net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/kernel.h>
  26 #include <linux/uaccess.h>
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #define MGMT_VERSION    0
  35 #define MGMT_REVISION   1
  36
  37 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  38
  39 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
  40
  41 struct pending_cmd {
  42         struct list_head list;
  43         u16 opcode;
  44         int index;
  45         void *param;
  46         struct sock *sk;
  47         void *user_data;
  48 };
  49
  50 /* HCI to MGMT error code conversion table */
  51 static u8 mgmt_status_table[] = {
  52         MGMT_STATUS_SUCCESS,
  53         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
  54         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
  55         MGMT_STATUS_FAILED,             /* Hardware Failure */
  56         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
  57         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
  58         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
  59         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
  60         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
  61         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
  62         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
  63         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
  64         MGMT_STATUS_BUSY,               /* Command Disallowed */
  65         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
  66         MGMT_STATUS_REJECTED,           /* Rejected Security */
  67         MGMT_STATUS_REJECTED,           /* Rejected Personal */
  68         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
  69         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
  70         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
  71         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
  72         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
  73         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
  74         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
  75         MGMT_STATUS_BUSY,               /* Repeated Attempts */
  76         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
  77         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
  78         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
  79         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
  80         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
  81         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
  82         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
  83         MGMT_STATUS_FAILED,             /* Unspecified Error */
  84         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
  85         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
  86         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
  87         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
  88         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
  89         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
  90         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
  91         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
  92         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
  93         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
  94         MGMT_STATUS_FAILED,             /* Transaction Collision */
  95         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
  96         MGMT_STATUS_REJECTED,           /* QoS Rejected */
  97         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
  98         MGMT_STATUS_REJECTED,           /* Insufficient Security */
  99         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 100         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 101         MGMT_STATUS_FAILED,             /* Slot Violation */
 102         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 103         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 104         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 105         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 106         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 107         MGMT_STATUS_BUSY,               /* Controller Busy */
 108         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 109         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 110         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 111         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 112         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 113 };
 114
 115 static u8 mgmt_status(u8 hci_status)
 116 {
 117         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 118                 return mgmt_status_table[hci_status];
 119
 120         return MGMT_STATUS_FAILED;
 121 }
 122
 123 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 124 {
 125         struct sk_buff *skb;
 126         struct mgmt_hdr *hdr;
 127         struct mgmt_ev_cmd_status *ev;
 128         int err;
 129
 130         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 131
 132         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 133         if (!skb)
 134                 return -ENOMEM;
 135
 136         hdr = (void *) skb_put(skb, sizeof(*hdr));
 137
 138         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 139         hdr->index = cpu_to_le16(index);
 140         hdr->len = cpu_to_le16(sizeof(*ev));
 141
 142         ev = (void *) skb_put(skb, sizeof(*ev));
 143         ev->status = status;
 144         put_unaligned_le16(cmd, &ev->opcode);
 145
 146         err = sock_queue_rcv_skb(sk, skb);
 147         if (err < 0)
 148                 kfree_skb(skb);
 149
 150         return err;
 151 }
 152
 153 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 154                                                                 size_t rp_len)
 155 {
 156         struct sk_buff *skb;
 157         struct mgmt_hdr *hdr;
 158         struct mgmt_ev_cmd_complete *ev;
 159         int err;
 160
 161         BT_DBG("sock %p", sk);
 162
 163         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 164         if (!skb)
 165                 return -ENOMEM;
 166
 167         hdr = (void *) skb_put(skb, sizeof(*hdr));
 168
 169         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 170         hdr->index = cpu_to_le16(index);
 171         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 172
 173         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 174         put_unaligned_le16(cmd, &ev->opcode);
 175
 176         if (rp)
 177                 memcpy(ev->data, rp, rp_len);
 178
 179         err = sock_queue_rcv_skb(sk, skb);
 180         if (err < 0)
 181                 kfree_skb(skb);
 182
 183         return err;;
 184 }
 185
 186 static int read_version(struct sock *sk)
 187 {
 188         struct mgmt_rp_read_version rp;
 189
 190         BT_DBG("sock %p", sk);
 191
 192         rp.version = MGMT_VERSION;
 193         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 194
 195         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 196                                                                 sizeof(rp));
 197 }
 198
 199 static int read_index_list(struct sock *sk)
 200 {
 201         struct mgmt_rp_read_index_list *rp;
 202         struct list_head *p;
 203         struct hci_dev *d;
 204         size_t rp_len;
 205         u16 count;
 206         int i, err;
 207
 208         BT_DBG("sock %p", sk);
 209
 210         read_lock(&hci_dev_list_lock);
 211
 212         count = 0;
 213         list_for_each(p, &hci_dev_list) {
 214                 count++;
 215         }
 216
 217         rp_len = sizeof(*rp) + (2 * count);
 218         rp = kmalloc(rp_len, GFP_ATOMIC);
 219         if (!rp) {
 220                 read_unlock(&hci_dev_list_lock);
 221                 return -ENOMEM;
 222         }
 223
 224         put_unaligned_le16(count, &rp->num_controllers);
 225
 226         i = 0;
 227         list_for_each_entry(d, &hci_dev_list, list) {
 228                 if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
 229                         cancel_delayed_work(&d->power_off);
 230
 231                 if (test_bit(HCI_SETUP, &d->flags))
 232                         continue;
 233
 234                 put_unaligned_le16(d->id, &rp->index[i++]);
 235                 BT_DBG("Added hci%u", d->id);
 236         }
 237
 238         read_unlock(&hci_dev_list_lock);
 239
 240         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 241                                                                         rp_len);
 242
 243         kfree(rp);
 244
 245         return err;
 246 }
 247
 248 static u32 get_supported_settings(struct hci_dev *hdev)
 249 {
 250         u32 settings = 0;
 251
 252         settings |= MGMT_SETTING_POWERED;
 253         settings |= MGMT_SETTING_CONNECTABLE;
 254         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 255         settings |= MGMT_SETTING_DISCOVERABLE;
 256         settings |= MGMT_SETTING_PAIRABLE;
 257
 258         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 259                 settings |= MGMT_SETTING_SSP;
 260
 261         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 262                 settings |= MGMT_SETTING_BREDR;
 263                 settings |= MGMT_SETTING_LINK_SECURITY;
 264         }
 265
 266         if (hdev->features[4] & LMP_LE)
 267                 settings |= MGMT_SETTING_LE;
 268
 269         return settings;
 270 }
 271
 272 static u32 get_current_settings(struct hci_dev *hdev)
 273 {
 274         u32 settings = 0;
 275
 276         if (test_bit(HCI_UP, &hdev->flags))
 277                 settings |= MGMT_SETTING_POWERED;
 278         else
 279                 return settings;
 280
 281         if (test_bit(HCI_PSCAN, &hdev->flags))
 282                 settings |= MGMT_SETTING_CONNECTABLE;
 283
 284         if (test_bit(HCI_ISCAN, &hdev->flags))
 285                 settings |= MGMT_SETTING_DISCOVERABLE;
 286
 287         if (test_bit(HCI_PAIRABLE, &hdev->flags))
 288                 settings |= MGMT_SETTING_PAIRABLE;
 289
 290         if (!(hdev->features[4] & LMP_NO_BREDR))
 291                 settings |= MGMT_SETTING_BREDR;
 292
 293         if (hdev->extfeatures[0] & LMP_HOST_LE)
 294                 settings |= MGMT_SETTING_LE;
 295
 296         if (test_bit(HCI_AUTH, &hdev->flags))
 297                 settings |= MGMT_SETTING_LINK_SECURITY;
 298
 299         if (hdev->ssp_mode > 0)
 300                 settings |= MGMT_SETTING_SSP;
 301
 302         return settings;
 303 }
 304
 305 #define EIR_FLAGS               0x01 /* flags */
 306 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 307 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 308 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 309 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 310 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 311 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 312 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 313 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 314 #define EIR_TX_POWER            0x0A /* transmit power level */
 315 #define EIR_DEVICE_ID           0x10 /* device ID */
 316
 317 #define PNP_INFO_SVCLASS_ID             0x1200
 318
 319 static u8 bluetooth_base_uuid[] = {
 320                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 321                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 322 };
 323
 324 static u16 get_uuid16(u8 *uuid128)
 325 {
 326         u32 val;
 327         int i;
 328
 329         for (i = 0; i < 12; i++) {
 330                 if (bluetooth_base_uuid[i] != uuid128[i])
 331                         return 0;
 332         }
 333
 334         memcpy(&val, &uuid128[12], 4);
 335
 336         val = le32_to_cpu(val);
 337         if (val > 0xffff)
 338                 return 0;
 339
 340         return (u16) val;
 341 }
 342
 343 static void create_eir(struct hci_dev *hdev, u8 *data)
