projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Revert "netfilter: ensure number of counters is >0 in do_replace()"
[deliverable/linux.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
0857dd3b 33#include "hci_request.h"
23b9ceb7 34#include "hci_debugfs.h"
7024728e 35#include "a2mp.h"
7ef9fbf0 36#include "amp.h"
2ceba539 37#include "smp.h"
1da177e4 38
aa5b0345
MH		 39#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
1da177e4
LT		 42/* Handle HCI Event packets */
43
a9de9248 44static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 45{
a9de9248 46 __u8 status = *((__u8 *) skb->data);
1da177e4 47
9f1db00c 48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 49
82f4785c 50 if (status)
a9de9248 51 return;
1da177e4 52
89352e7d 53 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 56
50143a43
JH		 57 hci_dev_lock(hdev);
58 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
59 hci_dev_unlock(hdev);
60
a9de9248
MH		 61 hci_conn_check_pending(hdev);
62}
6bd57416 63
4d93483b
AG		 64static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
65{
66 __u8 status = *((__u8 *) skb->data);
67
9f1db00c 68 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 69
70 if (status)
71 return;
72
a1536da2 73 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
4d93483b
AG		 74}
75
a9de9248
MH		 76static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
77{
78 __u8 status = *((__u8 *) skb->data);
6bd57416 79
9f1db00c 80 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 81
a9de9248
MH		 82 if (status)
83 return;
1da177e4 84
a358dc11 85 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
ae854a70 86
a9de9248
MH		 87 hci_conn_check_pending(hdev);
88}
89
807deac2
GP		 90static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
91 struct sk_buff *skb)
a9de9248
MH		 92{
93 BT_DBG("%s", hdev->name);
94}
95
96static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
97{
98 struct hci_rp_role_discovery *rp = (void *) skb->data;
99 struct hci_conn *conn;
100
9f1db00c 101 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 102
103 if (rp->status)
104 return;
105
106 hci_dev_lock(hdev);
107
108 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 109 if (conn)
110 conn->role = rp->role;
a9de9248
MH		 111
112 hci_dev_unlock(hdev);
1da177e4
LT		 113}
114
e4e8e37c
MH		 115static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
116{
117 struct hci_rp_read_link_policy *rp = (void *) skb->data;
118 struct hci_conn *conn;
119
9f1db00c 120 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 121
122 if (rp->status)
123 return;
124
125 hci_dev_lock(hdev);
126
127 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
128 if (conn)
129 conn->link_policy = __le16_to_cpu(rp->policy);
130
131 hci_dev_unlock(hdev);
132}
133
a9de9248 134static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 135{
a9de9248 136 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 137 struct hci_conn *conn;
04837f64 138 void *sent;
1da177e4 139
9f1db00c 140 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 141
a9de9248
MH		 142 if (rp->status)
143 return;
1da177e4 144
a9de9248
MH		 145 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
146 if (!sent)
147 return;
1da177e4 148
a9de9248 149 hci_dev_lock(hdev);
1da177e4 150
a9de9248 151 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 152 if (conn)
83985319 153 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 154
a9de9248
MH		 155 hci_dev_unlock(hdev);
156}
1da177e4 157
807deac2
GP		 158static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
159 struct sk_buff *skb)
e4e8e37c
MH		 160{
161 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
162
9f1db00c 163 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 164
165 if (rp->status)
166 return;
167
168 hdev->link_policy = __le16_to_cpu(rp->policy);
169}
170
807deac2
GP		 171static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
172 struct sk_buff *skb)
e4e8e37c
MH		 173{
174 __u8 status = *((__u8 *) skb->data);
175 void *sent;
176
9f1db00c 177 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 178
45296acd
MH		 179 if (status)
180 return;
181
e4e8e37c
MH		 182 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
183 if (!sent)
184 return;
185
45296acd 186 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 187}
188
a9de9248
MH		 189static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
190{
191 __u8 status = *((__u8 *) skb->data);
04837f64 192
9f1db00c 193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 194
10572132
GP		 195 clear_bit(HCI_RESET, &hdev->flags);
196
8761f9d6
MH		 197 if (status)
198 return;
199
a297e97c 200 /* Reset all non-persistent flags */
eacb44df 201 hci_dev_clear_volatile_flags(hdev);
69775ff6 202
39c5d970
JH		 203 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
204
bbaf444a
JH		 205 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
206 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 207
208 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
209 hdev->adv_data_len = 0;
f8e808bd
MH		 210
211 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
212 hdev->scan_rsp_data_len = 0;
06f5b778 213
533553f8
MH		 214 hdev->le_scan_type = LE_SCAN_PASSIVE;
215
06f5b778 216 hdev->ssp_debug_mode = 0;
a4d5504d
MH		 217
218 hci_bdaddr_list_clear(&hdev->le_white_list);
a9de9248 219}
04837f64 220
c2f0f979
MH		 221static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
222 struct sk_buff *skb)
223{
224 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
225 struct hci_cp_read_stored_link_key *sent;
226
227 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
228
229 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
230 if (!sent)
231 return;
232
233 if (!rp->status && sent->read_all == 0x01) {
234 hdev->stored_max_keys = rp->max_keys;
235 hdev->stored_num_keys = rp->num_keys;
236 }
237}
238
a9366120
MH		 239static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
240 struct sk_buff *skb)
241{
242 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
245
246 if (rp->status)
247 return;
248
249 if (rp->num_keys <= hdev->stored_num_keys)
250 hdev->stored_num_keys -= rp->num_keys;
251 else
252 hdev->stored_num_keys = 0;
253}
254
a9de9248
MH		 255static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
256{
257 __u8 status = *((__u8 *) skb->data);
258 void *sent;
04837f64 259
9f1db00c 260 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 261
a9de9248
MH		 262 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
263 if (!sent)
264 return;
04837f64 265
56e5cb86
JH		 266 hci_dev_lock(hdev);
267
d7a5a11d 268 if (hci_dev_test_flag(hdev, HCI_MGMT))
f51d5b24 269 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 270 else if (!status)
271 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 272
56e5cb86 273 hci_dev_unlock(hdev);
a9de9248
MH		 274}
275
276static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
277{
278 struct hci_rp_read_local_name *rp = (void *) skb->data;
279
9f1db00c 280 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 281
282 if (rp->status)
283 return;
284
d7a5a11d
MH		 285 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
286 hci_dev_test_flag(hdev, HCI_CONFIG))
db99b5fc 287 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 288}
289
290static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
291{
292 __u8 status = *((__u8 *) skb->data);
293 void *sent;
294
9f1db00c 295 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 296
297 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
298 if (!sent)
299 return;
300
5c1a4c8f
JK		 301 hci_dev_lock(hdev);
302
a9de9248
MH		 303 if (!status) {
304 __u8 param = *((__u8 *) sent);
305
306 if (param == AUTH_ENABLED)
307 set_bit(HCI_AUTH, &hdev->flags);
308 else
309 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 310 }
a9de9248 311
d7a5a11d 312 if (hci_dev_test_flag(hdev, HCI_MGMT))
33ef95ed 313 mgmt_auth_enable_complete(hdev, status);
5c1a4c8f
JK		 314
315 hci_dev_unlock(hdev);
1da177e4
LT		 316}
317
a9de9248 318static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 319{
a9de9248 320 __u8 status = *((__u8 *) skb->data);
45296acd 321 __u8 param;
1da177e4
LT		 322 void *sent;
323
9f1db00c 324 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 325
45296acd
MH		 326 if (status)
327 return;
328
a9de9248
MH		 329 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
330 if (!sent)
331 return;
1da177e4 332
45296acd 333 param = *((__u8 *) sent);
a9de9248 334
