
1574         }
1575
1576         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1577         if (!cmd) {
1578                 err = -ENOMEM;
1579                 hci_conn_put(conn);
1580                 goto unlock;
1581         }
1582
1583         /* For LE, just connecting isn't a proof that the pairing finished */
1584         if (cp->addr.type == MGMT_ADDR_BREDR)
1585                 conn->connect_cfm_cb = pairing_complete_cb;
1586
1587         conn->security_cfm_cb = pairing_complete_cb;
1588         conn->disconn_cfm_cb = pairing_complete_cb;
1589         conn->io_capability = cp->io_cap;
1590         cmd->user_data = conn;
1591
1592         if (conn->state == BT_CONNECTED &&
1593                                 hci_conn_security(conn, sec_level, auth_type))
1594                 pairing_complete(cmd, 0);
1595
1596         err = 0;
1597
1598 unlock:
1599         hci_dev_unlock(hdev);
1600         hci_dev_put(hdev);
1601
1602         return err;
1603 }
1604
1605 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1606                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1607 {
1608         struct pending_cmd *cmd;
1609         struct hci_dev *hdev;
1610         struct hci_conn *conn;
1611         int err;
1612
1613         hdev = hci_dev_get(index);
1614         if (!hdev)
1615                 return cmd_status(sk, index, mgmt_op,
1616                                                 MGMT_STATUS_INVALID_PARAMS);
1617
1618         hci_dev_lock(hdev);
1619
1620         if (!test_bit(HCI_UP, &hdev->flags)) {
1621                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1622                 goto done;
1623         }
1624
1625         /*
1626          * Check for an existing ACL link, if present pair via
1627          * HCI commands.
1628          *
1629          * If no ACL link is present, check for an LE link and if
1630          * present, pair via the SMP engine.
1631          *
1632          * If neither ACL nor LE links are present, fail with error.
1633          */
1634         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1635         if (!conn) {
1636                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1637                 if (!conn) {
1638                         err = cmd_status(sk, index, mgmt_op,
1639                                                 MGMT_STATUS_NOT_CONNECTED);
1640                         goto done;
1641                 }
1642
1643                 /* Continue with pairing via SMP */
1644
1645                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
1646                 goto done;
1647         }
1648
1649         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1650         if (!cmd) {
1651                 err = -ENOMEM;
1652                 goto done;
1653         }
1654
1655         /* Continue with pairing via HCI */
1656         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1657                 struct hci_cp_user_passkey_reply cp;
1658
1659                 bacpy(&cp.bdaddr, bdaddr);
1660                 cp.passkey = passkey;
1661                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1662         } else
1663                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1664
1665         if (err < 0)
1666                 mgmt_pending_remove(cmd);
1667
1668 done:
1669         hci_dev_unlock(hdev);
1670         hci_dev_put(hdev);
1671
1672         return err;
1673 }
1674
1675 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1676 {
1677         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1678
1679         BT_DBG("");
1680
1681         if (len != sizeof(*cp))
1682                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1683                                                 MGMT_STATUS_INVALID_PARAMS);
1684
1685         return user_pairing_resp(sk, index, &cp->bdaddr,
1686                         MGMT_OP_USER_CONFIRM_REPLY,
1687                         HCI_OP_USER_CONFIRM_REPLY, 0);
1688 }
1689
1690 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1691                                                                         u16 len)
1692 {
1693         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1694
1695         BT_DBG("");
1696
1697         if (len != sizeof(*cp))
1698                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1699                                                 MGMT_STATUS_INVALID_PARAMS);
1700
1701         return user_pairing_resp(sk, index, &cp->bdaddr,
1702                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1703                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1704 }
1705
1706 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1707 {
1708         struct mgmt_cp_user_passkey_reply *cp = (void *) data;
1709
1710         BT_DBG("");
1711
1712         if (len != sizeof(*cp))
1713                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1714                                                                         EINVAL);
1715
1716         return user_pairing_resp(sk, index, &cp->bdaddr,
1717                         MGMT_OP_USER_PASSKEY_REPLY,
1718                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1719 }
1720
1721 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1722                                                                         u16 len)
1723 {