 344 {
 345         u8 *ptr = data;
 346         u16 eir_len = 0;
 347         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 348         int i, truncated = 0;
 349         struct bt_uuid *uuid;
 350         size_t name_len;
 351
 352         name_len = strlen(hdev->dev_name);
 353
 354         if (name_len > 0) {
 355                 /* EIR Data type */
 356                 if (name_len > 48) {
 357                         name_len = 48;
 358                         ptr[1] = EIR_NAME_SHORT;
 359                 } else
 360                         ptr[1] = EIR_NAME_COMPLETE;
 361
 362                 /* EIR Data length */
 363                 ptr[0] = name_len + 1;
 364
 365                 memcpy(ptr + 2, hdev->dev_name, name_len);
 366
 367                 eir_len += (name_len + 2);
 368                 ptr += (name_len + 2);
 369         }
 370
 371         memset(uuid16_list, 0, sizeof(uuid16_list));
 372
 373         /* Group all UUID16 types */
 374         list_for_each_entry(uuid, &hdev->uuids, list) {
 375                 u16 uuid16;
 376
 377                 uuid16 = get_uuid16(uuid->uuid);
 378                 if (uuid16 == 0)
 379                         return;
 380
 381                 if (uuid16 < 0x1100)
 382                         continue;
 383
 384                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 385                         continue;
 386
 387                 /* Stop if not enough space to put next UUID */
 388                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 389                         truncated = 1;
 390                         break;
 391                 }
 392
 393                 /* Check for duplicates */
 394                 for (i = 0; uuid16_list[i] != 0; i++)
 395                         if (uuid16_list[i] == uuid16)
 396                                 break;
 397
 398                 if (uuid16_list[i] == 0) {
 399                         uuid16_list[i] = uuid16;
 400                         eir_len += sizeof(u16);
 401                 }
 402         }
 403
 404         if (uuid16_list[0] != 0) {
 405                 u8 *length = ptr;
 406
 407                 /* EIR Data type */
 408                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 409
 410                 ptr += 2;
 411                 eir_len += 2;
 412
 413                 for (i = 0; uuid16_list[i] != 0; i++) {
 414                         *ptr++ = (uuid16_list[i] & 0x00ff);
 415                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 416                 }
 417
 418                 /* EIR Data length */
 419                 *length = (i * sizeof(u16)) + 1;
 420         }
 421 }
 422
 423 static int update_eir(struct hci_dev *hdev)
 424 {
 425         struct hci_cp_write_eir cp;
 426
 427         if (!(hdev->features[6] & LMP_EXT_INQ))
 428                 return 0;
 429
 430         if (hdev->ssp_mode == 0)
 431                 return 0;
 432
 433         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 434                 return 0;
 435
 436         memset(&cp, 0, sizeof(cp));
 437
 438         create_eir(hdev, cp.data);
 439
 440         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 441                 return 0;
 442
 443         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 444
 445         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 446 }
 447
 448 static u8 get_service_classes(struct hci_dev *hdev)
 449 {
 450         struct bt_uuid *uuid;
 451         u8 val = 0;
 452
 453         list_for_each_entry(uuid, &hdev->uuids, list)
 454                 val |= uuid->svc_hint;
 455
 456         return val;
 457 }
 458
 459 static int update_class(struct hci_dev *hdev)
 460 {
 461         u8 cod[3];
 462
 463         BT_DBG("%s", hdev->name);
 464
 465         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 466                 return 0;
 467
 468         cod[0] = hdev->minor_class;
 469         cod[1] = hdev->major_class;
 470         cod[2] = get_service_classes(hdev);
 471
 472         if (memcmp(cod, hdev->dev_class, 3) == 0)
 473                 return 0;
 474
 475         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 476 }
 477
 478 static void service_cache_off(struct work_struct *work)
 479 {
 480         struct hci_dev *hdev = container_of(work, struct hci_dev,
 481                                                         service_cache.work);
 482
 483         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
 484                 return;
 485
 486         hci_dev_lock(hdev);
 487
 488         update_eir(hdev);
 489         update_class(hdev);
 490
 491         hci_dev_unlock(hdev);
 492 }
 493
 494 static void mgmt_init_hdev(struct hci_dev *hdev)
 495 {
 496         if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
 497                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 498
 499         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
 500                 schedule_delayed_work(&hdev->service_cache,
 501                                 msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 502 }
 503
 504 static int read_controller_info(struct sock *sk, u16 index)
 505 {
 506         struct mgmt_rp_read_info rp;
 507         struct hci_dev *hdev;
 508
 509         BT_DBG("sock %p hci%u", sk, index);
 510
 511         hdev = hci_dev_get(index);
 512         if (!hdev)
 513                 return cmd_status(sk, index, MGMT_OP_READ_INFO,
 514                                                 MGMT_STATUS_INVALID_PARAMS);
 515
 516         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 517                 cancel_delayed_work_sync(&hdev->power_off);
 518
 519         hci_dev_lock(hdev);
 520
 521         if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 522                 mgmt_init_hdev(hdev);
 523
 524         memset(&rp, 0, sizeof(rp));
 525
 526         bacpy(&rp.bdaddr, &hdev->bdaddr);
 527
 528         rp.version = hdev->hci_ver;
 529
 530         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 531
 532         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 533         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 534
 535         memcpy(rp.dev_class, hdev->dev_class, 3);
 536
 537         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 538
 539         hci_dev_unlock(hdev);
 540         hci_dev_put(hdev);
 541
 542         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 543 }
 544
 545 static void mgmt_pending_free(struct pending_cmd *cmd)
 546 {
 547         sock_put(cmd->sk);
 548         kfree(cmd->param);
 549         kfree(cmd);
 550 }
 551
 552 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 553                                                         struct hci_dev *hdev,
 554                                                         void *data, u16 len)
 555 {
 556         struct pending_cmd *cmd;
 557
 558         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 559         if (!cmd)
 560                 return NULL;
 561
 562         cmd->opcode = opcode;
 563         cmd->index = hdev->id;
 564
 565         cmd->param = kmalloc(len, GFP_ATOMIC);
 566         if (!cmd->param) {
 567                 kfree(cmd);
 568                 return NULL;
 569         }
 570
 571         if (data)
 572                 memcpy(cmd->param, data, len);
 573
 574         cmd->sk = sk;
 575         sock_hold(sk);
 576
 577         list_add(&cmd->list, &hdev->mgmt_pending);
 578
 579         return cmd;
 580 }
 581
 582 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 583                                 void (*cb)(struct pending_cmd *cmd, void *data),
 584                                 void *data)
 585 {
 586         struct list_head *p, *n;
 587
 588         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 589                 struct pending_cmd *cmd;
 590
 591                 cmd = list_entry(p, struct pending_cmd, list);
 592
 593                 if (opcode > 0 && cmd->opcode != opcode)
 594                         continue;
 595
 596                 cb(cmd, data);
 597         }
 598 }
 599
 600 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 601 {
 602         struct pending_cmd *cmd;
 603
 604         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 605                 if (cmd->opcode == opcode)
 606                         return cmd;
 607         }
 608
 609         return NULL;
 610 }
 611
 612 static void mgmt_pending_remove(struct pending_cmd *cmd)
 613 {
 614         list_del(&cmd->list);
 615         mgmt_pending_free(cmd);
 616 }
 617
 618 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 619 {
 620         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 621
 622         return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
 623 }
 624
 625 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 626 {
 627         struct mgmt_mode *cp;
 628         struct hci_dev *hdev;
 629         struct pending_cmd *cmd;
 630         int err, up;
 631
 632         cp = (void *) data;
 633
 634         BT_DBG("request for hci%u", index);
 635
 636         if (len != sizeof(*cp))
 637                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 638                                                 MGMT_STATUS_INVALID_PARAMS);
 639
 640         hdev = hci_dev_get(index);
 641         if (!hdev)
 642                 return cmd_status(sk, index, MGMT_OP_SET_POWERED,
 643                                                 MGMT_STATUS_INVALID_PARAMS);
 644
 645         hci_dev_lock(hdev);
 646
 647         up = test_bit(HCI_UP, &hdev->flags);
 648         if ((cp->val && up) || (!cp->val && !up)) {
 649                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 650                 goto failed;
 651         }
 652
 653         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 654                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED,
 655                                                         MGMT_STATUS_BUSY);
 656                 goto failed;
 657         }
 658
 659         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 660         if (!cmd) {
 661                 err = -ENOMEM;
 662                 goto failed;
 663         }
 664
 665         if (cp->val)
 666                 schedule_work(&hdev->power_on);
 667         else
 668                 schedule_work(&hdev->power_off.work);
 669
 670         err = 0;
 671
 672 failed:
 673         hci_dev_unlock(hdev);
 674         hci_dev_put(hdev);
 675         return err;
 676 }
 677
 678 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 679                                                                         u16 len)
 680 {
 681         struct mgmt_cp_set_discoverable *cp;
 682         struct hci_dev *hdev;
 683         struct pending_cmd *cmd;
 684         u8 scan;
 685         int err;
 686
 687         cp = (void *) data;
 688
 689         BT_DBG("request for hci%u", index);
 690
 691         if (len != sizeof(*cp))
 692                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 693                                                 MGMT_STATUS_INVALID_PARAMS);
 694
 695         hdev = hci_dev_get(index);
 696         if (!hdev)
 697                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 698                                                 MGMT_STATUS_INVALID_PARAMS);
 699
 700         hci_dev_lock(hdev);
 701
 702         if (!test_bit(HCI_UP, &hdev->flags)) {
 703                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 704                                                 MGMT_STATUS_NOT_POWERED);
 705                 goto failed;
 706         }
 707
 708         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 709                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 710                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
 711                                                         MGMT_STATUS_BUSY);
 712                 goto failed;
 713         }
 714
