net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2010  Nokia Corporation
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 /* Bluetooth HCI Management interface */
  24
  25 #include <linux/uaccess.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/mgmt.h>
  31
  32 #define MGMT_VERSION    0
  33 #define MGMT_REVISION   1
  34
  35 struct pending_cmd {
  36         struct list_head list;
  37         __u16 opcode;
  38         int index;
  39         void *cmd;
  40         struct sock *sk;
  41         void *user_data;
  42 };
  43
  44 LIST_HEAD(cmd_list);
  45
  46 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
  47 {
  48         struct sk_buff *skb;
  49         struct mgmt_hdr *hdr;
  50         struct mgmt_ev_cmd_status *ev;
  51
  52         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
  53
  54         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
  55         if (!skb)
  56                 return -ENOMEM;
  57
  58         hdr = (void *) skb_put(skb, sizeof(*hdr));
  59
  60         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
  61         hdr->index = cpu_to_le16(index);
  62         hdr->len = cpu_to_le16(sizeof(*ev));
  63
  64         ev = (void *) skb_put(skb, sizeof(*ev));
  65         ev->status = status;
  66         put_unaligned_le16(cmd, &ev->opcode);
  67
  68         if (sock_queue_rcv_skb(sk, skb) < 0)
  69                 kfree_skb(skb);
  70
  71         return 0;
  72 }
  73
  74 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
  75                                                                 size_t rp_len)
  76 {
  77         struct sk_buff *skb;
  78         struct mgmt_hdr *hdr;
  79         struct mgmt_ev_cmd_complete *ev;
  80
  81         BT_DBG("sock %p", sk);
  82
  83         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
  84         if (!skb)
  85                 return -ENOMEM;
  86
  87         hdr = (void *) skb_put(skb, sizeof(*hdr));
  88
  89         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
  90         hdr->index = cpu_to_le16(index);
  91         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
  92
  93         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
  94         put_unaligned_le16(cmd, &ev->opcode);
  95
  96         if (rp)
  97                 memcpy(ev->data, rp, rp_len);
  98
  99         if (sock_queue_rcv_skb(sk, skb) < 0)
 100                 kfree_skb(skb);
 101
 102         return 0;
 103 }
 104
 105 static int read_version(struct sock *sk)
 106 {
 107         struct mgmt_rp_read_version rp;
 108
 109         BT_DBG("sock %p", sk);
 110
 111         rp.version = MGMT_VERSION;
 112         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 113
 114         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
 115                                                                 sizeof(rp));
 116 }
 117
 118 static int read_index_list(struct sock *sk)
 119 {
 120         struct mgmt_rp_read_index_list *rp;
 121         struct list_head *p;
 122         size_t rp_len;
 123         u16 count;
 124         int i, err;
 125
 126         BT_DBG("sock %p", sk);
 127
 128         read_lock(&hci_dev_list_lock);
 129
 130         count = 0;
 131         list_for_each(p, &hci_dev_list) {
 132                 count++;
 133         }
 134
 135         rp_len = sizeof(*rp) + (2 * count);
 136         rp = kmalloc(rp_len, GFP_ATOMIC);
 137         if (!rp) {
 138                 read_unlock(&hci_dev_list_lock);
 139                 return -ENOMEM;
 140         }
 141
 142         put_unaligned_le16(count, &rp->num_controllers);
 143
 144         i = 0;
 145         list_for_each(p, &hci_dev_list) {
 146                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 147
 148                 hci_del_off_timer(d);
 149
 150                 set_bit(HCI_MGMT, &d->flags);
 151
 152                 if (test_bit(HCI_SETUP, &d->flags))
 153                         continue;
 154
 155                 put_unaligned_le16(d->id, &rp->index[i++]);
 156                 BT_DBG("Added hci%u", d->id);
 157         }
 158
 159         read_unlock(&hci_dev_list_lock);
 160
 161         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
 162                                                                         rp_len);
 163
 164         kfree(rp);
 165
 166         return err;
 167 }
 168
 169 static int read_controller_info(struct sock *sk, u16 index)
 170 {
 171         struct mgmt_rp_read_info rp;
 172         struct hci_dev *hdev;
 173
 174         BT_DBG("sock %p hci%u", sk, index);
 175
 176         hdev = hci_dev_get(index);
 177         if (!hdev)
 178                 return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
 179
 180         hci_del_off_timer(hdev);
 181
 182         hci_dev_lock_bh(hdev);
 183
 184         set_bit(HCI_MGMT, &hdev->flags);
 185
 186         rp.type = hdev->dev_type;
 187
 188         rp.powered = test_bit(HCI_UP, &hdev->flags);
 189         rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
 190         rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
 191         rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
 192
 193         if (test_bit(HCI_AUTH, &hdev->flags))
 194                 rp.sec_mode = 3;
 195         else if (hdev->ssp_mode > 0)
 196                 rp.sec_mode = 4;
 197         else
 198                 rp.sec_mode = 2;
 199
 200         bacpy(&rp.bdaddr, &hdev->bdaddr);
 201         memcpy(rp.features, hdev->features, 8);
 202         memcpy(rp.dev_class, hdev->dev_class, 3);
 203         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 204         rp.hci_ver = hdev->hci_ver;
 205         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 206
 207         hci_dev_unlock_bh(hdev);
 208         hci_dev_put(hdev);
 209
 210         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
 211 }
 212
 213 static void mgmt_pending_free(struct pending_cmd *cmd)
 214 {
 215         sock_put(cmd->sk);
 216         kfree(cmd->cmd);
 217         kfree(cmd);
 218 }
 219
 220 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 221                                                 u16 index, void *data, u16 len)
 222 {
 223         struct pending_cmd *cmd;
 224
 225         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 226         if (!cmd)
 227                 return NULL;
 228
