net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #define MGMT_VERSION    0
  34 #define MGMT_REVISION   1
  35
  36 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  37
  38 struct pending_cmd {
  39         struct list_head list;
  40         u16 opcode;
  41         int index;
  42         void *param;
  43         struct sock *sk;
  44         void *user_data;
  45 };
  46
  47 /* HCI to MGMT error code conversion table */
  48 static u8 mgmt_status_table[] = {
  49         MGMT_STATUS_SUCCESS,
  50         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  51         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  52         MGMT_STATUS_FAILED,             /* Hardware Failure */
  53         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  54         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  55         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  56         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  57         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  58         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  59         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  60         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  61         MGMT_STATUS_BUSY,               /* Command Disallowed */
  62         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  63         MGMT_STATUS_REJECTED,           /* Rejected Security */
  64         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  65         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  66         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  67         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  68         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  69         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  70         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  71         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  72         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  73         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  74         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  75         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  76         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  77         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  78         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  79         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  80         MGMT_STATUS_FAILED,             /* Unspecified Error */
  81         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  82         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  83         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  84         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  85         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  86         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
  87         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
  88         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
  89         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
  90         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
  91         MGMT_STATUS_FAILED,             /* Transaction Collision */
  92         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
  93         MGMT_STATUS_REJECTED,           /* QoS Rejected */
  94         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
  95         MGMT_STATUS_REJECTED,           /* Insufficient Security */
  96         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
  97         MGMT_STATUS_BUSY,               /* Role Switch Pending */
  98         MGMT_STATUS_FAILED,             /* Slot Violation */
  99         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 100         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 101         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 102         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 103         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 104         MGMT_STATUS_BUSY,               /* Controller Busy */
 105         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 106         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 107         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 108         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 109         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 110 };
 111
 112 static u8 mgmt_status(u8 hci_status)
 113 {
 114         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 115                 return mgmt_status_table[hci_status];
 116
 117         return MGMT_STATUS_FAILED;
 118 }
 119
 120 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 121 {
 122         struct sk_buff *skb;
 123         struct mgmt_hdr *hdr;
 124         struct mgmt_ev_cmd_status *ev;
 125         int err;
 126
 127         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 128
 129         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 130         if (!skb)
 131                 return -ENOMEM;
 132
 133         hdr = (void *) skb_put(skb, sizeof(*hdr));
 134
 135         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 136         hdr->index = cpu_to_le16(index);
 137         hdr->len = cpu_to_le16(sizeof(*ev));
 138
 139         ev = (void *) skb_put(skb, sizeof(*ev));
 140         ev->status = status;
 141         put_unaligned_le16(cmd, &ev->opcode);
 142
 143         err = sock_queue_rcv_skb(sk, skb);
 144         if (err < 0)
 145                 kfree_skb(skb);
 146
 147         return err;
 148 }
 149
 150 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 151                                                                 size_t rp_len)
 152 {
 153         struct sk_buff *skb;
 154         struct mgmt_hdr *hdr;
 155         struct mgmt_ev_cmd_complete *ev;
 156         int err;
 157
 158         BT_DBG("sock %p", sk);
 159
 160         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 161         if (!skb)
 162                 return -ENOMEM;
 163
 164         hdr = (void *) skb_put(skb, sizeof(*hdr));
 165
 166         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 167         hdr->index = cpu_to_le16(index);
 168         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 169
 170         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 171         put_unaligned_le16(cmd, &ev->opcode);
 172
 173         if (rp)
 174                 memcpy(ev->data, rp, rp_len);
 175
 176         err = sock_queue_rcv_skb(sk, skb);
 177         if (err < 0)
 178                 kfree_skb(skb);
 179
 180         return err;;
 181 }
 182
 183 static int read_version(struct sock *sk)
 184 {
 185         struct mgmt_rp_read_version rp;
 186
 187         BT_DBG("sock %p", sk);
 188
 189         rp.version = MGMT_VERSION;
 190         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 191
 192         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 193                                                                 sizeof(rp));
 194 }
 195
 196 static int read_index_list(struct sock *sk)
 197 {
 198         struct mgmt_rp_read_index_list *rp;
 199         struct list_head *p;
 200         struct hci_dev *d;
 201         size_t rp_len;
 202         u16 count;
 203         int i, err;
 204
 205         BT_DBG("sock %p", sk);
 206
 207         read_lock(&hci_dev_list_lock);
 208
 209         count = 0;
 210         list_for_each(p, &hci_dev_list) {
 211                 count++;
 212         }
 213
 214         rp_len = sizeof(*rp) + (2 * count);
 215         rp = kmalloc(rp_len, GFP_ATOMIC);
 216         if (!rp) {
 217                 read_unlock(&hci_dev_list_lock);
 218                 return -ENOMEM;
 219         }
 220
 221         put_unaligned_le16(count, &rp->num_controllers);
 222
 223         i = 0;
 224         list_for_each_entry(d, &hci_dev_list, list) {
 225                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 226                         cancel_delayed_work(&d->power_off);
 227
 228                 if (test_bit(HCI_SETUP, &d->flags))
 229                         continue;
 230
 231                 put_unaligned_le16(d->id, &rp->index[i++]);
 232                 BT_DBG("Added hci%u", d->id);
 233         }
 234
 235         read_unlock(&hci_dev_list_lock);
 236
 237         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 238                                                                         rp_len);
 239
 240         kfree(rp);
 241
 242         return err;
 243 }
 244
 245 static int read_controller_info(struct sock *sk, u16 index)
 246 {
 247         struct mgmt_rp_read_info rp;
 248         struct hci_dev *hdev;
 249
 250         BT_DBG("sock %p hci%u", sk, index);
 251
 252         hdev = hci_dev_get(index);
 253         if (!hdev)
 254                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 255                                                 MGMT_STATUS_INVALID_PARAMS);
 256
 257         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 258                 cancel_delayed_work_sync(&hdev->power_off);
 259
 260         hci_dev_lock(hdev);
 261
 262         set_bit(HCI_MGMT, &hdev->flags);
 263
 264         memset(&rp, 0, sizeof(rp));
 265
 266         rp.type = hdev->dev_type;
 267
 268         rp.powered = test_bit(HCI_UP, &hdev->flags);
 269         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 270         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 271         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 272
 273         if (test_bit(HCI_AUTH, &hdev->flags))
 274                 rp.sec_mode = 3;
 275         else if (hdev->ssp_mode > 0)
 276                 rp.sec_mode = 4;
 277         else
 278                 rp.sec_mode = 2;
 279
 280         bacpy(&rp.bdaddr, &hdev->bdaddr);
 281         memcpy(rp.features, hdev->features, 8);
 282         memcpy(rp.dev_class, hdev->dev_class, 3);
 283         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 284         rp.hci_ver = hdev->hci_ver;
 285         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 286
 287         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 288
 289         hci_dev_unlock(hdev);
 290         hci_dev_put(hdev);
 291
 292         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 293 }
 294
 295 static void mgmt_pending_free(struct pending_cmd *cmd)
 296 {
 297         sock_put(cmd->sk);
 298         kfree(cmd->param);
 299         kfree(cmd);
 300 }
 301
 302 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 303                                                         struct hci_dev *hdev,
 304                                                         void *data, u16 len)
 305 {
 306         struct pending_cmd *cmd;
 307
 308         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 309         if (!cmd)
 310                 return NULL;
 311
 312         cmd->opcode = opcode;
 313         cmd->index = hdev->id;
 314
 315         cmd->param = kmalloc(len, GFP_ATOMIC);
 316         if (!cmd->param) {
 317                 kfree(cmd);
 318                 return NULL;
 319         }
 320
 321         if (data)
 322                 memcpy(cmd->param, data, len);
 323
 324         cmd->sk = sk;
 325         sock_hold(sk);
 326
 327         list_add(&cmd->list, &hdev->mgmt_pending);
 328
 329         return cmd;
 330 }
 331
 332 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 333                                 void (*cb)(struct pending_cmd *cmd, void *data),
 334                                 void *data)
 335 {
 336         struct list_head *p, *n;
 337
 338         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 339                 struct pending_cmd *cmd;
 340
 341                 cmd = list_entry(p, struct pending_cmd, list);
 342
 343                 if (opcode > 0 && cmd->opcode != opcode)
