net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  36
  37 struct pending_cmd {
  38         struct list_head list;
  39         __u16 opcode;
  40         int index;
  41         void *param;
  42         struct sock *sk;
  43         void *user_data;
  44 };
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51         int err;
  52
  53         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  54
  55         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  56         if (!skb)
  57                 return -ENOMEM;
  58
  59         hdr = (void *) skb_put(skb, sizeof(*hdr));
  60
  61         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  62         hdr->index = cpu_to_le16(index);
  63         hdr->len = cpu_to_le16(sizeof(*ev));
  64
  65         ev = (void *) skb_put(skb, sizeof(*ev));
  66         ev->status = status;
  67         put_unaligned_le16(cmd, &ev->opcode);
  68
  69         err = sock_queue_rcv_skb(sk, skb);
  70         if (err < 0)
  71                 kfree_skb(skb);
  72
  73         return err;
  74 }
  75
  76 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  77                                                                 size_t rp_len)
  78 {
  79         struct sk_buff *skb;
  80         struct mgmt_hdr *hdr;
  81         struct mgmt_ev_cmd_complete *ev;
  82         int err;
  83
  84         BT_DBG("sock %p", sk);
  85
  86         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  87         if (!skb)
  88                 return -ENOMEM;
  89
  90         hdr = (void *) skb_put(skb, sizeof(*hdr));
  91
  92         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  93         hdr->index = cpu_to_le16(index);
  94         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  95
  96         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  97         put_unaligned_le16(cmd, &ev->opcode);
  98
  99         if (rp)
 100                 memcpy(ev->data, rp, rp_len);
 101
 102         err = sock_queue_rcv_skb(sk, skb);
 103         if (err < 0)
 104                 kfree_skb(skb);
 105
 106         return err;;
 107 }
 108
 109 static int read_version(struct sock *sk)
 110 {
 111         struct mgmt_rp_read_version rp;
 112
 113         BT_DBG("sock %p", sk);
 114
 115         rp.version = MGMT_VERSION;
 116         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 117
 118         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 119                                                                 sizeof(rp));
 120 }
 121
 122 static int read_index_list(struct sock *sk)
 123 {
 124         struct mgmt_rp_read_index_list *rp;
 125         struct list_head *p;
 126         struct hci_dev *d;
 127         size_t rp_len;
 128         u16 count;
 129         int i, err;
 130
 131         BT_DBG("sock %p", sk);
 132
 133         read_lock(&hci_dev_list_lock);
 134
 135         count = 0;
 136         list_for_each(p, &hci_dev_list) {
 137                 count++;
 138         }
 139
 140         rp_len = sizeof(*rp) + (2 * count);
 141         rp = kmalloc(rp_len, GFP_ATOMIC);
 142         if (!rp) {
 143                 read_unlock(&hci_dev_list_lock);
 144                 return -ENOMEM;
 145         }
 146
 147         put_unaligned_le16(count, &rp->num_controllers);
 148
 149         i = 0;
 150         list_for_each_entry(d, &hci_dev_list, list) {
 151                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 152                         cancel_delayed_work_sync(&d->power_off);
 153
 154                 if (test_bit(HCI_SETUP, &d->flags))
 155                         continue;
 156
 157                 put_unaligned_le16(d->id, &rp->index[i++]);
 158                 BT_DBG("Added hci%u", d->id);
 159         }
 160
 161         read_unlock(&hci_dev_list_lock);
 162
 163         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 164                                                                         rp_len);
 165
 166         kfree(rp);
 167
 168         return err;
 169 }
 170
 171 static int read_controller_info(struct sock *sk, u16 index)
 172 {
 173         struct mgmt_rp_read_info rp;
 174         struct hci_dev *hdev;
 175
 176         BT_DBG("sock %p hci%u", sk, index);
 177
 178         hdev = hci_dev_get(index);
 179         if (!hdev)
 180                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 181
 182         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 183                 cancel_delayed_work_sync(&hdev->power_off);
 184
 185         hci_dev_lock_bh(hdev);
 186
 187         set_bit(HCI_MGMT, &hdev->flags);
 188
 189         memset(&rp, 0, sizeof(rp));
 190
 191         rp.type = hdev->dev_type;
 192
 193         rp.powered = test_bit(HCI_UP, &hdev->flags);
 194         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 195         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 196         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 197
 198         if (test_bit(HCI_AUTH, &hdev->flags))
 199                 rp.sec_mode = 3;
 200         else if (hdev->ssp_mode > 0)
 201                 rp.sec_mode = 4;
 202         else
 203                 rp.sec_mode = 2;
 204
 205         bacpy(&rp.bdaddr, &hdev->bdaddr);
 206         memcpy(rp.features, hdev->features, 8);
 207         memcpy(rp.dev_class, hdev->dev_class, 3);
 208         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 209         rp.hci_ver = hdev->hci_ver;
 210         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 211
 212         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 213
 214         hci_dev_unlock_bh(hdev);
 215         hci_dev_put(hdev);
 216
 217         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 218 }
 219
 220 static void mgmt_pending_free(struct pending_cmd *cmd)
 221 {
 222         sock_put(cmd->sk);
 223         kfree(cmd->param);
 224         kfree(cmd);
 225 }
 226
 227 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 228                                                         struct hci_dev *hdev,
 229                                                         void *data, u16 len)
 230 {
 231         struct pending_cmd *cmd;
 232
 233         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 234         if (!cmd)
 235                 return NULL;
 236
 237         cmd->opcode = opcode;
 238         cmd->index = hdev->id;
 239
 240         cmd->param = kmalloc(len, GFP_ATOMIC);
 241         if (!cmd->param) {
 242                 kfree(cmd);
 243                 return NULL;
 244         }
 245
 246         if (data)
 247                 memcpy(cmd->param, data, len);
 248
 249         cmd->sk = sk;
 250         sock_hold(sk);
 251
 252         list_add(&cmd->list, &hdev->mgmt_pending);
 253
 254         return cmd;
 255 }
 256
 257 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 258                                 void (*cb)(struct pending_cmd *cmd, void *data),
 259                                 void *data)
 260 {
 261         struct list_head *p, *n;
 262
 263         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 264                 struct pending_cmd *cmd;
 265
 266                 cmd = list_entry(p, struct pending_cmd, list);
 267
 268                 if (opcode > 0 && cmd->opcode != opcode)
 269                         continue;
 270
 271                 if (hdev && cmd->index != hdev->id)
 272                         continue;
 273
 274                 cb(cmd, data);
 275         }
 276 }
 277
 278 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 279 {
 280         struct pending_cmd *cmd;
 281
 282         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 283                 if (cmd->opcode != opcode)
 284                         continue;
 285
 286                 if (hdev && cmd->index != hdev->id)
 287                         continue;
 288
 289                 return cmd;
 290         }
 291
 292         return NULL;
 293 }
 294
 295 static void mgmt_pending_remove(struct pending_cmd *cmd)
 296 {
 297         list_del(&cmd->list);
 298         mgmt_pending_free(cmd);
 299 }
 300
 301 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 302 {
 303         struct mgmt_mode *cp;
 304         struct hci_dev *hdev;
 305         struct pending_cmd *cmd;
 306         int err, up;
 307
 308         cp = (void *) data;
 309
 310         BT_DBG("request for hci%u", index);
 311
 312         if (len != sizeof(*cp))
 313                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 314
 315         hdev = hci_dev_get(index);
 316         if (!hdev)
 317                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 318
 319         hci_dev_lock_bh(hdev);
 320
 321         up = test_bit(HCI_UP, &hdev->flags);
 322         if ((cp->val && up) || (!cp->val && !up)) {
 323                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 324                 goto failed;
 325         }
 326
 327         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 328                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 329                 goto failed;
 330         }
 331
 332         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 333         if (!cmd) {
 334                 err = -ENOMEM;
 335                 goto failed;
 336         }
 337
 338         if (cp->val)
 339                 queue_work(hdev->workqueue, &hdev->power_on);
 340         else
 341                 queue_work(hdev->workqueue, &hdev->power_off.work);
 342
 343         err = 0;
 344
 345 failed:
 346         hci_dev_unlock_bh(hdev);
 347         hci_dev_put(hdev);
 348         return err;
 349 }
 350
 351 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 352                                                                         u16 len)
 353 {
 354         struct mgmt_cp_set_discoverable *cp;