 229         cmd->opcode = opcode;
 230         cmd->index = index;
 231
 232         cmd->cmd = kmalloc(len, GFP_ATOMIC);
 233         if (!cmd->cmd) {
 234                 kfree(cmd);
 235                 return NULL;
 236         }
 237
 238         memcpy(cmd->cmd, data, len);
 239
 240         cmd->sk = sk;
 241         sock_hold(sk);
 242
 243         list_add(&cmd->list, &cmd_list);
 244
 245         return cmd;
 246 }
 247
 248 static void mgmt_pending_foreach(u16 opcode, int index,
 249                                 void (*cb)(struct pending_cmd *cmd, void *data),
 250                                 void *data)
 251 {
 252         struct list_head *p, *n;
 253
 254         list_for_each_safe(p, n, &cmd_list) {
 255                 struct pending_cmd *cmd;
 256
 257                 cmd = list_entry(p, struct pending_cmd, list);
 258
 259                 if (cmd->opcode != opcode)
 260                         continue;
 261
 262                 if (index >= 0 && cmd->index != index)
 263                         continue;
 264
 265                 cb(cmd, data);
 266         }
 267 }
 268
 269 static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
 270 {
 271         struct list_head *p;
 272
 273         list_for_each(p, &cmd_list) {
 274                 struct pending_cmd *cmd;
 275
 276                 cmd = list_entry(p, struct pending_cmd, list);
 277
 278                 if (cmd->opcode != opcode)
 279                         continue;
 280
 281                 if (index >= 0 && cmd->index != index)
 282                         continue;
 283
 284                 return cmd;
 285         }
 286
 287         return NULL;
 288 }
 289
 290 static void mgmt_pending_remove(struct pending_cmd *cmd)
 291 {
 292         list_del(&cmd->list);
 293         mgmt_pending_free(cmd);
 294 }
 295
 296 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
 297 {
 298         struct mgmt_mode *cp;
 299         struct hci_dev *hdev;
 300         struct pending_cmd *cmd;
 301         int err, up;
 302
 303         cp = (void *) data;
 304
 305         BT_DBG("request for hci%u", index);
 306
 307         if (len != sizeof(*cp))
 308                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
 309
 310         hdev = hci_dev_get(index);
 311         if (!hdev)
 312                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 313
 314         hci_dev_lock_bh(hdev);
 315
 316         up = test_bit(HCI_UP, &hdev->flags);
 317         if ((cp->val && up) || (!cp->val && !up)) {
 318                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
 319                 goto failed;
 320         }
 321
 322         if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
 323                 err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
 324                 goto failed;
 325         }
 326
 327         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
 328         if (!cmd) {
 329                 err = -ENOMEM;
 330                 goto failed;
 331         }
 332
 333         if (cp->val)
 334                 queue_work(hdev->workqueue, &hdev->power_on);
 335         else
 336                 queue_work(hdev->workqueue, &hdev->power_off);
 337
 338         err = 0;
 339
 340 failed:
 341         hci_dev_unlock_bh(hdev);
 342         hci_dev_put(hdev);
 343         return err;
 344 }
 345
 346 static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 347                                                                         u16 len)
 348 {
 349         struct mgmt_mode *cp;
 350         struct hci_dev *hdev;
 351         struct pending_cmd *cmd;
 352         u8 scan;
 353         int err;
 354
 355         cp = (void *) data;
 356
 357         BT_DBG("request for hci%u", index);
 358
 359         if (len != sizeof(*cp))
 360                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
 361
 362         hdev = hci_dev_get(index);
 363         if (!hdev)
 364                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 365
 366         hci_dev_lock_bh(hdev);
 367
 368         if (!test_bit(HCI_UP, &hdev->flags)) {
 369                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
 370                 goto failed;
 371         }
 372
 373         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 374                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 375                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
 376                 goto failed;
 377         }
 378
 379         if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
 380                                         test_bit(HCI_PSCAN, &hdev->flags)) {
 381                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
 382                 goto failed;
 383         }
 384
 385         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
 386         if (!cmd) {
 387                 err = -ENOMEM;
 388                 goto failed;
 389         }
 390
 391         scan = SCAN_PAGE;
 392
 393         if (cp->val)
 394                 scan |= SCAN_INQUIRY;
 395
 396         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 397         if (err < 0)
 398                 mgmt_pending_remove(cmd);
 399
 400 failed:
 401         hci_dev_unlock_bh(hdev);
 402         hci_dev_put(hdev);
 403
 404         return err;
 405 }
 406
 407 static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
 408                                                                         u16 len)
 409 {
 410         struct mgmt_mode *cp;
 411         struct hci_dev *hdev;
 412         struct pending_cmd *cmd;
 413         u8 scan;
 414         int err;
 415
 416         cp = (void *) data;
 417
 418         BT_DBG("request for hci%u", index);
 419
 420         if (len != sizeof(*cp))
 421                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
 422
 423         hdev = hci_dev_get(index);
 424         if (!hdev)
 425                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 426
 427         hci_dev_lock_bh(hdev);
 428
 429         if (!test_bit(HCI_UP, &hdev->flags)) {
 430                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
 431                 goto failed;
 432         }
 433
 434         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
 435                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