 344                         continue;
 345
 346                 cb(cmd, data);
 347         }
 348 }
 349
 350 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 351 {
 352         struct pending_cmd *cmd;
 353
 354         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 355                 if (cmd->opcode == opcode)
 356                         return cmd;
 357         }
 358
 359         return NULL;
 360 }
 361
 362 static void mgmt_pending_remove(struct pending_cmd *cmd)
 363 {
 364         list_del(&cmd->list);
 365         mgmt_pending_free(cmd);
 366 }
 367
 368 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 369 {
 370         struct mgmt_mode rp;
 371
 372         rp.val = val;
 373
 374         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 375 }
 376
 377 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 378 {
 379         struct mgmt_mode *cp;
 380         struct hci_dev *hdev;
 381         struct pending_cmd *cmd;
 382         int err, up;
 383
 384         cp = (void *) data;
 385
 386         BT_DBG("request for hci%u", index);
 387
 388         if (len != sizeof(*cp))
 389                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 390                                                 MGMT_STATUS_INVALID_PARAMS);
 391
 392         hdev = hci_dev_get(index);
 393         if (!hdev)
 394                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 395                                                 MGMT_STATUS_INVALID_PARAMS);
 396
 397         hci_dev_lock(hdev);
 398
 399         up = test_bit(HCI_UP, &hdev->flags);
 400         if ((cp->val && up) || (!cp->val && !up)) {
 401                 err = send_mode_rsp(sk, index, MGMT_OP_SET_POWERED, cp->val);
 402                 goto failed;
 403         }
 404
 405         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 406                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 407                                                         MGMT_STATUS_BUSY);
 408                 goto failed;
 409         }
 410
 411         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 412         if (!cmd) {
 413                 err = -ENOMEM;
 414                 goto failed;
 415         }
 416
 417         if (cp->val)
 418                 schedule_work(&hdev->power_on);
 419         else
 420                 schedule_work(&hdev->power_off.work);
 421
 422         err = 0;
 423
 424 failed:
 425         hci_dev_unlock(hdev);
 426         hci_dev_put(hdev);
 427         return err;
 428 }
 429
 430 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 431                                                                         u16 len)
 432 {
 433         struct mgmt_cp_set_discoverable *cp;
 434         struct hci_dev *hdev;
 435         struct pending_cmd *cmd;
 436         u8 scan;
 437         int err;
 438
 439         cp = (void *) data;
 440
 441         BT_DBG("request for hci%u", index);
 442
 443         if (len != sizeof(*cp))
 444                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 445                                                 MGMT_STATUS_INVALID_PARAMS);
 446
 447         hdev = hci_dev_get(index);
 448         if (!hdev)
 449                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 450                                                 MGMT_STATUS_INVALID_PARAMS);
 451
 452         hci_dev_lock(hdev);
 453
 454         if (!test_bit(HCI_UP, &hdev->flags)) {
 455                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 456                                                 MGMT_STATUS_NOT_POWERED);
 457                 goto failed;
 458         }
 459
 460         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 461                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 462                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 463                                                         MGMT_STATUS_BUSY);
 464                 goto failed;
 465         }
 466
 467         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 468                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 469                 err = send_mode_rsp(sk, index, MGMT_OP_SET_DISCOVERABLE,
 470                                                                 cp->val);
 471                 goto failed;
 472         }
 473
 474         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 475         if (!cmd) {
 476                 err = -ENOMEM;
 477                 goto failed;
 478         }
 479
 480         scan = SCAN_PAGE;
 481
 482         if (cp->val)
 483                 scan |= SCAN_INQUIRY;
 484         else
 485                 cancel_delayed_work(&hdev->discov_off);
 486
 487         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 488         if (err < 0)
 489                 mgmt_pending_remove(cmd);
 490
 491         if (cp->val)
 492                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 493
 494 failed:
 495         hci_dev_unlock(hdev);
 496         hci_dev_put(hdev);
 497
 498         return err;
 499 }
 500
 501 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 502                                                                         u16 len)
 503 {
 504         struct mgmt_mode *cp;
 505         struct hci_dev *hdev;
 506         struct pending_cmd *cmd;
 507         u8 scan;
 508         int err;
 509
 510         cp = (void *) data;
 511
 512         BT_DBG("request for hci%u", index);
 513
 514         if (len != sizeof(*cp))
 515                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 516                                                 MGMT_STATUS_INVALID_PARAMS);
 517
 518         hdev = hci_dev_get(index);
 519         if (!hdev)
 520                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 521                                                 MGMT_STATUS_INVALID_PARAMS);
 522
 523         hci_dev_lock(hdev);
 524
 525         if (!test_bit(HCI_UP, &hdev->flags)) {
 526                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 527                                                 MGMT_STATUS_NOT_POWERED);
 528                 goto failed;
 529         }
 530
 531         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 532                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 533                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 534                                                         MGMT_STATUS_BUSY);
 535                 goto failed;
 536         }
 537
 538         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 539                 err = send_mode_rsp(sk, index, MGMT_OP_SET_CONNECTABLE,
 540                                                                 cp->val);
 541                 goto failed;
 542         }
 543
 544         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 545         if (!cmd) {
 546                 err = -ENOMEM;
 547                 goto failed;
 548         }
 549
 550         if (cp->val)
 551                 scan = SCAN_PAGE;
 552         else
 553                 scan = 0;
 554
 555         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 556         if (err < 0)
 557                 mgmt_pending_remove(cmd);
 558
 559 failed:
 560         hci_dev_unlock(hdev);
 561         hci_dev_put(hdev);
 562
 563         return err;
 564 }
 565
 566 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 567                                         u16 data_len, struct sock *skip_sk)
 568 {
 569         struct sk_buff *skb;
 570         struct mgmt_hdr *hdr;
 571
 572         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 573         if (!skb)
 574                 return -ENOMEM;
 575
 576         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 577
 578         hdr = (void *) skb_put(skb, sizeof(*hdr));
 579         hdr->opcode = cpu_to_le16(event);
 580         if (hdev)
 581                 hdr->index = cpu_to_le16(hdev->id);
 582         else
 583                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 584         hdr->len = cpu_to_le16(data_len);
 585
 586         if (data)
 587                 memcpy(skb_put(skb, data_len), data, data_len);
 588
 589         hci_send_to_sock(NULL, skb, skip_sk);
 590         kfree_skb(skb);
 591
 592         return 0;
 593 }
 594
 595 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 596                                                                         u16 len)
 597 {
 598         struct mgmt_mode *cp, ev;
 599         struct hci_dev *hdev;
 600         int err;
 601
 602         cp = (void *) data;
 603
 604         BT_DBG("request for hci%u", index);
 605
 606         if (len != sizeof(*cp))
 607                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 608                                                 MGMT_STATUS_INVALID_PARAMS);
 609
 610         hdev = hci_dev_get(index);
 611         if (!hdev)
 612                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 613                                                 MGMT_STATUS_INVALID_PARAMS);
 614
 615         hci_dev_lock(hdev);
 616
 617         if (cp->val)
 618                 set_bit(HCI_PAIRABLE, &hdev->flags);
 619         else
 620                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 621
 622         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 623         if (err < 0)
 624                 goto failed;
 625
 626         ev.val = cp->val;
 627
 628         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 629
 630 failed:
 631         hci_dev_unlock(hdev);
 632         hci_dev_put(hdev);
 633
 634         return err;
 635 }
 636
 637 #define EIR_FLAGS               0x01 /* flags */
 638 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 639 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 640 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 641 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 642 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 643 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 644 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 645 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 646 #define EIR_TX_POWER            0x0A /* transmit power level */
 647 #define EIR_DEVICE_ID           0x10 /* device ID */
 648
 649 #define PNP_INFO_SVCLASS_ID             0x1200
 650
 651 static u8 bluetooth_base_uuid[] = {
 652                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 653                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 654 };
 655
 656 static u16 get_uuid16(u8 *uuid128)
 657 {
 658         u32 val;
 659         int i;
 660
 661         for (i = 0; i < 12; i++) {
 662                 if (bluetooth_base_uuid[i] != uuid128[i])
 663                         return 0;
 664         }
 665
 666         memcpy(&val, &uuid128[12], 4);
 667
 668         val = le32_to_cpu(val);
 669         if (val > 0xffff)
 670                 return 0;
 671
 672         return (u16) val;
 673 }
 674
 675 static void create_eir(struct hci_dev *hdev, u8 *data)
 676 {
 677         u8 *ptr = data;
 678         u16 eir_len = 0;
 679         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 680         int i, truncated = 0;
 681         struct bt_uuid *uuid;
 682         size_t name_len;
 683
 684         name_len = strlen(hdev->dev_name);
 685
 686         if (name_len > 0) {
 687                 /* EIR Data type */
 688                 if (name_len > 48) {
 689                         name_len = 48;
 690                         ptr[1] = EIR_NAME_SHORT;
 691                 } else
 692                         ptr[1] = EIR_NAME_COMPLETE;
 693
 694                 /* EIR Data length */
 695                 ptr[0] = name_len + 1;
 696
 697                 memcpy(ptr + 2, hdev->dev_name, name_len);
 698
 699                 eir_len += (name_len + 2);
 700                 ptr += (name_len + 2);
