net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 struct pending_cmd {
  36         struct list_head list;
  37         __u16 opcode;
  38         int index;
  39         void *param;
  40         struct sock *sk;
  41         void *user_data;
  42 };
  43
  44 static LIST_HEAD(cmd_list);
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51
  52         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  53
  54         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  55         if (!skb)
  56                 return -ENOMEM;
  57
  58         hdr = (void *) skb_put(skb, sizeof(*hdr));
  59
  60         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  61         hdr->index = cpu_to_le16(index);
  62         hdr->len = cpu_to_le16(sizeof(*ev));
  63
  64         ev = (void *) skb_put(skb, sizeof(*ev));
  65         ev->status = status;
  66         put_unaligned_le16(cmd, &ev->opcode);
  67
  68         if (sock_queue_rcv_skb(sk, skb) < 0)
  69                 kfree_skb(skb);
  70
  71         return 0;
  72 }
  73
  74 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  75                                                                 size_t rp_len)
  76 {
  77         struct sk_buff *skb;
  78         struct mgmt_hdr *hdr;
  79         struct mgmt_ev_cmd_complete *ev;
  80
  81         BT_DBG("sock %p", sk);
  82
  83         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  84         if (!skb)
  85                 return -ENOMEM;
  86
  87         hdr = (void *) skb_put(skb, sizeof(*hdr));
  88
  89         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  90         hdr->index = cpu_to_le16(index);
  91         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  92
  93         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  94         put_unaligned_le16(cmd, &ev->opcode);
  95
  96         if (rp)
  97                 memcpy(ev->data, rp, rp_len);
  98
  99         if (sock_queue_rcv_skb(sk, skb) < 0)
 100                 kfree_skb(skb);
 101
 102         return 0;
 103 }
 104
 105 static int read_version(struct sock *sk)
 106 {
 107         struct mgmt_rp_read_version rp;
 108
 109         BT_DBG("sock %p", sk);
 110
 111         rp.version = MGMT_VERSION;
 112         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 113
 114         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 115                                                                 sizeof(rp));
 116 }
 117
 118 static int read_index_list(struct sock *sk)
 119 {
 120         struct mgmt_rp_read_index_list *rp;
 121         struct list_head *p;
 122         size_t rp_len;
 123         u16 count;
 124         int i, err;
 125
 126         BT_DBG("sock %p", sk);
 127
 128         read_lock(&hci_dev_list_lock);
 129
 130         count = 0;
 131         list_for_each(p, &hci_dev_list) {
 132                 count++;
 133         }
 134
 135         rp_len = sizeof(*rp) + (2 * count);
 136         rp = kmalloc(rp_len, GFP_ATOMIC);
 137         if (!rp) {
 138                 read_unlock(&hci_dev_list_lock);
 139                 return -ENOMEM;
 140         }
 141
 142         put_unaligned_le16(count, &rp->num_controllers);
 143
 144         i = 0;
 145         list_for_each(p, &hci_dev_list) {
 146                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 147
 148                 hci_del_off_timer(d);
 149
 150                 set_bit(HCI_MGMT, &d->flags);
 151
 152                 if (test_bit(HCI_SETUP, &d->flags))
 153                         continue;
 154
 155                 put_unaligned_le16(d->id, &rp->index[i++]);
 156                 BT_DBG("Added hci%u", d->id);
 157         }
 158
 159         read_unlock(&hci_dev_list_lock);
 160
 161         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 162                                                                         rp_len);
 163
 164         kfree(rp);
 165
 166         return err;
 167 }
 168
 169 static int read_controller_info(struct sock *sk, u16 index)
 170 {
 171         struct mgmt_rp_read_info rp;
 172         struct hci_dev *hdev;
 173
 174         BT_DBG("sock %p hci%u", sk, index);
 175
 176         hdev = hci_dev_get(index);
 177         if (!hdev)
 178                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 179
 180         hci_del_off_timer(hdev);
 181
 182         hci_dev_lock_bh(hdev);
 183
 184         set_bit(HCI_MGMT, &hdev->flags);
 185
 186         memset(&rp, 0, sizeof(rp));
 187
 188         rp.type = hdev->dev_type;
 189
 190         rp.powered = test_bit(HCI_UP, &hdev->flags);
 191         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 192         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 193         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 194
 195         if (test_bit(HCI_AUTH, &hdev->flags))
 196                 rp.sec_mode = 3;
 197         else if (hdev->ssp_mode > 0)
 198                 rp.sec_mode = 4;
 199         else
 200                 rp.sec_mode = 2;
 201
 202         bacpy(&rp.bdaddr, &hdev->bdaddr);
 203         memcpy(rp.features, hdev->features, 8);
 204         memcpy(rp.dev_class, hdev->dev_class, 3);
 205         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 206         rp.hci_ver = hdev->hci_ver;
 207         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 208
 209         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 210
 211         hci_dev_unlock_bh(hdev);
 212         hci_dev_put(hdev);
 213
 214         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 215 }
 216
 217 static void mgmt_pending_free(struct pending_cmd *cmd)
 218 {
 219         sock_put(cmd->sk);
 220         kfree(cmd->param);
 221         kfree(cmd);
 222 }
 223
 224 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 225                                                 u16 index, void *data, u16 len)
 226 {
 227         struct pending_cmd *cmd;
 228
 229         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 230         if (!cmd)
 231                 return NULL;
 232
 233         cmd->opcode = opcode;
 234         cmd->index = index;
 235
 236         cmd->param = kmalloc(len, GFP_ATOMIC);
 237         if (!cmd->param) {
 238                 kfree(cmd);
 239                 return NULL;
 240         }
 241
 242         if (data)
 243                 memcpy(cmd->param, data, len);
 244
 245         cmd->sk = sk;
 246         sock_hold(sk);
 247
 248         list_add(&cmd->list, &cmd_list);
 249
 250         return cmd;
 251 }
 252
 253 static void mgmt_pending_foreach(u16 opcode, int index,
 254                                 void (*cb)(struct pending_cmd *cmd, void *data),
 255                                 void *data)
 256 {
 257         struct list_head *p, *n;
 258
 259         list_for_each_safe(p, n, &cmd_list) {
 260                 struct pending_cmd *cmd;
 261
 262                 cmd = list_entry(p, struct pending_cmd, list);
 263
 264                 if (cmd->opcode != opcode)
 265                         continue;
 266
 267                 if (index >= 0 && cmd->index != index)
 268                         continue;
 269
 270                 cb(cmd, data);
 271         }
 272 }
 273
 274 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 275 {
 276         struct list_head *p;
 277
 278         list_for_each(p, &cmd_list) {
 279                 struct pending_cmd *cmd;
 280
 281                 cmd = list_entry(p, struct pending_cmd, list);
 282
 283                 if (cmd->opcode != opcode)
 284                         continue;
 285
 286                 if (index >= 0 && cmd->index != index)
 287                         continue;
 288
 289                 return cmd;
 290         }
 291
 292         return NULL;
 293 }
 294
 295 static void mgmt_pending_remove(struct pending_cmd *cmd)
 296 {
 297         list_del(&cmd->list);
 298         mgmt_pending_free(cmd);
 299 }
 300
 301 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 302 {
 303         struct mgmt_mode *cp;
 304         struct hci_dev *hdev;
 305         struct pending_cmd *cmd;
 306         int err, up;
 307
 308         cp = (void *) data;
 309
 310         BT_DBG("request for hci%u", index);
 311
 312         if (len != sizeof(*cp))
 313                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 314
 315         hdev = hci_dev_get(index);
 316         if (!hdev)
 317                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 318
 319         hci_dev_lock_bh(hdev);
 320
 321         up = test_bit(HCI_UP, &hdev->flags);
 322         if ((cp->val && up) || (!cp->val && !up)) {
 323                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 324                 goto failed;
 325         }
 326
 327         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 328                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 329                 goto failed;
 330         }
 331
 332         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 333         if (!cmd) {
 334                 err = -ENOMEM;
 335                 goto failed;