 436                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
 437                 goto failed;
 438         }
 439
 440         if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 441                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
 442                 goto failed;
 443         }
 444
 445         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
 446         if (!cmd) {
 447                 err = -ENOMEM;
 448                 goto failed;
 449         }
 450
 451         if (cp->val)
 452                 scan = SCAN_PAGE;
 453         else
 454                 scan = 0;
 455
 456         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 457         if (err < 0)
 458                 mgmt_pending_remove(cmd);
 459
 460 failed:
 461         hci_dev_unlock_bh(hdev);
 462         hci_dev_put(hdev);
 463
 464         return err;
 465 }
 466
 467 static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
 468                                                         struct sock *skip_sk)
 469 {
 470         struct sk_buff *skb;
 471         struct mgmt_hdr *hdr;
 472
 473         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 474         if (!skb)
 475                 return -ENOMEM;
 476
 477         bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 478
 479         hdr = (void *) skb_put(skb, sizeof(*hdr));
 480         hdr->opcode = cpu_to_le16(event);
 481         hdr->index = cpu_to_le16(index);
 482         hdr->len = cpu_to_le16(data_len);
 483
 484         if (data)
 485                 memcpy(skb_put(skb, data_len), data, data_len);
 486
 487         hci_send_to_sock(NULL, skb, skip_sk);
 488         kfree_skb(skb);
 489
 490         return 0;
 491 }
 492
 493 static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
 494 {
 495         struct mgmt_mode rp;
 496
 497         rp.val = val;
 498
 499         return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
 500 }
 501
 502 static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
 503                                                                         u16 len)
 504 {
 505         struct mgmt_mode *cp, ev;
 506         struct hci_dev *hdev;
 507         int err;
 508
 509         cp = (void *) data;
 510
 511         BT_DBG("request for hci%u", index);
 512
 513         if (len != sizeof(*cp))
 514                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
 515
 516         hdev = hci_dev_get(index);
 517         if (!hdev)
 518                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 519
 520         hci_dev_lock_bh(hdev);
 521
 522         if (cp->val)
 523                 set_bit(HCI_PAIRABLE, &hdev->flags);
 524         else
 525                 clear_bit(HCI_PAIRABLE, &hdev->flags);
 526
 527         err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
 528         if (err < 0)
 529                 goto failed;
 530
 531         ev.val = cp->val;
 532
 533         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 534
 535 failed:
 536         hci_dev_unlock_bh(hdev);
 537         hci_dev_put(hdev);
 538
 539         return err;
 540 }
 541
 542 static u8 get_service_classes(struct hci_dev *hdev)
 543 {
 544         struct list_head *p;
 545         u8 val = 0;
 546
 547         list_for_each(p, &hdev->uuids) {
 548                 struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
 549
 550                 val |= uuid->svc_hint;
 551         }
 552
 553         return val;
 554 }
 555
 556 static int update_class(struct hci_dev *hdev)
 557 {
 558         u8 cod[3];
 559
 560         BT_DBG("%s", hdev->name);
 561
 562         if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
 563                 return 0;
 564
 565         cod[0] = hdev->minor_class;
 566         cod[1] = hdev->major_class;
 567         cod[2] = get_service_classes(hdev);
 568
 569         if (memcmp(cod, hdev->dev_class, 3) == 0)
 570                 return 0;
 571
 572         return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 573 }
 574
 575 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 576 {
 577         struct mgmt_cp_add_uuid *cp;
 578         struct hci_dev *hdev;
 579         struct bt_uuid *uuid;
 580         int err;
 581
 582         cp = (void *) data;
 583
 584         BT_DBG("request for hci%u", index);
 585
 586         if (len != sizeof(*cp))
 587                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
 588
 589         hdev = hci_dev_get(index);
 590         if (!hdev)
 591                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 592
 593         hci_dev_lock_bh(hdev);
 594
 595         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
 596         if (!uuid) {
 597                 err = -ENOMEM;
 598                 goto failed;
 599         }
 600
 601         memcpy(uuid->uuid, cp->uuid, 16);
 602         uuid->svc_hint = cp->svc_hint;
 603
 604         list_add(&uuid->list, &hdev->uuids);
 605
 606         err = update_class(hdev);
 607         if (err < 0)
 608                 goto failed;
 609
 610         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 611
 612 failed:
 613         hci_dev_unlock_bh(hdev);
 614         hci_dev_put(hdev);
 615
 616         return err;
 617 }
 618
 619 static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
 620 {
 621         struct list_head *p, *n;
 622         struct mgmt_cp_remove_uuid *cp;
 623         struct hci_dev *hdev;
 624         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 625         int err, found;
 626
 627         cp = (void *) data;
 628
 629         BT_DBG("request for hci%u", index);
 630
 631         if (len != sizeof(*cp))
 632                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
 633
 634         hdev = hci_dev_get(index);
 635         if (!hdev)
 636                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 637
 638         hci_dev_lock_bh(hdev);
 639
 640         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
 641                 err = hci_uuids_clear(hdev);
 642                 goto unlock;
 643         }
 644
 645         found = 0;
 646
 647         list_for_each_safe(p, n, &hdev->uuids) {
 648                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
 649
 650                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
 651                         continue;
 652