 355         struct hci_dev *hdev;
 356         struct pending_cmd *cmd;
 357         u8 scan;
 358         int err;
 359
 360         cp = (void *) data;
 361
 362         BT_DBG("request for hci%u", index);
 363
 364         if (len != sizeof(*cp))
 365                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 366
 367         hdev = hci_dev_get(index);
 368         if (!hdev)
 369                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 370
 371         hci_dev_lock_bh(hdev);
 372
 373         if (!test_bit(HCI_UP, &hdev->flags)) {
 374                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 375                 goto failed;
 376         }
 377
 378         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 379                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 380                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 381                 goto failed;
 382         }
 383
 384         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 385                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 386                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 387                 goto failed;
 388         }
 389
 390         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 391         if (!cmd) {
 392                 err = -ENOMEM;
 393                 goto failed;
 394         }
 395
 396         scan = SCAN_PAGE;
 397
 398         if (cp->val)
 399                 scan |= SCAN_INQUIRY;
 400         else
 401                 cancel_delayed_work_sync(&hdev->discov_off);
 402
 403         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 404         if (err < 0)
 405                 mgmt_pending_remove(cmd);
 406
 407         if (cp->val)
 408                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 409
 410 failed:
 411         hci_dev_unlock_bh(hdev);
 412         hci_dev_put(hdev);
 413
 414         return err;
 415 }
 416
 417 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 418                                                                         u16 len)
 419 {
 420         struct mgmt_mode *cp;
 421         struct hci_dev *hdev;
 422         struct pending_cmd *cmd;
 423         u8 scan;
 424         int err;
 425
 426         cp = (void *) data;
 427
 428         BT_DBG("request for hci%u", index);
 429
 430         if (len != sizeof(*cp))
 431                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 432
 433         hdev = hci_dev_get(index);
 434         if (!hdev)
 435                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 436
 437         hci_dev_lock_bh(hdev);
 438
 439         if (!test_bit(HCI_UP, &hdev->flags)) {
 440                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 441                 goto failed;
 442         }
 443
 444         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 445                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 446                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 447                 goto failed;
 448         }
 449
 450         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 451                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 452                 goto failed;
 453         }
 454
 455         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 456         if (!cmd) {
 457                 err = -ENOMEM;
 458                 goto failed;
 459         }
 460
 461         if (cp->val)
 462                 scan = SCAN_PAGE;
 463         else
 464                 scan = 0;
 465
 466         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 467         if (err < 0)
 468                 mgmt_pending_remove(cmd);
 469
 470 failed:
 471         hci_dev_unlock_bh(hdev);
 472         hci_dev_put(hdev);
 473
 474         return err;
 475 }
 476
 477 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 478                                         u16 data_len, struct sock *skip_sk)
 479 {
 480         struct sk_buff *skb;
 481         struct mgmt_hdr *hdr;
 482
 483         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 484         if (!skb)
 485                 return -ENOMEM;
 486
 487         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 488
 489         hdr = (void *) skb_put(skb, sizeof(*hdr));
 490         hdr->opcode = cpu_to_le16(event);
 491         if (hdev)
 492                 hdr->index = cpu_to_le16(hdev->id);
 493         else
 494                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 495         hdr->len = cpu_to_le16(data_len);
 496
 497         if (data)
 498                 memcpy(skb_put(skb, data_len), data, data_len);
 499
 500         hci_send_to_sock(NULL, skb, skip_sk);
 501         kfree_skb(skb);
 502
 503         return 0;
 504 }
 505
 506 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 507 {
 508         struct mgmt_mode rp;
 509
 510         rp.val = val;
 511
 512         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 513 }
 514
 515 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 516                                                                         u16 len)
 517 {
 518         struct mgmt_mode *cp, ev;
 519         struct hci_dev *hdev;
 520         int err;
 521
 522         cp = (void *) data;
 523
 524         BT_DBG("request for hci%u", index);
 525
 526         if (len != sizeof(*cp))
 527                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 528
 529         hdev = hci_dev_get(index);
 530         if (!hdev)
 531                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 532
 533         hci_dev_lock_bh(hdev);
 534
 535         if (cp->val)
 536                 set_bit(HCI_PAIRABLE, &hdev->flags);
 537         else
 538                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 539
 540         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 541         if (err < 0)
 542                 goto failed;
 543
 544         ev.val = cp->val;
 545
 546         err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
 547
 548 failed:
 549         hci_dev_unlock_bh(hdev);
 550         hci_dev_put(hdev);
 551
 552         return err;
 553 }
 554
 555 #define EIR_FLAGS               0x01 /* flags */
 556 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 557 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 558 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 559 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 560 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 561 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 562 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 563 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 564 #define EIR_TX_POWER            0x0A /* transmit power level */
 565 #define EIR_DEVICE_ID           0x10 /* device ID */
 566
 567 #define PNP_INFO_SVCLASS_ID             0x1200
 568
 569 static u8 bluetooth_base_uuid[] = {
 570                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 571                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 572 };
 573
 574 static u16 get_uuid16(u8 *uuid128)
 575 {
 576         u32 val;
 577         int i;
 578
 579         for (i = 0; i < 12; i++) {
 580                 if (bluetooth_base_uuid[i] != uuid128[i])
 581                         return 0;
 582         }
 583
 584         memcpy(&val, &uuid128[12], 4);
 585
 586         val = le32_to_cpu(val);
 587         if (val > 0xffff)
 588                 return 0;
 589
 590         return (u16) val;
 591 }
 592
 593 static void create_eir(struct hci_dev *hdev, u8 *data)
 594 {
 595         u8 *ptr = data;
 596         u16 eir_len = 0;
 597         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 598         int i, truncated = 0;
 599         struct bt_uuid *uuid;
 600         size_t name_len;
 601
 602         name_len = strlen(hdev->dev_name);
 603
 604         if (name_len > 0) {
 605                 /* EIR Data type */
 606                 if (name_len > 48) {
 607                         name_len = 48;
 608                         ptr[1] = EIR_NAME_SHORT;
 609                 } else
 610                         ptr[1] = EIR_NAME_COMPLETE;
 611
 612                 /* EIR Data length */
 613                 ptr[0] = name_len + 1;
 614
 615                 memcpy(ptr + 2, hdev->dev_name, name_len);
 616
 617                 eir_len += (name_len + 2);
 618                 ptr += (name_len + 2);
 619         }
 620
 621         memset(uuid16_list, 0, sizeof(uuid16_list));
 622
 623         /* Group all UUID16 types */
 624         list_for_each_entry(uuid, &hdev->uuids, list) {
 625                 u16 uuid16;
 626
 627                 uuid16 = get_uuid16(uuid->uuid);
 628                 if (uuid16 == 0)
 629                         return;
 630
 631                 if (uuid16 < 0x1100)
 632                         continue;
 633
 634                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 635                         continue;
 636
 637                 /* Stop if not enough space to put next UUID */
 638                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 639                         truncated = 1;
 640                         break;
 641                 }
 642
 643                 /* Check for duplicates */
 644                 for (i = 0; uuid16_list[i] != 0; i++)
 645                         if (uuid16_list[i] == uuid16)
 646                                 break;
 647
 648                 if (uuid16_list[i] == 0) {
 649                         uuid16_list[i] = uuid16;
 650                         eir_len += sizeof(u16);
 651                 }
 652         }
 653
 654         if (uuid16_list[0] != 0) {
 655                 u8 *length = ptr;
 656