1724         struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
1725
1726         BT_DBG("");
1727
1728         if (len != sizeof(*cp))
1729                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1730                                                                         EINVAL);
1731
1732         return user_pairing_resp(sk, index, &cp->bdaddr,
1733                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1734                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1735 }
1736
1737 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1738                                                                 u16 len)
1739 {
1740         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1741         struct hci_cp_write_local_name hci_cp;
1742         struct hci_dev *hdev;
1743         struct pending_cmd *cmd;
1744         int err;
1745
1746         BT_DBG("");
1747
1748         if (len != sizeof(*mgmt_cp))
1749                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1750                                                 MGMT_STATUS_INVALID_PARAMS);
1751
1752         hdev = hci_dev_get(index);
1753         if (!hdev)
1754                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1755                                                 MGMT_STATUS_INVALID_PARAMS);
1756
1757         hci_dev_lock(hdev);
1758
1759         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1760         if (!cmd) {
1761                 err = -ENOMEM;
1762                 goto failed;
1763         }
1764
1765         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1766         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1767                                                                 &hci_cp);
1768         if (err < 0)
1769                 mgmt_pending_remove(cmd);
1770
1771 failed:
1772         hci_dev_unlock(hdev);
1773         hci_dev_put(hdev);
1774
1775         return err;
1776 }
1777
1778 static int read_local_oob_data(struct sock *sk, u16 index)
1779 {
1780         struct hci_dev *hdev;
1781         struct pending_cmd *cmd;
1782         int err;
1783
1784         BT_DBG("hci%u", index);
1785
1786         hdev = hci_dev_get(index);
1787         if (!hdev)
1788                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1789                                                 MGMT_STATUS_INVALID_PARAMS);
1790
1791         hci_dev_lock(hdev);
1792
1793         if (!test_bit(HCI_UP, &hdev->flags)) {
1794                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1795                                                 MGMT_STATUS_NOT_POWERED);
1796                 goto unlock;
1797         }
1798
1799         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1800                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1801                                                 MGMT_STATUS_NOT_SUPPORTED);
1802                 goto unlock;
1803         }
1804
1805         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1806                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1807                                                         MGMT_STATUS_BUSY);
1808                 goto unlock;
1809         }
1810
1811         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1812         if (!cmd) {
1813                 err = -ENOMEM;
1814                 goto unlock;
1815         }
1816
1817         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1818         if (err < 0)
1819                 mgmt_pending_remove(cmd);
1820
1821 unlock:
1822         hci_dev_unlock(hdev);
1823         hci_dev_put(hdev);
1824
1825         return err;
1826 }
1827
1828 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1829                                                                         u16 len)
1830 {
1831         struct hci_dev *hdev;
1832         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1833         int err;
1834
1835         BT_DBG("hci%u ", index);
1836
1837         if (len != sizeof(*cp))
1838                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1839                                                 MGMT_STATUS_INVALID_PARAMS);
1840
1841         hdev = hci_dev_get(index);
1842         if (!hdev)
1843                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1844                                                 MGMT_STATUS_INVALID_PARAMS);
1845
1846         hci_dev_lock(hdev);
1847
1848         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1849                                                                 cp->randomizer);
1850         if (err < 0)
1851                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1852                                                         MGMT_STATUS_FAILED);
1853         else
1854                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1855                                                                         0);
1856
1857         hci_dev_unlock(hdev);
1858         hci_dev_put(hdev);
1859
1860         return err;
1861 }
1862
1863 static int remove_remote_oob_data(struct sock *sk, u16 index,
1864                                                 unsigned char *data, u16 len)
1865 {
1866         struct hci_dev *hdev;
1867         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1868         int err;
1869