 653                 list_del(&match->list);
 654                 found++;
 655         }
 656
 657         if (found == 0) {
 658                 err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
 659                 goto unlock;
 660         }
 661
 662         err = update_class(hdev);
 663         if (err < 0)
 664                 goto unlock;
 665
 666         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 667
 668 unlock:
 669         hci_dev_unlock_bh(hdev);
 670         hci_dev_put(hdev);
 671
 672         return err;
 673 }
 674
 675 static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
 676                                                                         u16 len)
 677 {
 678         struct hci_dev *hdev;
 679         struct mgmt_cp_set_dev_class *cp;
 680         int err;
 681
 682         cp = (void *) data;
 683
 684         BT_DBG("request for hci%u", index);
 685
 686         if (len != sizeof(*cp))
 687                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
 688
 689         hdev = hci_dev_get(index);
 690         if (!hdev)
 691                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 692
 693         hci_dev_lock_bh(hdev);
 694
 695         hdev->major_class = cp->major;
 696         hdev->minor_class = cp->minor;
 697
 698         err = update_class(hdev);
 699
 700         if (err == 0)
 701                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 702
 703         hci_dev_unlock_bh(hdev);
 704         hci_dev_put(hdev);
 705
 706         return err;
 707 }
 708
 709 static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
 710                                                                         u16 len)
 711 {
 712         struct hci_dev *hdev;
 713         struct mgmt_cp_set_service_cache *cp;
 714         int err;
 715
 716         cp = (void *) data;
 717
 718         if (len != sizeof(*cp))
 719                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
 720                                                                         EINVAL);
 721
 722         hdev = hci_dev_get(index);
 723         if (!hdev)
 724                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 725
 726         hci_dev_lock_bh(hdev);
 727
 728         BT_DBG("hci%u enable %d", index, cp->enable);
 729
 730         if (cp->enable) {
 731                 set_bit(HCI_SERVICE_CACHE, &hdev->flags);
 732                 err = 0;
 733         } else {
 734                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
 735                 err = update_class(hdev);
 736         }
 737
 738         if (err == 0)
 739                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
 740                                                                         0);
 741
 742         hci_dev_unlock_bh(hdev);
 743         hci_dev_put(hdev);
 744
 745         return err;
 746 }
 747
 748 static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
 749 {
 750         struct hci_dev *hdev;
 751         struct mgmt_cp_load_keys *cp;
 752         u16 key_count, expected_len;
 753         int i;
 754
 755         cp = (void *) data;
 756
 757         if (len < sizeof(*cp))
 758                 return -EINVAL;
 759
 760         key_count = get_unaligned_le16(&cp->key_count);
 761
 762         expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
 763         if (expected_len != len) {
 764                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
 765                                                         len, expected_len);
 766                 return -EINVAL;
 767         }
 768
 769         hdev = hci_dev_get(index);
 770         if (!hdev)
 771                 return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
 772
 773         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
 774                                                                 key_count);
 775
 776         hci_dev_lock_bh(hdev);
 777
 778         hci_link_keys_clear(hdev);
 779
 780         set_bit(HCI_LINK_KEYS, &hdev->flags);
 781
 782         if (cp->debug_keys)
 783                 set_bit(HCI_DEBUG_KEYS, &hdev->flags);
 784         else
 785                 clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
 786
 787         for (i = 0; i < key_count; i++) {
 788                 struct mgmt_key_info *key = &cp->keys[i];
 789
 790                 hci_add_link_key(hdev, 0, &key->bdaddr, key->val, key->type,
 791                                                                 key->pin_len);
 792         }
 793
 794         hci_dev_unlock_bh(hdev);
 795         hci_dev_put(hdev);
 796
 797         return 0;
 798 }
 799
 800 static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
 801 {
 802         struct hci_dev *hdev;
 803         struct mgmt_cp_remove_key *cp;
 804         struct hci_conn *conn;
 805         int err;
 806
 807         cp = (void *) data;
 808
 809         if (len != sizeof(*cp))
 810                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
 811
 812         hdev = hci_dev_get(index);
 813         if (!hdev)
 814                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 815
 816         hci_dev_lock_bh(hdev);
 817
 818         err = hci_remove_link_key(hdev, &cp->bdaddr);
 819         if (err < 0) {
 820                 err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
 821                 goto unlock;
 822         }
 823
 824         err = 0;
 825
 826         if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
 827                 goto unlock;
 828
 829         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 830         if (conn) {
 831                 struct hci_cp_disconnect dc;
 832
 833                 put_unaligned_le16(conn->handle, &dc.handle);
 834                 dc.reason = 0x13; /* Remote User Terminated Connection */
 835                 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, 0, NULL);
 836         }
 837
 838 unlock:
 839         hci_dev_unlock_bh(hdev);
 840         hci_dev_put(hdev);
 841
 842         return err;
 843 }
 844
 845 static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
 846 {
 847         struct hci_dev *hdev;
 848         struct mgmt_cp_disconnect *cp;
 849         struct hci_cp_disconnect dc;
 850         struct pending_cmd *cmd;
 851         struct hci_conn *conn;
 852         int err;
 853