 336         }
 337
 338         if (cp->val)
 339                 queue_work(hdev->workqueue, &hdev->power_on);
 340         else
 341                 queue_work(hdev->workqueue, &hdev->power_off);
 342
 343         err = 0;
 344
 345 failed:
 346         hci_dev_unlock_bh(hdev);
 347         hci_dev_put(hdev);
 348         return err;
 349 }
 350
 351 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 352                                                                         u16 len)
 353 {
 354         struct mgmt_mode *cp;
 355         struct hci_dev *hdev;
 356         struct pending_cmd *cmd;
 357         u8 scan;
 358         int err;
 359
 360         cp = (void *) data;
 361
 362         BT_DBG("request for hci%u", index);
 363
 364         if (len != sizeof(*cp))
 365                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 366
 367         hdev = hci_dev_get(index);
 368         if (!hdev)
 369                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 370
 371         hci_dev_lock_bh(hdev);
 372
 373         if (!test_bit(HCI_UP, &hdev->flags)) {
 374                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 375                 goto failed;
 376         }
 377
 378         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 379                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 380                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 381                 goto failed;
 382         }
 383
 384         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 385                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 386                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 387                 goto failed;
 388         }
 389
 390         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 391         if (!cmd) {
 392                 err = -ENOMEM;
 393                 goto failed;
 394         }
 395
 396         scan = SCAN_PAGE;
 397
 398         if (cp->val)
 399                 scan |= SCAN_INQUIRY;
 400
 401         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 402         if (err < 0)
 403                 mgmt_pending_remove(cmd);
 404
 405 failed:
 406         hci_dev_unlock_bh(hdev);
 407         hci_dev_put(hdev);
 408
 409         return err;
 410 }
 411
 412 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 413                                                                         u16 len)
 414 {
 415         struct mgmt_mode *cp;
 416         struct hci_dev *hdev;
 417         struct pending_cmd *cmd;
 418         u8 scan;
 419         int err;
 420
 421         cp = (void *) data;
 422
 423         BT_DBG("request for hci%u", index);
 424
 425         if (len != sizeof(*cp))
 426                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 427
 428         hdev = hci_dev_get(index);
 429         if (!hdev)
 430                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 431
 432         hci_dev_lock_bh(hdev);
 433
 434         if (!test_bit(HCI_UP, &hdev->flags)) {
 435                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 436                 goto failed;
 437         }
 438
 439         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 440                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 441                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 442                 goto failed;
 443         }
 444
 445         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 446                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 447                 goto failed;
 448         }
 449
 450         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 451         if (!cmd) {
 452                 err = -ENOMEM;
 453                 goto failed;
 454         }
 455
 456         if (cp->val)
 457                 scan = SCAN_PAGE;
 458         else
 459                 scan = 0;
 460
 461         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 462         if (err < 0)
 463                 mgmt_pending_remove(cmd);
 464
 465 failed:
 466         hci_dev_unlock_bh(hdev);
 467         hci_dev_put(hdev);
 468
 469         return err;
 470 }
 471
 472 static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
 473                                                         struct sock *skip_sk)
 474 {
 475         struct sk_buff *skb;
 476         struct mgmt_hdr *hdr;
 477
 478         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 479         if (!skb)
 480                 return -ENOMEM;
 481
 482         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 483
 484         hdr = (void *) skb_put(skb, sizeof(*hdr));
 485         hdr->opcode = cpu_to_le16(event);
 486         hdr->index = cpu_to_le16(index);
 487         hdr->len = cpu_to_le16(data_len);
 488
 489         if (data)
 490                 memcpy(skb_put(skb, data_len), data, data_len);
 491
 492         hci_send_to_sock(NULL, skb, skip_sk);
 493         kfree_skb(skb);
 494
 495         return 0;
 496 }
 497
 498 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 499 {
 500         struct mgmt_mode rp;
 501
 502         rp.val = val;
 503
 504         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 505 }
 506
 507 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 508                                                                         u16 len)
 509 {
 510         struct mgmt_mode *cp, ev;
 511         struct hci_dev *hdev;
 512         int err;
 513
 514         cp = (void *) data;
 515
 516         BT_DBG("request for hci%u", index);
 517
 518         if (len != sizeof(*cp))
 519                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 520
 521         hdev = hci_dev_get(index);
 522         if (!hdev)
 523                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 524
 525         hci_dev_lock_bh(hdev);
 526
 527         if (cp->val)
 528                 set_bit(HCI_PAIRABLE, &hdev->flags);
 529         else
 530                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 531
 532         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 533         if (err < 0)
 534                 goto failed;
 535
 536         ev.val = cp->val;
 537
 538         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 539
 540 failed:
 541         hci_dev_unlock_bh(hdev);
 542         hci_dev_put(hdev);
 543
 544         return err;
 545 }
 546
 547 #define EIR_FLAGS               0x01 /* flags */
 548 #define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
 549 #define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
 550 #define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
 551 #define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
 552 #define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
 553 #define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
 554 #define EIR_NAME_SHORT          0x08 /* shortened local name */
 555 #define EIR_NAME_COMPLETE       0x09 /* complete local name */
 556 #define EIR_TX_POWER            0x0A /* transmit power level */
 557 #define EIR_DEVICE_ID           0x10 /* device ID */
 558
 559 #define PNP_INFO_SVCLASS_ID             0x1200
 560
 561 static u8 bluetooth_base_uuid[] = {
 562                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 563                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 564 };
 565
 566 static u16 get_uuid16(u8 *uuid128)
 567 {
 568         u32 val;
 569         int i;
 570
 571         for (i = 0; i < 12; i++) {
 572                 if (bluetooth_base_uuid[i] != uuid128[i])
 573                         return 0;
 574         }
 575
 576         memcpy(&val, &uuid128[12], 4);
 577
 578         val = le32_to_cpu(val);
 579         if (val > 0xffff)
 580                 return 0;
 581
 582         return (u16) val;
 583 }
 584
 585 static void create_eir(struct hci_dev *hdev, u8 *data)
 586 {
 587         u8 *ptr = data;
 588         u16 eir_len = 0;
 589         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 590         int i, truncated = 0;
 591         struct list_head *p;
 592         size_t name_len;
 593
 594         name_len = strlen(hdev->dev_name);
 595
 596         if (name_len > 0) {
 597                 /* EIR Data type */
 598                 if (name_len > 48) {
 599                         name_len = 48;
 600                         ptr[1] = EIR_NAME_SHORT;
 601                 } else
 602                         ptr[1] = EIR_NAME_COMPLETE;
 603
 604                 /* EIR Data length */
 605                 ptr[0] = name_len + 1;
 606
 607                 memcpy(ptr + 2, hdev->dev_name, name_len);
 608
 609                 eir_len += (name_len + 2);
 610                 ptr += (name_len + 2);
 611         }
 612
 613         memset(uuid16_list, 0, sizeof(uuid16_list));
 614
 615         /* Group all UUID16 types */
 616         list_for_each(p, &hdev->uuids) {
 617                 struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
 618                 u16 uuid16;
 619
 620                 uuid16 = get_uuid16(uuid->uuid);