45296acd
MH		 335 if (param)
336 set_bit(HCI_ENCRYPT, &hdev->flags);
337 else
338 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 339}
1da177e4 340
a9de9248
MH		 341static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
342{
45296acd
MH		 343 __u8 status = *((__u8 *) skb->data);
344 __u8 param;
a9de9248 345 void *sent;
1da177e4 346
9f1db00c 347 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 348
a9de9248
MH		 349 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
350 if (!sent)
351 return;
1da177e4 352
36f7fc7e
JH		 353 param = *((__u8 *) sent);
354
56e5cb86
JH		 355 hci_dev_lock(hdev);
356
fa1bd918 357 if (status) {
2d7cee58
JH		 358 hdev->discov_timeout = 0;
359 goto done;
360 }
361
bc6d2d04 362 if (param & SCAN_INQUIRY)
36f7fc7e 363 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 364 else
365 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 366
031547d8 367 if (param & SCAN_PAGE)
36f7fc7e 368 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 369 else
204e3990 370 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 371
36f7fc7e 372done:
56e5cb86 373 hci_dev_unlock(hdev);
a9de9248 374}
1da177e4 375
a9de9248
MH		 376static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
377{
378 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 379
9f1db00c 380 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 381
a9de9248
MH		 382 if (rp->status)
383 return;
1da177e4 384
a9de9248 385 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 386
a9de9248 387 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 388 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 389}
1da177e4 390
a9de9248
MH		 391static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
392{
393 __u8 status = *((__u8 *) skb->data);
394 void *sent;
1da177e4 395
9f1db00c 396 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 397
a9de9248
MH		 398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
399 if (!sent)
400 return;
1da177e4 401
7f9a903c
MH		 402 hci_dev_lock(hdev);
403
404 if (status == 0)
405 memcpy(hdev->dev_class, sent, 3);
406
d7a5a11d 407 if (hci_dev_test_flag(hdev, HCI_MGMT))
7f9a903c
MH		 408 mgmt_set_class_of_dev_complete(hdev, sent, status);
409
410 hci_dev_unlock(hdev);
a9de9248 411}
1da177e4 412
a9de9248
MH		 413static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
414{
415 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
416 __u16 setting;
417
9f1db00c 418 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 419
420 if (rp->status)
421 return;
422
423 setting = __le16_to_cpu(rp->voice_setting);
424
f383f275 425 if (hdev->voice_setting == setting)
a9de9248
MH		 426 return;
427
428 hdev->voice_setting = setting;
429
9f1db00c 430 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 431
3c54711c 432 if (hdev->notify)
a9de9248 433 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 434}
435
8fc9ced3
GP		 436static void hci_cc_write_voice_setting(struct hci_dev *hdev,
437 struct sk_buff *skb)
a9de9248
MH		 438{
439 __u8 status = *((__u8 *) skb->data);
f383f275 440 __u16 setting;
a9de9248
MH		 441 void *sent;
442
9f1db00c 443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 444
f383f275
MH		 445 if (status)
446 return;
447
a9de9248
MH		 448 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
449 if (!sent)
450 return;
1da177e4 451
f383f275 452 setting = get_unaligned_le16(sent);
1da177e4 453
f383f275
MH		 454 if (hdev->voice_setting == setting)
455 return;
456
457 hdev->voice_setting = setting;
1da177e4 458
9f1db00c 459 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 460
3c54711c 461 if (hdev->notify)
f383f275 462 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 463}
464
b4cb9fb2
MH		 465static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
466 struct sk_buff *skb)
467{
468 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
469
470 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
471
472 if (rp->status)
473 return;
474
475 hdev->num_iac = rp->num_iac;
476
477 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
478}
479
333140b5
MH		 480static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
481{
482 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 483 struct hci_cp_write_ssp_mode *sent;
333140b5 484
9f1db00c 485 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 486
333140b5
MH		 487 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
488 if (!sent)
489 return;
490
5c1a4c8f
JK		 491 hci_dev_lock(hdev);
492
5ed8eb2f
JH		 493 if (!status) {
494 if (sent->mode)
cad718ed 495 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 496 else
cad718ed 497 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 498 }
499
d7a5a11d 500 if (hci_dev_test_flag(hdev, HCI_MGMT))
5ed8eb2f 501 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 502 else if (!status) {
5ed8eb2f 503 if (sent->mode)
a1536da2 504 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 505 else
a358dc11 506 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 507 }
5c1a4c8f
JK		 508
509 hci_dev_unlock(hdev);
333140b5
MH		 510}
511
eac83dc6
MH		 512static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
513{
514 u8 status = *((u8 *) skb->data);
515 struct hci_cp_write_sc_support *sent;
516
517 BT_DBG("%s status 0x%2.2x", hdev->name, status);
518
519 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
520 if (!sent)
521 return;
522
5c1a4c8f
JK		 523 hci_dev_lock(hdev);
524
eac83dc6
MH		 525 if (!status) {
526 if (sent->support)
527 hdev->features[1][0] |= LMP_HOST_SC;
528 else
529 hdev->features[1][0] &= ~LMP_HOST_SC;
530 }
531
d7a5a11d 532 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
eac83dc6 533 if (sent->support)
a1536da2 534 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
eac83dc6 535 else
a358dc11 536 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
eac83dc6 537 }
5c1a4c8f
JK		 538
539 hci_dev_unlock(hdev);
eac83dc6
MH		 540}
541
a9de9248
MH		 542static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
543{
544 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 545
9f1db00c 546 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 547
a9de9248 548 if (rp->status)
42c6b129 549 return;
1143e5a6 550
d7a5a11d
MH		 551 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
552 hci_dev_test_flag(hdev, HCI_CONFIG)) {
0d5551f5
MH		 553 hdev->hci_ver = rp->hci_ver;
554 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
555 hdev->lmp_ver = rp->lmp_ver;
556 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
557 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
558 }
d5859e22
JH		 559}
560
8fc9ced3
GP		 561static void hci_cc_read_local_commands(struct hci_dev *hdev,
562 struct sk_buff *skb)
a9de9248
MH		 563{
564 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 565
9f1db00c 566 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 567
6a070e6e
MH		 568 if (rp->status)
569 return;
570
d7a5a11d
MH		 571 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
572 hci_dev_test_flag(hdev, HCI_CONFIG))
2177bab5 573 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 574}
1da177e4 575
8fc9ced3
GP		 576static void hci_cc_read_local_features(struct hci_dev *hdev,
577 struct sk_buff *skb)
a9de9248
MH		 578{
579 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 580
9f1db00c 581 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 582
a9de9248
MH		 583 if (rp->status)
584 return;
5b7f9909 585
a9de9248 586 memcpy(hdev->features, rp->features, 8);
5b7f9909 587
a9de9248
MH		 588 /* Adjust default settings according to features
589 * supported by device. */
1da177e4 590
cad718ed 591 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 592 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 593
cad718ed 594 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 595 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 596
cad718ed 597 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 598 hdev->pkt_type |= (HCI_HV2);
599 hdev->esco_type |= (ESCO_HV2);
600 }
1da177e4 601
cad718ed 602 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 603 hdev->pkt_type |= (HCI_HV3);
604 hdev->esco_type |= (ESCO_HV3);
605 }
1da177e4 606
45db810f 607 if (lmp_esco_capable(hdev))
a9de9248 608 hdev->esco_type |= (ESCO_EV3);
da1f5198 609
cad718ed 610 if (hdev->features[0][4] & LMP_EV4)
a9de9248 611 hdev->esco_type |= (ESCO_EV4);
da1f5198 612
cad718ed 613 if (hdev->features[0][4] & LMP_EV5)
a9de9248 614 hdev->esco_type |= (ESCO_EV5);
1da177e4 615