 854         BT_DBG("");
 855
 856         cp = (void *) data;
 857
 858         if (len != sizeof(*cp))
 859                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
 860
 861         hdev = hci_dev_get(index);
 862         if (!hdev)
 863                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
 864
 865         hci_dev_lock_bh(hdev);
 866
 867         if (!test_bit(HCI_UP, &hdev->flags)) {
 868                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
 869                 goto failed;
 870         }
 871
 872         if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
 873                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
 874                 goto failed;
 875         }
 876
 877         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 878         if (!conn) {
 879                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
 880                 goto failed;
 881         }
 882
 883         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
 884         if (!cmd) {
 885                 err = -ENOMEM;
 886                 goto failed;
 887         }
 888
 889         put_unaligned_le16(conn->handle, &dc.handle);
 890         dc.reason = 0x13; /* Remote User Terminated Connection */
 891
 892         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
 893         if (err < 0)
 894                 mgmt_pending_remove(cmd);
 895
 896 failed:
 897         hci_dev_unlock_bh(hdev);
 898         hci_dev_put(hdev);
 899
 900         return err;
 901 }
 902
 903 static int get_connections(struct sock *sk, u16 index, unsigned char *data,
 904                                                                         u16 len)
 905 {
 906         struct mgmt_cp_get_connections *cp;
 907         struct mgmt_rp_get_connections *rp;
 908         struct hci_dev *hdev;
 909         struct list_head *p;
 910         size_t rp_len;
 911         u16 count;
 912         int i, err;
 913
 914         BT_DBG("");
 915
 916         cp = (void *) data;
 917
 918         hdev = hci_dev_get(index);
 919         if (!hdev)
 920                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
 921
 922         hci_dev_lock_bh(hdev);
 923
 924         count = 0;
 925         list_for_each(p, &hdev->conn_hash.list) {
 926                 count++;
 927         }
 928
 929         rp_len = sizeof(*rp) + (count * sizeof(bdaddr_t));
 930         rp = kmalloc(rp_len, GFP_ATOMIC);
 931         if (!rp) {
 932                 err = -ENOMEM;
 933                 goto unlock;
 934         }
 935
 936         put_unaligned_le16(count, &rp->conn_count);
 937
 938         read_lock(&hci_dev_list_lock);
 939
 940         i = 0;
 941         list_for_each(p, &hdev->conn_hash.list) {
 942                 struct hci_conn *c = list_entry(p, struct hci_conn, list);
 943
 944                 bacpy(&rp->conn[i++], &c->dst);
 945         }
 946
 947         read_unlock(&hci_dev_list_lock);
 948
 949         err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
 950
 951 unlock:
 952         kfree(rp);
 953         hci_dev_unlock_bh(hdev);
 954         hci_dev_put(hdev);
 955         return err;
 956 }
 957
 958 static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
 959                                                                         u16 len)
 960 {
 961         struct hci_dev *hdev;
 962         struct mgmt_cp_pin_code_reply *cp;
 963         struct hci_cp_pin_code_reply reply;
 964         struct pending_cmd *cmd;
 965         int err;
 966
 967         BT_DBG("");
 968
 969         cp = (void *) data;
 970
 971         if (len != sizeof(*cp))
 972                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
 973
 974         hdev = hci_dev_get(index);
 975         if (!hdev)
 976                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
 977
 978         hci_dev_lock_bh(hdev);
 979
 980         if (!test_bit(HCI_UP, &hdev->flags)) {
 981                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
 982                 goto failed;
 983         }
 984
 985         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
 986         if (!cmd) {
 987                 err = -ENOMEM;
 988                 goto failed;
 989         }
 990
 991         bacpy(&reply.bdaddr, &cp->bdaddr);
 992         reply.pin_len = cp->pin_len;
 993         memcpy(reply.pin_code, cp->pin_code, 16);
 994
 995         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
 996         if (err < 0)
 997                 mgmt_pending_remove(cmd);
 998
 999 failed:
1000         hci_dev_unlock_bh(hdev);
1001         hci_dev_put(hdev);
1002
1003         return err;
1004 }
1005
1006 static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
1007                                                                         u16 len)
1008 {
1009         struct hci_dev *hdev;
1010         struct mgmt_cp_pin_code_neg_reply *cp;
1011         struct pending_cmd *cmd;
1012         int err;
1013
1014         BT_DBG("");
1015
1016         cp = (void *) data;
1017
1018         if (len != sizeof(*cp))
1019                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1020                                                                         EINVAL);
1021
1022         hdev = hci_dev_get(index);
1023         if (!hdev)
1024                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1025                                                                         ENODEV);
1026
1027         hci_dev_lock_bh(hdev);
1028
1029         if (!test_bit(HCI_UP, &hdev->flags)) {
1030                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
1031                                                                 ENETDOWN);
1032                 goto failed;
1033         }
1034
1035         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index,
1036                                                                 data, len);
1037         if (!cmd) {
1038                 err = -ENOMEM;
1039                 goto failed;
1040         }
1041
1042         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(bdaddr_t),
1043                                                                 &cp->bdaddr);
1044         if (err < 0)
1045                 mgmt_pending_remove(cmd);
1046
1047 failed:
1048         hci_dev_unlock_bh(hdev);
1049         hci_dev_put(hdev);
1050
1051         return err;