 701         }
 702
 703         memset(uuid16_list, 0, sizeof(uuid16_list));
 704
 705         /* Group all UUID16 types */
 706         list_for_each_entry(uuid, &hdev->uuids, list) {
 707                 u16 uuid16;
 708
 709                 uuid16 = get_uuid16(uuid->uuid);
 710                 if (uuid16 == 0)
 711                         return;
 712
 713                 if (uuid16 < 0x1100)
 714                         continue;
 715
 716                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 717                         continue;
 718
 719                 /* Stop if not enough space to put next UUID */
 720                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 721                         truncated = 1;
 722                         break;
 723                 }
 724
 725                 /* Check for duplicates */
 726                 for (i = 0; uuid16_list[i] != 0; i++)
 727                         if (uuid16_list[i] == uuid16)
 728                                 break;
 729
 730                 if (uuid16_list[i] == 0) {
 731                         uuid16_list[i] = uuid16;
 732                         eir_len += sizeof(u16);
 733                 }
 734         }
 735
 736         if (uuid16_list[0] != 0) {
 737                 u8 *length = ptr;
 738
 739                 /* EIR Data type */
 740                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 741
 742                 ptr += 2;
 743                 eir_len += 2;
 744
 745                 for (i = 0; uuid16_list[i] != 0; i++) {
 746                         *ptr++ = (uuid16_list[i] & 0x00ff);
 747                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 748                 }
 749
 750                 /* EIR Data length */
 751                 *length = (i * sizeof(u16)) + 1;
 752         }
 753 }
 754
 755 static int update_eir(struct hci_dev *hdev)
 756 {
 757         struct hci_cp_write_eir cp;
 758
 759         if (!(hdev->features[6] & LMP_EXT_INQ))
 760                 return 0;
 761
 762         if (hdev->ssp_mode == 0)
 763                 return 0;
 764
 765         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 766                 return 0;
 767
 768         memset(&cp, 0, sizeof(cp));
 769
 770         create_eir(hdev, cp.data);
 771
 772         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 773                 return 0;
 774
 775         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 776
 777         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 778 }
 779
 780 static u8 get_service_classes(struct hci_dev *hdev)
 781 {
 782         struct bt_uuid *uuid;
 783         u8 val = 0;
 784
 785         list_for_each_entry(uuid, &hdev->uuids, list)
 786                 val |= uuid->svc_hint;
 787
 788         return val;
 789 }
 790
 791 static int update_class(struct hci_dev *hdev)
 792 {
 793         u8 cod[3];
 794
 795         BT_DBG("%s", hdev->name);
 796
 797         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 798                 return 0;
 799
 800         cod[0] = hdev->minor_class;
 801         cod[1] = hdev->major_class;
 802         cod[2] = get_service_classes(hdev);
 803
 804         if (memcmp(cod, hdev->dev_class, 3) == 0)
 805                 return 0;
 806
 807         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 808 }
 809
 810 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 811 {
 812         struct mgmt_cp_add_uuid *cp;
 813         struct hci_dev *hdev;
 814         struct bt_uuid *uuid;
 815         int err;
 816
 817         cp = (void *) data;
 818
 819         BT_DBG("request for hci%u", index);
 820
 821         if (len != sizeof(*cp))
 822                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 823                                                 MGMT_STATUS_INVALID_PARAMS);
 824
 825         hdev = hci_dev_get(index);
 826         if (!hdev)
 827                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 828                                                 MGMT_STATUS_INVALID_PARAMS);
 829
 830         hci_dev_lock(hdev);
 831
 832         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 833         if (!uuid) {
 834                 err = -ENOMEM;
 835                 goto failed;
 836         }
 837
 838         memcpy(uuid->uuid, cp->uuid, 16);
 839         uuid->svc_hint = cp->svc_hint;
 840
 841         list_add(&uuid->list, &hdev->uuids);
 842
 843         err = update_class(hdev);
 844         if (err < 0)
 845                 goto failed;
 846
 847         err = update_eir(hdev);
 848         if (err < 0)
 849                 goto failed;
 850
 851         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 852
 853 failed:
 854         hci_dev_unlock(hdev);
 855         hci_dev_put(hdev);
 856
 857         return err;
 858 }
 859
 860 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 861 {
 862         struct list_head *p, *n;
 863         struct mgmt_cp_remove_uuid *cp;
 864         struct hci_dev *hdev;
 865         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 866         int err, found;
 867
 868         cp = (void *) data;
 869
 870         BT_DBG("request for hci%u", index);
 871
 872         if (len != sizeof(*cp))
 873                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 874                                                 MGMT_STATUS_INVALID_PARAMS);
 875
 876         hdev = hci_dev_get(index);
 877         if (!hdev)
 878                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 879                                                 MGMT_STATUS_INVALID_PARAMS);
 880
 881         hci_dev_lock(hdev);
 882
 883         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 884                 err = hci_uuids_clear(hdev);
 885                 goto unlock;
 886         }
 887
 888         found = 0;
 889
 890         list_for_each_safe(p, n, &hdev->uuids) {
 891                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 892
 893                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 894                         continue;
 895
 896                 list_del(&match->list);
 897                 found++;
 898         }
 899
 900         if (found == 0) {
 901                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 902                                                 MGMT_STATUS_INVALID_PARAMS);
 903                 goto unlock;
 904         }
 905
 906         err = update_class(hdev);
 907         if (err < 0)
 908                 goto unlock;
 909
 910         err = update_eir(hdev);
 911         if (err < 0)
 912                 goto unlock;
 913
 914         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 915
 916 unlock:
 917         hci_dev_unlock(hdev);
 918         hci_dev_put(hdev);
 919
 920         return err;
 921 }
 922
 923 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 924                                                                         u16 len)
 925 {
 926         struct hci_dev *hdev;
 927         struct mgmt_cp_set_dev_class *cp;
 928         int err;
 929
 930         cp = (void *) data;
 931
 932         BT_DBG("request for hci%u", index);
 933
 934         if (len != sizeof(*cp))
 935                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 936                                                 MGMT_STATUS_INVALID_PARAMS);
 937
 938         hdev = hci_dev_get(index);
 939         if (!hdev)
 940                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
 941                                                 MGMT_STATUS_INVALID_PARAMS);
 942
 943         hci_dev_lock(hdev);
 944
 945         hdev->major_class = cp->major;
 946         hdev->minor_class = cp->minor;
 947
 948         err = update_class(hdev);
 949
 950         if (err == 0)
 951                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 952
 953         hci_dev_unlock(hdev);
 954         hci_dev_put(hdev);
 955
 956         return err;
 957 }
 958
 959 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 960                                                                         u16 len)
 961 {
 962         struct hci_dev *hdev;
 963         struct mgmt_cp_set_service_cache *cp;
 964         int err;
 965
 966         cp = (void *) data;
 967
 968         if (len != sizeof(*cp))
 969                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
 970                                                 MGMT_STATUS_INVALID_PARAMS);
 971
 972         hdev = hci_dev_get(index);
 973         if (!hdev)
 974                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
 975                                                 MGMT_STATUS_INVALID_PARAMS);
 976
 977         hci_dev_lock(hdev);
 978
 979         BT_DBG("hci%u enable %d", index, cp->enable);
 980
 981         if (cp->enable) {
 982                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 983                 err = 0;
 984         } else {
 985                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 986                 err = update_class(hdev);
 987                 if (err == 0)
 988                         err = update_eir(hdev);
 989         }
 990
 991         if (err == 0)
 992                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 993                                                                         0);
 994         else
 995                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 996
 997
 998         hci_dev_unlock(hdev);
 999         hci_dev_put(hdev);
1000
1001         return err;
1002 }
1003
1004 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
1005                                                                 u16 len)
1006 {
1007         struct hci_dev *hdev;
1008         struct mgmt_cp_load_link_keys *cp;
1009         u16 key_count, expected_len;
1010         int i;
1011
1012         cp = (void *) data;
1013
1014         if (len < sizeof(*cp))
1015                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1016                                                 MGMT_STATUS_INVALID_PARAMS);
1017
1018         key_count = get_unaligned_le16(&cp->key_count);
1019
1020         expected_len = sizeof(*cp) + key_count *
1021                                         sizeof(struct mgmt_link_key_info);
1022         if (expected_len != len) {
1023                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1024                                                         len, expected_len);
1025                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1026                                                 MGMT_STATUS_INVALID_PARAMS);
1027         }
1028
1029         hdev = hci_dev_get(index);
1030         if (!hdev)
1031                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1032                                                 MGMT_STATUS_INVALID_PARAMS);
1033
1034         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1035                                                                 key_count);
1036
1037         hci_dev_lock(hdev);
1038
1039         hci_link_keys_clear(hdev);
1040
1041         set_bit(HCI_LINK_KEYS, &hdev->flags);
1042
1043         if (cp->debug_keys)
1044                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
1045         else
1046                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
1047
1048         for (i = 0; i < key_count; i++) {
1049                 struct mgmt_link_key_info *key = &cp->keys[i];
1050
1051                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1052                                                                 key->pin_len);
1053         }
1054
1055         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1056
1057         hci_dev_unlock(hdev);
1058         hci_dev_put(hdev);
1059
1060         return 0;
1061 }
1062
1063 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