cad718ed 616 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 617 hdev->esco_type |= (ESCO_2EV3);
618
cad718ed 619 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 620 hdev->esco_type |= (ESCO_3EV3);
621
cad718ed 622 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 623 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 624}
1da177e4 625
971e3a4b 626static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 627 struct sk_buff *skb)
971e3a4b
AG		 628{
629 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
630
9f1db00c 631 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 632
633 if (rp->status)
42c6b129 634 return;
971e3a4b 635
57af75a8
MH		 636 if (hdev->max_page < rp->max_page)
637 hdev->max_page = rp->max_page;
d2c5d77f 638
cad718ed
JH		 639 if (rp->page < HCI_MAX_PAGES)
640 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 641}
642
1e89cffb 643static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 644 struct sk_buff *skb)
1e89cffb
AE		 645{
646 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
647
9f1db00c 648 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 649
45296acd
MH		 650 if (rp->status)
651 return;
652
653 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 654}
655
a9de9248
MH		 656static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
657{
658 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 659
9f1db00c 660 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 661
a9de9248
MH		 662 if (rp->status)
663 return;
1da177e4 664
a9de9248
MH		 665 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
666 hdev->sco_mtu = rp->sco_mtu;
667 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
668 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
669
670 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
671 hdev->sco_mtu = 64;
672 hdev->sco_pkts = 8;
1da177e4 673 }
a9de9248
MH		 674
675 hdev->acl_cnt = hdev->acl_pkts;
676 hdev->sco_cnt = hdev->sco_pkts;
677
807deac2
GP		 678 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
679 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 680}
681
682static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
683{
684 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
685
9f1db00c 686 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 687
e30d3f5f
MH		 688 if (rp->status)
689 return;
690
691 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 692 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f 693
d7a5a11d 694 if (hci_dev_test_flag(hdev, HCI_SETUP))
e30d3f5f 695 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 696}
697
f332ec66
JH		 698static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
699 struct sk_buff *skb)
700{
701 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
702
703 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
704
45296acd
MH		 705 if (rp->status)
706 return;
707
708 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 709 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
710 hdev->page_scan_window = __le16_to_cpu(rp->window);
711 }
712}
713
4a3ee763
JH		 714static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
715 struct sk_buff *skb)
716{
717 u8 status = *((u8 *) skb->data);
718 struct hci_cp_write_page_scan_activity *sent;
719
720 BT_DBG("%s status 0x%2.2x", hdev->name, status);
721
722 if (status)
723 return;
724
725 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
726 if (!sent)
727 return;
728
729 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
730 hdev->page_scan_window = __le16_to_cpu(sent->window);
731}
732
f332ec66
JH		 733static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
734 struct sk_buff *skb)
735{
736 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
737
738 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
739
45296acd
MH		 740 if (rp->status)
741 return;
742
743 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 744 hdev->page_scan_type = rp->type;
745}
746
4a3ee763
JH		 747static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
748 struct sk_buff *skb)
749{
750 u8 status = *((u8 *) skb->data);
751 u8 *type;
752
753 BT_DBG("%s status 0x%2.2x", hdev->name, status);
754
755 if (status)
756 return;
757
758 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
759 if (type)
760 hdev->page_scan_type = *type;
761}
762
350ee4cf 763static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 764 struct sk_buff *skb)
350ee4cf
AE		 765{
766 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
767
9f1db00c 768 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 769
770 if (rp->status)
771 return;
772
773 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
774 hdev->block_len = __le16_to_cpu(rp->block_len);
775 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
776
777 hdev->block_cnt = hdev->num_blocks;
778
779 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 780 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 781}
782
33f35721
JH		 783static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
784{
785 struct hci_rp_read_clock *rp = (void *) skb->data;
786 struct hci_cp_read_clock *cp;
787 struct hci_conn *conn;
788
789 BT_DBG("%s", hdev->name);
790
791 if (skb->len < sizeof(*rp))
792 return;
793
794 if (rp->status)
795 return;
796
797 hci_dev_lock(hdev);
798
799 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
800 if (!cp)
801 goto unlock;
802
803 if (cp->which == 0x00) {
804 hdev->clock = le32_to_cpu(rp->clock);
805 goto unlock;
806 }
807
808 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
809 if (conn) {
810 conn->clock = le32_to_cpu(rp->clock);
811 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
812 }
813
814unlock:
815 hci_dev_unlock(hdev);
816}
817
928abaa7 818static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 819 struct sk_buff *skb)
928abaa7
AE		 820{
821 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
822
9f1db00c 823 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 824
825 if (rp->status)
8e2a0d92 826 goto a2mp_rsp;
928abaa7
AE		 827
828 hdev->amp_status = rp->amp_status;
829 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
830 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
831 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
832 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
833 hdev->amp_type = rp->amp_type;
834 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
835 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
836 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
837 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
838
8e2a0d92
AE		 839a2mp_rsp:
840 a2mp_send_getinfo_rsp(hdev);
928abaa7
AE		 841}
842
903e4541
AE		 843static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
844 struct sk_buff *skb)
845{
846 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
847 struct amp_assoc *assoc = &hdev->loc_assoc;
848 size_t rem_len, frag_len;
849
850 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
851
852 if (rp->status)
853 goto a2mp_rsp;
854
855 frag_len = skb->len - sizeof(*rp);
856 rem_len = __le16_to_cpu(rp->rem_len);
857
858 if (rem_len > frag_len) {
2e430be3 859 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
903e4541
AE		 860
861 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
862 assoc->offset += frag_len;
863
864 /* Read other fragments */
865 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
866
867 return;
868 }
869
870 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
871 assoc->len = assoc->offset + rem_len;
872 assoc->offset = 0;
873
874a2mp_rsp:
875 /* Send A2MP Rsp when all fragments are received */
876 a2mp_send_getampassoc_rsp(hdev, rp->status);
9495b2ee 877 a2mp_send_create_phy_link_req(hdev, rp->status);
903e4541
AE		 878}
879
d5859e22 880static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 881 struct sk_buff *skb)
d5859e22 882{
91c4e9b1 883 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 884
9f1db00c 885 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 886
45296acd
MH		 887 if (rp->status)
888 return;
889
890 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 891}
892
980e1a53
JH		 893static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
894{
895 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
896 struct hci_cp_pin_code_reply *cp;
897 struct hci_conn *conn;
898
9f1db00c 899 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 900
56e5cb86
JH		 901 hci_dev_lock(hdev);
902