1870         BT_DBG("hci%u ", index);
1871
1872         if (len != sizeof(*cp))
1873                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1874                                                 MGMT_STATUS_INVALID_PARAMS);
1875
1876         hdev = hci_dev_get(index);
1877         if (!hdev)
1878                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1879                                                 MGMT_STATUS_INVALID_PARAMS);
1880
1881         hci_dev_lock(hdev);
1882
1883         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1884         if (err < 0)
1885                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1886                                                 MGMT_STATUS_INVALID_PARAMS);
1887         else
1888                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1889                                                                 NULL, 0);
1890
1891         hci_dev_unlock(hdev);
1892         hci_dev_put(hdev);
1893
1894         return err;
1895 }
1896
1897 static int start_discovery(struct sock *sk, u16 index,
1898                                                 unsigned char *data, u16 len)
1899 {
1900         struct mgmt_cp_start_discovery *cp = (void *) data;
1901         struct pending_cmd *cmd;
1902         struct hci_dev *hdev;
1903         int err;
1904
1905         BT_DBG("hci%u", index);
1906
1907         if (len != sizeof(*cp))
1908                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1909                                                 MGMT_STATUS_INVALID_PARAMS);
1910
1911         hdev = hci_dev_get(index);
1912         if (!hdev)
1913                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1914                                                 MGMT_STATUS_INVALID_PARAMS);
1915
1916         hci_dev_lock(hdev);
1917
1918         if (!test_bit(HCI_UP, &hdev->flags)) {
1919                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1920                                                 MGMT_STATUS_NOT_POWERED);
1921                 goto failed;
1922         }
1923
1924         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1925         if (!cmd) {
1926                 err = -ENOMEM;
1927                 goto failed;
1928         }
1929
1930         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1931         if (err < 0)
1932                 mgmt_pending_remove(cmd);
1933
1934 failed:
1935         hci_dev_unlock(hdev);
1936         hci_dev_put(hdev);
1937
1938         return err;
1939 }
1940
1941 static int stop_discovery(struct sock *sk, u16 index)
1942 {
1943         struct hci_dev *hdev;
1944         struct pending_cmd *cmd;
1945         int err;
1946
1947         BT_DBG("hci%u", index);
1948
1949         hdev = hci_dev_get(index);
1950         if (!hdev)
1951                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1952                                                 MGMT_STATUS_INVALID_PARAMS);
1953
1954         hci_dev_lock(hdev);
1955
1956         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1957         if (!cmd) {
1958                 err = -ENOMEM;
1959                 goto failed;
1960         }
1961
1962         err = hci_cancel_inquiry(hdev);
1963         if (err < 0)
1964                 mgmt_pending_remove(cmd);
1965
1966 failed:
1967         hci_dev_unlock(hdev);
1968         hci_dev_put(hdev);
1969
1970         return err;
1971 }
1972
1973 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1974                                                                 u16 len)
1975 {
1976         struct hci_dev *hdev;
1977         struct mgmt_cp_block_device *cp = (void *) data;
1978         int err;
1979
1980         BT_DBG("hci%u", index);
1981
1982         if (len != sizeof(*cp))
1983                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1984                                                 MGMT_STATUS_INVALID_PARAMS);
1985
1986         hdev = hci_dev_get(index);
1987         if (!hdev)
1988                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1989                                                 MGMT_STATUS_INVALID_PARAMS);
1990
1991         hci_dev_lock(hdev);
1992
1993         err = hci_blacklist_add(hdev, &cp->bdaddr);
1994         if (err < 0)
1995                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1996                                                         MGMT_STATUS_FAILED);
1997         else
1998                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1999                                                         NULL, 0);
2000
2001         hci_dev_unlock(hdev);
2002         hci_dev_put(hdev);
2003
2004         return err;
2005 }
2006
2007 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
2008                                                                 u16 len)
2009 {
2010         struct hci_dev *hdev;
2011         struct mgmt_cp_unblock_device *cp = (void *) data;
2012         int err;
2013
2014         BT_DBG("hci%u", index);
2015
2016         if (len != sizeof(*cp))
2017                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2018                                                 MGMT_STATUS_INVALID_PARAMS);
2019
2020         hdev = hci_dev_get(index);
2021         if (!hdev)
2022                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2023                                                 MGMT_STATUS_INVALID_PARAMS);