1064                                                                 u16 len)
1065 {
1066         struct hci_dev *hdev;
1067         struct mgmt_cp_remove_keys *cp;
1068         struct mgmt_rp_remove_keys rp;
1069         struct hci_cp_disconnect dc;
1070         struct pending_cmd *cmd;
1071         struct hci_conn *conn;
1072         int err;
1073
1074         cp = (void *) data;
1075
1076         if (len != sizeof(*cp))
1077                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1078                                                 MGMT_STATUS_INVALID_PARAMS);
1079
1080         hdev = hci_dev_get(index);
1081         if (!hdev)
1082                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1083                                                 MGMT_STATUS_INVALID_PARAMS);
1084
1085         hci_dev_lock(hdev);
1086
1087         memset(&rp, 0, sizeof(rp));
1088         bacpy(&rp.bdaddr, &cp->bdaddr);
1089         rp.status = MGMT_STATUS_FAILED;
1090
1091         err = hci_remove_link_key(hdev, &cp->bdaddr);
1092         if (err < 0) {
1093                 rp.status = MGMT_STATUS_NOT_PAIRED;
1094                 goto unlock;
1095         }
1096
1097         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1098                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1099                                                                 sizeof(rp));
1100                 goto unlock;
1101         }
1102
1103         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1104         if (!conn) {
1105                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1106                                                                 sizeof(rp));
1107                 goto unlock;
1108         }
1109
1110         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1111         if (!cmd) {
1112                 err = -ENOMEM;
1113                 goto unlock;
1114         }
1115
1116         put_unaligned_le16(conn->handle, &dc.handle);
1117         dc.reason = 0x13; /* Remote User Terminated Connection */
1118         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1119         if (err < 0)
1120                 mgmt_pending_remove(cmd);
1121
1122 unlock:
1123         if (err < 0)
1124                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1125                                                                 sizeof(rp));
1126         hci_dev_unlock(hdev);
1127         hci_dev_put(hdev);
1128
1129         return err;
1130 }
1131
1132 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1133 {
1134         struct hci_dev *hdev;
1135         struct mgmt_cp_disconnect *cp;
1136         struct hci_cp_disconnect dc;
1137         struct pending_cmd *cmd;
1138         struct hci_conn *conn;
1139         int err;
1140
1141         BT_DBG("");
1142
1143         cp = (void *) data;
1144
1145         if (len != sizeof(*cp))
1146                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1147                                                 MGMT_STATUS_INVALID_PARAMS);
1148
1149         hdev = hci_dev_get(index);
1150         if (!hdev)
1151                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1152                                                 MGMT_STATUS_INVALID_PARAMS);
1153
1154         hci_dev_lock(hdev);
1155
1156         if (!test_bit(HCI_UP, &hdev->flags)) {
1157                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1158                                                 MGMT_STATUS_NOT_POWERED);
1159                 goto failed;
1160         }
1161
1162         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1163                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1164                                                         MGMT_STATUS_BUSY);
1165                 goto failed;
1166         }
1167
1168         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1169         if (!conn)
1170                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1171
1172         if (!conn) {
1173                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1174                                                 MGMT_STATUS_NOT_CONNECTED);
1175                 goto failed;
1176         }
1177
1178         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1179         if (!cmd) {
1180                 err = -ENOMEM;
1181                 goto failed;
1182         }
1183
1184         put_unaligned_le16(conn->handle, &dc.handle);
1185         dc.reason = 0x13; /* Remote User Terminated Connection */
1186
1187         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1188         if (err < 0)
1189                 mgmt_pending_remove(cmd);
1190
1191 failed:
1192         hci_dev_unlock(hdev);
1193         hci_dev_put(hdev);
1194
1195         return err;
1196 }
1197
1198 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1199 {
1200         switch (link_type) {
1201         case LE_LINK:
1202                 switch (addr_type) {
1203                 case ADDR_LE_DEV_PUBLIC:
1204                         return MGMT_ADDR_LE_PUBLIC;
1205                 case ADDR_LE_DEV_RANDOM:
1206                         return MGMT_ADDR_LE_RANDOM;
1207                 default:
1208                         return MGMT_ADDR_INVALID;
1209                 }
1210         case ACL_LINK:
1211                 return MGMT_ADDR_BREDR;
1212         default:
1213                 return MGMT_ADDR_INVALID;
1214         }
1215 }
1216
1217 static int get_connections(struct sock *sk, u16 index)
1218 {
1219         struct mgmt_rp_get_connections *rp;
1220         struct hci_dev *hdev;
1221         struct hci_conn *c;
1222         struct list_head *p;
1223         size_t rp_len;
1224         u16 count;
1225         int i, err;
1226
1227         BT_DBG("");
1228
1229         hdev = hci_dev_get(index);
1230         if (!hdev)
1231                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1232                                                 MGMT_STATUS_INVALID_PARAMS);
1233
1234         hci_dev_lock(hdev);
1235
1236         count = 0;
1237         list_for_each(p, &hdev->conn_hash.list) {
1238                 count++;
1239         }
1240
1241         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1242         rp = kmalloc(rp_len, GFP_ATOMIC);
1243         if (!rp) {
1244                 err = -ENOMEM;
1245                 goto unlock;
1246         }
1247
1248         put_unaligned_le16(count, &rp->conn_count);
1249
1250         i = 0;
1251         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1252                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1253                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1254                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1255                         continue;
1256                 i++;
1257         }
1258
1259         /* Recalculate length in case of filtered SCO connections, etc */
1260         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1261
1262         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1263
1264 unlock:
1265         kfree(rp);
1266         hci_dev_unlock(hdev);
1267         hci_dev_put(hdev);
1268         return err;
1269 }
1270
1271 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1272                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1273 {
1274         struct pending_cmd *cmd;
1275         int err;
1276
1277         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1278                                                                 sizeof(*cp));
1279         if (!cmd)
1280                 return -ENOMEM;
1281
1282         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1283                                                                 &cp->bdaddr);
1284         if (err < 0)
1285                 mgmt_pending_remove(cmd);
1286
1287         return err;
1288 }
1289
1290 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1291                                                                         u16 len)
1292 {
1293         struct hci_dev *hdev;
1294         struct hci_conn *conn;
1295         struct mgmt_cp_pin_code_reply *cp;
1296         struct mgmt_cp_pin_code_neg_reply ncp;
1297         struct hci_cp_pin_code_reply reply;
1298         struct pending_cmd *cmd;
1299         int err;
1300
1301         BT_DBG("");
1302
1303         cp = (void *) data;
1304
1305         if (len != sizeof(*cp))
1306                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1307                                                 MGMT_STATUS_INVALID_PARAMS);
1308
1309         hdev = hci_dev_get(index);
1310         if (!hdev)
1311                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1312                                                 MGMT_STATUS_INVALID_PARAMS);
1313
1314         hci_dev_lock(hdev);
1315
1316         if (!test_bit(HCI_UP, &hdev->flags)) {
1317                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1318                                                 MGMT_STATUS_NOT_POWERED);
1319                 goto failed;
1320         }
1321
1322         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1323         if (!conn) {
1324                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1325                                                 MGMT_STATUS_NOT_CONNECTED);
1326                 goto failed;
1327         }
1328
1329         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1330                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1331
1332                 BT_ERR("PIN code is not 16 bytes long");
1333
1334                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1335                 if (err >= 0)
1336                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1337                                                 MGMT_STATUS_INVALID_PARAMS);
1338
1339                 goto failed;
1340         }
1341
1342         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1343         if (!cmd) {
1344                 err = -ENOMEM;
1345                 goto failed;
1346         }
1347
1348         bacpy(&reply.bdaddr, &cp->bdaddr);
1349         reply.pin_len = cp->pin_len;
1350         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1351
1352         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1353         if (err < 0)
1354                 mgmt_pending_remove(cmd);
1355
1356 failed:
1357         hci_dev_unlock(hdev);
1358         hci_dev_put(hdev);
1359
1360         return err;
1361 }
1362
1363 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1364                                                                         u16 len)
1365 {
1366         struct hci_dev *hdev;
1367         struct mgmt_cp_pin_code_neg_reply *cp;
1368         int err;
1369
1370         BT_DBG("");
1371
1372         cp = (void *) data;
1373
1374         if (len != sizeof(*cp))
1375                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1376                                                 MGMT_STATUS_INVALID_PARAMS);
1377
1378         hdev = hci_dev_get(index);
1379         if (!hdev)
1380                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1381                                                 MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (!test_bit(HCI_UP, &hdev->flags)) {
1386                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1387                                                 MGMT_STATUS_NOT_POWERED);
1388                 goto failed;
1389         }
1390
1391         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1392
1393 failed:
1394         hci_dev_unlock(hdev);
1395         hci_dev_put(hdev);
1396
1397         return err;
1398 }
1399
1400 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1401                                                                         u16 len)
1402 {
1403         struct hci_dev *hdev;