 715         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 716                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 717                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 718                 goto failed;
 719         }
 720
 721         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 722         if (!cmd) {
 723                 err = -ENOMEM;
 724                 goto failed;
 725         }
 726
 727         scan = SCAN_PAGE;
 728
 729         if (cp->val)
 730                 scan |= SCAN_INQUIRY;
 731         else
 732                 cancel_delayed_work(&hdev->discov_off);
 733
 734         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 735         if (err < 0)
 736                 mgmt_pending_remove(cmd);
 737
 738         if (cp->val)
 739                 hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 740
 741 failed:
 742         hci_dev_unlock(hdev);
 743         hci_dev_put(hdev);
 744
 745         return err;
 746 }
 747
 748 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 749                                                                         u16 len)
 750 {
 751         struct mgmt_mode *cp;
 752         struct hci_dev *hdev;
 753         struct pending_cmd *cmd;
 754         u8 scan;
 755         int err;
 756
 757         cp = (void *) data;
 758
 759         BT_DBG("request for hci%u", index);
 760
 761         if (len != sizeof(*cp))
 762                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 763                                                 MGMT_STATUS_INVALID_PARAMS);
 764
 765         hdev = hci_dev_get(index);
 766         if (!hdev)
 767                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 768                                                 MGMT_STATUS_INVALID_PARAMS);
 769
 770         hci_dev_lock(hdev);
 771
 772         if (!test_bit(HCI_UP, &hdev->flags)) {
 773                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 774                                                 MGMT_STATUS_NOT_POWERED);
 775                 goto failed;
 776         }
 777
 778         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 779                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 780                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
 781                                                         MGMT_STATUS_BUSY);
 782                 goto failed;
 783         }
 784
 785         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 786                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 787                 goto failed;
 788         }
 789
 790         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 791         if (!cmd) {
 792                 err = -ENOMEM;
 793                 goto failed;
 794         }
 795
 796         if (cp->val)
 797                 scan = SCAN_PAGE;
 798         else
 799                 scan = 0;
 800
 801         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 802         if (err < 0)
 803                 mgmt_pending_remove(cmd);
 804
 805 failed:
 806         hci_dev_unlock(hdev);
 807         hci_dev_put(hdev);
 808
 809         return err;
 810 }
 811
 812 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 813                                         u16 data_len, struct sock *skip_sk)
 814 {
 815         struct sk_buff *skb;
 816         struct mgmt_hdr *hdr;
 817
 818         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 819         if (!skb)
 820                 return -ENOMEM;
 821
 822         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 823
 824         hdr = (void *) skb_put(skb, sizeof(*hdr));
 825         hdr->opcode = cpu_to_le16(event);
 826         if (hdev)
 827                 hdr->index = cpu_to_le16(hdev->id);
 828         else
 829                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 830         hdr->len = cpu_to_le16(data_len);
 831
 832         if (data)
 833                 memcpy(skb_put(skb, data_len), data, data_len);
 834
 835         hci_send_to_sock(NULL, skb, skip_sk);
 836         kfree_skb(skb);
 837
 838         return 0;
 839 }
 840
 841 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 842                                                                         u16 len)
 843 {
 844         struct mgmt_mode *cp;
 845         struct hci_dev *hdev;
 846         __le32 ev;
 847         int err;
 848
 849         cp = (void *) data;
 850
 851         BT_DBG("request for hci%u", index);
 852
 853         if (len != sizeof(*cp))
 854                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 855                                                 MGMT_STATUS_INVALID_PARAMS);
 856
 857         hdev = hci_dev_get(index);
 858         if (!hdev)
 859                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
 860                                                 MGMT_STATUS_INVALID_PARAMS);
 861
 862         hci_dev_lock(hdev);
 863
 864         if (cp->val)
 865                 set_bit(HCI_PAIRABLE, &hdev->flags);
 866         else
 867                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 868
 869         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
 870         if (err < 0)
 871                 goto failed;
 872
 873         ev = cpu_to_le32(get_current_settings(hdev));
 874
 875         err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
 876
 877 failed:
 878         hci_dev_unlock(hdev);
 879         hci_dev_put(hdev);
 880
 881         return err;
 882 }
 883
 884 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 885 {
 886         struct mgmt_cp_add_uuid *cp;
 887         struct hci_dev *hdev;
 888         struct bt_uuid *uuid;
 889         int err;
 890
 891         cp = (void *) data;
 892
 893         BT_DBG("request for hci%u", index);
 894
 895         if (len != sizeof(*cp))
 896                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 897                                                 MGMT_STATUS_INVALID_PARAMS);
 898
 899         hdev = hci_dev_get(index);
 900         if (!hdev)
 901                 return cmd_status(sk, index, MGMT_OP_ADD_UUID,
 902                                                 MGMT_STATUS_INVALID_PARAMS);
 903
 904         hci_dev_lock(hdev);
 905
 906         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 907         if (!uuid) {
 908                 err = -ENOMEM;
 909                 goto failed;
 910         }
 911
 912         memcpy(uuid->uuid, cp->uuid, 16);
 913         uuid->svc_hint = cp->svc_hint;
 914
 915         list_add(&uuid->list, &hdev->uuids);
 916
 917         err = update_class(hdev);
 918         if (err < 0)
 919                 goto failed;
 920
 921         err = update_eir(hdev);
 922         if (err < 0)
 923                 goto failed;
 924
 925         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 926
 927 failed:
 928         hci_dev_unlock(hdev);
 929         hci_dev_put(hdev);
 930
 931         return err;
 932 }
 933
 934 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 935 {
 936         struct list_head *p, *n;
 937         struct mgmt_cp_remove_uuid *cp;
 938         struct hci_dev *hdev;
 939         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 940         int err, found;
 941
 942         cp = (void *) data;
 943
 944         BT_DBG("request for hci%u", index);
 945
 946         if (len != sizeof(*cp))
 947                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 948                                                 MGMT_STATUS_INVALID_PARAMS);
 949
 950         hdev = hci_dev_get(index);
 951         if (!hdev)
 952                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 953                                                 MGMT_STATUS_INVALID_PARAMS);
 954
 955         hci_dev_lock(hdev);
 956
 957         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 958                 err = hci_uuids_clear(hdev);
 959                 goto unlock;
 960         }
 961
 962         found = 0;
 963
 964         list_for_each_safe(p, n, &hdev->uuids) {
 965                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 966
 967                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 968                         continue;
 969
 970                 list_del(&match->list);
 971                 found++;
 972         }
 973
 974         if (found == 0) {
 975                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
 976                                                 MGMT_STATUS_INVALID_PARAMS);
 977                 goto unlock;
 978         }
 979
 980         err = update_class(hdev);
 981         if (err < 0)
 982                 goto unlock;
 983
 984         err = update_eir(hdev);
 985         if (err < 0)
 986                 goto unlock;
 987
 988         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 989
 990 unlock:
 991         hci_dev_unlock(hdev);
 992         hci_dev_put(hdev);
 993
 994         return err;
 995 }
 996
 997 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 998                                                                         u16 len)
 999 {
1000         struct hci_dev *hdev;
1001         struct mgmt_cp_set_dev_class *cp;
1002         int err;
1003
1004         cp = (void *) data;
1005
1006         BT_DBG("request for hci%u", index);
1007
1008         if (len != sizeof(*cp))
1009                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1010                                                 MGMT_STATUS_INVALID_PARAMS);
1011
1012         hdev = hci_dev_get(index);
1013         if (!hdev)
1014                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
1015                                                 MGMT_STATUS_INVALID_PARAMS);
1016
1017         hci_dev_lock(hdev);
1018
1019         hdev->major_class = cp->major;
1020         hdev->minor_class = cp->minor;
1021
1022         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
1023                 hci_dev_unlock(hdev);
1024                 cancel_delayed_work_sync(&hdev->service_cache);
1025                 hci_dev_lock(hdev);
1026                 update_eir(hdev);
1027         }
1028
1029         err = update_class(hdev);
1030
1031         if (err == 0)
1032                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
1033
1034         hci_dev_unlock(hdev);
1035         hci_dev_put(hdev);
1036
1037         return err;
1038 }
1039
1040 static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
1041                                                                 u16 len)
1042 {
1043         struct hci_dev *hdev;
1044         struct mgmt_cp_load_link_keys *cp;
1045         u16 key_count, expected_len;
1046         int i;
1047
1048         cp = (void *) data;
1049
1050         if (len < sizeof(*cp))
1051                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1052                                                 MGMT_STATUS_INVALID_PARAMS);
1053
1054         key_count = get_unaligned_le16(&cp->key_count);
1055
1056         expected_len = sizeof(*cp) + key_count *
1057                                         sizeof(struct mgmt_link_key_info);
1058         if (expected_len != len) {
1059                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1060                                                         len, expected_len);
1061                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1062                                                 MGMT_STATUS_INVALID_PARAMS);
1063         }
1064
1065         hdev = hci_dev_get(index);
1066         if (!hdev)
1067                 return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
1068                                                 MGMT_STATUS_INVALID_PARAMS);
1069
1070         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
1071                                                                 key_count);
1072
1073         hci_dev_lock(hdev);
1074
1075         hci_link_keys_clear(hdev);
1076
1077         set_bit(HCI_LINK_KEYS, &hdev->flags);
1078
1079         if (cp->debug_keys)
1080                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