 621                 if (uuid16 == 0)
 622                         return;
 623
 624                 if (uuid16 < 0x1100)
 625                         continue;
 626
 627                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 628                         continue;
 629
 630                 /* Stop if not enough space to put next UUID */
 631                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 632                         truncated = 1;
 633                         break;
 634                 }
 635
 636                 /* Check for duplicates */
 637                 for (i = 0; uuid16_list[i] != 0; i++)
 638                         if (uuid16_list[i] == uuid16)
 639                                 break;
 640
 641                 if (uuid16_list[i] == 0) {
 642                         uuid16_list[i] = uuid16;
 643                         eir_len += sizeof(u16);
 644                 }
 645         }
 646
 647         if (uuid16_list[0] != 0) {
 648                 u8 *length = ptr;
 649
 650                 /* EIR Data type */
 651                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 652
 653                 ptr += 2;
 654                 eir_len += 2;
 655
 656                 for (i = 0; uuid16_list[i] != 0; i++) {
 657                         *ptr++ = (uuid16_list[i] & 0x00ff);
 658                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 659                 }
 660
 661                 /* EIR Data length */
 662                 *length = (i * sizeof(u16)) + 1;
 663         }
 664 }
 665
 666 static int update_eir(struct hci_dev *hdev)
 667 {
 668         struct hci_cp_write_eir cp;
 669
 670         if (!(hdev->features[6] & LMP_EXT_INQ))
 671                 return 0;
 672
 673         if (hdev->ssp_mode == 0)
 674                 return 0;
 675
 676         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 677                 return 0;
 678
 679         memset(&cp, 0, sizeof(cp));
 680
 681         create_eir(hdev, cp.data);
 682
 683         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 684                 return 0;
 685
 686         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 687
 688         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 689 }
 690
 691 static u8 get_service_classes(struct hci_dev *hdev)
 692 {
 693         struct list_head *p;
 694         u8 val = 0;
 695
 696         list_for_each(p, &hdev->uuids) {
 697                 struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
 698
 699                 val |= uuid->svc_hint;
 700         }
 701
 702         return val;
 703 }
 704
 705 static int update_class(struct hci_dev *hdev)
 706 {
 707         u8 cod[3];
 708
 709         BT_DBG("%s", hdev->name);
 710
 711         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 712                 return 0;
 713
 714         cod[0] = hdev->minor_class;
 715         cod[1] = hdev->major_class;
 716         cod[2] = get_service_classes(hdev);
 717
 718         if (memcmp(cod, hdev->dev_class, 3) == 0)
 719                 return 0;
 720
 721         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 722 }
 723
 724 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 725 {
 726         struct mgmt_cp_add_uuid *cp;
 727         struct hci_dev *hdev;
 728         struct bt_uuid *uuid;
 729         int err;
 730
 731         cp = (void *) data;
 732
 733         BT_DBG("request for hci%u", index);
 734
 735         if (len != sizeof(*cp))
 736                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 737
 738         hdev = hci_dev_get(index);
 739         if (!hdev)
 740                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 741
 742         hci_dev_lock_bh(hdev);
 743
 744         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 745         if (!uuid) {
 746                 err = -ENOMEM;
 747                 goto failed;
 748         }
 749
 750         memcpy(uuid->uuid, cp->uuid, 16);
 751         uuid->svc_hint = cp->svc_hint;
 752
 753         list_add(&uuid->list, &hdev->uuids);
 754
 755         err = update_class(hdev);
 756         if (err < 0)
 757                 goto failed;
 758
 759         err = update_eir(hdev);
 760         if (err < 0)
 761                 goto failed;
 762
 763         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 764
 765 failed:
 766         hci_dev_unlock_bh(hdev);
 767         hci_dev_put(hdev);
 768
 769         return err;
 770 }
 771
 772 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 773 {
 774         struct list_head *p, *n;
 775         struct mgmt_cp_remove_uuid *cp;
 776         struct hci_dev *hdev;
 777         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 778         int err, found;
 779
 780         cp = (void *) data;
 781
 782         BT_DBG("request for hci%u", index);
 783
 784         if (len != sizeof(*cp))
 785                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 786
 787         hdev = hci_dev_get(index);
 788         if (!hdev)
 789                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 790
 791         hci_dev_lock_bh(hdev);
 792
 793         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 794                 err = hci_uuids_clear(hdev);
 795                 goto unlock;
 796         }
 797
 798         found = 0;
 799
 800         list_for_each_safe(p, n, &hdev->uuids) {
 801                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 802
 803                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 804                         continue;
 805
 806                 list_del(&match->list);
 807                 found++;
 808         }
 809
 810         if (found == 0) {
 811                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 812                 goto unlock;
 813         }
 814
 815         err = update_class(hdev);
 816         if (err < 0)
 817                 goto unlock;
 818
 819         err = update_eir(hdev);
 820         if (err < 0)
 821                 goto unlock;
 822
 823         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 824
 825 unlock:
 826         hci_dev_unlock_bh(hdev);
 827         hci_dev_put(hdev);
 828
 829         return err;
 830 }
 831
 832 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 833                                                                         u16 len)
 834 {
 835         struct hci_dev *hdev;
 836         struct mgmt_cp_set_dev_class *cp;
 837         int err;
 838
 839         cp = (void *) data;
 840
 841         BT_DBG("request for hci%u", index);
 842
 843         if (len != sizeof(*cp))
 844                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 845
 846         hdev = hci_dev_get(index);
 847         if (!hdev)
 848                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 849
 850         hci_dev_lock_bh(hdev);
 851
 852         hdev->major_class = cp->major;
 853         hdev->minor_class = cp->minor;
 854
 855         err = update_class(hdev);
 856
 857         if (err == 0)
 858                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 859
 860         hci_dev_unlock_bh(hdev);
 861         hci_dev_put(hdev);
 862
 863         return err;
 864 }
 865
 866 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 867                                                                         u16 len)
 868 {
 869         struct hci_dev *hdev;
 870         struct mgmt_cp_set_service_cache *cp;
 871         int err;
 872
 873         cp = (void *) data;
 874
 875         if (len != sizeof(*cp))
 876                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
 877
 878         hdev = hci_dev_get(index);
 879         if (!hdev)
 880                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 881
 882         hci_dev_lock_bh(hdev);
 883
 884         BT_DBG("hci%u enable %d", index, cp->enable);
 885
 886         if (cp->enable) {
 887                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 888                 err = 0;
 889         } else {
 890                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 891                 err = update_class(hdev);
 892                 if (err == 0)
 893                         err = update_eir(hdev);
 894         }
 895
 896         if (err == 0)
 897                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 898                                                                         0);
 899
 900         hci_dev_unlock_bh(hdev);
 901         hci_dev_put(hdev);
 902
 903         return err;
 904 }
 905
 906 static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 907 {
 908         struct hci_dev *hdev;
 909         struct mgmt_cp_load_keys *cp;
 910         u16 key_count, expected_len;
 911         int i, err;
 912
 913         cp = (void *) data;
 914
 915         if (len < sizeof(*cp))
 916                 return -EINVAL;
 917
 918         key_count = get_unaligned_le16(&cp->key_count);
 919
 920         expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