1404         struct mgmt_cp_set_io_capability *cp;
1405
1406         BT_DBG("");
1407
1408         cp = (void *) data;
1409
1410         if (len != sizeof(*cp))
1411                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1412                                                 MGMT_STATUS_INVALID_PARAMS);
1413
1414         hdev = hci_dev_get(index);
1415         if (!hdev)
1416                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1417                                                 MGMT_STATUS_INVALID_PARAMS);
1418
1419         hci_dev_lock(hdev);
1420
1421         hdev->io_capability = cp->io_capability;
1422
1423         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1424                                                         hdev->io_capability);
1425
1426         hci_dev_unlock(hdev);
1427         hci_dev_put(hdev);
1428
1429         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1430 }
1431
1432 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1433 {
1434         struct hci_dev *hdev = conn->hdev;
1435         struct pending_cmd *cmd;
1436
1437         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1438                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1439                         continue;
1440
1441                 if (cmd->user_data != conn)
1442                         continue;
1443
1444                 return cmd;
1445         }
1446
1447         return NULL;
1448 }
1449
1450 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1451 {
1452         struct mgmt_rp_pair_device rp;
1453         struct hci_conn *conn = cmd->user_data;
1454
1455         bacpy(&rp.addr.bdaddr, &conn->dst);
1456         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1457         rp.status = status;
1458
1459         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1460
1461         /* So we don't get further callbacks for this connection */
1462         conn->connect_cfm_cb = NULL;
1463         conn->security_cfm_cb = NULL;
1464         conn->disconn_cfm_cb = NULL;
1465
1466         hci_conn_put(conn);
1467
1468         mgmt_pending_remove(cmd);
1469 }
1470
1471 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1472 {
1473         struct pending_cmd *cmd;
1474
1475         BT_DBG("status %u", status);
1476
1477         cmd = find_pairing(conn);
1478         if (!cmd)
1479                 BT_DBG("Unable to find a pending command");
1480         else
1481                 pairing_complete(cmd, status);
1482 }
1483
1484 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1485 {
1486         struct hci_dev *hdev;
1487         struct mgmt_cp_pair_device *cp;
1488         struct mgmt_rp_pair_device rp;
1489         struct pending_cmd *cmd;
1490         u8 sec_level, auth_type;
1491         struct hci_conn *conn;
1492         int err;
1493
1494         BT_DBG("");
1495
1496         cp = (void *) data;
1497
1498         if (len != sizeof(*cp))
1499                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1500                                                 MGMT_STATUS_INVALID_PARAMS);
1501
1502         hdev = hci_dev_get(index);
1503         if (!hdev)
1504                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1505                                                 MGMT_STATUS_INVALID_PARAMS);
1506
1507         hci_dev_lock(hdev);
1508
1509         sec_level = BT_SECURITY_MEDIUM;
1510         if (cp->io_cap == 0x03)
1511                 auth_type = HCI_AT_DEDICATED_BONDING;
1512         else
1513                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1514
1515         if (cp->addr.type == MGMT_ADDR_BREDR)
1516                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1517                                                                 auth_type);
1518         else
1519                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1520                                                                 auth_type);
1521
1522         memset(&rp, 0, sizeof(rp));
1523         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1524         rp.addr.type = cp->addr.type;
1525
1526         if (IS_ERR(conn)) {
1527                 rp.status = -PTR_ERR(conn);
1528                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1529                                                         &rp, sizeof(rp));
1530                 goto unlock;
1531         }
1532
1533         if (conn->connect_cfm_cb) {
1534                 hci_conn_put(conn);
1535                 rp.status = EBUSY;
1536                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1537                                                         &rp, sizeof(rp));
1538                 goto unlock;
1539         }
1540
1541         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1542         if (!cmd) {
1543                 err = -ENOMEM;
1544                 hci_conn_put(conn);
1545                 goto unlock;
1546         }
1547
1548         /* For LE, just connecting isn't a proof that the pairing finished */
1549         if (cp->addr.type == MGMT_ADDR_BREDR)
1550                 conn->connect_cfm_cb = pairing_complete_cb;
1551
1552         conn->security_cfm_cb = pairing_complete_cb;
1553         conn->disconn_cfm_cb = pairing_complete_cb;
1554         conn->io_capability = cp->io_cap;
1555         cmd->user_data = conn;
1556
1557         if (conn->state == BT_CONNECTED &&
1558                                 hci_conn_security(conn, sec_level, auth_type))
1559                 pairing_complete(cmd, 0);
1560
1561         err = 0;
1562
1563 unlock:
1564         hci_dev_unlock(hdev);
1565         hci_dev_put(hdev);
1566
1567         return err;
1568 }
1569
1570 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1571                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1572 {
1573         struct pending_cmd *cmd;
1574         struct hci_dev *hdev;
1575         struct hci_conn *conn;
1576         int err;
1577
1578         hdev = hci_dev_get(index);
1579         if (!hdev)
1580                 return cmd_status(sk, index, mgmt_op,
1581                                                 MGMT_STATUS_INVALID_PARAMS);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (!test_bit(HCI_UP, &hdev->flags)) {
1586                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1587                 goto done;
1588         }
1589
1590         /*
1591          * Check for an existing ACL link, if present pair via
1592          * HCI commands.
1593          *
1594          * If no ACL link is present, check for an LE link and if
1595          * present, pair via the SMP engine.
1596          *
1597          * If neither ACL nor LE links are present, fail with error.
1598          */
1599         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1600         if (!conn) {
1601                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1602                 if (!conn) {
1603                         err = cmd_status(sk, index, mgmt_op,
1604                                                 MGMT_STATUS_NOT_CONNECTED);
1605                         goto done;
1606                 }
1607
1608                 /* Continue with pairing via SMP */
1609
1610                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
1611                 goto done;
1612         }
1613
1614         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1615         if (!cmd) {
1616                 err = -ENOMEM;
1617                 goto done;
1618         }
1619
1620         /* Continue with pairing via HCI */
1621         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1622                 struct hci_cp_user_passkey_reply cp;
1623
1624                 bacpy(&cp.bdaddr, bdaddr);
1625                 cp.passkey = passkey;
1626                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1627         } else
1628                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1629
1630         if (err < 0)
1631                 mgmt_pending_remove(cmd);
1632
1633 done:
1634         hci_dev_unlock(hdev);
1635         hci_dev_put(hdev);
1636
1637         return err;
1638 }
1639
1640 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1641 {
1642         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1643
1644         BT_DBG("");
1645
1646         if (len != sizeof(*cp))
1647                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1648                                                 MGMT_STATUS_INVALID_PARAMS);
1649
1650         return user_pairing_resp(sk, index, &cp->bdaddr,
1651                         MGMT_OP_USER_CONFIRM_REPLY,
1652                         HCI_OP_USER_CONFIRM_REPLY, 0);
1653 }
1654
1655 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1656                                                                         u16 len)
1657 {
1658         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1659
1660         BT_DBG("");
1661
1662         if (len != sizeof(*cp))
1663                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1664                                                 MGMT_STATUS_INVALID_PARAMS);
1665
1666         return user_pairing_resp(sk, index, &cp->bdaddr,
1667                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1668                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1669 }
1670
1671 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1672 {
1673         struct mgmt_cp_user_passkey_reply *cp = (void *) data;
1674
1675         BT_DBG("");
1676
1677         if (len != sizeof(*cp))
1678                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1679                                                                         EINVAL);
1680
1681         return user_pairing_resp(sk, index, &cp->bdaddr,
1682                         MGMT_OP_USER_PASSKEY_REPLY,
1683                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1684 }
1685
1686 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1687                                                                         u16 len)
1688 {
1689         struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
1690
1691         BT_DBG("");
1692
1693         if (len != sizeof(*cp))
1694                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1695                                                                         EINVAL);
1696
1697         return user_pairing_resp(sk, index, &cp->bdaddr,
1698                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1699                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1700 }
1701
1702 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1703                                                                 u16 len)
1704 {
1705         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1706         struct hci_cp_write_local_name hci_cp;
1707         struct hci_dev *hdev;
1708         struct pending_cmd *cmd;
1709         int err;
1710
1711         BT_DBG("");
1712
1713         if (len != sizeof(*mgmt_cp))
1714                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1715                                                 MGMT_STATUS_INVALID_PARAMS);
1716
1717         hdev = hci_dev_get(index);
1718         if (!hdev)
1719                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1720                                                 MGMT_STATUS_INVALID_PARAMS);
1721
1722         hci_dev_lock(hdev);
1723
1724         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1725         if (!cmd) {
1726                 err = -ENOMEM;
1727                 goto failed;
1728         }
1729
1730         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1731         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1732                                                                 &hci_cp);
1733         if (err < 0)
1734                 mgmt_pending_remove(cmd);
1735
1736 failed:
1737         hci_dev_unlock(hdev);
1738         hci_dev_put(hdev);
1739
1740         return err;
1741 }
1742
1743 static int read_local_oob_data(struct sock *sk, u16 index)
1744 {
1745         struct hci_dev *hdev;
1746         struct pending_cmd *cmd;
1747         int err;
1748
1749         BT_DBG("hci%u", index);
1750
1751         hdev = hci_dev_get(index);
1752         if (!hdev)
1753                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1754                                                 MGMT_STATUS_INVALID_PARAMS);
1755
1756         hci_dev_lock(hdev);
1757
1758         if (!test_bit(HCI_UP, &hdev->flags)) {
1759                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1760                                                 MGMT_STATUS_NOT_POWERED);
1761                 goto unlock;
1762         }
1763
1764         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1765                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1766                                                 MGMT_STATUS_NOT_SUPPORTED);
1767                 goto unlock;
1768         }
1769
1770         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1771                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1772                                                         MGMT_STATUS_BUSY);
1773                 goto unlock;
1774         }
1775
1776         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1777         if (!cmd) {
1778                 err = -ENOMEM;
1779                 goto unlock;
1780         }
1781
1782         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1783         if (err < 0)
1784                 mgmt_pending_remove(cmd);
1785
1786 unlock:
1787         hci_dev_unlock(hdev);
1788         hci_dev_put(hdev);
1789
1790         return err;
1791 }
1792
1793 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1794                                                                         u16 len)
1795 {
1796         struct hci_dev *hdev;
1797         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1798         int err;
1799
1800         BT_DBG("hci%u ", index);
1801
1802         if (len != sizeof(*cp))
1803                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1804                                                 MGMT_STATUS_INVALID_PARAMS);
1805
1806         hdev = hci_dev_get(index);
1807         if (!hdev)
1808                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1809                                                 MGMT_STATUS_INVALID_PARAMS);
1810
1811         hci_dev_lock(hdev);
1812
1813         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1814                                                                 cp->randomizer);
1815         if (err < 0)
1816                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1817                                                         MGMT_STATUS_FAILED);
1818         else
1819                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1820                                                                         0);
1821
1822         hci_dev_unlock(hdev);
1823         hci_dev_put(hdev);
1824
1825         return err;
1826 }
1827
1828 static int remove_remote_oob_data(struct sock *sk, u16 index,
1829                                                 unsigned char *data, u16 len)
1830 {
1831         struct hci_dev *hdev;
1832         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1833         int err;
1834
1835         BT_DBG("hci%u ", index);
1836
1837         if (len != sizeof(*cp))
1838                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1839                                                 MGMT_STATUS_INVALID_PARAMS);
1840
1841         hdev = hci_dev_get(index);
1842         if (!hdev)
1843                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1844                                                 MGMT_STATUS_INVALID_PARAMS);
1845
1846         hci_dev_lock(hdev);
1847
1848         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1849         if (err < 0)
1850                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1851                                                 MGMT_STATUS_INVALID_PARAMS);
1852         else
1853                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1854                                                                 NULL, 0);
1855
1856         hci_dev_unlock(hdev);
1857         hci_dev_put(hdev);
1858
1859         return err;
1860 }
1861
1862 static int start_discovery(struct sock *sk, u16 index,
1863                                                 unsigned char *data, u16 len)
1864 {
1865         struct mgmt_cp_start_discovery *cp = (void *) data;
1866         struct pending_cmd *cmd;
1867         struct hci_dev *hdev;
1868         int err;
1869
1870         BT_DBG("hci%u", index);
1871
1872         if (len != sizeof(*cp))
1873                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1874                                                 MGMT_STATUS_INVALID_PARAMS);
1875
1876         hdev = hci_dev_get(index);
1877         if (!hdev)
1878                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1879                                                 MGMT_STATUS_INVALID_PARAMS);
1880
1881         hci_dev_lock(hdev);
1882
1883         if (!test_bit(HCI_UP, &hdev->flags)) {
1884                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1885                                                 MGMT_STATUS_NOT_POWERED);
1886                 goto failed;
1887         }
1888
1889         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1890         if (!cmd) {
1891                 err = -ENOMEM;
1892                 goto failed;
1893         }
1894
1895         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1896         if (err < 0)
1897                 mgmt_pending_remove(cmd);
1898
1899 failed:
1900         hci_dev_unlock(hdev);
1901         hci_dev_put(hdev);
1902
1903         return err;
1904 }
1905
1906 static int stop_discovery(struct sock *sk, u16 index)
1907 {
1908         struct hci_dev *hdev;
1909         struct pending_cmd *cmd;
1910         int err;
1911
1912         BT_DBG("hci%u", index);
1913
1914         hdev = hci_dev_get(index);
1915         if (!hdev)
1916                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1917                                                 MGMT_STATUS_INVALID_PARAMS);
1918
1919         hci_dev_lock(hdev);
1920
1921         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1922         if (!cmd) {
1923                 err = -ENOMEM;
1924                 goto failed;
1925         }
1926
1927         err = hci_cancel_inquiry(hdev);
1928         if (err < 0)
1929                 mgmt_pending_remove(cmd);
1930
1931 failed:
1932         hci_dev_unlock(hdev);
1933         hci_dev_put(hdev);
1934
1935         return err;
1936 }
1937
1938 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1939                                                                 u16 len)
1940 {
1941         struct hci_dev *hdev;
1942         struct mgmt_cp_block_device *cp = (void *) data;
1943         int err;
1944
1945         BT_DBG("hci%u", index);
1946
1947         if (len != sizeof(*cp))
1948                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1949                                                 MGMT_STATUS_INVALID_PARAMS);
1950
1951         hdev = hci_dev_get(index);
1952         if (!hdev)
1953                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1954                                                 MGMT_STATUS_INVALID_PARAMS);
1955
1956         hci_dev_lock(hdev);
1957
1958         err = hci_blacklist_add(hdev, &cp->bdaddr);
1959         if (err < 0)
1960                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1961                                                         MGMT_STATUS_FAILED);
1962         else
1963                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1964                                                         NULL, 0);
1965
1966         hci_dev_unlock(hdev);
1967         hci_dev_put(hdev);
1968
1969         return err;
1970 }
1971
1972 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1973                                                                 u16 len)
1974 {
1975         struct hci_dev *hdev;
1976         struct mgmt_cp_unblock_device *cp = (void *) data;
1977         int err;
1978
1979         BT_DBG("hci%u", index);
1980
1981         if (len != sizeof(*cp))
1982                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1983                                                 MGMT_STATUS_INVALID_PARAMS);
1984
1985         hdev = hci_dev_get(index);
1986         if (!hdev)
1987                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1988                                                 MGMT_STATUS_INVALID_PARAMS);
1989
1990         hci_dev_lock(hdev);
1991
1992         err = hci_blacklist_del(hdev, &cp->bdaddr);
1993
1994         if (err < 0)
1995                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1996                                                 MGMT_STATUS_INVALID_PARAMS);
1997         else
1998                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1999                                                                 NULL, 0);
2000
2001         hci_dev_unlock(hdev);
2002         hci_dev_put(hdev);
2003
2004         return err;
2005 }
2006
2007 static int set_fast_connectable(struct sock *sk, u16 index,
2008                                         unsigned char *data, u16 len)
2009 {
2010         struct hci_dev *hdev;
2011         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
2012         struct hci_cp_write_page_scan_activity acp;
2013         u8 type;
2014         int err;
2015
2016         BT_DBG("hci%u", index);
2017
2018         if (len != sizeof(*cp))
2019                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2020                                                 MGMT_STATUS_INVALID_PARAMS);
2021
2022         hdev = hci_dev_get(index);
2023         if (!hdev)
2024                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2025                                                 MGMT_STATUS_INVALID_PARAMS);
2026
2027         hci_dev_lock(hdev);
2028
2029         if (cp->enable) {
2030                 type = PAGE_SCAN_TYPE_INTERLACED;
2031                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2032         } else {
2033                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2034                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2035         }
2036
2037         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2038
2039         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2040                                                 sizeof(acp), &acp);
2041         if (err < 0) {
2042                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2043                                                         MGMT_STATUS_FAILED);
2044                 goto done;
2045         }
2046
2047         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2048         if (err < 0) {
2049                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2050                                                         MGMT_STATUS_FAILED);
2051                 goto done;
2052         }
2053
2054         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2055                                                         NULL, 0);
2056 done:
2057         hci_dev_unlock(hdev);
2058         hci_dev_put(hdev);
2059
2060         return err;
2061 }
2062
2063 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2064 {
2065         unsigned char *buf;
2066         struct mgmt_hdr *hdr;
2067         u16 opcode, index, len;
2068         int err;
2069
2070         BT_DBG("got %zu bytes", msglen);
2071