1081         else
1082                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
1083
1084         for (i = 0; i < key_count; i++) {
1085                 struct mgmt_link_key_info *key = &cp->keys[i];
1086
1087                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
1088                                                                 key->pin_len);
1089         }
1090
1091         cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
1092
1093         hci_dev_unlock(hdev);
1094         hci_dev_put(hdev);
1095
1096         return 0;
1097 }
1098
1099 static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
1100                                                                 u16 len)
1101 {
1102         struct hci_dev *hdev;
1103         struct mgmt_cp_remove_keys *cp;
1104         struct mgmt_rp_remove_keys rp;
1105         struct hci_cp_disconnect dc;
1106         struct pending_cmd *cmd;
1107         struct hci_conn *conn;
1108         int err;
1109
1110         cp = (void *) data;
1111
1112         if (len != sizeof(*cp))
1113                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1114                                                 MGMT_STATUS_INVALID_PARAMS);
1115
1116         hdev = hci_dev_get(index);
1117         if (!hdev)
1118                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
1119                                                 MGMT_STATUS_INVALID_PARAMS);
1120
1121         hci_dev_lock(hdev);
1122
1123         memset(&rp, 0, sizeof(rp));
1124         bacpy(&rp.bdaddr, &cp->bdaddr);
1125         rp.status = MGMT_STATUS_FAILED;
1126
1127         err = hci_remove_link_key(hdev, &cp->bdaddr);
1128         if (err < 0) {
1129                 rp.status = MGMT_STATUS_NOT_PAIRED;
1130                 goto unlock;
1131         }
1132
1133         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
1134                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1135                                                                 sizeof(rp));
1136                 goto unlock;
1137         }
1138
1139         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1140         if (!conn) {
1141                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1142                                                                 sizeof(rp));
1143                 goto unlock;
1144         }
1145
1146         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
1147         if (!cmd) {
1148                 err = -ENOMEM;
1149                 goto unlock;
1150         }
1151
1152         put_unaligned_le16(conn->handle, &dc.handle);
1153         dc.reason = 0x13; /* Remote User Terminated Connection */
1154         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1155         if (err < 0)
1156                 mgmt_pending_remove(cmd);
1157
1158 unlock:
1159         if (err < 0)
1160                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
1161                                                                 sizeof(rp));
1162         hci_dev_unlock(hdev);
1163         hci_dev_put(hdev);
1164
1165         return err;
1166 }
1167
1168 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1169 {
1170         struct hci_dev *hdev;
1171         struct mgmt_cp_disconnect *cp;
1172         struct hci_cp_disconnect dc;
1173         struct pending_cmd *cmd;
1174         struct hci_conn *conn;
1175         int err;
1176
1177         BT_DBG("");
1178
1179         cp = (void *) data;
1180
1181         if (len != sizeof(*cp))
1182                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1183                                                 MGMT_STATUS_INVALID_PARAMS);
1184
1185         hdev = hci_dev_get(index);
1186         if (!hdev)
1187                 return cmd_status(sk, index, MGMT_OP_DISCONNECT,
1188                                                 MGMT_STATUS_INVALID_PARAMS);
1189
1190         hci_dev_lock(hdev);
1191
1192         if (!test_bit(HCI_UP, &hdev->flags)) {
1193                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1194                                                 MGMT_STATUS_NOT_POWERED);
1195                 goto failed;
1196         }
1197
1198         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1199                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1200                                                         MGMT_STATUS_BUSY);
1201                 goto failed;
1202         }
1203
1204         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1205         if (!conn)
1206                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1207
1208         if (!conn) {
1209                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
1210                                                 MGMT_STATUS_NOT_CONNECTED);
1211                 goto failed;
1212         }
1213
1214         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1215         if (!cmd) {
1216                 err = -ENOMEM;
1217                 goto failed;
1218         }
1219
1220         put_unaligned_le16(conn->handle, &dc.handle);
1221         dc.reason = 0x13; /* Remote User Terminated Connection */
1222
1223         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1224         if (err < 0)
1225                 mgmt_pending_remove(cmd);
1226
1227 failed:
1228         hci_dev_unlock(hdev);
1229         hci_dev_put(hdev);
1230
1231         return err;
1232 }
1233
1234 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1235 {
1236         switch (link_type) {
1237         case LE_LINK:
1238                 switch (addr_type) {
1239                 case ADDR_LE_DEV_PUBLIC:
1240                         return MGMT_ADDR_LE_PUBLIC;
1241                 case ADDR_LE_DEV_RANDOM:
1242                         return MGMT_ADDR_LE_RANDOM;
1243                 default:
1244                         return MGMT_ADDR_INVALID;
1245                 }
1246         case ACL_LINK:
1247                 return MGMT_ADDR_BREDR;
1248         default:
1249                 return MGMT_ADDR_INVALID;
1250         }
1251 }
1252
1253 static int get_connections(struct sock *sk, u16 index)
1254 {
1255         struct mgmt_rp_get_connections *rp;
1256         struct hci_dev *hdev;
1257         struct hci_conn *c;
1258         struct list_head *p;
1259         size_t rp_len;
1260         u16 count;
1261         int i, err;
1262
1263         BT_DBG("");
1264
1265         hdev = hci_dev_get(index);
1266         if (!hdev)
1267                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
1268                                                 MGMT_STATUS_INVALID_PARAMS);
1269
1270         hci_dev_lock(hdev);
1271
1272         count = 0;
1273         list_for_each(p, &hdev->conn_hash.list) {
1274                 count++;
1275         }
1276
1277         rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
1278         rp = kmalloc(rp_len, GFP_ATOMIC);
1279         if (!rp) {
1280                 err = -ENOMEM;
1281                 goto unlock;
1282         }
1283
1284         put_unaligned_le16(count, &rp->conn_count);
1285
1286         i = 0;
1287         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1288                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1289                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1290                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1291                         continue;
1292                 i++;
1293         }
1294
1295         /* Recalculate length in case of filtered SCO connections, etc */
1296         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1297
1298         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1299
1300 unlock:
1301         kfree(rp);
1302         hci_dev_unlock(hdev);
1303         hci_dev_put(hdev);
1304         return err;
1305 }
1306
1307 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1308                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1309 {
1310         struct pending_cmd *cmd;
1311         int err;
1312
1313         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1314                                                                 sizeof(*cp));
1315         if (!cmd)
1316                 return -ENOMEM;
1317
1318         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1319                                                                 &cp->bdaddr);
1320         if (err < 0)
1321                 mgmt_pending_remove(cmd);
1322
1323         return err;
1324 }
1325
1326 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1327                                                                         u16 len)
1328 {
1329         struct hci_dev *hdev;
1330         struct hci_conn *conn;
1331         struct mgmt_cp_pin_code_reply *cp;
1332         struct mgmt_cp_pin_code_neg_reply ncp;
1333         struct hci_cp_pin_code_reply reply;
1334         struct pending_cmd *cmd;
1335         int err;
1336
1337         BT_DBG("");
1338
1339         cp = (void *) data;
1340
1341         if (len != sizeof(*cp))
1342                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1343                                                 MGMT_STATUS_INVALID_PARAMS);
1344
1345         hdev = hci_dev_get(index);
1346         if (!hdev)
1347                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1348                                                 MGMT_STATUS_INVALID_PARAMS);
1349
1350         hci_dev_lock(hdev);
1351
1352         if (!test_bit(HCI_UP, &hdev->flags)) {
1353                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1354                                                 MGMT_STATUS_NOT_POWERED);
1355                 goto failed;
1356         }
1357
1358         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1359         if (!conn) {
1360                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1361                                                 MGMT_STATUS_NOT_CONNECTED);
1362                 goto failed;
1363         }
1364
1365         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1366                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1367
1368                 BT_ERR("PIN code is not 16 bytes long");
1369
1370                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1371                 if (err >= 0)
1372                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1373                                                 MGMT_STATUS_INVALID_PARAMS);
1374
1375                 goto failed;
1376         }
1377
1378         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1379         if (!cmd) {
1380                 err = -ENOMEM;
1381                 goto failed;
1382         }
1383
1384         bacpy(&reply.bdaddr, &cp->bdaddr);
1385         reply.pin_len = cp->pin_len;
1386         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1387
1388         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1389         if (err < 0)
1390                 mgmt_pending_remove(cmd);
1391
1392 failed:
1393         hci_dev_unlock(hdev);
1394         hci_dev_put(hdev);
1395
1396         return err;
1397 }
1398
1399 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1400                                                                         u16 len)
1401 {
1402         struct hci_dev *hdev;
1403         struct mgmt_cp_pin_code_neg_reply *cp;
1404         int err;
1405
1406         BT_DBG("");
1407
1408         cp = (void *) data;
1409
1410         if (len != sizeof(*cp))
1411                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1412                                                 MGMT_STATUS_INVALID_PARAMS);
1413
1414         hdev = hci_dev_get(index);
1415         if (!hdev)
1416                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1417                                                 MGMT_STATUS_INVALID_PARAMS);
1418
1419         hci_dev_lock(hdev);
1420
1421         if (!test_bit(HCI_UP, &hdev->flags)) {
1422                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1423                                                 MGMT_STATUS_NOT_POWERED);