 921         if (expected_len > len) {
 922                 BT_ERR("load_keys: expected at least %u bytes, got %u bytes",
 923                                                         expected_len, len);
 924                 return -EINVAL;
 925         }
 926
 927         hdev = hci_dev_get(index);
 928         if (!hdev)
 929                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
 930
 931         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 932                                                                 key_count);
 933
 934         hci_dev_lock_bh(hdev);
 935
 936         hci_link_keys_clear(hdev);
 937
 938         set_bit(HCI_LINK_KEYS, &hdev->flags);
 939
 940         if (cp->debug_keys)
 941                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 942         else
 943                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 944
 945         len -= sizeof(*cp);
 946         i = 0;
 947
 948         while (i < len) {
 949                 struct mgmt_key_info *key = (void *) cp->keys + i;
 950
 951                 i += sizeof(*key) + key->dlen;
 952
 953                 if (key->type == HCI_LK_SMP_LTK) {
 954                         struct key_master_id *id = (void *) key->data;
 955
 956                         if (key->dlen != sizeof(struct key_master_id))
 957                                 continue;
 958
 959                         hci_add_ltk(hdev, 0, &key->bdaddr, key->pin_len,
 960                                                 id->ediv, id->rand, key->val);
 961
 962                         continue;
 963                 }
 964
 965                 hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
 966                                                                 key->pin_len);
 967         }
 968
 969         err = cmd_complete(sk, index, MGMT_OP_LOAD_KEYS, NULL, 0);
 970
 971         hci_dev_unlock_bh(hdev);
 972         hci_dev_put(hdev);
 973
 974         return err;
 975 }
 976
 977 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 978 {
 979         struct hci_dev *hdev;
 980         struct mgmt_cp_remove_key *cp;
 981         struct hci_conn *conn;
 982         int err;
 983
 984         cp = (void *) data;
 985
 986         if (len != sizeof(*cp))
 987                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
 988
 989         hdev = hci_dev_get(index);
 990         if (!hdev)
 991                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 992
 993         hci_dev_lock_bh(hdev);
 994
 995         err = hci_remove_link_key(hdev, &cp->bdaddr);
 996         if (err < 0) {
 997                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
 998                 goto unlock;
 999         }
1000
1001         err = 0;
1002
1003         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
1004                 goto unlock;
1005
1006         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1007         if (conn) {
1008                 struct hci_cp_disconnect dc;
1009
1010                 put_unaligned_le16(conn->handle, &dc.handle);
1011                 dc.reason = 0x13; /* Remote User Terminated Connection */
1012                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1013         }
1014
1015 unlock:
1016         hci_dev_unlock_bh(hdev);
1017         hci_dev_put(hdev);
1018
1019         return err;
1020 }
1021
1022 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
1023 {
1024         struct hci_dev *hdev;
1025         struct mgmt_cp_disconnect *cp;
1026         struct hci_cp_disconnect dc;
1027         struct pending_cmd *cmd;
1028         struct hci_conn *conn;
1029         int err;
1030
1031         BT_DBG("");
1032
1033         cp = (void *) data;
1034
1035         if (len != sizeof(*cp))
1036                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
1037
1038         hdev = hci_dev_get(index);
1039         if (!hdev)
1040                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
1041
1042         hci_dev_lock_bh(hdev);
1043
1044         if (!test_bit(HCI_UP, &hdev->flags)) {
1045                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
1046                 goto failed;
1047         }
1048
1049         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
1050                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
1051                 goto failed;
1052         }
1053
1054         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1055         if (!conn)
1056                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
1057
1058         if (!conn) {
1059                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
1060                 goto failed;
1061         }
1062
1063         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
1064         if (!cmd) {
1065                 err = -ENOMEM;
1066                 goto failed;
1067         }
1068
1069         put_unaligned_le16(conn->handle, &dc.handle);
1070         dc.reason = 0x13; /* Remote User Terminated Connection */
1071
1072         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1073         if (err < 0)
1074                 mgmt_pending_remove(cmd);
1075
1076 failed:
1077         hci_dev_unlock_bh(hdev);
1078         hci_dev_put(hdev);
1079
1080         return err;
1081 }
1082
1083 static int get_connections(struct sock *sk, u16 index)
1084 {
1085         struct mgmt_rp_get_connections *rp;
1086         struct hci_dev *hdev;
1087         struct list_head *p;
1088         size_t rp_len;
1089         u16 count;
1090         int i, err;
1091
1092         BT_DBG("");
1093
1094         hdev = hci_dev_get(index);
1095         if (!hdev)
1096                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
1097
1098         hci_dev_lock_bh(hdev);
1099
1100         count = 0;
1101         list_for_each(p, &hdev->conn_hash.list) {
1102                 count++;
1103         }
1104
1105         rp_len = sizeof(*rp) + (count * sizeof(bdaddr_t));
1106         rp = kmalloc(rp_len, GFP_ATOMIC);
1107         if (!rp) {
1108                 err = -ENOMEM;
1109                 goto unlock;
1110         }
1111
1112         put_unaligned_le16(count, &rp->conn_count);
1113
1114         i = 0;
1115         list_for_each(p, &hdev->conn_hash.list) {
1116                 struct hci_conn *c = list_entry(p, struct hci_conn, list);
1117
1118                 bacpy(&rp->conn[i++], &c->dst);
1119         }
1120
1121         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
1122
1123 unlock:
1124         kfree(rp);
1125         hci_dev_unlock_bh(hdev);
1126         hci_dev_put(hdev);
1127         return err;
1128 }
1129
1130 static int send_pin_code_neg_reply(struct sock *sk, u16 index,
1131                 struct hci_dev *hdev, struct mgmt_cp_pin_code_neg_reply *cp)
1132 {
1133         struct pending_cmd *cmd;
1134         int err;
1135
1136         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index, cp,
1137                                                                 sizeof(*cp));
1138         if (!cmd)
1139                 return -ENOMEM;
1140
1141         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
1142                                                                 &cp->bdaddr);
1143         if (err < 0)
1144                 mgmt_pending_remove(cmd);
1145
1146         return err;
1147 }
1148
1149 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
1150                                                                         u16 len)
1151 {
1152         struct hci_dev *hdev;
1153         struct hci_conn *conn;
1154         struct mgmt_cp_pin_code_reply *cp;
1155         struct mgmt_cp_pin_code_neg_reply ncp;
1156         struct hci_cp_pin_code_reply reply;
1157         struct pending_cmd *cmd;
1158         int err;
1159
1160         BT_DBG("");
1161
1162         cp = (void *) data;
1163
1164         if (len != sizeof(*cp))
1165                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
1166
1167         hdev = hci_dev_get(index);
1168         if (!hdev)
1169                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
1170
1171         hci_dev_lock_bh(hdev);
1172
1173         if (!test_bit(HCI_UP, &hdev->flags)) {
1174                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
1175                 goto failed;
1176         }
1177
1178         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1179         if (!conn) {
1180                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENOTCONN);
1181                 goto failed;
1182         }
1183
1184         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1185                 bacpy(&ncp.bdaddr, &cp->bdaddr);
1186
1187                 BT_ERR("PIN code is not 16 bytes long");
1188
1189                 err = send_pin_code_neg_reply(sk, index, hdev, &ncp);
1190                 if (err >= 0)
1191                         err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
1192                                                                 EINVAL);
1193
1194                 goto failed;
1195         }
1196