d7a5a11d 903 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 904 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 905
fa1bd918 906 if (rp->status)
56e5cb86 907 goto unlock;
980e1a53
JH		 908
909 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
910 if (!cp)
56e5cb86 911 goto unlock;
980e1a53
JH		 912
913 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
914 if (conn)
915 conn->pin_length = cp->pin_len;
56e5cb86
JH		 916
917unlock:
918 hci_dev_unlock(hdev);
980e1a53
JH		 919}
920
921static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
922{
923 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
924
9f1db00c 925 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 926
56e5cb86
JH		 927 hci_dev_lock(hdev);
928
d7a5a11d 929 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 930 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 931 rp->status);
56e5cb86
JH		 932
933 hci_dev_unlock(hdev);
980e1a53 934}
56e5cb86 935
6ed58ec5
VT		 936static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
937 struct sk_buff *skb)
938{
939 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
940
9f1db00c 941 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 942
943 if (rp->status)
944 return;
945
946 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
947 hdev->le_pkts = rp->le_max_pkt;
948
949 hdev->le_cnt = hdev->le_pkts;
950
951 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 952}
980e1a53 953
60e77321
JH		 954static void hci_cc_le_read_local_features(struct hci_dev *hdev,
955 struct sk_buff *skb)
956{
957 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
958
959 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
960
45296acd
MH		 961 if (rp->status)
962 return;
963
964 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 965}
966
8fa19098
JH		 967static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
968 struct sk_buff *skb)
969{
970 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
971
972 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
973
45296acd
MH		 974 if (rp->status)
975 return;
976
977 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 978}
979
a5c29683
JH		 980static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
981{
982 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
983
9f1db00c 984 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 985
56e5cb86
JH		 986 hci_dev_lock(hdev);
987
d7a5a11d 988 if (hci_dev_test_flag(hdev, HCI_MGMT))
04124681
GP		 989 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
990 rp->status);
56e5cb86
JH		 991
992 hci_dev_unlock(hdev);
a5c29683
JH		 993}
994
995static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 996 struct sk_buff *skb)
a5c29683
JH		 997{
998 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
999
9f1db00c 1000 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 1001
56e5cb86
JH		 1002 hci_dev_lock(hdev);
1003
d7a5a11d 1004 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 1005 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1006 ACL_LINK, 0, rp->status);
56e5cb86
JH		 1007
1008 hci_dev_unlock(hdev);
a5c29683
JH		 1009}
1010
1143d458
BG		 1011static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1012{
1013 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1014
9f1db00c 1015 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1016
1017 hci_dev_lock(hdev);
1018
d7a5a11d 1019 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 1020 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 1021 0, rp->status);
1143d458
BG		 1022
1023 hci_dev_unlock(hdev);
1024}
1025
1026static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 1027 struct sk_buff *skb)
1143d458
BG		 1028{
1029 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1030
9f1db00c 1031 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1032
1033 hci_dev_lock(hdev);
1034
d7a5a11d 1035 if (hci_dev_test_flag(hdev, HCI_MGMT))
1143d458 1036 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1037 ACL_LINK, 0, rp->status);
1143d458
BG		 1038
1039 hci_dev_unlock(hdev);
1040}
1041
4d2d2796
MH		 1042static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1043 struct sk_buff *skb)
c35938b2
SJ		 1044{
1045 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1046
9f1db00c 1047 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
4d2d2796
MH		 1048}
1049
1050static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1051 struct sk_buff *skb)
1052{
1053 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1054
1055 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2
SJ		 1056}
1057
7a4cd51d
MH		 1058static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1059{
1060 __u8 status = *((__u8 *) skb->data);
1061 bdaddr_t *sent;
1062
1063 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1064
45296acd
MH		 1065 if (status)
1066 return;
1067
7a4cd51d
MH		 1068 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1069 if (!sent)
1070 return;
1071
1072 hci_dev_lock(hdev);
1073
45296acd 1074 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1075
1076 hci_dev_unlock(hdev);
1077}
1078
c1d5dc4a
JH		 1079static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1080{
1081 __u8 *sent, status = *((__u8 *) skb->data);
1082
1083 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1084
45296acd 1085 if (status)
c1d5dc4a
JH		 1086 return;
1087
45296acd
MH		 1088 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1089 if (!sent)
3c857757
JH		 1090 return;
1091
c1d5dc4a
JH		 1092 hci_dev_lock(hdev);
1093
49c922bb 1094 /* If we're doing connection initiation as peripheral. Set a
3c857757
JH		 1095 * timeout in case something goes wrong.
1096 */
1097 if (*sent) {
1098 struct hci_conn *conn;
1099
a1536da2 1100 hci_dev_set_flag(hdev, HCI_LE_ADV);
66c417c1 1101
3c857757
JH		 1102 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1103 if (conn)
1104 queue_delayed_work(hdev->workqueue,
1105 &conn->le_conn_timeout,
09ae260b 1106 conn->conn_timeout);
66c417c1 1107 } else {
a358dc11 1108 hci_dev_clear_flag(hdev, HCI_LE_ADV);
3c857757
JH		 1109 }
1110
04b4edcb 1111 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1112}
1113
533553f8
MH		 1114static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1115{
1116 struct hci_cp_le_set_scan_param *cp;
1117 __u8 status = *((__u8 *) skb->data);
1118
1119 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1120
45296acd
MH		 1121 if (status)
1122 return;
1123
533553f8
MH		 1124 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1125 if (!cp)
1126 return;
1127
1128 hci_dev_lock(hdev);
1129
45296acd 1130 hdev->le_scan_type = cp->type;
533553f8
MH		 1131
1132 hci_dev_unlock(hdev);
1133}
1134
b9a6328f
JH		 1135static bool has_pending_adv_report(struct hci_dev *hdev)
1136{
1137 struct discovery_state *d = &hdev->discovery;
1138
1139 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1140}
1141
1142static void clear_pending_adv_report(struct hci_dev *hdev)
1143{
1144 struct discovery_state *d = &hdev->discovery;
1145
1146 bacpy(&d->last_adv_addr, BDADDR_ANY);
1147 d->last_adv_data_len = 0;
1148}
1149
1150static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1151 u8 bdaddr_type, s8 rssi, u32 flags,
1152 u8 *data, u8 len)
b9a6328f
JH		 1153{
1154 struct discovery_state *d = &hdev->discovery;
1155
1156 bacpy(&d->last_adv_addr, bdaddr);
1157 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1158 d->last_adv_rssi = rssi;
c70a7e4c 1159 d->last_adv_flags = flags;
b9a6328f
JH		 1160 memcpy(d->last_adv_data, data, len);
1161 d->last_adv_data_len = len;
1162}
1163
eb9d91f5 1164static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
807deac2 1165 struct sk_buff *skb)
eb9d91f5
AG		 1166{
1167 struct hci_cp_le_set_scan_enable *cp;
1168 __u8 status = *((__u8 *) skb->data);
1169
9f1db00c 1170 BT_DBG("%s status 0x%2.2x", hdev->name, status);
eb9d91f5 1171
45296acd 1172 if (status)
eb9d91f5
AG		 1173 return;
1174
45296acd
MH		 1175 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1176 if (!cp)
3fd319b8
AG		 1177 return;
1178
5c1a4c8f
JK		 1179 hci_dev_lock(hdev);
1180
68a8aea4 1181 switch (cp->enable) {
76a388be 1182 case LE_SCAN_ENABLE:
a1536da2 1183 hci_dev_set_flag(hdev, HCI_LE_SCAN);
b9a6328f
JH		 1184 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1185 clear_pending_adv_report(hdev);
68a8aea4
AE		 1186 break;
1187
76a388be 1188 case LE_SCAN_DISABLE:
b9a6328f
JH		 1189 /* We do this here instead of when setting DISCOVERY_STOPPED
1190 * since the latter would potentially require waiting for
1191 * inquiry to stop too.