2024
2025         hci_dev_lock(hdev);
2026
2027         err = hci_blacklist_del(hdev, &cp->bdaddr);
2028
2029         if (err < 0)
2030                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2031                                                 MGMT_STATUS_INVALID_PARAMS);
2032         else
2033                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2034                                                                 NULL, 0);
2035
2036         hci_dev_unlock(hdev);
2037         hci_dev_put(hdev);
2038
2039         return err;
2040 }
2041
2042 static int set_fast_connectable(struct sock *sk, u16 index,
2043                                         unsigned char *data, u16 len)
2044 {
2045         struct hci_dev *hdev;
2046         struct mgmt_mode *cp = (void *) data;
2047         struct hci_cp_write_page_scan_activity acp;
2048         u8 type;
2049         int err;
2050
2051         BT_DBG("hci%u", index);
2052
2053         if (len != sizeof(*cp))
2054                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2055                                                 MGMT_STATUS_INVALID_PARAMS);
2056
2057         hdev = hci_dev_get(index);
2058         if (!hdev)
2059                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2060                                                 MGMT_STATUS_INVALID_PARAMS);
2061
2062         hci_dev_lock(hdev);
2063
2064         if (cp->val) {
2065                 type = PAGE_SCAN_TYPE_INTERLACED;
2066                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2067         } else {
2068                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2069                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2070         }
2071
2072         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2073
2074         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2075                                                 sizeof(acp), &acp);
2076         if (err < 0) {
2077                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2078                                                         MGMT_STATUS_FAILED);
2079                 goto done;
2080         }
2081
2082         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2083         if (err < 0) {
2084                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2085                                                         MGMT_STATUS_FAILED);
2086                 goto done;
2087         }
2088
2089         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2090                                                         NULL, 0);
2091 done:
2092         hci_dev_unlock(hdev);
2093         hci_dev_put(hdev);
2094
2095         return err;
2096 }
2097
2098 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2099 {
2100         unsigned char *buf;
2101         struct mgmt_hdr *hdr;
2102         u16 opcode, index, len;
2103         int err;
2104
2105         BT_DBG("got %zu bytes", msglen);
2106
2107         if (msglen < sizeof(*hdr))
2108                 return -EINVAL;
2109
2110         buf = kmalloc(msglen, GFP_KERNEL);
2111         if (!buf)
2112                 return -ENOMEM;
2113
2114         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2115                 err = -EFAULT;
2116                 goto done;
2117         }
2118
2119         hdr = (struct mgmt_hdr *) buf;
2120         opcode = get_unaligned_le16(&hdr->opcode);
2121         index = get_unaligned_le16(&hdr->index);
2122         len = get_unaligned_le16(&hdr->len);
2123
2124         if (len != msglen - sizeof(*hdr)) {
2125                 err = -EINVAL;
2126                 goto done;
2127         }
2128
2129         switch (opcode) {
2130         case MGMT_OP_READ_VERSION:
2131                 err = read_version(sk);
2132                 break;
2133         case MGMT_OP_READ_INDEX_LIST:
2134                 err = read_index_list(sk);
2135                 break;
2136         case MGMT_OP_READ_INFO:
2137                 err = read_controller_info(sk, index);
2138                 break;
2139         case MGMT_OP_SET_POWERED:
2140                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
2141                 break;
2142         case MGMT_OP_SET_DISCOVERABLE:
2143                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
2144                 break;
2145         case MGMT_OP_SET_CONNECTABLE:
2146                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
2147                 break;
2148         case MGMT_OP_SET_FAST_CONNECTABLE:
2149                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
2150                                                                 len);
2151                 break;
2152         case MGMT_OP_SET_PAIRABLE:
2153                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
2154                 break;
2155         case MGMT_OP_ADD_UUID:
2156                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
2157                 break;
2158         case MGMT_OP_REMOVE_UUID:
2159                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
2160                 break;
2161         case MGMT_OP_SET_DEV_CLASS:
2162                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
2163                 break;
2164         case MGMT_OP_LOAD_LINK_KEYS:
2165                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
2166                 break;
2167         case MGMT_OP_REMOVE_KEYS:
2168                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
2169                 break;
2170         case MGMT_OP_DISCONNECT:
2171                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
2172                 break;
2173         case MGMT_OP_GET_CONNECTIONS:
2174                 err = get_connections(sk, index);
2175                 break;
2176         case MGMT_OP_PIN_CODE_REPLY:
2177                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
2178                 break;
2179         case MGMT_OP_PIN_CODE_NEG_REPLY:
2180                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
2181                 break;
2182         case MGMT_OP_SET_IO_CAPABILITY:
2183                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
2184                 break;
2185         case MGMT_OP_PAIR_DEVICE:
2186                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
2187                 break;
2188         case MGMT_OP_USER_CONFIRM_REPLY:
2189                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
2190                 break;
2191         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2192                 err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
2193                                                                         len);
2194                 break;
2195         case MGMT_OP_USER_PASSKEY_REPLY:
2196                 err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
2197                 break;
2198         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2199                 err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
2200                                                                         len);
2201                 break;
2202         case MGMT_OP_SET_LOCAL_NAME:
2203                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
2204                 break;
2205         case MGMT_OP_READ_LOCAL_OOB_DATA:
2206                 err = read_local_oob_data(sk, index);
2207                 break;
2208         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2209                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
2210                 break;
2211         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2212                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
2213                                                                         len);
2214                 break;
2215         case MGMT_OP_START_DISCOVERY:
2216                 err = start_discovery(sk, index, buf + sizeof(*hdr), len);
2217                 break;
2218         case MGMT_OP_STOP_DISCOVERY:
2219                 err = stop_discovery(sk, index);
2220                 break;
2221         case MGMT_OP_BLOCK_DEVICE:
2222                 err = block_device(sk, index, buf + sizeof(*hdr), len);
2223                 break;
2224         case MGMT_OP_UNBLOCK_DEVICE:
2225                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
2226                 break;
2227         default:
2228                 BT_DBG("Unknown op %u", opcode);
2229                 err = cmd_status(sk, index, opcode,
2230                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2231                 break;
2232         }
2233
2234         if (err < 0)
2235                 goto done;
2236
2237         err = msglen;
2238
2239 done:
2240         kfree(buf);
2241         return err;
2242 }
2243
2244 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2245 {
2246         u8 *status = data;
2247
2248         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2249         mgmt_pending_remove(cmd);
2250 }
2251
2252 int mgmt_index_added(struct hci_dev *hdev)
2253 {
2254         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2255 }
2256
2257 int mgmt_index_removed(struct hci_dev *hdev)
2258 {
2259         u8 status = ENODEV;
2260
2261         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2262
2263         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2264 }
2265
2266 struct cmd_lookup {
2267         u8 val;
2268         struct sock *sk;
2269         struct hci_dev *hdev;
2270 };
2271
2272 static void settings_rsp(struct pending_cmd *cmd, void *data)
2273 {
2274         struct cmd_lookup *match = data;
2275
2276         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2277
2278         list_del(&cmd->list);
2279
2280         if (match->sk == NULL) {
2281                 match->sk = cmd->sk;
2282                 sock_hold(match->sk);
2283         }
2284
2285         mgmt_pending_free(cmd);
2286 }
2287
2288 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2289 {
2290         struct cmd_lookup match = { powered, NULL, hdev };
2291         __le32 ev;
2292         int ret;
2293
2294         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2295
2296         if (!powered) {
2297                 u8 status = ENETDOWN;
2298                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2299         }
2300
2301         ev = cpu_to_le32(get_current_settings(hdev));
2302
2303         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2304                                                                 match.sk);
2305
2306         if (match.sk)
2307                 sock_put(match.sk);