 657                 /* EIR Data type */
 658                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 659
 660                 ptr += 2;
 661                 eir_len += 2;
 662
 663                 for (i = 0; uuid16_list[i] != 0; i++) {
 664                         *ptr++ = (uuid16_list[i] & 0x00ff);
 665                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 666                 }
 667
 668                 /* EIR Data length */
 669                 *length = (i * sizeof(u16)) + 1;
 670         }
 671 }
 672
 673 static int update_eir(struct hci_dev *hdev)
 674 {
 675         struct hci_cp_write_eir cp;
 676
 677         if (!(hdev->features[6] & LMP_EXT_INQ))
 678                 return 0;
 679
 680         if (hdev->ssp_mode == 0)
 681                 return 0;
 682
 683         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 684                 return 0;
 685
 686         memset(&cp, 0, sizeof(cp));
 687
 688         create_eir(hdev, cp.data);
 689
 690         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 691                 return 0;
 692
 693         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 694
 695         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 696 }
 697
 698 static u8 get_service_classes(struct hci_dev *hdev)
 699 {
 700         struct bt_uuid *uuid;
 701         u8 val = 0;
 702
 703         list_for_each_entry(uuid, &hdev->uuids, list)
 704                 val |= uuid->svc_hint;
 705
 706         return val;
 707 }
 708
 709 static int update_class(struct hci_dev *hdev)
 710 {
 711         u8 cod[3];
 712
 713         BT_DBG("%s", hdev->name);
 714
 715         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 716                 return 0;
 717
 718         cod[0] = hdev->minor_class;
 719         cod[1] = hdev->major_class;
 720         cod[2] = get_service_classes(hdev);
 721
 722         if (memcmp(cod, hdev->dev_class, 3) == 0)
 723                 return 0;
 724
 725         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 726 }
 727
 728 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 729 {
 730         struct mgmt_cp_add_uuid *cp;
 731         struct hci_dev *hdev;
 732         struct bt_uuid *uuid;
 733         int err;
 734
 735         cp = (void *) data;
 736
 737         BT_DBG("request for hci%u", index);
 738
 739         if (len != sizeof(*cp))
 740                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 741
 742         hdev = hci_dev_get(index);
 743         if (!hdev)
 744                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 745
 746         hci_dev_lock_bh(hdev);
 747
 748         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 749         if (!uuid) {
 750                 err = -ENOMEM;
 751                 goto failed;
 752         }
 753
 754         memcpy(uuid->uuid, cp->uuid, 16);
 755         uuid->svc_hint = cp->svc_hint;
 756
 757         list_add(&uuid->list, &hdev->uuids);
 758
 759         err = update_class(hdev);
 760         if (err < 0)
 761                 goto failed;
 762
 763         err = update_eir(hdev);
 764         if (err < 0)
 765                 goto failed;
 766
 767         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 768
 769 failed:
 770         hci_dev_unlock_bh(hdev);
 771         hci_dev_put(hdev);
 772
 773         return err;
 774 }
 775
 776 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 777 {
 778         struct list_head *p, *n;
 779         struct mgmt_cp_remove_uuid *cp;
 780         struct hci_dev *hdev;
 781         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 782         int err, found;
 783
 784         cp = (void *) data;
 785
 786         BT_DBG("request for hci%u", index);
 787
 788         if (len != sizeof(*cp))
 789                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 790
 791         hdev = hci_dev_get(index);
 792         if (!hdev)
 793                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 794
 795         hci_dev_lock_bh(hdev);
 796
 797         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 798                 err = hci_uuids_clear(hdev);
 799                 goto unlock;
 800         }
 801
 802         found = 0;
 803
 804         list_for_each_safe(p, n, &hdev->uuids) {
 805                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 806
 807                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 808                         continue;
 809
 810                 list_del(&match->list);
 811                 found++;
 812         }
 813
 814         if (found == 0) {
 815                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 816                 goto unlock;
 817         }
 818
 819         err = update_class(hdev);
 820         if (err < 0)
 821                 goto unlock;
 822
 823         err = update_eir(hdev);
 824         if (err < 0)
 825                 goto unlock;
 826
 827         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 828
 829 unlock:
 830         hci_dev_unlock_bh(hdev);
 831         hci_dev_put(hdev);
 832
 833         return err;
 834 }
 835
 836 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 837                                                                         u16 len)
 838 {
 839         struct hci_dev *hdev;
 840         struct mgmt_cp_set_dev_class *cp;
 841         int err;
 842
 843         cp = (void *) data;
 844
 845         BT_DBG("request for hci%u", index);
 846
 847         if (len != sizeof(*cp))
 848                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 849
 850         hdev = hci_dev_get(index);
 851         if (!hdev)
 852                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 853
 854         hci_dev_lock_bh(hdev);
 855
 856         hdev->major_class = cp->major;
 857         hdev->minor_class = cp->minor;
 858
 859         err = update_class(hdev);
 860
 861         if (err == 0)
 862                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 863
 864         hci_dev_unlock_bh(hdev);
 865         hci_dev_put(hdev);
 866
 867         return err;
 868 }
 869
 870 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 871                                                                         u16 len)
 872 {
 873         struct hci_dev *hdev;
 874         struct mgmt_cp_set_service_cache *cp;
 875         int err;
 876
 877         cp = (void *) data;
 878
 879         if (len != sizeof(*cp))
 880                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 881
 882         hdev = hci_dev_get(index);
 883         if (!hdev)
 884                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 885
 886         hci_dev_lock_bh(hdev);
 887
 888         BT_DBG("hci%u enable %d", index, cp->enable);
 889
 890         if (cp->enable) {
 891                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 892                 err = 0;
 893         } else {
 894                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 895                 err = update_class(hdev);
 896                 if (err == 0)
 897                         err = update_eir(hdev);
 898         }
 899
 900         if (err == 0)
 901                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 902                                                                         0);
 903         else
 904                 cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
 905
 906
 907         hci_dev_unlock_bh(hdev);
 908         hci_dev_put(hdev);
 909
 910         return err;
 911 }
 912
 913 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 914                                                                 u16 len)
 915 {
 916         struct hci_dev *hdev;
 917         struct mgmt_cp_load_link_keys *cp;
 918         u16 key_count, expected_len;
 919         int i;
 920
 921         cp = (void *) data;
 922
 923         if (len < sizeof(*cp))
 924                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 925
 926         key_count = get_unaligned_le16(&cp->key_count);
 927
 928         expected_len = sizeof(*cp) + key_count *
 929                                         sizeof(struct mgmt_link_key_info);
 930         if (expected_len != len) {
 931                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
 932                                                         len, expected_len);
 933                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, EINVAL);
 934         }
 935
 936         hdev = hci_dev_get(index);
 937         if (!hdev)
 938                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS, ENODEV);
 939
 940         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 941                                                                 key_count);
 942
 943         hci_dev_lock_bh(hdev);
 944
 945         hci_link_keys_clear(hdev);
 946
 947         set_bit(HCI_LINK_KEYS, &hdev->flags);
 948
 949         if (cp->debug_keys)
 950                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 951         else
 952                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 953
 954         for (i = 0; i < key_count; i++) {
 955                 struct mgmt_link_key_info *key = &cp->keys[i];
 956
 957                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 958                                                                 key->pin_len);
 959         }
 960
 961         hci_dev_unlock_bh(hdev);
 962         hci_dev_put(hdev);
 963
 964         return 0;
 965 }
 966
 967 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 968                                                                 u16 len)
 969 {
 970         struct hci_dev *hdev;
 971         struct mgmt_cp_remove_keys *cp;