1052 }
1053
1054 static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
1055                                                                         u16 len)
1056 {
1057         struct hci_dev *hdev;
1058         struct mgmt_cp_set_io_capability *cp;
1059
1060         BT_DBG("");
1061
1062         cp = (void *) data;
1063
1064         if (len != sizeof(*cp))
1065                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
1066                                                                         EINVAL);
1067
1068         hdev = hci_dev_get(index);
1069         if (!hdev)
1070                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
1071
1072         hci_dev_lock_bh(hdev);
1073
1074         hdev->io_capability = cp->io_capability;
1075
1076         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1077                                                 hdev->io_capability);
1078
1079         hci_dev_unlock_bh(hdev);
1080         hci_dev_put(hdev);
1081
1082         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
1083 }
1084
1085 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1086 {
1087         struct hci_dev *hdev = conn->hdev;
1088         struct list_head *p;
1089
1090         list_for_each(p, &cmd_list) {
1091                 struct pending_cmd *cmd;
1092
1093                 cmd = list_entry(p, struct pending_cmd, list);
1094
1095                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1096                         continue;
1097
1098                 if (cmd->index != hdev->id)
1099                         continue;
1100
1101                 if (cmd->user_data != conn)
1102                         continue;
1103
1104                 return cmd;
1105         }
1106
1107         return NULL;
1108 }
1109
1110 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1111 {
1112         struct mgmt_rp_pair_device rp;
1113         struct hci_conn *conn = cmd->user_data;
1114
1115         bacpy(&rp.bdaddr, &conn->dst);
1116         rp.status = status;
1117
1118         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
1119
1120         /* So we don't get further callbacks for this connection */
1121         conn->connect_cfm_cb = NULL;
1122         conn->security_cfm_cb = NULL;
1123         conn->disconn_cfm_cb = NULL;
1124
1125         hci_conn_put(conn);
1126
1127         mgmt_pending_remove(cmd);
1128 }
1129
1130 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1131 {
1132         struct pending_cmd *cmd;
1133
1134         BT_DBG("status %u", status);
1135
1136         cmd = find_pairing(conn);
1137         if (!cmd) {
1138                 BT_DBG("Unable to find a pending command");
1139                 return;
1140         }
1141
1142         pairing_complete(cmd, status);
1143 }
1144
1145 static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
1146 {
1147         struct hci_dev *hdev;
1148         struct mgmt_cp_pair_device *cp;
1149         struct pending_cmd *cmd;
1150         u8 sec_level, auth_type;
1151         struct hci_conn *conn;
1152         int err;
1153
1154         BT_DBG("");
1155
1156         cp = (void *) data;
1157
1158         if (len != sizeof(*cp))
1159                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
1160
1161         hdev = hci_dev_get(index);
1162         if (!hdev)
1163                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
1164
1165         hci_dev_lock_bh(hdev);
1166
1167         if (cp->io_cap == 0x03) {
1168                 sec_level = BT_SECURITY_MEDIUM;
1169                 auth_type = HCI_AT_DEDICATED_BONDING;
1170         } else {
1171                 sec_level = BT_SECURITY_HIGH;
1172                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1173         }
1174
1175         conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level, auth_type);
1176         if (IS_ERR(conn)) {
1177                 err = PTR_ERR(conn);
1178                 goto unlock;
1179         }
1180
1181         if (conn->connect_cfm_cb) {
1182                 hci_conn_put(conn);
1183                 err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
1184                 goto unlock;
1185         }
1186
1187         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
1188         if (!cmd) {
1189                 err = -ENOMEM;
1190                 hci_conn_put(conn);
1191                 goto unlock;
1192         }
1193
1194         conn->connect_cfm_cb = pairing_complete_cb;
1195         conn->security_cfm_cb = pairing_complete_cb;
1196         conn->disconn_cfm_cb = pairing_complete_cb;
1197         conn->io_capability = cp->io_cap;
1198         cmd->user_data = conn;
1199
1200         if (conn->state == BT_CONNECTED &&
1201                                 hci_conn_security(conn, sec_level, auth_type))
1202                 pairing_complete(cmd, 0);
1203
1204         err = 0;
1205
1206 unlock:
1207         hci_dev_unlock_bh(hdev);
1208         hci_dev_put(hdev);
1209
1210         return err;
1211 }
1212
1213 static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
1214                                                         u16 len, int success)
1215 {
1216         struct mgmt_cp_user_confirm_reply *cp = (void *) data;
1217         u16 mgmt_op, hci_op;
1218         struct pending_cmd *cmd;
1219         struct hci_dev *hdev;
1220         int err;
1221
1222         BT_DBG("");
1223
1224         if (success) {
1225                 mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
1226                 hci_op = HCI_OP_USER_CONFIRM_REPLY;
1227         } else {
1228                 mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
1229                 hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
1230         }
1231
1232         if (len != sizeof(*cp))
1233                 return cmd_status(sk, index, mgmt_op, EINVAL);
1234
1235         hdev = hci_dev_get(index);
1236         if (!hdev)
1237                 return cmd_status(sk, index, mgmt_op, ENODEV);
1238
1239         if (!test_bit(HCI_UP, &hdev->flags)) {
1240                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
1241                 goto failed;
1242         }
1243
1244         cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
1245         if (!cmd) {
1246                 err = -ENOMEM;
1247                 goto failed;
1248         }
1249