1197         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
1198         if (!cmd) {
1199                 err = -ENOMEM;
1200                 goto failed;
1201         }
1202
1203         bacpy(&reply.bdaddr, &cp->bdaddr);
1204         reply.pin_len = cp->pin_len;
1205         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1206
1207         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1208         if (err < 0)
1209                 mgmt_pending_remove(cmd);
1210
1211 failed:
1212         hci_dev_unlock_bh(hdev);
1213         hci_dev_put(hdev);
1214
1215         return err;
1216 }
1217
1218 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1219                                                                         u16 len)
1220 {
1221         struct hci_dev *hdev;
1222         struct mgmt_cp_pin_code_neg_reply *cp;
1223         int err;
1224
1225         BT_DBG("");
1226
1227         cp = (void *) data;
1228
1229         if (len != sizeof(*cp))
1230                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1231                                                                         EINVAL);
1232
1233         hdev = hci_dev_get(index);
1234         if (!hdev)
1235                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1236                                                                         ENODEV);
1237
1238         hci_dev_lock_bh(hdev);
1239
1240         if (!test_bit(HCI_UP, &hdev->flags)) {
1241                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1242                                                                 ENETDOWN);
1243                 goto failed;
1244         }
1245
1246         err = send_pin_code_neg_reply(sk, index, hdev, cp);
1247
1248 failed:
1249         hci_dev_unlock_bh(hdev);
1250         hci_dev_put(hdev);
1251
1252         return err;
1253 }
1254
1255 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1256                                                                         u16 len)
1257 {
1258         struct hci_dev *hdev;
1259         struct mgmt_cp_set_io_capability *cp;
1260
1261         BT_DBG("");
1262
1263         cp = (void *) data;
1264
1265         if (len != sizeof(*cp))
1266                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
1267
1268         hdev = hci_dev_get(index);
1269         if (!hdev)
1270                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1271
1272         hci_dev_lock_bh(hdev);
1273
1274         hdev->io_capability = cp->io_capability;
1275
1276         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1277                                                         hdev->io_capability);
1278
1279         hci_dev_unlock_bh(hdev);
1280         hci_dev_put(hdev);
1281
1282         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1283 }
1284
1285 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1286 {
1287         struct hci_dev *hdev = conn->hdev;
1288         struct list_head *p;
1289
1290         list_for_each(p, &cmd_list) {
1291                 struct pending_cmd *cmd;
1292
1293                 cmd = list_entry(p, struct pending_cmd, list);
1294
1295                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1296                         continue;
1297
1298                 if (cmd->index != hdev->id)
1299                         continue;
1300
1301                 if (cmd->user_data != conn)
1302                         continue;
1303
1304                 return cmd;
1305         }
1306
1307         return NULL;
1308 }
1309
1310 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1311 {
1312         struct mgmt_rp_pair_device rp;
1313         struct hci_conn *conn = cmd->user_data;
1314
1315         bacpy(&rp.bdaddr, &conn->dst);
1316         rp.status = status;
1317
1318         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1319
1320         /* So we don't get further callbacks for this connection */
1321         conn->connect_cfm_cb = NULL;
1322         conn->security_cfm_cb = NULL;
1323         conn->disconn_cfm_cb = NULL;
1324
1325         hci_conn_put(conn);
1326
1327         mgmt_pending_remove(cmd);
1328 }
1329
1330 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1331 {
1332         struct pending_cmd *cmd;
1333
1334         BT_DBG("status %u", status);
1335
1336         cmd = find_pairing(conn);
1337         if (!cmd) {
1338                 BT_DBG("Unable to find a pending command");
1339                 return;
1340         }
1341
1342         pairing_complete(cmd, status);
1343 }
1344
1345 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1346 {
1347         struct hci_dev *hdev;
1348         struct mgmt_cp_pair_device *cp;
1349         struct pending_cmd *cmd;
1350         struct adv_entry *entry;
1351         u8 sec_level, auth_type;
1352         struct hci_conn *conn;
1353         int err;
1354
1355         BT_DBG("");
1356
1357         cp = (void *) data;
1358
1359         if (len != sizeof(*cp))
1360                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1361
1362         hdev = hci_dev_get(index);
1363         if (!hdev)
1364                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1365
1366         hci_dev_lock_bh(hdev);
1367
1368         if (cp->io_cap == 0x03) {
1369                 sec_level = BT_SECURITY_MEDIUM;
1370                 auth_type = HCI_AT_DEDICATED_BONDING;
1371         } else {
1372                 sec_level = BT_SECURITY_HIGH;
1373                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1374         }
1375
1376         entry = hci_find_adv_entry(hdev, &cp->bdaddr);
1377         if (entry)
1378                 conn = hci_connect(hdev, LE_LINK, &cp->bdaddr, sec_level,
1379                                                                 auth_type);
1380         else
1381                 conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level,
1382                                                                 auth_type);
1383
1384         if (IS_ERR(conn)) {
1385                 err = PTR_ERR(conn);
1386                 goto unlock;
1387         }
1388
1389         if (conn->connect_cfm_cb) {
1390                 hci_conn_put(conn);
1391                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1392                 goto unlock;
1393         }
1394
1395         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1396         if (!cmd) {
1397                 err = -ENOMEM;
1398                 hci_conn_put(conn);
1399                 goto unlock;
1400         }
1401
1402         /* For LE, just connecting isn't a proof that the pairing finished */
1403         if (!entry)
1404                 conn->connect_cfm_cb = pairing_complete_cb;
1405
1406         conn->security_cfm_cb = pairing_complete_cb;
1407         conn->disconn_cfm_cb = pairing_complete_cb;
1408         conn->io_capability = cp->io_cap;
1409         cmd->user_data = conn;
1410
1411         if (conn->state == BT_CONNECTED &&
1412                                 hci_conn_security(conn, sec_level, auth_type))
1413                 pairing_complete(cmd, 0);
1414
1415         err = 0;
1416
1417 unlock:
1418         hci_dev_unlock_bh(hdev);
1419         hci_dev_put(hdev);
1420
1421         return err;
1422 }
1423
1424 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1425                                                         u16 len, int success)
1426 {
1427         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1428         u16 mgmt_op, hci_op;
1429         struct pending_cmd *cmd;
1430         struct hci_dev *hdev;
1431         int err;
1432
1433         BT_DBG("");
1434
1435         if (success) {
1436                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1437                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1438         } else {
1439                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1440                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1441         }
1442
1443         if (len != sizeof(*cp))
1444                 return cmd_status(sk, index, mgmt_op, EINVAL);
1445
1446         hdev = hci_dev_get(index);
1447         if (!hdev)
1448                 return cmd_status(sk, index, mgmt_op, ENODEV);
1449
1450         hci_dev_lock_bh(hdev);
1451
1452         if (!test_bit(HCI_UP, &hdev->flags)) {
1453                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1454                 goto failed;
1455         }
1456
1457         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1458         if (!cmd) {
1459                 err = -ENOMEM;
1460                 goto failed;
1461         }
1462
1463         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1464         if (err < 0)
1465                 mgmt_pending_remove(cmd);
1466
1467 failed:
1468         hci_dev_unlock_bh(hdev);
1469         hci_dev_put(hdev);
1470
1471         return err;
1472 }
1473
1474 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
1475                                                                 u16 len)
1476 {
1477         struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