2072         if (msglen < sizeof(*hdr))
2073                 return -EINVAL;
2074
2075         buf = kmalloc(msglen, GFP_KERNEL);
2076         if (!buf)
2077                 return -ENOMEM;
2078
2079         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2080                 err = -EFAULT;
2081                 goto done;
2082         }
2083
2084         hdr = (struct mgmt_hdr *) buf;
2085         opcode = get_unaligned_le16(&hdr->opcode);
2086         index = get_unaligned_le16(&hdr->index);
2087         len = get_unaligned_le16(&hdr->len);
2088
2089         if (len != msglen - sizeof(*hdr)) {
2090                 err = -EINVAL;
2091                 goto done;
2092         }
2093
2094         switch (opcode) {
2095         case MGMT_OP_READ_VERSION:
2096                 err = read_version(sk);
2097                 break;
2098         case MGMT_OP_READ_INDEX_LIST:
2099                 err = read_index_list(sk);
2100                 break;
2101         case MGMT_OP_READ_INFO:
2102                 err = read_controller_info(sk, index);
2103                 break;
2104         case MGMT_OP_SET_POWERED:
2105                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
2106                 break;
2107         case MGMT_OP_SET_DISCOVERABLE:
2108                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
2109                 break;
2110         case MGMT_OP_SET_CONNECTABLE:
2111                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
2112                 break;
2113         case MGMT_OP_SET_PAIRABLE:
2114                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
2115                 break;
2116         case MGMT_OP_ADD_UUID:
2117                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
2118                 break;
2119         case MGMT_OP_REMOVE_UUID:
2120                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
2121                 break;
2122         case MGMT_OP_SET_DEV_CLASS:
2123                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
2124                 break;
2125         case MGMT_OP_SET_SERVICE_CACHE:
2126                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
2127                 break;
2128         case MGMT_OP_LOAD_LINK_KEYS:
2129                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
2130                 break;
2131         case MGMT_OP_REMOVE_KEYS:
2132                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
2133                 break;
2134         case MGMT_OP_DISCONNECT:
2135                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
2136                 break;
2137         case MGMT_OP_GET_CONNECTIONS:
2138                 err = get_connections(sk, index);
2139                 break;
2140         case MGMT_OP_PIN_CODE_REPLY:
2141                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
2142                 break;
2143         case MGMT_OP_PIN_CODE_NEG_REPLY:
2144                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
2145                 break;
2146         case MGMT_OP_SET_IO_CAPABILITY:
2147                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
2148                 break;
2149         case MGMT_OP_PAIR_DEVICE:
2150                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
2151                 break;
2152         case MGMT_OP_USER_CONFIRM_REPLY:
2153                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
2154                 break;
2155         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2156                 err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
2157                                                                         len);
2158                 break;
2159         case MGMT_OP_USER_PASSKEY_REPLY:
2160                 err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
2161                 break;
2162         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2163                 err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
2164                                                                         len);
2165                 break;
2166         case MGMT_OP_SET_LOCAL_NAME:
2167                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
2168                 break;
2169         case MGMT_OP_READ_LOCAL_OOB_DATA:
2170                 err = read_local_oob_data(sk, index);
2171                 break;
2172         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2173                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
2174                 break;
2175         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2176                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
2177                                                                         len);
2178                 break;
2179         case MGMT_OP_START_DISCOVERY:
2180                 err = start_discovery(sk, index, buf + sizeof(*hdr), len);
2181                 break;
2182         case MGMT_OP_STOP_DISCOVERY:
2183                 err = stop_discovery(sk, index);
2184                 break;
2185         case MGMT_OP_BLOCK_DEVICE:
2186                 err = block_device(sk, index, buf + sizeof(*hdr), len);
2187                 break;
2188         case MGMT_OP_UNBLOCK_DEVICE:
2189                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
2190                 break;
2191         case MGMT_OP_SET_FAST_CONNECTABLE:
2192                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
2193                                                                 len);
2194                 break;
2195         default:
2196                 BT_DBG("Unknown op %u", opcode);
2197                 err = cmd_status(sk, index, opcode,
2198                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2199                 break;
2200         }
2201
2202         if (err < 0)
2203                 goto done;
2204
2205         err = msglen;
2206
2207 done:
2208         kfree(buf);
2209         return err;
2210 }
2211
2212 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2213 {
2214         u8 *status = data;
2215
2216         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2217         mgmt_pending_remove(cmd);
2218 }
2219
2220 int mgmt_index_added(struct hci_dev *hdev)
2221 {
2222         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2223 }
2224
2225 int mgmt_index_removed(struct hci_dev *hdev)
2226 {
2227         u8 status = ENODEV;
2228
2229         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2230
2231         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2232 }
2233
2234 struct cmd_lookup {
2235         u8 val;
2236         struct sock *sk;
2237 };
2238
2239 static void mode_rsp(struct pending_cmd *cmd, void *data)
2240 {
2241         struct mgmt_mode *cp = cmd->param;
2242         struct cmd_lookup *match = data;
2243
2244         if (cp->val != match->val)
2245                 return;
2246
2247         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
2248
2249         list_del(&cmd->list);
2250
2251         if (match->sk == NULL) {
2252                 match->sk = cmd->sk;
2253                 sock_hold(match->sk);
2254         }
2255
2256         mgmt_pending_free(cmd);
2257 }
2258
2259 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2260 {
2261         struct mgmt_mode ev;
2262         struct cmd_lookup match = { powered, NULL };
2263         int ret;
2264
2265         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2266
2267         if (!powered) {
2268                 u8 status = ENETDOWN;
2269                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2270         }
2271
2272         ev.val = powered;
2273
2274         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2275
2276         if (match.sk)
2277                 sock_put(match.sk);
2278
2279         return ret;
2280 }
2281
2282 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2283 {
2284         struct mgmt_mode ev;
2285         struct cmd_lookup match = { discoverable, NULL };
2286         int ret;
2287
2288         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2289
2290         ev.val = discoverable;
2291
2292         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2293                                                                 match.sk);
2294
2295         if (match.sk)
2296                 sock_put(match.sk);
2297
2298         return ret;
2299 }
2300
2301 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2302 {
2303         struct mgmt_mode ev;
2304         struct cmd_lookup match = { connectable, NULL };
2305         int ret;
2306
2307         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2308
2309         ev.val = connectable;
2310
2311         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2312
2313         if (match.sk)
2314                 sock_put(match.sk);
2315
2316         return ret;
2317 }
2318
2319 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2320 {
2321         u8 mgmt_err = mgmt_status(status);
2322
2323         if (scan & SCAN_PAGE)
2324                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2325                                                 cmd_status_rsp, &mgmt_err);
2326
2327         if (scan & SCAN_INQUIRY)
2328                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2329                                                 cmd_status_rsp, &mgmt_err);
2330
2331         return 0;
2332 }
2333
2334 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2335                                                                 u8 persistent)
2336 {
2337         struct mgmt_ev_new_link_key ev;
2338
2339         memset(&ev, 0, sizeof(ev));
2340
2341         ev.store_hint = persistent;
2342         bacpy(&ev.key.bdaddr, &key->bdaddr);
2343         ev.key.type = key->type;
2344         memcpy(ev.key.val, key->val, 16);
2345         ev.key.pin_len = key->pin_len;
2346
2347         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2348 }
2349
2350 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2351                                                                 u8 addr_type)
2352 {
2353         struct mgmt_addr_info ev;
2354
2355         bacpy(&ev.bdaddr, bdaddr);
2356         ev.type = link_to_mgmt(link_type, addr_type);
2357
2358         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2359 }
2360
2361 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2362 {
2363         struct mgmt_cp_disconnect *cp = cmd->param;
2364         struct sock **sk = data;
2365         struct mgmt_rp_disconnect rp;
2366
2367         bacpy(&rp.bdaddr, &cp->bdaddr);
2368         rp.status = 0;
2369
2370         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2371
2372         *sk = cmd->sk;
2373         sock_hold(*sk);
2374
2375         mgmt_pending_remove(cmd);
2376 }
2377
2378 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2379 {
2380         u8 *status = data;
2381         struct mgmt_cp_remove_keys *cp = cmd->param;
2382         struct mgmt_rp_remove_keys rp;
2383
2384         memset(&rp, 0, sizeof(rp));
2385         bacpy(&rp.bdaddr, &cp->bdaddr);
2386         if (status != NULL)
2387                 rp.status = *status;
2388
2389         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2390                                                                 sizeof(rp));
2391
2392         mgmt_pending_remove(cmd);
2393 }
2394
2395 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2396                                                                 u8 addr_type)
2397 {
2398         struct mgmt_addr_info ev;
2399         struct sock *sk = NULL;
2400         int err;
2401
2402         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2403
2404         bacpy(&ev.bdaddr, bdaddr);
2405         ev.type = link_to_mgmt(link_type, addr_type);
2406
2407         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2408