1250         err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
1251         if (err < 0)
1252                 mgmt_pending_remove(cmd);
1253
1254 failed:
1255         hci_dev_unlock_bh(hdev);
1256         hci_dev_put(hdev);
1257
1258         return err;
1259 }
1260
1261 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
1262 {
1263         unsigned char *buf;
1264         struct mgmt_hdr *hdr;
1265         u16 opcode, index, len;
1266         int err;
1267
1268         BT_DBG("got %zu bytes", msglen);
1269
1270         if (msglen < sizeof(*hdr))
1271                 return -EINVAL;
1272
1273         buf = kmalloc(msglen, GFP_ATOMIC);
1274         if (!buf)
1275                 return -ENOMEM;
1276
1277         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
1278                 err = -EFAULT;
1279                 goto done;
1280         }
1281
1282         hdr = (struct mgmt_hdr *) buf;
1283         opcode = get_unaligned_le16(&hdr->opcode);
1284         index = get_unaligned_le16(&hdr->index);
1285         len = get_unaligned_le16(&hdr->len);
1286
1287         if (len != msglen - sizeof(*hdr)) {
1288                 err = -EINVAL;
1289                 goto done;
1290         }
1291
1292         switch (opcode) {
1293         case MGMT_OP_READ_VERSION:
1294                 err = read_version(sk);
1295                 break;
1296         case MGMT_OP_READ_INDEX_LIST:
1297                 err = read_index_list(sk);
1298                 break;
1299         case MGMT_OP_READ_INFO:
1300                 err = read_controller_info(sk, index);
1301                 break;
1302         case MGMT_OP_SET_POWERED:
1303                 err = set_powered(sk, index, buf + sizeof(*hdr), len);
1304                 break;
1305         case MGMT_OP_SET_DISCOVERABLE:
1306                 err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
1307                 break;
1308         case MGMT_OP_SET_CONNECTABLE:
1309                 err = set_connectable(sk, index, buf + sizeof(*hdr), len);
1310                 break;
1311         case MGMT_OP_SET_PAIRABLE:
1312                 err = set_pairable(sk, index, buf + sizeof(*hdr), len);
1313                 break;
1314         case MGMT_OP_ADD_UUID:
1315                 err = add_uuid(sk, index, buf + sizeof(*hdr), len);
1316                 break;
1317         case MGMT_OP_REMOVE_UUID:
1318                 err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
1319                 break;
1320         case MGMT_OP_SET_DEV_CLASS:
1321                 err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
1322                 break;
1323         case MGMT_OP_SET_SERVICE_CACHE:
1324                 err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
1325                 break;
1326         case MGMT_OP_LOAD_KEYS:
1327                 err = load_keys(sk, index, buf + sizeof(*hdr), len);
1328                 break;
1329         case MGMT_OP_REMOVE_KEY:
1330                 err = remove_key(sk, index, buf + sizeof(*hdr), len);
1331                 break;
1332         case MGMT_OP_DISCONNECT:
1333                 err = disconnect(sk, index, buf + sizeof(*hdr), len);
1334                 break;
1335         case MGMT_OP_GET_CONNECTIONS:
1336                 err = get_connections(sk, index, buf + sizeof(*hdr), len);
1337                 break;
1338         case MGMT_OP_PIN_CODE_REPLY:
1339                 err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
1340                 break;
1341         case MGMT_OP_PIN_CODE_NEG_REPLY:
1342                 err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
1343                 break;
1344         case MGMT_OP_SET_IO_CAPABILITY:
1345                 err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
1346                 break;
1347         case MGMT_OP_PAIR_DEVICE:
1348                 err = pair_device(sk, index, buf + sizeof(*hdr), len);
1349                 break;
1350         case MGMT_OP_USER_CONFIRM_REPLY:
1351                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
1352                 break;
1353         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
1354                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
1355                 break;
1356         default:
1357                 BT_DBG("Unknown op %u", opcode);
1358                 err = cmd_status(sk, index, opcode, 0x01);
1359                 break;
1360         }
1361
1362         if (err < 0)
1363                 goto done;
1364
1365         err = msglen;
1366
1367 done:
1368         kfree(buf);
1369         return err;
1370 }
1371
1372 int mgmt_index_added(u16 index)
1373 {
1374         return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
1375 }
1376
1377 int mgmt_index_removed(u16 index)
1378 {
1379         return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
1380 }
1381
1382 struct cmd_lookup {
1383         u8 val;
1384         struct sock *sk;
1385 };
1386
1387 static void mode_rsp(struct pending_cmd *cmd, void *data)
1388 {
1389         struct mgmt_mode *cp = cmd->cmd;
1390         struct cmd_lookup *match = data;
1391
1392         if (cp->val != match->val)
1393                 return;
1394
1395         send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
1396
1397         list_del(&cmd->list);
1398
1399         if (match->sk == NULL) {
1400                 match->sk = cmd->sk;
1401                 sock_hold(match->sk);
1402         }
1403
1404         mgmt_pending_free(cmd);
1405 }
1406
1407 int mgmt_powered(u16 index, u8 powered)
1408 {
1409         struct mgmt_mode ev;
1410         struct cmd_lookup match = { powered, NULL };
1411         int ret;
1412
1413         mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
1414
1415         ev.val = powered;
1416
1417         ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
1418
1419         if (match.sk)
1420                 sock_put(match.sk);
1421
1422         return ret;
1423 }
1424
1425 int mgmt_discoverable(u16 index, u8 discoverable)
1426 {
1427         struct mgmt_mode ev;
1428         struct cmd_lookup match = { discoverable, NULL };
1429         int ret;
1430
1431         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index,
1432                                                         mode_rsp, &match);
1433
1434         ev.val = discoverable;
1435
1436         ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