1478         struct hci_cp_write_local_name hci_cp;
1479         struct hci_dev *hdev;
1480         struct pending_cmd *cmd;
1481         int err;
1482
1483         BT_DBG("");
1484
1485         if (len != sizeof(*mgmt_cp))
1486                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
1487
1488         hdev = hci_dev_get(index);
1489         if (!hdev)
1490                 return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
1491
1492         hci_dev_lock_bh(hdev);
1493
1494         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
1495         if (!cmd) {
1496                 err = -ENOMEM;
1497                 goto failed;
1498         }
1499
1500         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
1501         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
1502                                                                 &hci_cp);
1503         if (err < 0)
1504                 mgmt_pending_remove(cmd);
1505
1506 failed:
1507         hci_dev_unlock_bh(hdev);
1508         hci_dev_put(hdev);
1509
1510         return err;
1511 }
1512
1513 static int read_local_oob_data(struct sock *sk, u16 index)
1514 {
1515         struct hci_dev *hdev;
1516         struct pending_cmd *cmd;
1517         int err;
1518
1519         BT_DBG("hci%u", index);
1520
1521         hdev = hci_dev_get(index);
1522         if (!hdev)
1523                 return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1524                                                                         ENODEV);
1525
1526         hci_dev_lock_bh(hdev);
1527
1528         if (!test_bit(HCI_UP, &hdev->flags)) {
1529                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1530                                                                 ENETDOWN);
1531                 goto unlock;
1532         }
1533
1534         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1535                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
1536                                                                 EOPNOTSUPP);
1537                 goto unlock;
1538         }
1539
1540         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
1541                 err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
1542                 goto unlock;
1543         }
1544
1545         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
1546         if (!cmd) {
1547                 err = -ENOMEM;
1548                 goto unlock;
1549         }
1550
1551         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
1552         if (err < 0)
1553                 mgmt_pending_remove(cmd);
1554
1555 unlock:
1556         hci_dev_unlock_bh(hdev);
1557         hci_dev_put(hdev);
1558
1559         return err;
1560 }
1561
1562 static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
1563                                                                         u16 len)
1564 {
1565         struct hci_dev *hdev;
1566         struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
1567         int err;
1568
1569         BT_DBG("hci%u ", index);
1570
1571         if (len != sizeof(*cp))
1572                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1573                                                                         EINVAL);
1574
1575         hdev = hci_dev_get(index);
1576         if (!hdev)
1577                 return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
1578                                                                         ENODEV);
1579
1580         hci_dev_lock_bh(hdev);
1581
1582         err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
1583                                                                 cp->randomizer);
1584         if (err < 0)
1585                 err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
1586         else
1587                 err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
1588                                                                         0);
1589
1590         hci_dev_unlock_bh(hdev);
1591         hci_dev_put(hdev);
1592
1593         return err;
1594 }
1595
1596 static int remove_remote_oob_data(struct sock *sk, u16 index,
1597                                                 unsigned char *data, u16 len)
1598 {
1599         struct hci_dev *hdev;
1600         struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
1601         int err;
1602
1603         BT_DBG("hci%u ", index);
1604
1605         if (len != sizeof(*cp))
1606                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1607                                                                         EINVAL);
1608
1609         hdev = hci_dev_get(index);
1610         if (!hdev)
1611                 return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1612                                                                         ENODEV);
1613
1614         hci_dev_lock_bh(hdev);
1615
1616         err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
1617         if (err < 0)
1618                 err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1619                                                                         -err);
1620         else
1621                 err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
1622                                                                 NULL, 0);
1623
1624         hci_dev_unlock_bh(hdev);
1625         hci_dev_put(hdev);
1626
1627         return err;
1628 }
1629
1630 static int start_discovery(struct sock *sk, u16 index)
1631 {
1632         u8 lap[3] = { 0x33, 0x8b, 0x9e };
1633         struct hci_cp_inquiry cp;
1634         struct pending_cmd *cmd;
1635         struct hci_dev *hdev;
1636         int err;
1637
1638         BT_DBG("hci%u", index);
1639
1640         hdev = hci_dev_get(index);
1641         if (!hdev)
1642                 return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
1643
1644         hci_dev_lock_bh(hdev);
1645
1646         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
1647         if (!cmd) {
1648                 err = -ENOMEM;
1649                 goto failed;
1650         }
1651
1652         memset(&cp, 0, sizeof(cp));
1653         memcpy(&cp.lap, lap, 3);
1654         cp.length  = 0x08;
1655         cp.num_rsp = 0x00;
1656
1657         err = hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1658         if (err < 0)
1659                 mgmt_pending_remove(cmd);
1660
1661 failed:
1662         hci_dev_unlock_bh(hdev);
1663         hci_dev_put(hdev);
1664
1665         return err;
1666 }
1667
1668 static int stop_discovery(struct sock *sk, u16 index)
1669 {
1670         struct hci_dev *hdev;
1671         struct pending_cmd *cmd;
1672         int err;
1673
1674         BT_DBG("hci%u", index);
1675
1676         hdev = hci_dev_get(index);
1677         if (!hdev)
1678                 return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
1679
1680         hci_dev_lock_bh(hdev);
1681
1682         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
1683         if (!cmd) {
1684                 err = -ENOMEM;
1685                 goto failed;
1686         }
1687
1688         err = hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1689         if (err < 0)
1690                 mgmt_pending_remove(cmd);
1691
1692 failed:
1693         hci_dev_unlock_bh(hdev);
1694         hci_dev_put(hdev);
1695
1696         return err;
1697 }
1698
1699 static int block_device(struct sock *sk, u16 index, unsigned char *data,
1700                                                                 u16 len)
1701 {
1702         struct hci_dev *hdev;
1703         struct mgmt_cp_block_device *cp;
1704         int err;
1705
1706         BT_DBG("hci%u", index);
1707
1708         cp = (void *) data;
1709
1710         if (len != sizeof(*cp))
1711                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1712                                                         EINVAL);
1713
1714         hdev = hci_dev_get(index);
1715         if (!hdev)
1716                 return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
1717                                                         ENODEV);
1718
1719         err = hci_blacklist_add(hdev, &cp->bdaddr);
1720
1721         if (err < 0)
1722                 err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE, -err);
1723         else
1724                 err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
1725                                                         NULL, 0);
1726         hci_dev_put(hdev);
1727
1728         return err;
1729 }
1730
1731 static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
1732                                                                 u16 len)
1733 {
1734         struct hci_dev *hdev;
1735         struct mgmt_cp_unblock_device *cp;
1736         int err;
1737
1738         BT_DBG("hci%u", index);
1739
1740         cp = (void *) data;
1741
1742         if (len != sizeof(*cp))
1743                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1744                                                                 EINVAL);