 972         struct hci_conn *conn;
 973         int err;
 974
 975         cp = (void *) data;
 976
 977         if (len != sizeof(*cp))
 978                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, EINVAL);
 979
 980         hdev = hci_dev_get(index);
 981         if (!hdev)
 982                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, ENODEV);
 983
 984         hci_dev_lock_bh(hdev);
 985
 986         err = hci_remove_link_key(hdev, &cp->bdaddr);
 987         if (err < 0) {
 988                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEYS, -err);
 989                 goto unlock;
 990         }
 991
 992         err = 0;
 993
 994         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 995                 goto unlock;
 996
 997         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 998         if (conn) {
 999                 struct hci_cp_disconnect dc;
1000
1001                 put_unaligned_le16(conn->handle, &dc.handle);
1002                 dc.reason = 0x13; /* Remote User Terminated Connection */
1003                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1004         }
1005
1006 unlock:
1007         hci_dev_unlock_bh(hdev);
1008         hci_dev_put(hdev);
1009
1010         return err;
1011 }
1012
1013 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1014 {
1015         struct hci_dev *hdev;
1016         struct mgmt_cp_disconnect *cp;
1017         struct hci_cp_disconnect dc;
1018         struct pending_cmd *cmd;
1019         struct hci_conn *conn;
1020         int err;
1021
1022         BT_DBG("");
1023
1024         cp = (void *) data;
1025
1026         if (len != sizeof(*cp))
1027                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1028
1029         hdev = hci_dev_get(index);
1030         if (!hdev)
1031                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1032
1033         hci_dev_lock_bh(hdev);
1034
1035         if (!test_bit(HCI_UP, &hdev->flags)) {
1036                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1037                 goto failed;
1038         }
1039
1040         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1041                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1042                 goto failed;
1043         }
1044
1045         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1046         if (!conn)
1047                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1048
1049         if (!conn) {
1050                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1051                 goto failed;
1052         }
1053
1054         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1055         if (!cmd) {
1056                 err = -ENOMEM;
1057                 goto failed;
1058         }
1059
1060         put_unaligned_le16(conn->handle, &dc.handle);
1061         dc.reason = 0x13; /* Remote User Terminated Connection */
1062
1063         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1064         if (err < 0)
1065                 mgmt_pending_remove(cmd);
1066
1067 failed:
1068         hci_dev_unlock_bh(hdev);
1069         hci_dev_put(hdev);
1070
1071         return err;
1072 }
1073
1074 static u8 link_to_mgmt(u8 link_type)
1075 {
1076         switch (link_type) {
1077         case LE_LINK:
1078                 return MGMT_ADDR_LE;
1079         case ACL_LINK:
1080                 return MGMT_ADDR_BREDR;
1081         default:
1082                 return MGMT_ADDR_INVALID;
1083         }
1084 }
1085
1086 static int get_connections(struct sock *sk, u16 index)
1087 {
1088         struct mgmt_rp_get_connections *rp;
1089         struct hci_dev *hdev;
1090         struct hci_conn *c;
1091         struct list_head *p;
1092         size_t rp_len;
1093         u16 count;
1094         int i, err;
1095
1096         BT_DBG("");
1097
1098         hdev = hci_dev_get(index);
1099         if (!hdev)
1100                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1101
1102         hci_dev_lock_bh(hdev);
1103
1104         count = 0;
1105         list_for_each(p, &hdev->conn_hash.list) {
1106                 count++;
1107         }
1108
1109         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1110         rp = kmalloc(rp_len, GFP_ATOMIC);
1111         if (!rp) {
1112                 err = -ENOMEM;
1113                 goto unlock;
1114         }
1115
1116         put_unaligned_le16(count, &rp->conn_count);
1117
1118         i = 0;
1119         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1120                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1121                 rp->addr[i].type = link_to_mgmt(c->type);
1122                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1123                         continue;
1124                 i++;
1125         }
1126
1127         /* Recalculate length in case of filtered SCO connections, etc */
1128         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1129
1130         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1131
1132 unlock:
1133         kfree(rp);
1134         hci_dev_unlock_bh(hdev);
1135         hci_dev_put(hdev);
1136         return err;
1137 }
1138
1139 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1140                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1141 {
1142         struct pending_cmd *cmd;
1143         int err;
1144
1145         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1146                                                                 sizeof(*cp));
1147         if (!cmd)
1148                 return -ENOMEM;
1149
1150         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1151                                                                 &cp->bdaddr);
1152         if (err < 0)
1153                 mgmt_pending_remove(cmd);
1154
1155         return err;
1156 }
1157
1158 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1159                                                                         u16 len)
1160 {
1161         struct hci_dev *hdev;
1162         struct hci_conn *conn;
1163         struct mgmt_cp_pin_code_reply *cp;
1164         struct mgmt_cp_pin_code_neg_reply ncp;
1165         struct hci_cp_pin_code_reply reply;
1166         struct pending_cmd *cmd;
1167         int err;
1168
1169         BT_DBG("");
1170
1171         cp = (void *) data;
1172
1173         if (len != sizeof(*cp))
1174                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1175
1176         hdev = hci_dev_get(index);
1177         if (!hdev)
1178                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1179
1180         hci_dev_lock_bh(hdev);
1181
1182         if (!test_bit(HCI_UP, &hdev->flags)) {
1183                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1184                 goto failed;
1185         }
1186
1187         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1188         if (!conn) {
1189                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1190                 goto failed;
1191         }
1192
1193         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1194                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1195
1196                 BT_ERR("PIN code is not 16 bytes long");
1197
1198                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1199                 if (err >= 0)
1200                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1201                                                                 EINVAL);
1202
1203                 goto failed;
1204         }
1205
1206         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1207         if (!cmd) {
1208                 err = -ENOMEM;
1209                 goto failed;
1210         }
1211
1212         bacpy(&reply.bdaddr, &cp->bdaddr);
1213         reply.pin_len = cp->pin_len;
1214         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1215
1216         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1217         if (err < 0)
1218                 mgmt_pending_remove(cmd);
1219
1220 failed:
1221         hci_dev_unlock_bh(hdev);
1222         hci_dev_put(hdev);
1223
1224         return err;
1225 }
1226
1227 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1228                                                                         u16 len)
1229 {
1230         struct hci_dev *hdev;
1231         struct mgmt_cp_pin_code_neg_reply *cp;
1232         int err;
1233
1234         BT_DBG("");
1235
1236         cp = (void *) data;
1237
1238         if (len != sizeof(*cp))
1239                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1240                                                                         EINVAL);
1241
1242         hdev = hci_dev_get(index);
1243         if (!hdev)
1244                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1245                                                                         ENODEV);
1246
1247         hci_dev_lock_bh(hdev);
1248
1249         if (!test_bit(HCI_UP, &hdev->flags)) {
1250                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1251                                                                 ENETDOWN);
1252                 goto failed;
1253         }
1254
1255         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1256
1257 failed:
1258         hci_dev_unlock_bh(hdev);
1259         hci_dev_put(hdev);
1260
1261         return err;
1262 }
1263
1264 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1265                                                                         u16 len)
1266 {
1267         struct hci_dev *hdev;
1268         struct mgmt_cp_set_io_capability *cp;
1269
1270         BT_DBG("");
1271
1272         cp = (void *) data;
1273
1274         if (len != sizeof(*cp))