1424                 goto failed;
1425         }
1426
1427         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1428
1429 failed:
1430         hci_dev_unlock(hdev);
1431         hci_dev_put(hdev);
1432
1433         return err;
1434 }
1435
1436 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1437                                                                         u16 len)
1438 {
1439         struct hci_dev *hdev;
1440         struct mgmt_cp_set_io_capability *cp;
1441
1442         BT_DBG("");
1443
1444         cp = (void *) data;
1445
1446         if (len != sizeof(*cp))
1447                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1448                                                 MGMT_STATUS_INVALID_PARAMS);
1449
1450         hdev = hci_dev_get(index);
1451         if (!hdev)
1452                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1453                                                 MGMT_STATUS_INVALID_PARAMS);
1454
1455         hci_dev_lock(hdev);
1456
1457         hdev->io_capability = cp->io_capability;
1458
1459         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1460                                                         hdev->io_capability);
1461
1462         hci_dev_unlock(hdev);
1463         hci_dev_put(hdev);
1464
1465         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1466 }
1467
1468 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1469 {
1470         struct hci_dev *hdev = conn->hdev;
1471         struct pending_cmd *cmd;
1472
1473         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1474                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1475                         continue;
1476
1477                 if (cmd->user_data != conn)
1478                         continue;
1479
1480                 return cmd;
1481         }
1482
1483         return NULL;
1484 }
1485
1486 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1487 {
1488         struct mgmt_rp_pair_device rp;
1489         struct hci_conn *conn = cmd->user_data;
1490
1491         bacpy(&rp.addr.bdaddr, &conn->dst);
1492         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1493         rp.status = status;
1494
1495         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1496
1497         /* So we don't get further callbacks for this connection */
1498         conn->connect_cfm_cb = NULL;
1499         conn->security_cfm_cb = NULL;
1500         conn->disconn_cfm_cb = NULL;
1501
1502         hci_conn_put(conn);
1503
1504         mgmt_pending_remove(cmd);
1505 }
1506
1507 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1508 {
1509         struct pending_cmd *cmd;
1510
1511         BT_DBG("status %u", status);
1512
1513         cmd = find_pairing(conn);
1514         if (!cmd)
1515                 BT_DBG("Unable to find a pending command");
1516         else
1517                 pairing_complete(cmd, status);
1518 }
1519
1520 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1521 {
1522         struct hci_dev *hdev;
1523         struct mgmt_cp_pair_device *cp;
1524         struct mgmt_rp_pair_device rp;
1525         struct pending_cmd *cmd;
1526         u8 sec_level, auth_type;
1527         struct hci_conn *conn;
1528         int err;
1529
1530         BT_DBG("");
1531
1532         cp = (void *) data;
1533
1534         if (len != sizeof(*cp))
1535                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1536                                                 MGMT_STATUS_INVALID_PARAMS);
1537
1538         hdev = hci_dev_get(index);
1539         if (!hdev)
1540                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
1541                                                 MGMT_STATUS_INVALID_PARAMS);
1542
1543         hci_dev_lock(hdev);
1544
1545         sec_level = BT_SECURITY_MEDIUM;
1546         if (cp->io_cap == 0x03)
1547                 auth_type = HCI_AT_DEDICATED_BONDING;
1548         else
1549                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1550
1551         if (cp->addr.type == MGMT_ADDR_BREDR)
1552                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1553                                                                 auth_type);
1554         else
1555                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1556                                                                 auth_type);
1557
1558         memset(&rp, 0, sizeof(rp));
1559         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1560         rp.addr.type = cp->addr.type;
1561
1562         if (IS_ERR(conn)) {
1563                 rp.status = -PTR_ERR(conn);
1564                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1565                                                         &rp, sizeof(rp));
1566                 goto unlock;
1567         }
1568
1569         if (conn->connect_cfm_cb) {
1570                 hci_conn_put(conn);
1571                 rp.status = EBUSY;
1572                 err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
1573                                                         &rp, sizeof(rp));
1574                 goto unlock;
1575         }
1576
1577         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1578         if (!cmd) {
1579                 err = -ENOMEM;
1580                 hci_conn_put(conn);
1581                 goto unlock;
1582         }
1583
1584         /* For LE, just connecting isn't a proof that the pairing finished */
1585         if (cp->addr.type == MGMT_ADDR_BREDR)
1586                 conn->connect_cfm_cb = pairing_complete_cb;
1587
1588         conn->security_cfm_cb = pairing_complete_cb;
1589         conn->disconn_cfm_cb = pairing_complete_cb;
1590         conn->io_capability = cp->io_cap;
1591         cmd->user_data = conn;
1592
1593         if (conn->state == BT_CONNECTED &&
1594                                 hci_conn_security(conn, sec_level, auth_type))
1595                 pairing_complete(cmd, 0);
1596
1597         err = 0;
1598
1599 unlock:
1600         hci_dev_unlock(hdev);
1601         hci_dev_put(hdev);
1602
1603         return err;
1604 }
1605
1606 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
1607                                         u16 mgmt_op, u16 hci_op, __le32 passkey)
1608 {
1609         struct pending_cmd *cmd;
1610         struct hci_dev *hdev;
1611         struct hci_conn *conn;
1612         int err;
1613
1614         hdev = hci_dev_get(index);
1615         if (!hdev)
1616                 return cmd_status(sk, index, mgmt_op,
1617                                                 MGMT_STATUS_INVALID_PARAMS);
1618
1619         hci_dev_lock(hdev);
1620
1621         if (!test_bit(HCI_UP, &hdev->flags)) {
1622                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
1623                 goto done;
1624         }
1625
1626         /*
1627          * Check for an existing ACL link, if present pair via
1628          * HCI commands.
1629          *
1630          * If no ACL link is present, check for an LE link and if
1631          * present, pair via the SMP engine.
1632          *
1633          * If neither ACL nor LE links are present, fail with error.
1634          */
1635         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
1636         if (!conn) {
1637                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
1638                 if (!conn) {
1639                         err = cmd_status(sk, index, mgmt_op,
1640                                                 MGMT_STATUS_NOT_CONNECTED);
1641                         goto done;
1642                 }
1643
1644                 /* Continue with pairing via SMP */
1645
1646                 err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
1647                 goto done;
1648         }
1649
1650         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
1651         if (!cmd) {
1652                 err = -ENOMEM;
1653                 goto done;
1654         }
1655
1656         /* Continue with pairing via HCI */
1657         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
1658                 struct hci_cp_user_passkey_reply cp;
1659
1660                 bacpy(&cp.bdaddr, bdaddr);
1661                 cp.passkey = passkey;
1662                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
1663         } else
1664                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
1665
1666         if (err < 0)
1667                 mgmt_pending_remove(cmd);
1668
1669 done:
1670         hci_dev_unlock(hdev);
1671         hci_dev_put(hdev);
1672
1673         return err;
1674 }
1675
1676 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
1677 {
1678         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1679
1680         BT_DBG("");
1681
1682         if (len != sizeof(*cp))
1683                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
1684                                                 MGMT_STATUS_INVALID_PARAMS);
1685
1686         return user_pairing_resp(sk, index, &cp->bdaddr,
1687                         MGMT_OP_USER_CONFIRM_REPLY,
1688                         HCI_OP_USER_CONFIRM_REPLY, 0);
1689 }
1690
1691 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
1692                                                                         u16 len)
1693 {
1694         struct mgmt_cp_user_confirm_neg_reply *cp = data;
1695
1696         BT_DBG("");
1697
1698         if (len != sizeof(*cp))
1699                 return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
1700                                                 MGMT_STATUS_INVALID_PARAMS);
1701
1702         return user_pairing_resp(sk, index, &cp->bdaddr,
1703                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
1704                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
1705 }
1706
1707 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
1708 {
1709         struct mgmt_cp_user_passkey_reply *cp = (void *) data;
1710
1711         BT_DBG("");
1712
1713         if (len != sizeof(*cp))
1714                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
1715                                                                         EINVAL);
1716
1717         return user_pairing_resp(sk, index, &cp->bdaddr,
1718                         MGMT_OP_USER_PASSKEY_REPLY,
1719                         HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
1720 }
1721
1722 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
1723                                                                         u16 len)
1724 {
1725         struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
1726
1727         BT_DBG("");
1728
1729         if (len != sizeof(*cp))
1730                 return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
1731                                                                         EINVAL);
1732
1733         return user_pairing_resp(sk, index, &cp->bdaddr,
1734                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
1735                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
1736 }
1737
1738 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1739                                                                 u16 len)
1740 {
1741         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1742         struct hci_cp_write_local_name hci_cp;
1743         struct hci_dev *hdev;
1744         struct pending_cmd *cmd;
1745         int err;
1746
1747         BT_DBG("");
1748
1749         if (len != sizeof(*mgmt_cp))
1750                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1751                                                 MGMT_STATUS_INVALID_PARAMS);
1752
1753         hdev = hci_dev_get(index);
1754         if (!hdev)
1755                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
1756                                                 MGMT_STATUS_INVALID_PARAMS);
1757
1758         hci_dev_lock(hdev);
1759
1760         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
1761         if (!cmd) {