2308
2309         return ret;
2310 }
2311
2312 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2313 {
2314         struct cmd_lookup match = { discoverable, NULL, hdev };
2315         __le32 ev;
2316         int ret;
2317
2318         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
2319
2320         ev = cpu_to_le32(get_current_settings(hdev));
2321
2322         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2323                                                                 match.sk);
2324         if (match.sk)
2325                 sock_put(match.sk);
2326
2327         return ret;
2328 }
2329
2330 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2331 {
2332         __le32 ev;
2333         struct cmd_lookup match = { connectable, NULL, hdev };
2334         int ret;
2335
2336         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2337                                                                 &match);
2338
2339         ev = cpu_to_le32(get_current_settings(hdev));
2340
2341         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
2342
2343         if (match.sk)
2344                 sock_put(match.sk);
2345
2346         return ret;
2347 }
2348
2349 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2350 {
2351         u8 mgmt_err = mgmt_status(status);
2352
2353         if (scan & SCAN_PAGE)
2354                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2355                                                 cmd_status_rsp, &mgmt_err);
2356
2357         if (scan & SCAN_INQUIRY)
2358                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2359                                                 cmd_status_rsp, &mgmt_err);
2360
2361         return 0;
2362 }
2363
2364 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2365                                                                 u8 persistent)
2366 {
2367         struct mgmt_ev_new_link_key ev;
2368
2369         memset(&ev, 0, sizeof(ev));
2370
2371         ev.store_hint = persistent;
2372         bacpy(&ev.key.bdaddr, &key->bdaddr);
2373         ev.key.type = key->type;
2374         memcpy(ev.key.val, key->val, 16);
2375         ev.key.pin_len = key->pin_len;
2376
2377         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2378 }
2379
2380 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2381                                                                 u8 addr_type)
2382 {
2383         struct mgmt_addr_info ev;
2384
2385         bacpy(&ev.bdaddr, bdaddr);
2386         ev.type = link_to_mgmt(link_type, addr_type);
2387
2388         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2389 }
2390
2391 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2392 {
2393         struct mgmt_cp_disconnect *cp = cmd->param;
2394         struct sock **sk = data;
2395         struct mgmt_rp_disconnect rp;
2396
2397         bacpy(&rp.bdaddr, &cp->bdaddr);
2398         rp.status = 0;
2399
2400         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2401
2402         *sk = cmd->sk;
2403         sock_hold(*sk);
2404
2405         mgmt_pending_remove(cmd);
2406 }
2407
2408 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2409 {
2410         u8 *status = data;
2411         struct mgmt_cp_remove_keys *cp = cmd->param;
2412         struct mgmt_rp_remove_keys rp;
2413
2414         memset(&rp, 0, sizeof(rp));
2415         bacpy(&rp.bdaddr, &cp->bdaddr);
2416         if (status != NULL)
2417                 rp.status = *status;
2418
2419         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2420                                                                 sizeof(rp));
2421
2422         mgmt_pending_remove(cmd);
2423 }
2424
2425 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2426                                                                 u8 addr_type)
2427 {
2428         struct mgmt_addr_info ev;
2429         struct sock *sk = NULL;
2430         int err;
2431
2432         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2433
2434         bacpy(&ev.bdaddr, bdaddr);
2435         ev.type = link_to_mgmt(link_type, addr_type);
2436
2437         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2438
2439         if (sk)
2440                 sock_put(sk);
2441
2442         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2443
2444         return err;
2445 }
2446
2447 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2448 {
2449         struct pending_cmd *cmd;
2450         u8 mgmt_err = mgmt_status(status);
2451         int err;
2452
2453         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2454         if (!cmd)
2455                 return -ENOENT;
2456
2457         if (bdaddr) {
2458                 struct mgmt_rp_disconnect rp;
2459
2460                 bacpy(&rp.bdaddr, bdaddr);
2461                 rp.status = status;
2462
2463                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2464                                                         &rp, sizeof(rp));
2465         } else
2466                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2467                                                                 mgmt_err);
2468
2469         mgmt_pending_remove(cmd);
2470
2471         return err;
2472 }
2473
2474 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2475                                                 u8 addr_type, u8 status)