1192 */
1193 if (has_pending_adv_report(hdev)) {
1194 struct discovery_state *d = &hdev->discovery;
1195
1196 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1197 d->last_adv_addr_type, NULL,
c70a7e4c 1198 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1199 d->last_adv_data,
b9a6328f
JH		 1200 d->last_adv_data_len, NULL, 0);
1201 }
1202
317ac8cb
JH		 1203 /* Cancel this timer so that we don't try to disable scanning
1204 * when it's already disabled.
1205 */
1206 cancel_delayed_work(&hdev->le_scan_disable);
1207
a358dc11 1208 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
e8bb6b97 1209
81ad6fd9
JH		 1210 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1211 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1212 * therefore discovery as stopped. If this was not
1213 * because of a connect request advertising might have
1214 * been disabled because of active scanning, so
1215 * re-enable it again if necessary.
81ad6fd9 1216 */
a69d8927 1217 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
81ad6fd9 1218 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
d7a5a11d 1219 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
34722277 1220 hdev->discovery.state == DISCOVERY_FINDING)
e8bb6b97
JH		 1221 mgmt_reenable_advertising(hdev);
1222
68a8aea4
AE		 1223 break;
1224
1225 default:
1226 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1227 break;
35815085 1228 }
5c1a4c8f
JK		 1229
1230 hci_dev_unlock(hdev);
eb9d91f5
AG		 1231}
1232
cf1d081f
JH		 1233static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1234 struct sk_buff *skb)
1235{
1236 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1237
1238 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1239
45296acd
MH		 1240 if (rp->status)
1241 return;
1242
1243 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1244}
1245
0f36b589
MH		 1246static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1247 struct sk_buff *skb)
1248{
1249 __u8 status = *((__u8 *) skb->data);
1250
1251 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1252
45296acd
MH		 1253 if (status)
1254 return;
1255
dcc36c16 1256 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1257}
1258
1259static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1260 struct sk_buff *skb)
1261{
1262 struct hci_cp_le_add_to_white_list *sent;
1263 __u8 status = *((__u8 *) skb->data);
1264
1265 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1266
45296acd
MH		 1267 if (status)
1268 return;
1269
0f36b589
MH		 1270 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1271 if (!sent)
1272 return;
1273
dcc36c16
JH		 1274 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1275 sent->bdaddr_type);
0f36b589
MH		 1276}
1277
1278static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1279 struct sk_buff *skb)
1280{
1281 struct hci_cp_le_del_from_white_list *sent;
1282 __u8 status = *((__u8 *) skb->data);
1283
1284 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1285
45296acd
MH		 1286 if (status)
1287 return;
1288
0f36b589
MH		 1289 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1290 if (!sent)
1291 return;
1292
dcc36c16
JH		 1293 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1294 sent->bdaddr_type);
0f36b589
MH		 1295}
1296
9b008c04
JH		 1297static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1298 struct sk_buff *skb)
1299{
1300 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1301
1302 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1303
45296acd
MH		 1304 if (rp->status)
1305 return;
1306
1307 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1308}
1309
a8e1bfaa
MH		 1310static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1311 struct sk_buff *skb)
1312{
1313 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1314
1315 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1316
1317 if (rp->status)
1318 return;
1319
1320 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1321 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1322}
1323
1324static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1325 struct sk_buff *skb)
1326{
1327 struct hci_cp_le_write_def_data_len *sent;
1328 __u8 status = *((__u8 *) skb->data);
1329
1330 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1331
1332 if (status)
1333 return;
1334
1335 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1336 if (!sent)
1337 return;
1338
1339 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1340 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1341}
1342
1343static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1344 struct sk_buff *skb)
1345{
1346 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1347
1348 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1349
1350 if (rp->status)
1351 return;
1352
1353 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1354 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1355 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1356 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1357}
1358
6039aa73
GP		 1359static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1360 struct sk_buff *skb)
f9b49306 1361{
06199cf8 1362 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1363 __u8 status = *((__u8 *) skb->data);
1364
9f1db00c 1365 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1366
45296acd
MH		 1367 if (status)
1368 return;
1369
06199cf8 1370 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1371 if (!sent)
f9b49306
AG		 1372 return;
1373
5c1a4c8f
JK		 1374 hci_dev_lock(hdev);
1375
45296acd
MH		 1376 if (sent->le) {
1377 hdev->features[1][0] |= LMP_HOST_LE;
a1536da2 1378 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
45296acd
MH		 1379 } else {
1380 hdev->features[1][0] &= ~LMP_HOST_LE;
a358dc11
MH		 1381 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1382 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
8f984dfa 1383 }
45296acd
MH		 1384
1385 if (sent->simul)
1386 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1387 else
1388 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
5c1a4c8f
JK		 1389
1390 hci_dev_unlock(hdev);
f9b49306
AG		 1391}
1392
56ed2cb8
JH		 1393static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1394{
1395 struct hci_cp_le_set_adv_param *cp;
1396 u8 status = *((u8 *) skb->data);
1397
1398 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
1400 if (status)
1401 return;
1402
1403 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1404 if (!cp)
1405 return;
1406
1407 hci_dev_lock(hdev);
1408 hdev->adv_addr_type = cp->own_address_type;
1409 hci_dev_unlock(hdev);
1410}
1411
93c284ee
AE		 1412static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1413 struct sk_buff *skb)
1414{
1415 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1416
1417 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1418 hdev->name, rp->status, rp->phy_handle);
1419
1420 if (rp->status)
1421 return;
1422
1423 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1424}
1425
5ae76a94
AK		 1426static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1427{
1428 struct hci_rp_read_rssi *rp = (void *) skb->data;
1429 struct hci_conn *conn;
1430
1431 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1432