1762                 err = -ENOMEM;
1763                 goto failed;
1764         }
1765
1766         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1767         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1768                                                                 &hci_cp);
1769         if (err < 0)
1770                 mgmt_pending_remove(cmd);
1771
1772 failed:
1773         hci_dev_unlock(hdev);
1774         hci_dev_put(hdev);
1775
1776         return err;
1777 }
1778
1779 static int read_local_oob_data(struct sock *sk, u16 index)
1780 {
1781         struct hci_dev *hdev;
1782         struct pending_cmd *cmd;
1783         int err;
1784
1785         BT_DBG("hci%u", index);
1786
1787         hdev = hci_dev_get(index);
1788         if (!hdev)
1789                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1790                                                 MGMT_STATUS_INVALID_PARAMS);
1791
1792         hci_dev_lock(hdev);
1793
1794         if (!test_bit(HCI_UP, &hdev->flags)) {
1795                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1796                                                 MGMT_STATUS_NOT_POWERED);
1797                 goto unlock;
1798         }
1799
1800         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1801                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1802                                                 MGMT_STATUS_NOT_SUPPORTED);
1803                 goto unlock;
1804         }
1805
1806         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
1807                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1808                                                         MGMT_STATUS_BUSY);
1809                 goto unlock;
1810         }
1811
1812         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
1813         if (!cmd) {
1814                 err = -ENOMEM;
1815                 goto unlock;
1816         }
1817
1818         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1819         if (err < 0)
1820                 mgmt_pending_remove(cmd);
1821
1822 unlock:
1823         hci_dev_unlock(hdev);
1824         hci_dev_put(hdev);
1825
1826         return err;
1827 }
1828
1829 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1830                                                                         u16 len)
1831 {
1832         struct hci_dev *hdev;
1833         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1834         int err;
1835
1836         BT_DBG("hci%u ", index);
1837
1838         if (len != sizeof(*cp))
1839                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1840                                                 MGMT_STATUS_INVALID_PARAMS);
1841
1842         hdev = hci_dev_get(index);
1843         if (!hdev)
1844                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1845                                                 MGMT_STATUS_INVALID_PARAMS);
1846
1847         hci_dev_lock(hdev);
1848
1849         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1850                                                                 cp->randomizer);
1851         if (err < 0)
1852                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1853                                                         MGMT_STATUS_FAILED);
1854         else
1855                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1856                                                                         0);
1857
1858         hci_dev_unlock(hdev);
1859         hci_dev_put(hdev);
1860
1861         return err;
1862 }
1863
1864 static int remove_remote_oob_data(struct sock *sk, u16 index,
1865                                                 unsigned char *data, u16 len)
1866 {
1867         struct hci_dev *hdev;
1868         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1869         int err;
1870
1871         BT_DBG("hci%u ", index);
1872
1873         if (len != sizeof(*cp))
1874                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1875                                                 MGMT_STATUS_INVALID_PARAMS);
1876
1877         hdev = hci_dev_get(index);
1878         if (!hdev)
1879                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1880                                                 MGMT_STATUS_INVALID_PARAMS);
1881
1882         hci_dev_lock(hdev);
1883
1884         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1885         if (err < 0)
1886                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1887                                                 MGMT_STATUS_INVALID_PARAMS);
1888         else
1889                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1890                                                                 NULL, 0);
1891
1892         hci_dev_unlock(hdev);
1893         hci_dev_put(hdev);
1894
1895         return err;
1896 }
1897
1898 static int start_discovery(struct sock *sk, u16 index,
1899                                                 unsigned char *data, u16 len)
1900 {
1901         struct mgmt_cp_start_discovery *cp = (void *) data;
1902         struct pending_cmd *cmd;
1903         struct hci_dev *hdev;
1904         int err;
1905
1906         BT_DBG("hci%u", index);
1907
1908         if (len != sizeof(*cp))
1909                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1910                                                 MGMT_STATUS_INVALID_PARAMS);
1911
1912         hdev = hci_dev_get(index);
1913         if (!hdev)
1914                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1915                                                 MGMT_STATUS_INVALID_PARAMS);
1916
1917         hci_dev_lock(hdev);
1918
1919         if (!test_bit(HCI_UP, &hdev->flags)) {
1920                 err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
1921                                                 MGMT_STATUS_NOT_POWERED);
1922                 goto failed;
1923         }
1924
1925         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
1926         if (!cmd) {
1927                 err = -ENOMEM;
1928                 goto failed;
1929         }
1930
1931         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
1932         if (err < 0)
1933                 mgmt_pending_remove(cmd);
1934
1935 failed:
1936         hci_dev_unlock(hdev);
1937         hci_dev_put(hdev);
1938
1939         return err;
1940 }
1941
1942 static int stop_discovery(struct sock *sk, u16 index)
1943 {
1944         struct hci_dev *hdev;
1945         struct pending_cmd *cmd;
1946         int err;
1947
1948         BT_DBG("hci%u", index);
1949
1950         hdev = hci_dev_get(index);
1951         if (!hdev)
1952                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
1953                                                 MGMT_STATUS_INVALID_PARAMS);
1954
1955         hci_dev_lock(hdev);
1956
1957         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
1958         if (!cmd) {
1959                 err = -ENOMEM;
1960                 goto failed;
1961         }
1962
1963         err = hci_cancel_inquiry(hdev);
1964         if (err < 0)
1965                 mgmt_pending_remove(cmd);
1966
1967 failed:
1968         hci_dev_unlock(hdev);
1969         hci_dev_put(hdev);
1970
1971         return err;
1972 }
1973
1974 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1975                                                                 u16 len)
1976 {
1977         struct hci_dev *hdev;
1978         struct mgmt_cp_block_device *cp = (void *) data;
1979         int err;
1980
1981         BT_DBG("hci%u", index);
1982
1983         if (len != sizeof(*cp))
1984                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1985                                                 MGMT_STATUS_INVALID_PARAMS);
1986
1987         hdev = hci_dev_get(index);
1988         if (!hdev)
1989                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1990                                                 MGMT_STATUS_INVALID_PARAMS);
1991
1992         hci_dev_lock(hdev);
1993
1994         err = hci_blacklist_add(hdev, &cp->bdaddr);
1995         if (err < 0)
1996                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1997                                                         MGMT_STATUS_FAILED);
1998         else
1999                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
2000                                                         NULL, 0);
2001
2002         hci_dev_unlock(hdev);
2003         hci_dev_put(hdev);
2004
2005         return err;
2006 }
2007
2008 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
2009                                                                 u16 len)
2010 {
2011         struct hci_dev *hdev;
2012         struct mgmt_cp_unblock_device *cp = (void *) data;
2013         int err;
2014
2015         BT_DBG("hci%u", index);
2016
2017         if (len != sizeof(*cp))
2018                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2019                                                 MGMT_STATUS_INVALID_PARAMS);
2020
2021         hdev = hci_dev_get(index);
2022         if (!hdev)
2023                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2024                                                 MGMT_STATUS_INVALID_PARAMS);
2025
2026         hci_dev_lock(hdev);
2027
2028         err = hci_blacklist_del(hdev, &cp->bdaddr);
2029
2030         if (err < 0)
2031                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2032                                                 MGMT_STATUS_INVALID_PARAMS);
2033         else
2034                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
2035                                                                 NULL, 0);
2036
2037         hci_dev_unlock(hdev);
2038         hci_dev_put(hdev);
2039
2040         return err;
2041 }
2042
2043 static int set_fast_connectable(struct sock *sk, u16 index,
2044                                         unsigned char *data, u16 len)
2045 {
2046         struct hci_dev *hdev;
2047         struct mgmt_mode *cp = (void *) data;
2048         struct hci_cp_write_page_scan_activity acp;
2049         u8 type;
2050         int err;
2051
2052         BT_DBG("hci%u", index);
2053
2054         if (len != sizeof(*cp))
2055                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2056                                                 MGMT_STATUS_INVALID_PARAMS);
2057
2058         hdev = hci_dev_get(index);
2059         if (!hdev)
2060                 return cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2061                                                 MGMT_STATUS_INVALID_PARAMS);
2062
2063         hci_dev_lock(hdev);
2064
2065         if (cp->val) {
2066                 type = PAGE_SCAN_TYPE_INTERLACED;
2067                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2068         } else {
2069                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2070                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2071         }
2072
2073         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2074
2075         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2076                                                 sizeof(acp), &acp);
2077         if (err < 0) {
2078                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2079                                                         MGMT_STATUS_FAILED);
2080                 goto done;
2081         }
2082
2083         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2084         if (err < 0) {
2085                 err = cmd_status(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2086                                                         MGMT_STATUS_FAILED);
2087                 goto done;
2088         }
2089
2090         err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
2091                                                         NULL, 0);
2092 done:
2093         hci_dev_unlock(hdev);
2094         hci_dev_put(hdev);
2095
2096         return err;
2097 }