2476 {
2477         struct mgmt_ev_connect_failed ev;
2478
2479         bacpy(&ev.addr.bdaddr, bdaddr);
2480         ev.addr.type = link_to_mgmt(link_type, addr_type);
2481         ev.status = mgmt_status(status);
2482
2483         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2484 }
2485
2486 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2487 {
2488         struct mgmt_ev_pin_code_request ev;
2489
2490         bacpy(&ev.bdaddr, bdaddr);
2491         ev.secure = secure;
2492
2493         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2494                                                                         NULL);
2495 }
2496
2497 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2498                                                                 u8 status)
2499 {
2500         struct pending_cmd *cmd;
2501         struct mgmt_rp_pin_code_reply rp;
2502         int err;
2503
2504         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2505         if (!cmd)
2506                 return -ENOENT;
2507
2508         bacpy(&rp.bdaddr, bdaddr);
2509         rp.status = mgmt_status(status);
2510
2511         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2512                                                                 sizeof(rp));
2513
2514         mgmt_pending_remove(cmd);
2515
2516         return err;
2517 }
2518
2519 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2520                                                                 u8 status)
2521 {
2522         struct pending_cmd *cmd;
2523         struct mgmt_rp_pin_code_reply rp;
2524         int err;
2525
2526         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2527         if (!cmd)
2528                 return -ENOENT;
2529
2530         bacpy(&rp.bdaddr, bdaddr);
2531         rp.status = mgmt_status(status);
2532
2533         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2534                                                                 sizeof(rp));
2535
2536         mgmt_pending_remove(cmd);
2537
2538         return err;
2539 }
2540
2541 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2542                                                 __le32 value, u8 confirm_hint)
2543 {
2544         struct mgmt_ev_user_confirm_request ev;
2545
2546         BT_DBG("%s", hdev->name);
2547
2548         bacpy(&ev.bdaddr, bdaddr);
2549         ev.confirm_hint = confirm_hint;
2550         put_unaligned_le32(value, &ev.value);
2551
2552         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2553                                                                         NULL);
2554 }
2555
2556 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2557 {
2558         struct mgmt_ev_user_passkey_request ev;
2559
2560         BT_DBG("%s", hdev->name);
2561
2562         bacpy(&ev.bdaddr, bdaddr);
2563
2564         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2565                                                                         NULL);
2566 }
2567
2568 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2569                                                         u8 status, u8 opcode)
2570 {
2571         struct pending_cmd *cmd;
2572         struct mgmt_rp_user_confirm_reply rp;
2573         int err;
2574
2575         cmd = mgmt_pending_find(opcode, hdev);
2576         if (!cmd)
2577                 return -ENOENT;
2578
2579         bacpy(&rp.bdaddr, bdaddr);
2580         rp.status = mgmt_status(status);
2581         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2582
2583         mgmt_pending_remove(cmd);
2584
2585         return err;
2586 }
2587
2588 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2589                                                                 u8 status)
2590 {
2591         return user_pairing_resp_complete(hdev, bdaddr, status,
2592                                                 MGMT_OP_USER_CONFIRM_REPLY);
2593 }
2594
2595 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2596                                                 bdaddr_t *bdaddr, u8 status)
2597 {
2598         return user_pairing_resp_complete(hdev, bdaddr, status,
2599                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2600 }
2601
2602 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2603                                                                 u8 status)
2604 {
2605         return user_pairing_resp_complete(hdev, bdaddr, status,
2606                                                 MGMT_OP_USER_PASSKEY_REPLY);
2607 }
2608
2609 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2610                                                 bdaddr_t *bdaddr, u8 status)
2611 {
2612         return user_pairing_resp_complete(hdev, bdaddr, status,
2613                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2614 }
2615
2616 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2617 {
2618         struct mgmt_ev_auth_failed ev;
2619
2620         bacpy(&ev.bdaddr, bdaddr);
2621         ev.status = mgmt_status(status);
2622
2623         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2624 }
2625
2626 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2627 {
2628         struct pending_cmd *cmd;
2629         struct mgmt_cp_set_local_name ev;
2630         int err;
2631
2632         memset(&ev, 0, sizeof(ev));
2633         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2634