1275                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1276
1277         hdev = hci_dev_get(index);
1278         if (!hdev)
1279                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1280
1281         hci_dev_lock_bh(hdev);
1282
1283         hdev->io_capability = cp->io_capability;
1284
1285         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1286                                                         hdev->io_capability);
1287
1288         hci_dev_unlock_bh(hdev);
1289         hci_dev_put(hdev);
1290
1291         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1292 }
1293
1294 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1295 {
1296         struct hci_dev *hdev = conn->hdev;
1297         struct pending_cmd *cmd;
1298
1299         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1300                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1301                         continue;
1302
1303                 if (cmd->index != hdev->id)
1304                         continue;
1305
1306                 if (cmd->user_data != conn)
1307                         continue;
1308
1309                 return cmd;
1310         }
1311
1312         return NULL;
1313 }
1314
1315 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1316 {
1317         struct mgmt_rp_pair_device rp;
1318         struct hci_conn *conn = cmd->user_data;
1319
1320         bacpy(&rp.bdaddr, &conn->dst);
1321         rp.status = status;
1322
1323         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1324
1325         /* So we don't get further callbacks for this connection */
1326         conn->connect_cfm_cb = NULL;
1327         conn->security_cfm_cb = NULL;
1328         conn->disconn_cfm_cb = NULL;
1329
1330         hci_conn_put(conn);
1331
1332         mgmt_pending_remove(cmd);
1333 }
1334
1335 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1336 {
1337         struct pending_cmd *cmd;
1338         struct hci_dev *hdev = conn->hdev;
1339
1340         BT_DBG("status %u", status);
1341
1342         hci_dev_lock_bh(hdev);
1343
1344         cmd = find_pairing(conn);
1345         if (!cmd)
1346                 BT_DBG("Unable to find a pending command");
1347         else
1348                 pairing_complete(cmd, status);
1349
1350         hci_dev_unlock_bh(hdev);
1351 }
1352
1353 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1354 {
1355         struct hci_dev *hdev;
1356         struct mgmt_cp_pair_device *cp;
1357         struct pending_cmd *cmd;
1358         struct adv_entry *entry;
1359         u8 sec_level, auth_type;
1360         struct hci_conn *conn;
1361         int err;
1362
1363         BT_DBG("");
1364
1365         cp = (void *) data;
1366
1367         if (len != sizeof(*cp))
1368                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1369
1370         hdev = hci_dev_get(index);
1371         if (!hdev)
1372                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1373
1374         hci_dev_lock_bh(hdev);
1375
1376         sec_level = BT_SECURITY_MEDIUM;
1377         if (cp->io_cap == 0x03)
1378                 auth_type = HCI_AT_DEDICATED_BONDING;
1379         else
1380                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1381
1382         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1383         if (entry)
1384                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1385                                                                 auth_type);
1386         else
1387                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1388                                                                 auth_type);
1389
1390         if (IS_ERR(conn)) {
1391                 err = PTR_ERR(conn);
1392                 goto unlock;
1393         }
1394
1395         if (conn->connect_cfm_cb) {
1396                 hci_conn_put(conn);
1397                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1398                 goto unlock;
1399         }
1400
1401         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1402         if (!cmd) {
1403                 err = -ENOMEM;
1404                 hci_conn_put(conn);
1405                 goto unlock;
1406         }
1407
1408         /* For LE, just connecting isn't a proof that the pairing finished */
1409         if (!entry)
1410                 conn->connect_cfm_cb = pairing_complete_cb;
1411
1412         conn->security_cfm_cb = pairing_complete_cb;
1413         conn->disconn_cfm_cb = pairing_complete_cb;
1414         conn->io_capability = cp->io_cap;
1415         cmd->user_data = conn;
1416
1417         if (conn->state == BT_CONNECTED &&
1418                                 hci_conn_security(conn, sec_level, auth_type))
1419                 pairing_complete(cmd, 0);
1420
1421         err = 0;
1422
1423 unlock:
1424         hci_dev_unlock_bh(hdev);
1425         hci_dev_put(hdev);
1426
1427         return err;
1428 }
1429
1430 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1431                                                         u16 len, int success)
1432 {
1433         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1434         u16 mgmt_op, hci_op;
1435         struct pending_cmd *cmd;
1436         struct hci_dev *hdev;
1437         int err;
1438
1439         BT_DBG("");
1440
1441         if (success) {
1442                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1443                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1444         } else {
1445                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1446                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1447         }
1448
1449         if (len != sizeof(*cp))
1450                 return cmd_status(sk, index, mgmt_op, EINVAL);
1451
1452         hdev = hci_dev_get(index);
1453         if (!hdev)
1454                 return cmd_status(sk, index, mgmt_op, ENODEV);
1455
1456         hci_dev_lock_bh(hdev);
1457
1458         if (!test_bit(HCI_UP, &hdev->flags)) {
1459                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1460                 goto failed;
1461         }
1462
1463         cmd = mgmt_pending_add(sk, mgmt_op, hdev, data, len);
1464         if (!cmd) {
1465                 err = -ENOMEM;
1466                 goto failed;
1467         }
1468
1469         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1470         if (err < 0)
1471                 mgmt_pending_remove(cmd);
1472
1473 failed:
1474         hci_dev_unlock_bh(hdev);
1475         hci_dev_put(hdev);
1476
1477         return err;
1478 }
1479
1480 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1481                                                                 u16 len)
1482 {
1483         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1484         struct hci_cp_write_local_name hci_cp;
1485         struct hci_dev *hdev;
1486         struct pending_cmd *cmd;
1487         int err;
1488
1489         BT_DBG("");
1490
1491         if (len != sizeof(*mgmt_cp))
1492                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1493
1494         hdev = hci_dev_get(index);
1495         if (!hdev)
1496                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1497
1498         hci_dev_lock_bh(hdev);
1499
1500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1501         if (!cmd) {
1502                 err = -ENOMEM;
1503                 goto failed;
1504         }
1505
1506         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1507         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1508                                                                 &hci_cp);
1509         if (err < 0)
1510                 mgmt_pending_remove(cmd);
1511
1512 failed:
1513         hci_dev_unlock_bh(hdev);
1514         hci_dev_put(hdev);
1515
1516         return err;
1517 }
1518
1519 static int read_local_oob_data(struct sock *sk, u16 index)
1520 {
1521         struct hci_dev *hdev;
1522         struct pending_cmd *cmd;
1523         int err;
1524
1525         BT_DBG("hci%u", index);
1526
1527         hdev = hci_dev_get(index);
1528         if (!hdev)
1529                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1530                                                                         ENODEV);
1531
1532         hci_dev_lock_bh(hdev);
1533
1534         if (!test_bit(HCI_UP, &hdev->flags)) {
1535                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1536                                                                 ENETDOWN);
1537                 goto unlock;
1538         }
1539
1540         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1541                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1542                                                                 EOPNOTSUPP);
1543                 goto unlock;
1544         }
1545
1546         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1547                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1548                 goto unlock;
1549         }
1550
1551         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1552         if (!cmd) {
1553                 err = -ENOMEM;
1554                 goto unlock;
1555         }
1556
1557         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1558         if (err < 0)
1559                 mgmt_pending_remove(cmd);
1560
1561 unlock:
1562         hci_dev_unlock_bh(hdev);
1563         hci_dev_put(hdev);
1564
1565         return err;
1566 }
1567
1568 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1569                                                                         u16 len)
1570 {
1571         struct hci_dev *hdev;
1572         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1573         int err;
1574