1745
1746         hdev = hci_dev_get(index);
1747         if (!hdev)
1748                 return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1749                                                                 ENODEV);
1750
1751         err = hci_blacklist_del(hdev, &cp->bdaddr);
1752
1753         if (err < 0)
1754                 err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE, -err);
1755         else
1756                 err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
1757                                                                 NULL, 0);
1758         hci_dev_put(hdev);
1759
1760         return err;
1761 }
1762
1763 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1764 {
1765         unsigned char *buf;
1766         struct mgmt_hdr *hdr;
1767         u16 opcode, index, len;
1768         int err;
1769
1770         BT_DBG("got %zu bytes", msglen);
1771
1772         if (msglen < sizeof(*hdr))
1773                 return -EINVAL;
1774
1775         buf = kmalloc(msglen, GFP_KERNEL);
1776         if (!buf)
1777                 return -ENOMEM;
1778
1779         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1780                 err = -EFAULT;
1781                 goto done;
1782         }
1783
1784         hdr = (struct mgmt_hdr *) buf;
1785         opcode = get_unaligned_le16(&hdr->opcode);
1786         index = get_unaligned_le16(&hdr->index);
1787         len = get_unaligned_le16(&hdr->len);
1788
1789         if (len != msglen - sizeof(*hdr)) {
1790                 err = -EINVAL;
1791                 goto done;
1792         }
1793
1794         switch (opcode) {
1795         case MGMT_OP_READ_VERSION:
1796                 err = read_version(sk);
1797                 break;
1798         case MGMT_OP_READ_INDEX_LIST:
1799                 err = read_index_list(sk);
1800                 break;
1801         case MGMT_OP_READ_INFO:
1802                 err = read_controller_info(sk, index);
1803                 break;
1804         case MGMT_OP_SET_POWERED:
1805                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1806                 break;
1807         case MGMT_OP_SET_DISCOVERABLE:
1808                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1809                 break;
1810         case MGMT_OP_SET_CONNECTABLE:
1811                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1812                 break;
1813         case MGMT_OP_SET_PAIRABLE:
1814                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1815                 break;
1816         case MGMT_OP_ADD_UUID:
1817                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1818                 break;
1819         case MGMT_OP_REMOVE_UUID:
1820                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1821                 break;
1822         case MGMT_OP_SET_DEV_CLASS:
1823                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1824                 break;
1825         case MGMT_OP_SET_SERVICE_CACHE:
1826                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1827                 break;
1828         case MGMT_OP_LOAD_KEYS:
1829                 err = load_keys(sk, index, buf + sizeof(*hdr), len);
1830                 break;
1831         case MGMT_OP_REMOVE_KEY:
1832                 err = remove_key(sk, index, buf + sizeof(*hdr), len);
1833                 break;
1834         case MGMT_OP_DISCONNECT:
1835                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1836                 break;
1837         case MGMT_OP_GET_CONNECTIONS:
1838                 err = get_connections(sk, index);
1839                 break;
1840         case MGMT_OP_PIN_CODE_REPLY:
1841                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1842                 break;
1843         case MGMT_OP_PIN_CODE_NEG_REPLY:
1844                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1845                 break;
1846         case MGMT_OP_SET_IO_CAPABILITY:
1847                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1848                 break;
1849         case MGMT_OP_PAIR_DEVICE:
1850                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1851                 break;
1852         case MGMT_OP_USER_CONFIRM_REPLY:
1853                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1854                 break;
1855         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1856                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1857                 break;
1858         case MGMT_OP_SET_LOCAL_NAME:
1859                 err = set_local_name(sk, index, buf + sizeof(*hdr), len);
1860                 break;
1861         case MGMT_OP_READ_LOCAL_OOB_DATA:
1862                 err = read_local_oob_data(sk, index);
1863                 break;
1864         case MGMT_OP_ADD_REMOTE_OOB_DATA:
1865                 err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
1866                 break;
1867         case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
1868                 err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
1869                                                                         len);
1870                 break;
1871         case MGMT_OP_START_DISCOVERY:
1872                 err = start_discovery(sk, index);
1873                 break;
1874         case MGMT_OP_STOP_DISCOVERY:
1875                 err = stop_discovery(sk, index);
1876                 break;
1877         case MGMT_OP_BLOCK_DEVICE:
1878                 err = block_device(sk, index, buf + sizeof(*hdr), len);
1879                 break;
1880         case MGMT_OP_UNBLOCK_DEVICE:
1881                 err = unblock_device(sk, index, buf + sizeof(*hdr), len);
1882                 break;
1883         default:
1884                 BT_DBG("Unknown op %u", opcode);
1885                 err = cmd_status(sk, index, opcode, 0x01);
1886                 break;
1887         }
1888
1889         if (err < 0)
1890                 goto done;
1891
1892         err = msglen;
1893
1894 done:
1895         kfree(buf);
1896         return err;
1897 }
1898
1899 int mgmt_index_added(u16 index)
1900 {
1901         return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
1902 }
1903
1904 int mgmt_index_removed(u16 index)
1905 {
1906         return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
1907 }
1908
1909 struct cmd_lookup {
1910         u8 val;
1911         struct sock *sk;
1912 };
1913
1914 static void mode_rsp(struct pending_cmd *cmd, void *data)
1915 {
1916         struct mgmt_mode *cp = cmd->param;
1917         struct cmd_lookup *match = data;
1918
1919         if (cp->val != match->val)
1920                 return;
1921
1922         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1923
1924         list_del(&cmd->list);
1925
1926         if (match->sk == NULL) {
1927                 match->sk = cmd->sk;
1928                 sock_hold(match->sk);
1929         }
1930
1931         mgmt_pending_free(cmd);
1932 }
1933
1934 int mgmt_powered(u16 index, u8 powered)
1935 {
1936         struct mgmt_mode ev;
1937         struct cmd_lookup match = { powered, NULL };
1938         int ret;
1939
1940         mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
1941
1942         ev.val = powered;
1943
1944         ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
1945
1946         if (match.sk)
1947                 sock_put(match.sk);
1948
1949         return ret;
1950 }
1951
1952 int mgmt_discoverable(u16 index, u8 discoverable)
1953 {
1954         struct mgmt_mode ev;
1955         struct cmd_lookup match = { discoverable, NULL };
1956         int ret;
1957
1958         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
1959
1960         ev.val = discoverable;
1961
1962         ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
1963                                                                 match.sk);
1964
1965         if (match.sk)
1966                 sock_put(match.sk);
1967
1968         return ret;
1969 }
1970
1971 int mgmt_connectable(u16 index, u8 connectable)
1972 {
1973         struct mgmt_mode ev;
1974         struct cmd_lookup match = { connectable, NULL };
1975         int ret;
1976
1977         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
1978
1979         ev.val = connectable;
1980
1981         ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
1982
1983         if (match.sk)
1984                 sock_put(match.sk);
1985
1986         return ret;
1987 }
1988
1989 int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
1990 {
1991         struct mgmt_ev_new_key *ev;
1992         int err, total;
1993
1994         total = sizeof(struct mgmt_ev_new_key) + key->dlen;
1995         ev = kzalloc(total, GFP_ATOMIC);
1996         if (!ev)
1997                 return -ENOMEM;
1998
1999         bacpy(&ev->key.bdaddr, &key->bdaddr);
2000         ev->key.type = key->type;
2001         memcpy(ev->key.val, key->val, 16);
2002         ev->key.pin_len = key->pin_len;
2003         ev->key.dlen = key->dlen;
2004         ev->store_hint = persistent;