1433 if (rp->status)
1434 return;
1435
1436 hci_dev_lock(hdev);
1437
1438 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1439 if (conn)
1440 conn->rssi = rp->rssi;
1441
1442 hci_dev_unlock(hdev);
1443}
1444
5a134fae
AK		 1445static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1446{
1447 struct hci_cp_read_tx_power *sent;
1448 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1449 struct hci_conn *conn;
1450
1451 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1452
1453 if (rp->status)
1454 return;
1455
1456 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1457 if (!sent)
1458 return;
1459
1460 hci_dev_lock(hdev);
1461
1462 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1463 if (!conn)
1464 goto unlock;
1465
1466 switch (sent->type) {
1467 case 0x00:
5a134fae 1468 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1469 break;
1470 case 0x01:
1471 conn->max_tx_power = rp->tx_power;
1472 break;
1473 }
5a134fae 1474
d0455ed9 1475unlock:
5a134fae
AK		 1476 hci_dev_unlock(hdev);
1477}
1478
c50b33c8
MH		 1479static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1480{
1481 u8 status = *((u8 *) skb->data);
1482 u8 *mode;
1483
1484 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1485
1486 if (status)
1487 return;
1488
1489 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1490 if (mode)
1491 hdev->ssp_debug_mode = *mode;
1492}
1493
6039aa73 1494static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1495{
9f1db00c 1496 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1497
1498 if (status) {
a9de9248 1499 hci_conn_check_pending(hdev);
314b2381
JH		 1500 return;
1501 }
1502
89352e7d 1503 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1504}
1505
6039aa73 1506static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1507{
a9de9248 1508 struct hci_cp_create_conn *cp;
1da177e4 1509 struct hci_conn *conn;
1da177e4 1510
9f1db00c 1511 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1512
1513 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1514 if (!cp)
1515 return;
1516
1517 hci_dev_lock(hdev);
1518
1519 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1520
6ed93dc6 1521 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1522
1523 if (status) {
1524 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1525 if (status != 0x0c || conn->attempt > 2) {
1526 conn->state = BT_CLOSED;
539c496d 1527 hci_connect_cfm(conn, status);
4c67bc74
MH		 1528 hci_conn_del(conn);
1529 } else
1530 conn->state = BT_CONNECT2;
1da177e4
LT		 1531 }
1532 } else {
1533 if (!conn) {
a5c4e309
JH		 1534 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1535 HCI_ROLE_MASTER);
1536 if (!conn)
893ef971 1537 BT_ERR("No memory for new connection");
1da177e4
LT		 1538 }
1539 }
1540
1541 hci_dev_unlock(hdev);
1542}
1543
a9de9248 1544static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1545{
a9de9248
MH		 1546 struct hci_cp_add_sco *cp;
1547 struct hci_conn *acl, *sco;
1548 __u16 handle;
1da177e4 1549
9f1db00c 1550 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1551
a9de9248
MH		 1552 if (!status)
1553 return;
1da177e4 1554
a9de9248
MH		 1555 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1556 if (!cp)
1557 return;
1da177e4 1558
a9de9248 1559 handle = __le16_to_cpu(cp->handle);
1da177e4 1560
9f1db00c 1561 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1562
a9de9248 1563 hci_dev_lock(hdev);
1da177e4 1564
a9de9248 1565 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1566 if (acl) {
1567 sco = acl->link;
1568 if (sco) {
1569 sco->state = BT_CLOSED;
1da177e4 1570
539c496d 1571 hci_connect_cfm(sco, status);
5a08ecce
AE		 1572 hci_conn_del(sco);
1573 }
a9de9248 1574 }
1da177e4 1575
a9de9248
MH		 1576 hci_dev_unlock(hdev);
1577}
1da177e4 1578
f8558555
MH		 1579static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1580{
1581 struct hci_cp_auth_requested *cp;
1582 struct hci_conn *conn;
1583
9f1db00c 1584 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1585
1586 if (!status)
1587 return;
1588
1589 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1590 if (!cp)
1591 return;
1592
1593 hci_dev_lock(hdev);
1594
1595 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1596 if (conn) {
1597 if (conn->state == BT_CONFIG) {
539c496d 1598 hci_connect_cfm(conn, status);
76a68ba0 1599 hci_conn_drop(conn);
f8558555
MH		 1600 }
1601 }
1602
1603 hci_dev_unlock(hdev);
1604}
1605
1606static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1607{
1608 struct hci_cp_set_conn_encrypt *cp;
1609 struct hci_conn *conn;
1610
9f1db00c 1611 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1612
1613 if (!status)
1614 return;
1615
1616 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1617 if (!cp)
1618 return;
1619
1620 hci_dev_lock(hdev);
1621
1622 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1623 if (conn) {
1624 if (conn->state == BT_CONFIG) {
539c496d 1625 hci_connect_cfm(conn, status);
76a68ba0 1626 hci_conn_drop(conn);
f8558555
MH		 1627 }
1628 }
1629
1630 hci_dev_unlock(hdev);
1631}
1632
127178d2 1633static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1634 struct hci_conn *conn)
392599b9 1635{
392599b9
JH		 1636 if (conn->state != BT_CONFIG || !conn->out)
1637 return 0;
1638
765c2a96 1639 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1640 return 0;
1641
1642 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1643 * devices with sec_level MEDIUM or HIGH or if MITM protection
1644 * is requested.
1645 */
807deac2 1646 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1647 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1648 conn->pending_sec_level != BT_SECURITY_HIGH &&
1649 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1650 return 0;
1651
392599b9
JH		 1652 return 1;
1653}
1654
6039aa73 1655static int hci_resolve_name(struct hci_dev *hdev,
04124681 1656 struct inquiry_entry *e)
30dc78e1
JH		 1657{
1658 struct hci_cp_remote_name_req cp;
1659
1660 memset(&cp, 0, sizeof(cp));
1661
1662 bacpy(&cp.bdaddr, &e->data.bdaddr);
1663 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1664 cp.pscan_mode = e->data.pscan_mode;
1665 cp.clock_offset = e->data.clock_offset;
1666
1667 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1668}
1669
b644ba33 1670static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1671{
1672 struct discovery_state *discov = &hdev->discovery;
1673 struct inquiry_entry *e;
1674
b644ba33
JH		 1675 if (list_empty(&discov->resolve))
1676 return false;
1677
1678 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1679 if (!e)
1680 return false;
1681
b644ba33
JH		 1682 if (hci_resolve_name(hdev, e) == 0) {
1683 e->name_state = NAME_PENDING;
1684 return true;
1685 }
1686
1687 return false;
1688}
1689
1690static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1691 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1692{
1693 struct discovery_state *discov = &hdev->discovery;
1694 struct inquiry_entry *e;
1695
60cb49d2
JH		 1696 /* Update the mgmt connected state if necessary. Be careful with
1697 * conn objects that exist but are not (yet) connected however.
1698 * Only those in BT_CONFIG or BT_CONNECTED states can be
1699 * considered connected.