1575         BT_DBG("hci%u ", index);
1576
1577         if (len != sizeof(*cp))
1578                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1579                                                                         EINVAL);
1580
1581         hdev = hci_dev_get(index);
1582         if (!hdev)
1583                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1584                                                                         ENODEV);
1585
1586         hci_dev_lock_bh(hdev);
1587
1588         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1589                                                                 cp->randomizer);
1590         if (err < 0)
1591                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1592         else
1593                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1594                                                                         0);
1595
1596         hci_dev_unlock_bh(hdev);
1597         hci_dev_put(hdev);
1598
1599         return err;
1600 }
1601
1602 static int remove_remote_oob_data(struct sock *sk, u16 index,
1603                                                 unsigned char *data, u16 len)
1604 {
1605         struct hci_dev *hdev;
1606         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1607         int err;
1608
1609         BT_DBG("hci%u ", index);
1610
1611         if (len != sizeof(*cp))
1612                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1613                                                                         EINVAL);
1614
1615         hdev = hci_dev_get(index);
1616         if (!hdev)
1617                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1618                                                                         ENODEV);
1619
1620         hci_dev_lock_bh(hdev);
1621
1622         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1623         if (err < 0)
1624                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1625                                                                         -err);
1626         else
1627                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1628                                                                 NULL, 0);
1629
1630         hci_dev_unlock_bh(hdev);
1631         hci_dev_put(hdev);
1632
1633         return err;
1634 }
1635
1636 static int start_discovery(struct sock *sk, u16 index)
1637 {
1638         struct pending_cmd *cmd;
1639         struct hci_dev *hdev;
1640         int err;
1641
1642         BT_DBG("hci%u", index);
1643
1644         hdev = hci_dev_get(index);
1645         if (!hdev)
1646                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1647
1648         hci_dev_lock_bh(hdev);
1649
1650         if (!test_bit(HCI_UP, &hdev->flags)) {
1651                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENETDOWN);
1652                 goto failed;
1653         }
1654
1655         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1656         if (!cmd) {
1657                 err = -ENOMEM;
1658                 goto failed;
1659         }
1660
1661         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1662         if (err < 0)
1663                 mgmt_pending_remove(cmd);
1664
1665 failed:
1666         hci_dev_unlock_bh(hdev);
1667         hci_dev_put(hdev);
1668
1669         return err;
1670 }
1671
1672 static int stop_discovery(struct sock *sk, u16 index)
1673 {
1674         struct hci_dev *hdev;
1675         struct pending_cmd *cmd;
1676         int err;
1677
1678         BT_DBG("hci%u", index);
1679
1680         hdev = hci_dev_get(index);
1681         if (!hdev)
1682                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1683
1684         hci_dev_lock_bh(hdev);
1685
1686         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1687         if (!cmd) {
1688                 err = -ENOMEM;
1689                 goto failed;
1690         }
1691
1692         err = hci_cancel_inquiry(hdev);
1693         if (err < 0)
1694                 mgmt_pending_remove(cmd);
1695
1696 failed:
1697         hci_dev_unlock_bh(hdev);
1698         hci_dev_put(hdev);
1699
1700         return err;
1701 }
1702
1703 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1704                                                                 u16 len)
1705 {
1706         struct hci_dev *hdev;
1707         struct mgmt_cp_block_device *cp = (void *) data;
1708         int err;
1709
1710         BT_DBG("hci%u", index);
1711
1712         if (len != sizeof(*cp))
1713                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1714                                                         EINVAL);
1715
1716         hdev = hci_dev_get(index);
1717         if (!hdev)
1718                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1719                                                         ENODEV);
1720
1721         hci_dev_lock_bh(hdev);
1722
1723         err = hci_blacklist_add(hdev, &cp->bdaddr);
1724         if (err < 0)
1725                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1726         else
1727                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1728                                                         NULL, 0);
1729
1730         hci_dev_unlock_bh(hdev);
1731         hci_dev_put(hdev);
1732
1733         return err;
1734 }
1735
1736 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1737                                                                 u16 len)
1738 {
1739         struct hci_dev *hdev;
1740         struct mgmt_cp_unblock_device *cp = (void *) data;
1741         int err;
1742
1743         BT_DBG("hci%u", index);
1744
1745         if (len != sizeof(*cp))
1746                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1747                                                                 EINVAL);
1748
1749         hdev = hci_dev_get(index);
1750         if (!hdev)
1751                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1752                                                                 ENODEV);
1753
1754         hci_dev_lock_bh(hdev);
1755
1756         err = hci_blacklist_del(hdev, &cp->bdaddr);
1757
1758         if (err < 0)
1759                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1760         else
1761                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1762                                                                 NULL, 0);
1763
1764         hci_dev_unlock_bh(hdev);
1765         hci_dev_put(hdev);
1766
1767         return err;
1768 }
1769
1770 static int set_fast_connectable(struct sock *sk, u16 index,
1771                                         unsigned char *data, u16 len)
1772 {
1773         struct hci_dev *hdev;
1774         struct mgmt_cp_set_fast_connectable *cp = (void *) data;
1775         struct hci_cp_write_page_scan_activity acp;
1776         u8 type;
1777         int err;
1778
1779         BT_DBG("hci%u", index);
1780
1781         if (len != sizeof(*cp))
1782                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1783                                                                 EINVAL);
1784
1785         hdev = hci_dev_get(index);
1786         if (!hdev)
1787                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1788                                                                 ENODEV);
1789
1790         hci_dev_lock(hdev);
1791
1792         if (cp->enable) {
1793                 type = PAGE_SCAN_TYPE_INTERLACED;
1794                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
1795         } else {
1796                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1797                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
1798         }
1799
1800         acp.window = 0x0012;    /* default 11.25 msec page scan window */
1801
1802         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1803                                                 sizeof(acp), &acp);
1804         if (err < 0) {
1805                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1806                                                                 -err);
1807                 goto done;
1808         }
1809
1810         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1811         if (err < 0) {
1812                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1813                                                                 -err);
1814                 goto done;
1815         }
1816
1817         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
1818                                                         NULL, 0);
1819 done:
1820         hci_dev_unlock(hdev);
1821         hci_dev_put(hdev);
1822
1823         return err;
1824 }
1825
1826 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1827 {
1828         unsigned char *buf;
1829         struct mgmt_hdr *hdr;
1830         u16 opcode, index, len;
1831         int err;
1832
1833         BT_DBG("got %zu bytes", msglen);
1834
1835         if (msglen < sizeof(*hdr))
1836                 return -EINVAL;
1837
1838         buf = kmalloc(msglen, GFP_KERNEL);
1839         if (!buf)
1840                 return -ENOMEM;
1841
1842         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1843                 err = -EFAULT;
1844                 goto done;
1845         }
1846
1847         hdr = (struct mgmt_hdr *) buf;
1848         opcode = get_unaligned_le16(&hdr->opcode);
1849         index = get_unaligned_le16(&hdr->index);
1850         len = get_unaligned_le16(&hdr->len);
1851
1852         if (len != msglen - sizeof(*hdr)) {
1853                 err = -EINVAL;
1854                 goto done;
1855         }
1856
1857         switch (opcode) {
1858         case MGMT_OP_READ_VERSION:
1859                 err = read_version(sk);
1860                 break;
1861         case MGMT_OP_READ_INDEX_LIST:
1862                 err = read_index_list(sk);
1863                 break;
1864         case MGMT_OP_READ_INFO:
1865                 err = read_controller_info(sk, index);
1866                 break;
1867         case MGMT_OP_SET_POWERED:
1868                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1869                 break;
1870         case MGMT_OP_SET_DISCOVERABLE:
1871                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1872                 break;
1873         case MGMT_OP_SET_CONNECTABLE:
1874                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1875                 break;
1876         case MGMT_OP_SET_PAIRABLE:
1877                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1878                 break;
1879         case MGMT_OP_ADD_UUID:
1880                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1881                 break;
1882         case MGMT_OP_REMOVE_UUID:
1883                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1884                 break;
1885         case MGMT_OP_SET_DEV_CLASS:
1886                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1887                 break;
1888         case MGMT_OP_SET_SERVICE_CACHE:
1889                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1890                 break;
1891         case MGMT_OP_LOAD_LINK_KEYS:
1892                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
1893                 break;
1894         case MGMT_OP_REMOVE_KEYS:
1895                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
1896                 break;
1897         case MGMT_OP_DISCONNECT:
1898                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1899                 break;
1900         case MGMT_OP_GET_CONNECTIONS:
1901                 err = get_connections(sk, index);
1902                 break;
1903         case MGMT_OP_PIN_CODE_REPLY:
1904                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1905                 break;
1906         case MGMT_OP_PIN_CODE_NEG_REPLY:
1907                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1908                 break;
1909         case MGMT_OP_SET_IO_CAPABILITY:
1910                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1911                 break;
1912         case MGMT_OP_PAIR_DEVICE:
1913                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1914                 break;
1915         case MGMT_OP_USER_CONFIRM_REPLY:
1916                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1917                 break;
1918         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1919                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1920                 break;
1921         case MGMT_OP_SET_LOCAL_NAME:
1922                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1923                 break;
1924         case MGMT_OP_READ_LOCAL_OOB_DATA:
1925                 err = read_local_oob_data(sk, index);
1926                 break;
1927         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1928                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1929                 break;
1930         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1931                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1932                                                                         len);
1933                 break;
1934         case MGMT_OP_START_DISCOVERY:
1935                 err = start_discovery(sk, index);
1936                 break;
1937         case MGMT_OP_STOP_DISCOVERY:
1938                 err = stop_discovery(sk, index);
1939                 break;
1940         case MGMT_OP_BLOCK_DEVICE:
1941                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1942                 break;
1943         case MGMT_OP_UNBLOCK_DEVICE:
1944                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1945                 break;
1946         case MGMT_OP_SET_FAST_CONNECTABLE:
1947                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
1948                                                                 len);
1949                 break;
1950         default:
1951                 BT_DBG("Unknown op %u", opcode);
1952                 err = cmd_status(sk, index, opcode, 0x01);
1953                 break;
1954         }
1955
1956         if (err < 0)
1957                 goto done;
1958
1959         err = msglen;
1960
1961 done:
1962         kfree(buf);
1963         return err;
1964 }
1965
1966 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1967 {
1968         u8 *status = data;
1969
1970         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1971         mgmt_pending_remove(cmd);
1972 }
1973
1974 int mgmt_index_added(struct hci_dev *hdev)
1975 {
1976         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
1977 }
1978
1979 int mgmt_index_removed(struct hci_dev *hdev)
1980 {
1981         u8 status = ENODEV;
1982
1983         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
1984
1985         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
1986 }
1987
1988 struct cmd_lookup {
1989         u8 val;
1990         struct sock *sk;
1991 };
1992
1993 static void mode_rsp(struct pending_cmd *cmd, void *data)
1994 {
1995         struct mgmt_mode *cp = cmd->param;
1996         struct cmd_lookup *match = data;
1997
1998         if (cp->val != match->val)
1999                 return;
2000
2001         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
2002
2003         list_del(&cmd->list);
2004
2005         if (match->sk == NULL) {
2006                 match->sk = cmd->sk;
2007                 sock_hold(match->sk);
2008         }
2009
2010         mgmt_pending_free(cmd);
2011 }
2012
2013 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2014 {
2015         struct mgmt_mode ev;
2016         struct cmd_lookup match = { powered, NULL };
2017         int ret;
2018
2019         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
2020
2021         if (!powered) {
2022                 u8 status = ENETDOWN;
2023                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2024         }
2025
2026         ev.val = powered;
2027
2028         ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
2029
2030         if (match.sk)
2031                 sock_put(match.sk);
2032
2033         return ret;
2034 }
2035
2036 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2037 {
2038         struct mgmt_mode ev;
2039         struct cmd_lookup match = { discoverable, NULL };
2040         int ret;
2041
2042         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
2043
2044         ev.val = discoverable;
2045
2046         ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
2047                                                                 match.sk);
2048
2049         if (match.sk)
2050                 sock_put(match.sk);
2051
2052         return ret;
2053 }
2054
2055 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2056 {
2057         struct mgmt_mode ev;
2058         struct cmd_lookup match = { connectable, NULL };
2059         int ret;
2060
2061         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
2062
2063         ev.val = connectable;
2064
2065         ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
2066
2067         if (match.sk)
2068                 sock_put(match.sk);
2069
2070         return ret;
2071 }
2072
2073 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2074 {
2075         if (scan & SCAN_PAGE)
2076                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2077                                                 cmd_status_rsp, &status);
2078
2079         if (scan & SCAN_INQUIRY)
2080                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2081                                                 cmd_status_rsp, &status);
2082
2083         return 0;
2084 }
2085
2086 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2087                                                                 u8 persistent)
2088 {
2089         struct mgmt_ev_new_link_key ev;
2090
2091         memset(&ev, 0, sizeof(ev));
2092
2093         ev.store_hint = persistent;
2094         bacpy(&ev.key.bdaddr, &key->bdaddr);
2095         ev.key.type = key->type;
2096         memcpy(ev.key.val, key->val, 16);
2097         ev.key.pin_len = key->pin_len;
2098
2099         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2100 }
2101
2102 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type)
2103 {
2104         struct mgmt_addr_info ev;
2105
2106         bacpy(&ev.bdaddr, bdaddr);
2107         ev.type = link_to_mgmt(link_type);
2108
2109         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2110 }
2111
2112 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2113 {
2114         struct mgmt_cp_disconnect *cp = cmd->param;
2115         struct sock **sk = data;
2116         struct mgmt_rp_disconnect rp;
2117
2118         bacpy(&rp.bdaddr, &cp->bdaddr);
2119
2120         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2121
2122         *sk = cmd->sk;
2123         sock_hold(*sk);
2124
2125         mgmt_pending_remove(cmd);
2126 }
2127
2128 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2129 {
2130         struct mgmt_addr_info ev;
2131         struct sock *sk = NULL;
2132         int err;
2133
2134         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2135
2136         bacpy(&ev.bdaddr, bdaddr);
2137         ev.type = link_to_mgmt(type);
2138
2139         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2140
2141         if (sk)
2142                 sock_put(sk);
2143