2635         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2636         if (!cmd)
2637                 goto send_event;
2638
2639         if (status) {
2640                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2641                                                         mgmt_status(status));
2642                 goto failed;
2643         }
2644
2645         update_eir(hdev);
2646
2647         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2648                                                                 sizeof(ev));
2649         if (err < 0)
2650                 goto failed;
2651
2652 send_event:
2653         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2654                                                         cmd ? cmd->sk : NULL);
2655
2656 failed:
2657         if (cmd)
2658                 mgmt_pending_remove(cmd);
2659         return err;
2660 }
2661
2662 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2663                                                 u8 *randomizer, u8 status)
2664 {
2665         struct pending_cmd *cmd;
2666         int err;
2667
2668         BT_DBG("%s status %u", hdev->name, status);
2669
2670         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2671         if (!cmd)
2672                 return -ENOENT;
2673
2674         if (status) {
2675                 err = cmd_status(cmd->sk, hdev->id,
2676                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2677                                                 mgmt_status(status));
2678         } else {
2679                 struct mgmt_rp_read_local_oob_data rp;
2680
2681                 memcpy(rp.hash, hash, sizeof(rp.hash));
2682                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2683
2684                 err = cmd_complete(cmd->sk, hdev->id,
2685                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2686                                                 &rp, sizeof(rp));
2687         }
2688
2689         mgmt_pending_remove(cmd);
2690
2691         return err;
2692 }
2693
2694 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2695                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2696 {
2697         struct mgmt_ev_device_found ev;
2698
2699         memset(&ev, 0, sizeof(ev));
2700
2701         bacpy(&ev.addr.bdaddr, bdaddr);
2702         ev.addr.type = link_to_mgmt(link_type, addr_type);
2703         ev.rssi = rssi;
2704
2705         if (eir)
2706                 memcpy(ev.eir, eir, sizeof(ev.eir));
2707
2708         if (dev_class)
2709                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2710
2711         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2712 }
2713
2714 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2715 {
2716         struct mgmt_ev_remote_name ev;
2717
2718         memset(&ev, 0, sizeof(ev));
2719
2720         bacpy(&ev.bdaddr, bdaddr);
2721         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2722
2723         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2724 }
2725
2726 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2727 {
2728         struct pending_cmd *cmd;
2729         int err;
2730
2731         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2732         if (!cmd)
2733                 return -ENOENT;
2734
2735         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2736         mgmt_pending_remove(cmd);
2737
2738         return err;
2739 }
2740
2741 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2742 {
2743         struct pending_cmd *cmd;
2744         int err;
2745
2746         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2747         if (!cmd)
2748                 return -ENOENT;
2749
2750         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2751         mgmt_pending_remove(cmd);
2752
2753         return err;
2754 }
2755
2756 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2757 {
2758         struct pending_cmd *cmd;
2759
2760         if (discovering)
2761                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2762         else
2763                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2764
2765         if (cmd != NULL) {
2766                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2767                 mgmt_pending_remove(cmd);
2768         }
2769
2770         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2771                                                 sizeof(discovering), NULL);
2772 }
2773
2774 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2775 {
2776         struct pending_cmd *cmd;
2777         struct mgmt_ev_device_blocked ev;
2778
2779         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2780
2781         bacpy(&ev.bdaddr, bdaddr);
2782
2783         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2784                                                         cmd ? cmd->sk : NULL);
2785 }
2786
2787 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2788 {
2789         struct pending_cmd *cmd;
2790         struct mgmt_ev_device_unblocked ev;
2791
2792         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2793
2794         bacpy(&ev.bdaddr, bdaddr);
2795
2796         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2797                                                         cmd ? cmd->sk : NULL);
2798 }