1700 */
1701 if (conn &&
1702 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
cb77c3ec 1703 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1704 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1705
1706 if (discov->state == DISCOVERY_STOPPED)
1707 return;
1708
30dc78e1
JH		 1709 if (discov->state == DISCOVERY_STOPPING)
1710 goto discov_complete;
1711
1712 if (discov->state != DISCOVERY_RESOLVING)
1713 return;
1714
1715 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1716 /* If the device was not found in a list of found devices names of which
1717 * are pending. there is no need to continue resolving a next name as it
1718 * will be done upon receiving another Remote Name Request Complete
1719 * Event */
1720 if (!e)
1721 return;
1722
1723 list_del(&e->list);
1724 if (name) {
30dc78e1 1725 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1726 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1727 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1728 } else {
1729 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1730 }
1731
b644ba33 1732 if (hci_resolve_next_name(hdev))
30dc78e1 1733 return;
30dc78e1
JH		 1734
1735discov_complete:
1736 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1737}
1738
a9de9248
MH		 1739static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1740{
127178d2
JH		 1741 struct hci_cp_remote_name_req *cp;
1742 struct hci_conn *conn;
1743
9f1db00c 1744 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1745
1746 /* If successful wait for the name req complete event before
1747 * checking for the need to do authentication */
1748 if (!status)
1749 return;
1750
1751 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1752 if (!cp)
1753 return;
1754
1755 hci_dev_lock(hdev);
1756
b644ba33
JH		 1757 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1758
d7a5a11d 1759 if (hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 1760 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1761
79c6c70c
JH		 1762 if (!conn)
1763 goto unlock;
1764
1765 if (!hci_outgoing_auth_needed(hdev, conn))
1766 goto unlock;
1767
51a8efd7 1768 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1769 struct hci_cp_auth_requested auth_cp;
1770
977f8fce
JH		 1771 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1772
c1f23a2b
JB		 1773 auth_cp.handle = __cpu_to_le16(conn->handle);
1774 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1775 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1776 }
1777
79c6c70c 1778unlock:
127178d2 1779 hci_dev_unlock(hdev);
a9de9248 1780}
1da177e4 1781
769be974
MH		 1782static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1783{
1784 struct hci_cp_read_remote_features *cp;
1785 struct hci_conn *conn;
1786
9f1db00c 1787 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1788
1789 if (!status)
1790 return;
1791
1792 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1793 if (!cp)
1794 return;
1795
1796 hci_dev_lock(hdev);
1797
1798 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1799 if (conn) {
1800 if (conn->state == BT_CONFIG) {
539c496d 1801 hci_connect_cfm(conn, status);
76a68ba0 1802 hci_conn_drop(conn);
769be974
MH		 1803 }
1804 }
1805
1806 hci_dev_unlock(hdev);
1807}
1808
1809static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1810{
1811 struct hci_cp_read_remote_ext_features *cp;
1812 struct hci_conn *conn;
1813
9f1db00c 1814 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1815
1816 if (!status)
1817 return;
1818
1819 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1820 if (!cp)
1821 return;
1822
1823 hci_dev_lock(hdev);
1824
1825 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1826 if (conn) {
1827 if (conn->state == BT_CONFIG) {
539c496d 1828 hci_connect_cfm(conn, status);
76a68ba0 1829 hci_conn_drop(conn);
769be974
MH		 1830 }
1831 }
1832
1833 hci_dev_unlock(hdev);
1834}
1835
a9de9248
MH		 1836static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1837{
b6a0dc82
MH		 1838 struct hci_cp_setup_sync_conn *cp;
1839 struct hci_conn *acl, *sco;
1840 __u16 handle;
1841
9f1db00c 1842 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 1843
1844 if (!status)
1845 return;
1846
1847 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1848 if (!cp)
1849 return;
1850
1851 handle = __le16_to_cpu(cp->handle);
1852
9f1db00c 1853 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 1854
1855 hci_dev_lock(hdev);
1856
1857 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1858 if (acl) {
1859 sco = acl->link;
1860 if (sco) {
1861 sco->state = BT_CLOSED;
b6a0dc82 1862
539c496d 1863 hci_connect_cfm(sco, status);
5a08ecce
AE		 1864 hci_conn_del(sco);
1865 }
b6a0dc82
MH		 1866 }
1867
1868 hci_dev_unlock(hdev);
1da177e4
LT		 1869}
1870
a9de9248 1871static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1872{
a9de9248
MH		 1873 struct hci_cp_sniff_mode *cp;
1874 struct hci_conn *conn;
1da177e4 1875
9f1db00c 1876 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1877
a9de9248
MH		 1878 if (!status)
1879 return;
04837f64 1880
a9de9248
MH		 1881 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1882 if (!cp)
1883 return;
04837f64 1884
a9de9248 1885 hci_dev_lock(hdev);
04837f64 1886
a9de9248 1887 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1888 if (conn) {
51a8efd7 1889 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 1890
51a8efd7 1891 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1892 hci_sco_setup(conn, status);
1893 }
1894
a9de9248
MH		 1895 hci_dev_unlock(hdev);
1896}
04837f64 1897
a9de9248
MH		 1898static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1899{
1900 struct hci_cp_exit_sniff_mode *cp;
1901 struct hci_conn *conn;
04837f64 1902
9f1db00c 1903 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1904
a9de9248
MH		 1905 if (!status)
1906 return;
04837f64 1907
a9de9248
MH		 1908 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1909 if (!cp)
1910 return;
04837f64 1911
a9de9248 1912 hci_dev_lock(hdev);
1da177e4 1913
a9de9248 1914 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1915 if (conn) {
51a8efd7 1916 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 1917
51a8efd7 1918 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1919 hci_sco_setup(conn, status);
1920 }
1921
a9de9248 1922 hci_dev_unlock(hdev);
1da177e4
LT		 1923}
1924
88c3df13
JH		 1925static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1926{
1927 struct hci_cp_disconnect *cp;
1928 struct hci_conn *conn;
1929
1930 if (!status)
1931 return;
1932
1933 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1934 if (!cp)
1935 return;
1936
1937 hci_dev_lock(hdev);
1938
1939 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1940 if (conn)
1941 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 1942 conn->dst_type, status);
88c3df13
JH		 1943
1944 hci_dev_unlock(hdev);
1945}
1946
a02226d6
AE		 1947static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1948{
93c284ee
AE		 1949 struct hci_cp_create_phy_link *cp;
1950
a02226d6 1951 BT_DBG("%s status 0x%2.2x", hdev->name, status);
93c284ee 1952
93c284ee
AE		 1953 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1954 if (!cp)
1955 return;
1956
e58917b9
AE		 1957 hci_dev_lock(hdev);
1958
1959 if (status) {
1960 struct hci_conn *hcon;
1961
1962 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1963 if (hcon)
1964 hci_conn_del(hcon);
1965 } else {
1966 amp_write_remote_assoc(hdev, cp->phy_handle);
1967 }
1968
1969 hci_dev_unlock(hdev);
a02226d6
AE		 1970}
1971
0b26ab9d
AE		 1972static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1973{
1974 struct hci_cp_accept_phy_link *cp;
1975
1976 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1977
1978 if (status)
1979 return;
1980
1981 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1982 if (!cp)
1983 return;
1984
1985 amp_write_remote_assoc(hdev, cp->phy_handle);
1986}
1987
cb1d68f7
JH		 1988static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1989{
1990 struct hci_cp_le_create_conn *cp;
1991 struct hci_conn *conn;
1992
1993 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1994
1995 /* All connection failure handling is taken care of by the
1996 * hci_le_conn_failed function which is triggered by the HCI
1997 * request completion callbacks used for connecting.
1998 */
1999 if (status)
2000 return;
2001
2002 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2003 if (!cp)
2004 return;
2005
2006 hci_dev_lock(hdev);
2007
2008 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2009 if (!conn)
2010 goto unlock;
2011
2012 /* Store the initiator and responder address information which
2013 * is needed for SMP. These values will not change during the
2014 * lifetime of the connection.
2015 */
2016 conn->init_addr_type = cp->own_address_type;
2017 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2018 bacpy(&conn->init_addr, &hdev->random_addr);
2019 else
2020 bacpy(&conn->init_addr, &hdev->bdaddr);
2021
2022 conn->resp_addr_type = cp->peer_addr_type;
2023 bacpy(&conn->resp_addr, &cp->peer_addr);
2024
9489eca4
JH		 2025 /* We don't want the connection attempt to stick around
2026 * indefinitely since LE doesn't have a page timeout concept
2027 * like BR/EDR. Set a timer for any connection that doesn't use
2028 * the white list for connecting.