2098
2099 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2100 {
2101         unsigned char *buf;
2102         struct mgmt_hdr *hdr;
2103         u16 opcode, index, len;
2104         int err;
2105
2106         BT_DBG("got %zu bytes", msglen);
2107
2108         if (msglen < sizeof(*hdr))
2109                 return -EINVAL;
2110
2111         buf = kmalloc(msglen, GFP_KERNEL);
2112         if (!buf)
2113                 return -ENOMEM;
2114
2115         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2116                 err = -EFAULT;
2117                 goto done;
2118         }
2119
2120         hdr = (struct mgmt_hdr *) buf;
2121         opcode = get_unaligned_le16(&hdr->opcode);
2122         index = get_unaligned_le16(&hdr->index);
2123         len = get_unaligned_le16(&hdr->len);
2124
2125         if (len != msglen - sizeof(*hdr)) {
2126                 err = -EINVAL;
2127                 goto done;
2128         }
2129
2130         switch (opcode) {
2131         case MGMT_OP_READ_VERSION:
2132                 err = read_version(sk);
2133                 break;
2134         case MGMT_OP_READ_INDEX_LIST:
2135                 err = read_index_list(sk);
2136                 break;
2137         case MGMT_OP_READ_INFO:
2138                 err = read_controller_info(sk, index);
2139                 break;
2140         case MGMT_OP_SET_POWERED:
2141                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
2142                 break;
2143         case MGMT_OP_SET_DISCOVERABLE:
2144                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
2145                 break;
2146         case MGMT_OP_SET_CONNECTABLE:
2147                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
2148                 break;
2149         case MGMT_OP_SET_FAST_CONNECTABLE:
2150                 err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
2151                                                                 len);
2152                 break;
2153         case MGMT_OP_SET_PAIRABLE:
2154                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
2155                 break;
2156         case MGMT_OP_ADD_UUID:
2157                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
2158                 break;
2159         case MGMT_OP_REMOVE_UUID:
2160                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
2161                 break;
2162         case MGMT_OP_SET_DEV_CLASS:
2163                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
2164                 break;
2165         case MGMT_OP_LOAD_LINK_KEYS:
2166                 err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
2167                 break;
2168         case MGMT_OP_REMOVE_KEYS:
2169                 err = remove_keys(sk, index, buf + sizeof(*hdr), len);
2170                 break;
2171         case MGMT_OP_DISCONNECT:
2172                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
2173                 break;
2174         case MGMT_OP_GET_CONNECTIONS:
2175                 err = get_connections(sk, index);
2176                 break;
2177         case MGMT_OP_PIN_CODE_REPLY:
2178                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
2179                 break;
2180         case MGMT_OP_PIN_CODE_NEG_REPLY:
2181                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
2182                 break;
2183         case MGMT_OP_SET_IO_CAPABILITY:
2184                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
2185                 break;
2186         case MGMT_OP_PAIR_DEVICE:
2187                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
2188                 break;
2189         case MGMT_OP_USER_CONFIRM_REPLY:
2190                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
2191                 break;
2192         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
2193                 err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
2194                                                                         len);
2195                 break;
2196         case MGMT_OP_USER_PASSKEY_REPLY:
2197                 err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
2198                 break;
2199         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
2200                 err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
2201                                                                         len);
2202                 break;
2203         case MGMT_OP_SET_LOCAL_NAME:
2204                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
2205                 break;
2206         case MGMT_OP_READ_LOCAL_OOB_DATA:
2207                 err = read_local_oob_data(sk, index);
2208                 break;
2209         case MGMT_OP_ADD_REMOTE_OOB_DATA:
2210                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
2211                 break;
2212         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
2213                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
2214                                                                         len);
2215                 break;
2216         case MGMT_OP_START_DISCOVERY:
2217                 err = start_discovery(sk, index, buf + sizeof(*hdr), len);
2218                 break;
2219         case MGMT_OP_STOP_DISCOVERY:
2220                 err = stop_discovery(sk, index);
2221                 break;
2222         case MGMT_OP_BLOCK_DEVICE:
2223                 err = block_device(sk, index, buf + sizeof(*hdr), len);
2224                 break;
2225         case MGMT_OP_UNBLOCK_DEVICE:
2226                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
2227                 break;
2228         default:
2229                 BT_DBG("Unknown op %u", opcode);
2230                 err = cmd_status(sk, index, opcode,
2231                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2232                 break;
2233         }
2234
2235         if (err < 0)
2236                 goto done;
2237
2238         err = msglen;
2239
2240 done:
2241         kfree(buf);
2242         return err;
2243 }
2244
2245 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2246 {
2247         u8 *status = data;
2248
2249         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2250         mgmt_pending_remove(cmd);
2251 }
2252
2253 int mgmt_index_added(struct hci_dev *hdev)
2254 {
2255         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2256 }
2257
2258 int mgmt_index_removed(struct hci_dev *hdev)
2259 {
2260         u8 status = ENODEV;
2261
2262         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2263
2264         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2265 }
2266
2267 struct cmd_lookup {
2268         u8 val;
2269         struct sock *sk;
2270         struct hci_dev *hdev;
2271 };
2272
2273 static void settings_rsp(struct pending_cmd *cmd, void *data)
2274 {
2275         struct cmd_lookup *match = data;
2276
2277         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2278
2279         list_del(&cmd->list);
2280
2281         if (match->sk == NULL) {
2282                 match->sk = cmd->sk;
2283                 sock_hold(match->sk);
2284         }
2285
2286         mgmt_pending_free(cmd);
2287 }
2288
2289 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2290 {
2291         struct cmd_lookup match = { powered, NULL, hdev };
2292         __le32 ev;
2293         int ret;
2294
2295         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2296
2297         if (!powered) {
2298                 u8 status = ENETDOWN;
2299                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2300         }
2301
2302         ev = cpu_to_le32(get_current_settings(hdev));
2303
2304         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2305                                                                 match.sk);
2306
2307         if (match.sk)
2308                 sock_put(match.sk);
2309
2310         return ret;
2311 }
2312
2313 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2314 {
2315         struct cmd_lookup match = { discoverable, NULL, hdev };
2316         __le32 ev;
2317         int ret;
2318
2319         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
2320
2321         ev = cpu_to_le32(get_current_settings(hdev));
2322
2323         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
2324                                                                 match.sk);
2325         if (match.sk)
2326                 sock_put(match.sk);
2327
2328         return ret;
2329 }
2330
2331 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2332 {
2333         __le32 ev;
2334         struct cmd_lookup match = { connectable, NULL, hdev };
2335         int ret;
2336
2337         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2338                                                                 &match);
2339
2340         ev = cpu_to_le32(get_current_settings(hdev));
2341
2342         ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
2343
2344         if (match.sk)
2345                 sock_put(match.sk);
2346
2347         return ret;
2348 }
2349
2350 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2351 {
2352         u8 mgmt_err = mgmt_status(status);
2353
2354         if (scan & SCAN_PAGE)
2355                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2356                                                 cmd_status_rsp, &mgmt_err);
2357
2358         if (scan & SCAN_INQUIRY)
2359                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2360                                                 cmd_status_rsp, &mgmt_err);
2361
2362         return 0;
2363 }
2364
2365 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2366                                                                 u8 persistent)
2367 {
2368         struct mgmt_ev_new_link_key ev;
2369
2370         memset(&ev, 0, sizeof(ev));
2371
2372         ev.store_hint = persistent;
2373         bacpy(&ev.key.bdaddr, &key->bdaddr);
2374         ev.key.type = key->type;
2375         memcpy(ev.key.val, key->val, 16);
2376         ev.key.pin_len = key->pin_len;
2377
2378         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2379 }
2380
2381 int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2382                                                                 u8 addr_type)
2383 {
2384         struct mgmt_addr_info ev;
2385
2386         bacpy(&ev.bdaddr, bdaddr);
2387         ev.type = link_to_mgmt(link_type, addr_type);
2388
2389         return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
2390 }
2391
2392 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2393 {
2394         struct mgmt_cp_disconnect *cp = cmd->param;
2395         struct sock **sk = data;
2396         struct mgmt_rp_disconnect rp;
2397
2398         bacpy(&rp.bdaddr, &cp->bdaddr);
2399         rp.status = 0;
2400
2401         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2402
2403         *sk = cmd->sk;
2404         sock_hold(*sk);
2405
2406         mgmt_pending_remove(cmd);
2407 }
2408
2409 static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
2410 {
2411         u8 *status = data;
2412         struct mgmt_cp_remove_keys *cp = cmd->param;
2413         struct mgmt_rp_remove_keys rp;
2414
2415         memset(&rp, 0, sizeof(rp));
2416         bacpy(&rp.bdaddr, &cp->bdaddr);
2417         if (status != NULL)
2418                 rp.status = *status;
2419
2420         cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
2421                                                                 sizeof(rp));
2422
2423         mgmt_pending_remove(cmd);
2424 }
2425
2426 int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2427                                                                 u8 addr_type)
2428 {
2429         struct mgmt_addr_info ev;
2430         struct sock *sk = NULL;
2431         int err;
2432
2433         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2434
2435         bacpy(&ev.bdaddr, bdaddr);
2436         ev.type = link_to_mgmt(link_type, addr_type);
2437