2144         return err;
2145 }
2146
2147 int mgmt_disconnect_failed(struct hci_dev *hdev)
2148 {
2149         struct pending_cmd *cmd;
2150         int err;
2151
2152         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2153         if (!cmd)
2154                 return -ENOENT;
2155
2156         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT, EIO);
2157
2158         mgmt_pending_remove(cmd);
2159
2160         return err;
2161 }
2162
2163 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2164                                                                 u8 status)
2165 {
2166         struct mgmt_ev_connect_failed ev;
2167
2168         bacpy(&ev.addr.bdaddr, bdaddr);
2169         ev.addr.type = link_to_mgmt(type);
2170         ev.status = status;
2171
2172         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2173 }
2174
2175 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2176 {
2177         struct mgmt_ev_pin_code_request ev;
2178
2179         bacpy(&ev.bdaddr, bdaddr);
2180         ev.secure = secure;
2181
2182         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2183                                                                         NULL);
2184 }
2185
2186 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2187                                                                 u8 status)
2188 {
2189         struct pending_cmd *cmd;
2190         struct mgmt_rp_pin_code_reply rp;
2191         int err;
2192
2193         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2194         if (!cmd)
2195                 return -ENOENT;
2196
2197         bacpy(&rp.bdaddr, bdaddr);
2198         rp.status = status;
2199
2200         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2201                                                                 sizeof(rp));
2202
2203         mgmt_pending_remove(cmd);
2204
2205         return err;
2206 }
2207
2208 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2209                                                                 u8 status)
2210 {
2211         struct pending_cmd *cmd;
2212         struct mgmt_rp_pin_code_reply rp;
2213         int err;
2214
2215         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2216         if (!cmd)
2217                 return -ENOENT;
2218
2219         bacpy(&rp.bdaddr, bdaddr);
2220         rp.status = status;
2221
2222         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2223                                                                 sizeof(rp));
2224
2225         mgmt_pending_remove(cmd);
2226
2227         return err;
2228 }
2229
2230 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2231                                                 __le32 value, u8 confirm_hint)
2232 {
2233         struct mgmt_ev_user_confirm_request ev;
2234
2235         BT_DBG("%s", hdev->name);
2236
2237         bacpy(&ev.bdaddr, bdaddr);
2238         ev.confirm_hint = confirm_hint;
2239         put_unaligned_le32(value, &ev.value);
2240
2241         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2242                                                                         NULL);
2243 }
2244
2245 static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2246                                                         u8 status, u8 opcode)
2247 {
2248         struct pending_cmd *cmd;
2249         struct mgmt_rp_user_confirm_reply rp;
2250         int err;
2251
2252         cmd = mgmt_pending_find(opcode, hdev);
2253         if (!cmd)
2254                 return -ENOENT;
2255
2256         bacpy(&rp.bdaddr, bdaddr);
2257         rp.status = status;
2258         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2259
2260         mgmt_pending_remove(cmd);
2261
2262         return err;
2263 }
2264
2265 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2266                                                                 u8 status)
2267 {
2268         return confirm_reply_complete(hdev, bdaddr, status,
2269                                                 MGMT_OP_USER_CONFIRM_REPLY);
2270 }
2271
2272 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2273                                                 bdaddr_t *bdaddr, u8 status)
2274 {
2275         return confirm_reply_complete(hdev, bdaddr, status,
2276                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2277 }
2278
2279 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2280 {
2281         struct mgmt_ev_auth_failed ev;
2282
2283         bacpy(&ev.bdaddr, bdaddr);
2284         ev.status = status;
2285
2286         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2287 }
2288
2289 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2290 {
2291         struct pending_cmd *cmd;
2292         struct mgmt_cp_set_local_name ev;
2293         int err;
2294
2295         memset(&ev, 0, sizeof(ev));
2296         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2297
2298         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2299         if (!cmd)
2300                 goto send_event;
2301
2302         if (status) {
2303                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2304                                                                         EIO);
2305                 goto failed;
2306         }
2307
2308         update_eir(hdev);
2309
2310         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2311                                                                 sizeof(ev));
2312         if (err < 0)
2313                 goto failed;
2314
2315 send_event:
2316         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2317                                                         cmd ? cmd->sk : NULL);
2318
2319 failed:
2320         if (cmd)
2321                 mgmt_pending_remove(cmd);
2322         return err;
2323 }
2324
2325 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2326                                                 u8 *randomizer, u8 status)
2327 {
2328         struct pending_cmd *cmd;
2329         int err;
2330
2331         BT_DBG("%s status %u", hdev->name, status);
2332
2333         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2334         if (!cmd)
2335                 return -ENOENT;
2336
2337         if (status) {
2338                 err = cmd_status(cmd->sk, hdev->id,
2339                                         MGMT_OP_READ_LOCAL_OOB_DATA, EIO);
2340         } else {
2341                 struct mgmt_rp_read_local_oob_data rp;
2342
2343                 memcpy(rp.hash, hash, sizeof(rp.hash));
2344                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2345
2346                 err = cmd_complete(cmd->sk, hdev->id,
2347                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2348                                                 &rp, sizeof(rp));
2349         }
2350
2351         mgmt_pending_remove(cmd);
2352
2353         return err;
2354 }
2355
2356 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
2357                                         u8 *dev_class, s8 rssi, u8 *eir)
2358 {
2359         struct mgmt_ev_device_found ev;
2360
2361         memset(&ev, 0, sizeof(ev));
2362
2363         bacpy(&ev.addr.bdaddr, bdaddr);
2364         ev.addr.type = link_to_mgmt(type);
2365         ev.rssi = rssi;
2366
2367         if (eir)
2368                 memcpy(ev.eir, eir, sizeof(ev.eir));
2369
2370         if (dev_class)
2371                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2372
2373         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2374 }
2375
2376 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2377 {
2378         struct mgmt_ev_remote_name ev;
2379
2380         memset(&ev, 0, sizeof(ev));
2381
2382         bacpy(&ev.bdaddr, bdaddr);
2383         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2384
2385         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2386 }
2387
2388 int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status)
2389 {
2390         struct pending_cmd *cmd;
2391         int err;
2392
2393         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2394         if (!cmd)
2395                 return -ENOENT;
2396
2397         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2398         mgmt_pending_remove(cmd);
2399
2400         return err;
2401 }
2402
2403 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2404 {
2405         struct pending_cmd *cmd;
2406
2407         if (discovering)
2408                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2409         else
2410                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2411
2412         if (cmd != NULL) {
2413                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2414                 mgmt_pending_remove(cmd);
2415         }
2416
2417         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2418                                                 sizeof(discovering), NULL);
2419 }
2420
2421 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2422 {
2423         struct pending_cmd *cmd;
2424         struct mgmt_ev_device_blocked ev;
2425
2426         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2427
2428         bacpy(&ev.bdaddr, bdaddr);
2429
2430         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2431                                                         cmd ? cmd->sk : NULL);
2432 }
2433
2434 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2435 {
2436         struct pending_cmd *cmd;
2437         struct mgmt_ev_device_unblocked ev;
2438
2439         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2440
2441         bacpy(&ev.bdaddr, bdaddr);
2442
2443         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2444                                                         cmd ? cmd->sk : NULL);
2445 }