2005
2006         memcpy(ev->key.data, key->data, key->dlen);
2007
2008         err = mgmt_event(MGMT_EV_NEW_KEY, index, ev, total, NULL);
2009
2010         kfree(ev);
2011
2012         return err;
2013 }
2014
2015 int mgmt_connected(u16 index, bdaddr_t *bdaddr)
2016 {
2017         struct mgmt_ev_connected ev;
2018
2019         bacpy(&ev.bdaddr, bdaddr);
2020
2021         return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
2022 }
2023
2024 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2025 {
2026         struct mgmt_cp_disconnect *cp = cmd->param;
2027         struct sock **sk = data;
2028         struct mgmt_rp_disconnect rp;
2029
2030         bacpy(&rp.bdaddr, &cp->bdaddr);
2031
2032         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
2033
2034         *sk = cmd->sk;
2035         sock_hold(*sk);
2036
2037         mgmt_pending_remove(cmd);
2038 }
2039
2040 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr)
2041 {
2042         struct mgmt_ev_disconnected ev;
2043         struct sock *sk = NULL;
2044         int err;
2045
2046         mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
2047
2048         bacpy(&ev.bdaddr, bdaddr);
2049
2050         err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
2051
2052         if (sk)
2053                 sock_put(sk);
2054
2055         return err;
2056 }
2057
2058 int mgmt_disconnect_failed(u16 index)
2059 {
2060         struct pending_cmd *cmd;
2061         int err;
2062
2063         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
2064         if (!cmd)
2065                 return -ENOENT;
2066
2067         err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
2068
2069         mgmt_pending_remove(cmd);
2070
2071         return err;
2072 }
2073
2074 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2075 {
2076         struct mgmt_ev_connect_failed ev;
2077
2078         bacpy(&ev.bdaddr, bdaddr);
2079         ev.status = status;
2080
2081         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
2082 }
2083
2084 int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
2085 {
2086         struct mgmt_ev_pin_code_request ev;
2087
2088         bacpy(&ev.bdaddr, bdaddr);
2089         ev.secure = secure;
2090
2091         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
2092                                                                         NULL);
2093 }
2094
2095 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2096 {
2097         struct pending_cmd *cmd;
2098         struct mgmt_rp_pin_code_reply rp;
2099         int err;
2100
2101         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
2102         if (!cmd)
2103                 return -ENOENT;
2104
2105         bacpy(&rp.bdaddr, bdaddr);
2106         rp.status = status;
2107
2108         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
2109                                                                 sizeof(rp));
2110
2111         mgmt_pending_remove(cmd);
2112
2113         return err;
2114 }
2115
2116 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2117 {
2118         struct pending_cmd *cmd;
2119         struct mgmt_rp_pin_code_reply rp;
2120         int err;
2121
2122         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
2123         if (!cmd)
2124                 return -ENOENT;
2125
2126         bacpy(&rp.bdaddr, bdaddr);
2127         rp.status = status;
2128
2129         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
2130                                                                 sizeof(rp));
2131
2132         mgmt_pending_remove(cmd);
2133
2134         return err;
2135 }
2136
2137 int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
2138                                                         u8 confirm_hint)
2139 {
2140         struct mgmt_ev_user_confirm_request ev;
2141
2142         BT_DBG("hci%u", index);
2143
2144         bacpy(&ev.bdaddr, bdaddr);
2145         ev.confirm_hint = confirm_hint;
2146         put_unaligned_le32(value, &ev.value);
2147
2148         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
2149                                                                         NULL);
2150 }
2151
2152 static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
2153                                                                 u8 opcode)
2154 {
2155         struct pending_cmd *cmd;
2156         struct mgmt_rp_user_confirm_reply rp;
2157         int err;
2158
2159         cmd = mgmt_pending_find(opcode, index);
2160         if (!cmd)
2161                 return -ENOENT;
2162
2163         bacpy(&rp.bdaddr, bdaddr);
2164         rp.status = status;
2165         err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
2166
2167         mgmt_pending_remove(cmd);
2168
2169         return err;
2170 }
2171
2172 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2173 {
2174         return confirm_reply_complete(index, bdaddr, status,
2175                                                 MGMT_OP_USER_CONFIRM_REPLY);
2176 }
2177
2178 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
2179 {
2180         return confirm_reply_complete(index, bdaddr, status,
2181                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
2182 }
2183
2184 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
2185 {
2186         struct mgmt_ev_auth_failed ev;
2187
2188         bacpy(&ev.bdaddr, bdaddr);
2189         ev.status = status;
2190
2191         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
2192 }
2193
2194 int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
2195 {
2196         struct pending_cmd *cmd;
2197         struct hci_dev *hdev;
2198         struct mgmt_cp_set_local_name ev;
2199         int err;
2200
2201         memset(&ev, 0, sizeof(ev));
2202         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2203
2204         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
2205         if (!cmd)
2206                 goto send_event;
2207
2208         if (status) {
2209                 err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
2210                 goto failed;
2211         }
2212
2213         hdev = hci_dev_get(index);
2214         if (hdev) {
2215                 hci_dev_lock_bh(hdev);
2216                 update_eir(hdev);
2217                 hci_dev_unlock_bh(hdev);
2218                 hci_dev_put(hdev);
2219         }
2220
2221         err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
2222                                                                 sizeof(ev));
2223         if (err < 0)
2224                 goto failed;
2225
2226 send_event:
2227         err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
2228                                                         cmd ? cmd->sk : NULL);
2229
2230 failed:
2231         if (cmd)
2232                 mgmt_pending_remove(cmd);
2233         return err;
2234 }
2235
2236 int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
2237                                                                 u8 status)
2238 {
2239         struct pending_cmd *cmd;
2240         int err;
2241
2242         BT_DBG("hci%u status %u", index, status);
2243
2244         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
2245         if (!cmd)
2246                 return -ENOENT;
2247
2248         if (status) {
2249                 err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2250                                                                         EIO);
2251         } else {
2252                 struct mgmt_rp_read_local_oob_data rp;
2253
2254                 memcpy(rp.hash, hash, sizeof(rp.hash));
2255                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
2256
2257                 err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
2258                                                         &rp, sizeof(rp));
2259         }
2260
2261         mgmt_pending_remove(cmd);
2262
2263         return err;
2264 }
2265
2266 int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
2267                                                                 u8 *eir)
2268 {
2269         struct mgmt_ev_device_found ev;
2270
2271         memset(&ev, 0, sizeof(ev));
2272
2273         bacpy(&ev.bdaddr, bdaddr);
2274         memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
2275         ev.rssi = rssi;
2276
2277         if (eir)
2278                 memcpy(ev.eir, eir, sizeof(ev.eir));
2279
2280         return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
2281 }
2282
2283 int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
2284 {
2285         struct mgmt_ev_remote_name ev;
2286
2287         memset(&ev, 0, sizeof(ev));
2288
2289         bacpy(&ev.bdaddr, bdaddr);
2290         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
2291
2292         return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
2293 }
2294
2295 int mgmt_discovering(u16 index, u8 discovering)
2296 {
2297         return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
2298                                                 sizeof(discovering), NULL);
2299 }