2438         err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
2439
2440         if (sk)
2441                 sock_put(sk);
2442
2443         mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
2444
2445         return err;
2446 }
2447
2448 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2449 {
2450         struct pending_cmd *cmd;
2451         u8 mgmt_err = mgmt_status(status);
2452         int err;
2453
2454         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
2455         if (!cmd)
2456                 return -ENOENT;
2457
2458         if (bdaddr) {
2459                 struct mgmt_rp_disconnect rp;
2460
2461                 bacpy(&rp.bdaddr, bdaddr);
2462                 rp.status = status;
2463
2464                 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
2465                                                         &rp, sizeof(rp));
2466         } else
2467                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
2468                                                                 mgmt_err);
2469
2470         mgmt_pending_remove(cmd);
2471
2472         return err;
2473 }
2474
2475 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2476                                                 u8 addr_type, u8 status)
2477 {
2478         struct mgmt_ev_connect_failed ev;
2479
2480         bacpy(&ev.addr.bdaddr, bdaddr);
2481         ev.addr.type = link_to_mgmt(link_type, addr_type);
2482         ev.status = mgmt_status(status);
2483
2484         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
2485 }
2486
2487 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
2488 {
2489         struct mgmt_ev_pin_code_request ev;
2490
2491         bacpy(&ev.bdaddr, bdaddr);
2492         ev.secure = secure;
2493
2494         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
2495                                                                         NULL);
2496 }
2497
2498 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2499                                                                 u8 status)
2500 {
2501         struct pending_cmd *cmd;
2502         struct mgmt_rp_pin_code_reply rp;
2503         int err;
2504
2505         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
2506         if (!cmd)
2507                 return -ENOENT;
2508
2509         bacpy(&rp.bdaddr, bdaddr);
2510         rp.status = mgmt_status(status);
2511
2512         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
2513                                                                 sizeof(rp));
2514
2515         mgmt_pending_remove(cmd);
2516
2517         return err;
2518 }
2519
2520 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2521                                                                 u8 status)
2522 {
2523         struct pending_cmd *cmd;
2524         struct mgmt_rp_pin_code_reply rp;
2525         int err;
2526
2527         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
2528         if (!cmd)
2529                 return -ENOENT;
2530
2531         bacpy(&rp.bdaddr, bdaddr);
2532         rp.status = mgmt_status(status);
2533
2534         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2535                                                                 sizeof(rp));
2536
2537         mgmt_pending_remove(cmd);
2538
2539         return err;
2540 }
2541
2542 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
2543                                                 __le32 value, u8 confirm_hint)
2544 {
2545         struct mgmt_ev_user_confirm_request ev;
2546
2547         BT_DBG("%s", hdev->name);
2548
2549         bacpy(&ev.bdaddr, bdaddr);
2550         ev.confirm_hint = confirm_hint;
2551         put_unaligned_le32(value, &ev.value);
2552
2553         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
2554                                                                         NULL);
2555 }
2556
2557 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
2558 {
2559         struct mgmt_ev_user_passkey_request ev;
2560
2561         BT_DBG("%s", hdev->name);
2562
2563         bacpy(&ev.bdaddr, bdaddr);
2564
2565         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
2566                                                                         NULL);
2567 }
2568
2569 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2570                                                         u8 status, u8 opcode)
2571 {
2572         struct pending_cmd *cmd;
2573         struct mgmt_rp_user_confirm_reply rp;
2574         int err;
2575
2576         cmd = mgmt_pending_find(opcode, hdev);
2577         if (!cmd)
2578                 return -ENOENT;
2579
2580         bacpy(&rp.bdaddr, bdaddr);
2581         rp.status = mgmt_status(status);
2582         err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
2583
2584         mgmt_pending_remove(cmd);
2585
2586         return err;
2587 }
2588
2589 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2590                                                                 u8 status)
2591 {
2592         return user_pairing_resp_complete(hdev, bdaddr, status,
2593                                                 MGMT_OP_USER_CONFIRM_REPLY);
2594 }
2595
2596 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
2597                                                 bdaddr_t *bdaddr, u8 status)
2598 {
2599         return user_pairing_resp_complete(hdev, bdaddr, status,
2600                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2601 }
2602
2603 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
2604                                                                 u8 status)
2605 {
2606         return user_pairing_resp_complete(hdev, bdaddr, status,
2607                                                 MGMT_OP_USER_PASSKEY_REPLY);
2608 }
2609
2610 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
2611                                                 bdaddr_t *bdaddr, u8 status)
2612 {
2613         return user_pairing_resp_complete(hdev, bdaddr, status,
2614                                         MGMT_OP_USER_PASSKEY_NEG_REPLY);
2615 }
2616
2617 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
2618 {
2619         struct mgmt_ev_auth_failed ev;
2620
2621         bacpy(&ev.bdaddr, bdaddr);
2622         ev.status = mgmt_status(status);
2623
2624         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
2625 }
2626
2627 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
2628 {
2629         struct pending_cmd *cmd;
2630         struct mgmt_cp_set_local_name ev;
2631         int err;
2632
2633         memset(&ev, 0, sizeof(ev));
2634         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2635
2636         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2637         if (!cmd)
2638                 goto send_event;
2639
2640         if (status) {
2641                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2642                                                         mgmt_status(status));
2643                 goto failed;
2644         }
2645
2646         update_eir(hdev);
2647
2648         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
2649                                                                 sizeof(ev));
2650         if (err < 0)
2651                 goto failed;
2652
2653 send_event:
2654         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
2655                                                         cmd ? cmd->sk : NULL);
2656
2657 failed:
2658         if (cmd)
2659                 mgmt_pending_remove(cmd);
2660         return err;
2661 }
2662
2663 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
2664                                                 u8 *randomizer, u8 status)
2665 {
2666         struct pending_cmd *cmd;
2667         int err;
2668
2669         BT_DBG("%s status %u", hdev->name, status);
2670
2671         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
2672         if (!cmd)
2673                 return -ENOENT;
2674
2675         if (status) {
2676                 err = cmd_status(cmd->sk, hdev->id,
2677                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2678                                                 mgmt_status(status));
2679         } else {
2680                 struct mgmt_rp_read_local_oob_data rp;
2681
2682                 memcpy(rp.hash, hash, sizeof(rp.hash));
2683                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2684
2685                 err = cmd_complete(cmd->sk, hdev->id,
2686                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
2687                                                 &rp, sizeof(rp));
2688         }
2689
2690         mgmt_pending_remove(cmd);
2691
2692         return err;
2693 }
2694
2695 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2696                                 u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
2697 {
2698         struct mgmt_ev_device_found ev;
2699
2700         memset(&ev, 0, sizeof(ev));
2701
2702         bacpy(&ev.addr.bdaddr, bdaddr);
2703         ev.addr.type = link_to_mgmt(link_type, addr_type);
2704         ev.rssi = rssi;
2705
2706         if (eir)
2707                 memcpy(ev.eir, eir, sizeof(ev.eir));
2708
2709         if (dev_class)
2710                 memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2711
2712         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
2713 }
2714
2715 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
2716 {
2717         struct mgmt_ev_remote_name ev;
2718
2719         memset(&ev, 0, sizeof(ev));
2720
2721         bacpy(&ev.bdaddr, bdaddr);
2722         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2723
2724         return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
2725 }
2726
2727 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2728 {
2729         struct pending_cmd *cmd;
2730         int err;
2731
2732         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2733         if (!cmd)
2734                 return -ENOENT;
2735
2736         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
2737         mgmt_pending_remove(cmd);
2738
2739         return err;
2740 }
2741
2742 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2743 {
2744         struct pending_cmd *cmd;
2745         int err;
2746
2747         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2748         if (!cmd)
2749                 return -ENOENT;
2750
2751         err = cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2752         mgmt_pending_remove(cmd);
2753
2754         return err;
2755 }
2756
2757 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
2758 {
2759         struct pending_cmd *cmd;
2760
2761         if (discovering)
2762                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2763         else
2764                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2765
2766         if (cmd != NULL) {
2767                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
2768                 mgmt_pending_remove(cmd);
2769         }
2770
2771         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &discovering,
2772                                                 sizeof(discovering), NULL);
2773 }
2774
2775 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2776 {
2777         struct pending_cmd *cmd;
2778         struct mgmt_ev_device_blocked ev;
2779
2780         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
2781
2782         bacpy(&ev.bdaddr, bdaddr);
2783
2784         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
2785                                                         cmd ? cmd->sk : NULL);
2786 }
2787
2788 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
2789 {
2790         struct pending_cmd *cmd;
2791         struct mgmt_ev_device_unblocked ev;
2792
2793         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
2794
2795         bacpy(&ev.bdaddr, bdaddr);
2796
2797         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
2798                                                         cmd ? cmd->sk : NULL);
2799 }