1437                                                                 match.sk);
1438
1439         if (match.sk)
1440                 sock_put(match.sk);
1441
1442         return ret;
1443 }
1444
1445 int mgmt_connectable(u16 index, u8 connectable)
1446 {
1447         struct mgmt_mode ev;
1448         struct cmd_lookup match = { connectable, NULL };
1449         int ret;
1450
1451         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
1452
1453         ev.val = connectable;
1454
1455         ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
1456
1457         if (match.sk)
1458                 sock_put(match.sk);
1459
1460         return ret;
1461 }
1462
1463 int mgmt_new_key(u16 index, struct link_key *key, u8 old_key_type)
1464 {
1465         struct mgmt_ev_new_key ev;
1466
1467         memset(&ev, 0, sizeof(ev));
1468
1469         bacpy(&ev.key.bdaddr, &key->bdaddr);
1470         ev.key.type = key->type;
1471         memcpy(ev.key.val, key->val, 16);
1472         ev.key.pin_len = key->pin_len;
1473         ev.old_key_type = old_key_type;
1474
1475         return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
1476 }
1477
1478 int mgmt_connected(u16 index, bdaddr_t *bdaddr)
1479 {
1480         struct mgmt_ev_connected ev;
1481
1482         bacpy(&ev.bdaddr, bdaddr);
1483
1484         return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
1485 }
1486
1487 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
1488 {
1489         struct mgmt_cp_disconnect *cp = cmd->cmd;
1490         struct sock **sk = data;
1491         struct mgmt_rp_disconnect rp;
1492
1493         bacpy(&rp.bdaddr, &cp->bdaddr);
1494
1495         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
1496
1497         *sk = cmd->sk;
1498         sock_hold(*sk);
1499
1500         mgmt_pending_remove(cmd);
1501 }
1502
1503 int mgmt_disconnected(u16 index, bdaddr_t *bdaddr)
1504 {
1505         struct mgmt_ev_disconnected ev;
1506         struct sock *sk = NULL;
1507         int err;
1508
1509         mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
1510
1511         bacpy(&ev.bdaddr, bdaddr);
1512
1513         err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
1514
1515         if (sk)
1516                 sock_put(sk);
1517
1518         return err;
1519 }
1520
1521 int mgmt_disconnect_failed(u16 index)
1522 {
1523         struct pending_cmd *cmd;
1524         int err;
1525
1526         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
1527         if (!cmd)
1528                 return -ENOENT;
1529
1530         err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
1531
1532         mgmt_pending_remove(cmd);
1533
1534         return err;
1535 }
1536
1537 int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
1538 {
1539         struct mgmt_ev_connect_failed ev;
1540
1541         bacpy(&ev.bdaddr, bdaddr);
1542         ev.status = status;
1543
1544         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
1545 }
1546
1547 int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr)
1548 {
1549         struct mgmt_ev_pin_code_request ev;
1550
1551         bacpy(&ev.bdaddr, bdaddr);
1552
1553         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
1554                                                                         NULL);
1555 }
1556
1557 int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
1558 {
1559         struct pending_cmd *cmd;
1560         struct mgmt_rp_pin_code_reply rp;
1561         int err;
1562
1563         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
1564         if (!cmd)
1565                 return -ENOENT;
1566
1567         bacpy(&rp.bdaddr, bdaddr);
1568         rp.status = status;
1569
1570         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
1571                                                                 sizeof(rp));
1572
1573         mgmt_pending_remove(cmd);
1574
1575         return err;
1576 }
1577
1578 int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
1579 {
1580         struct pending_cmd *cmd;
1581         struct mgmt_rp_pin_code_reply rp;
1582         int err;
1583
1584         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
1585         if (!cmd)
1586                 return -ENOENT;
1587
1588         bacpy(&rp.bdaddr, bdaddr);
1589         rp.status = status;
1590
1591         err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
1592                                                                 sizeof(rp));
1593
1594         mgmt_pending_remove(cmd);
1595
1596         return err;
1597 }
1598
1599 int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value)
1600 {
1601         struct mgmt_ev_user_confirm_request ev;
1602
1603         BT_DBG("hci%u", index);
1604
1605         bacpy(&ev.bdaddr, bdaddr);
1606         put_unaligned_le32(value, &ev.value);
1607
1608         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
1609                                                                         NULL);
1610 }
1611
1612 static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
1613                                                                 u8 opcode)
1614 {
1615         struct pending_cmd *cmd;
1616         struct mgmt_rp_user_confirm_reply rp;
1617         int err;
1618
1619         cmd = mgmt_pending_find(opcode, index);
1620         if (!cmd)
1621                 return -ENOENT;
1622
1623         bacpy(&rp.bdaddr, bdaddr);
1624         rp.status = status;
1625         err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
1626
1627         mgmt_pending_remove(cmd);
1628
1629         return err;
1630 }
1631
1632 int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
1633 {
1634         return confirm_reply_complete(index, bdaddr, status,
1635                                                 MGMT_OP_USER_CONFIRM_REPLY);
1636 }
1637
1638 int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr,
1639                                                                 u8 status)
1640 {
1641         return confirm_reply_complete(index, bdaddr, status,
1642                                         MGMT_OP_USER_CONFIRM_NEG_REPLY);
1643 }
1644
1645 int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
1646 {
1647         struct mgmt_ev_auth_failed ev;
1648
1649         bacpy(&ev.bdaddr, bdaddr);
1650         ev.status = status;
1651
1652         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
1653 }