2409         if (sk)
2410                 sock_put(sk);
2411
2412         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2413
2414         return err;
2415 }
2416
2417 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2418 {
2419         struct pending_cmd *cmd;
2420         u8 mgmt_err = mgmt_status(status);
2421         int err;
2422
2423         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2424         if (!cmd)
2425                 return -ENOENT;
2426
2427         if (bdaddr) {
2428                 struct mgmt_rp_disconnect rp;
2429
2430                 bacpy(&rp.bdaddr, bdaddr);
2431                 rp.status = status;
2432
2433                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2434                                                         &rp, sizeof(rp));
2435         } else
2436                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2437                                                                 mgmt_err);
2438
2439         mgmt_pending_remove(cmd);
2440
2441         return err;
2442 }
2443
2444 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2445                                                 u8 addr_type, u8 status)
2446 {
2447         struct mgmt_ev_connect_failed ev;
2448
2449         bacpy(&ev.addr.bdaddr, bdaddr);
2450         ev.addr.type = link_to_mgmt(link_type, addr_type);
2451         ev.status = mgmt_status(status);
2452
2453         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2454 }
2455
2456 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2457 {
2458         struct mgmt_ev_pin_code_request ev;
2459
2460         bacpy(&ev.bdaddr, bdaddr);
2461         ev.secure = secure;
2462
2463         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2464                                                                         NULL);
2465 }
2466
2467 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2468                                                                 u8 status)
2469 {
2470         struct pending_cmd *cmd;
2471         struct mgmt_rp_pin_code_reply rp;
2472         int err;
2473
2474         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2475         if (!cmd)
2476                 return -ENOENT;
2477
2478         bacpy(&rp.bdaddr, bdaddr);
2479         rp.status = mgmt_status(status);
2480
2481         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2482                                                                 sizeof(rp));
2483
2484         mgmt_pending_remove(cmd);
2485
2486         return err;
2487 }
2488
2489 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2490                                                                 u8 status)
2491 {
2492         struct pending_cmd *cmd;
2493         struct mgmt_rp_pin_code_reply rp;
2494         int err;
2495
2496         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2497         if (!cmd)
2498                 return -ENOENT;
2499
2500         bacpy(&rp.bdaddr, bdaddr);
2501         rp.status = mgmt_status(status);
2502
2503         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2504                                                                 sizeof(rp));
2505
2506         mgmt_pending_remove(cmd);
2507
2508         return err;
2509 }
2510
2511 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2512                                                 __le32 value, u8 confirm_hint)
2513 {
2514         struct mgmt_ev_user_confirm_request ev;
2515
2516         BT_DBG("%s", hdev->name);
2517
2518         bacpy(&ev.bdaddr, bdaddr);
2519         ev.confirm_hint = confirm_hint;
2520         put_unaligned_le32(value, &ev.value);
2521
2522         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2523                                                                         NULL);
2524 }
2525
2526 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2527 {
2528         struct mgmt_ev_user_passkey_request ev;
2529
2530         BT_DBG("%s", hdev->name);
2531
2532         bacpy(&ev.bdaddr, bdaddr);
2533
2534         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2535                                                                         NULL);
2536 }
2537
2538 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2539                                                         u8 status, u8 opcode)
2540 {
2541         struct pending_cmd *cmd;
2542         struct mgmt_rp_user_confirm_reply rp;
2543         int err;
2544
2545         cmd = mgmt_pending_find(opcode, hdev);
2546         if (!cmd)
2547                 return -ENOENT;
2548
2549         bacpy(&rp.bdaddr, bdaddr);
2550         rp.status = mgmt_status(status);
2551         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2552
2553         mgmt_pending_remove(cmd);
2554
2555         return err;
2556 }
2557
2558 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2559                                                                 u8 status)
2560 {
2561         return user_pairing_resp_complete(hdev, bdaddr, status,
2562                                                 MGMT_OP_USER_CONFIRM_REPLY);
2563 }
2564
2565 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2566                                                 bdaddr_t *bdaddr, u8 status)
2567 {
2568         return user_pairing_resp_complete(hdev, bdaddr, status,
2569                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2570 }
2571
2572 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2573                                                                 u8 status)
2574 {
2575         return user_pairing_resp_complete(hdev, bdaddr, status,
2576                                                 MGMT_OP_USER_PASSKEY_REPLY);
2577 }
2578
2579 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2580                                                 bdaddr_t *bdaddr, u8 status)
2581 {
2582         return user_pairing_resp_complete(hdev, bdaddr, status,
2583                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2584 }
2585
2586 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2587 {
2588         struct mgmt_ev_auth_failed ev;
2589
2590         bacpy(&ev.bdaddr, bdaddr);
2591         ev.status = mgmt_status(status);
2592
2593         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2594 }
2595
2596 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2597 {
2598         struct pending_cmd *cmd;
2599         struct mgmt_cp_set_local_name ev;
2600         int err;
2601
2602         memset(&ev, 0, sizeof(ev));
2603         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2604
2605         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2606         if (!cmd)
2607                 goto send_event;
2608
2609         if (status) {
2610                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2611                                                         mgmt_status(status));
2612                 goto failed;
2613         }
2614
2615         update_eir(hdev);
2616
2617         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2618                                                                 sizeof(ev));
2619         if (err < 0)
2620                 goto failed;
2621
2622 send_event:
2623         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2624                                                         cmd ? cmd->sk : NULL);
2625
2626 failed:
2627         if (cmd)
2628                 mgmt_pending_remove(cmd);
2629         return err;
2630 }
2631
2632 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2633                                                 u8 *randomizer, u8 status)
2634 {
2635         struct pending_cmd *cmd;
2636         int err;
2637
2638         BT_DBG("%s status %u", hdev->name, status);
2639
2640         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2641         if (!cmd)
2642                 return -ENOENT;
2643
2644         if (status) {
2645                 err = cmd_status(cmd->sk, hdev->id,
2646                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2647                                                 mgmt_status(status));
2648         } else {
2649                 struct mgmt_rp_read_local_oob_data rp;
2650
2651                 memcpy(rp.hash, hash, sizeof(rp.hash));
2652                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2653
2654                 err = cmd_complete(cmd->sk, hdev->id,
2655                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2656                                                 &rp, sizeof(rp));
2657         }
2658
2659         mgmt_pending_remove(cmd);
2660
2661         return err;
2662 }
2663
2664 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2665                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2666 {
2667         struct mgmt_ev_device_found ev;
2668
2669         memset(&ev, 0, sizeof(ev));
2670
2671         bacpy(&ev.addr.bdaddr, bdaddr);
2672         ev.addr.type = link_to_mgmt(link_type, addr_type);
2673         ev.rssi = rssi;
2674
2675         if (eir)
2676                 memcpy(ev.eir, eir, sizeof(ev.eir));
2677
2678         if (dev_class)
2679                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2680
2681         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2682 }
2683
2684 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2685 {
2686         struct mgmt_ev_remote_name ev;
2687
2688         memset(&ev, 0, sizeof(ev));
2689
2690         bacpy(&ev.bdaddr, bdaddr);
2691         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2692
2693         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2694 }
2695
2696 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2697 {
2698         struct pending_cmd *cmd;
2699         int err;
2700
2701         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2702         if (!cmd)
2703                 return -ENOENT;
2704
2705         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2706         mgmt_pending_remove(cmd);
2707
2708         return err;
2709 }
2710
2711 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2712 {
2713         struct pending_cmd *cmd;
2714         int err;
2715
2716         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2717         if (!cmd)
2718                 return -ENOENT;
2719
2720         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2721         mgmt_pending_remove(cmd);
2722
2723         return err;
2724 }
2725
2726 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2727 {
2728         struct pending_cmd *cmd;
2729
2730         if (discovering)
2731                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2732         else
2733                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2734
2735         if (cmd != NULL) {
2736                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2737                 mgmt_pending_remove(cmd);
2738         }
2739
2740         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2741                                                 sizeof(discovering), NULL);
2742 }
2743
2744 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2745 {
2746         struct pending_cmd *cmd;
2747         struct mgmt_ev_device_blocked ev;
2748
2749         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2750
2751         bacpy(&ev.bdaddr, bdaddr);
2752
2753         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2754                                                         cmd ? cmd->sk : NULL);
2755 }
2756
2757 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2758 {
2759         struct pending_cmd *cmd;
2760         struct mgmt_ev_device_unblocked ev;
2761
2762         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2763
2764         bacpy(&ev.bdaddr, bdaddr);
2765
2766         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2767                                                         cmd ? cmd->sk : NULL);
2768 }