2029 */
2030 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2031 queue_delayed_work(conn->hdev->workqueue,
2032 &conn->le_conn_timeout,
09ae260b 2033 conn->conn_timeout);
9489eca4 2034
cb1d68f7
JH		 2035unlock:
2036 hci_dev_unlock(hdev);
2037}
2038
0fe29fd1
MH		 2039static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2040{
2041 struct hci_cp_le_read_remote_features *cp;
2042 struct hci_conn *conn;
2043
2044 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2045
2046 if (!status)
2047 return;
2048
2049 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2050 if (!cp)
2051 return;
2052
2053 hci_dev_lock(hdev);
2054
2055 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2056 if (conn) {
2057 if (conn->state == BT_CONFIG) {
2058 hci_connect_cfm(conn, status);
2059 hci_conn_drop(conn);
2060 }
2061 }
2062
2063 hci_dev_unlock(hdev);
2064}
2065
81d0c8ad
JH		 2066static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2067{
2068 struct hci_cp_le_start_enc *cp;
2069 struct hci_conn *conn;
2070
2071 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2072
2073 if (!status)
2074 return;
2075
2076 hci_dev_lock(hdev);
2077
2078 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2079 if (!cp)
2080 goto unlock;
2081
2082 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2083 if (!conn)
2084 goto unlock;
2085
2086 if (conn->state != BT_CONNECTED)
2087 goto unlock;
2088
2089 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2090 hci_conn_drop(conn);
2091
2092unlock:
2093 hci_dev_unlock(hdev);
2094}
2095
50fc85f1
KP		 2096static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2097{
2098 struct hci_cp_switch_role *cp;
2099 struct hci_conn *conn;
2100
2101 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2102
2103 if (!status)
2104 return;
2105
2106 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2107 if (!cp)
2108 return;
2109
2110 hci_dev_lock(hdev);
2111
2112 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2113 if (conn)
2114 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2115
2116 hci_dev_unlock(hdev);
2117}
2118
6039aa73 2119static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2120{
2121 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 2122 struct discovery_state *discov = &hdev->discovery;
2123 struct inquiry_entry *e;
1da177e4 2124
9f1db00c 2125 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 2126
a9de9248 2127 hci_conn_check_pending(hdev);
89352e7d
AG		 2128
2129 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2130 return;
2131
4e857c58 2132 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 2133 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2134
d7a5a11d 2135 if (!hci_dev_test_flag(hdev, HCI_MGMT))
30dc78e1
JH		 2136 return;
2137
56e5cb86 2138 hci_dev_lock(hdev);
30dc78e1 2139
343f935b 2140 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 2141 goto unlock;
2142
2143 if (list_empty(&discov->resolve)) {
07d2334a
JP		 2144 /* When BR/EDR inquiry is active and no LE scanning is in
2145 * progress, then change discovery state to indicate completion.
2146 *
2147 * When running LE scanning and BR/EDR inquiry simultaneously
2148 * and the LE scan already finished, then change the discovery
2149 * state to indicate completion.
2150 */
2151 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2152 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2153 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2154 goto unlock;
2155 }
2156
2157 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2158 if (e && hci_resolve_name(hdev, e) == 0) {
2159 e->name_state = NAME_PENDING;
2160 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2161 } else {
07d2334a
JP		 2162 /* When BR/EDR inquiry is active and no LE scanning is in
2163 * progress, then change discovery state to indicate completion.
2164 *
2165 * When running LE scanning and BR/EDR inquiry simultaneously
2166 * and the LE scan already finished, then change the discovery
2167 * state to indicate completion.
2168 */
2169 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2170 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2171 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2172 }
2173
2174unlock:
56e5cb86 2175 hci_dev_unlock(hdev);
1da177e4
LT		 2176}
2177
6039aa73 2178static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2179{
45bb4bf0 2180 struct inquiry_data data;
a9de9248 2181 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 2182 int num_rsp = *((__u8 *) skb->data);
2183
2184 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2185
45bb4bf0
MH		 2186 if (!num_rsp)
2187 return;
2188
d7a5a11d 2189 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 2190 return;
2191
1da177e4 2192 hci_dev_lock(hdev);
45bb4bf0 2193
e17acd40 2194 for (; num_rsp; num_rsp--, info++) {
af58925c 2195 u32 flags;
3175405b 2196
1da177e4
LT		 2197 bacpy(&data.bdaddr, &info->bdaddr);
2198 data.pscan_rep_mode = info->pscan_rep_mode;
2199 data.pscan_period_mode = info->pscan_period_mode;
2200 data.pscan_mode = info->pscan_mode;
2201 memcpy(data.dev_class, info->dev_class, 3);
2202 data.clock_offset = info->clock_offset;
efb2513f 2203 data.rssi = HCI_RSSI_INVALID;
41a96212 2204 data.ssp_mode = 0x00;
3175405b 2205
af58925c
MH		 2206 flags = hci_inquiry_cache_update(hdev, &data, false);
2207
48264f06 2208 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
efb2513f
MH		 2209 info->dev_class, HCI_RSSI_INVALID,
2210 flags, NULL, 0, NULL, 0);
1da177e4 2211 }
45bb4bf0 2212
1da177e4
LT		 2213 hci_dev_unlock(hdev);
2214}
2215
6039aa73 2216static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2217{
a9de9248
MH		 2218 struct hci_ev_conn_complete *ev = (void *) skb->data;
2219 struct hci_conn *conn;
1da177e4
LT		 2220
2221 BT_DBG("%s", hdev->name);
2222
2223 hci_dev_lock(hdev);
2224
2225 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2226 if (!conn) {
2227 if (ev->link_type != SCO_LINK)
2228 goto unlock;
2229
2230 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2231 if (!conn)
2232 goto unlock;
2233
2234 conn->type = SCO_LINK;
2235 }
1da177e4
LT		 2236
2237 if (!ev->status) {
2238 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2239
2240 if (conn->type == ACL_LINK) {
2241 conn->state = BT_CONFIG;
2242 hci_conn_hold(conn);
a9ea3ed9
SJ		 2243
2244 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2245 !hci_find_link_key(hdev, &ev->bdaddr))
2246 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2247 else
2248 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2249 } else
2250 conn->state = BT_CONNECTED;
1da177e4 2251
23b9ceb7 2252 hci_debugfs_create_conn(conn);
7d0db0a3
MH		 2253 hci_conn_add_sysfs(conn);
2254
1da177e4 2255 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2256 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2257
2258 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2259 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2260
04837f64
MH		 2261 /* Get remote features */
2262 if (conn->type == ACL_LINK) {
2263 struct hci_cp_read_remote_features cp;
2264 cp.handle = ev->handle;
769be974 2265 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2266 sizeof(cp), &cp);
22f433dc 2267
1d2dc5b7 2268 hci_update_page_scan(hdev);
04837f64
MH		 2269 }
2270
1da177e4 2271 /* Set packet type for incoming connection */
d095c1eb 2272 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2273 struct hci_cp_change_conn_ptype cp;
2274 cp.handle = ev->handle;
a8746417 2275 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2276 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2277 &cp);
1da177e4 2278 }
17d5c04c 2279 } else {
1da177e4 2280 conn->state = BT_CLOSED;
17d5c04c 2281 if (conn->type == ACL_LINK)
64c7b77c 2282 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2283 conn->dst_type, ev->status);
17d5c04c 2284 }
1da177e4 2285
e73439d8
MH		 2286 if (conn->type == ACL_LINK)
2287 hci_sco_setup(conn, ev->status);
1da177e4 2288
769be974 2289 if (ev->status) {
539c496d 2290 hci_connect_cfm(conn, ev->status);
1da177e4 2291 hci_conn_del(conn);
c89b6e6b 2292 } else if (ev->link_type != ACL_LINK)
539c496d 2293 hci_connect_cfm(conn, ev->status);
1da177e4 2294
a9de9248 2295unlock:
1da177e4 2296 hci_dev_unlock(hdev);
1da177e4 2297
a9de9248 2298 hci_conn_check_pending(hdev);
1da177e4
LT		 2299}
2300
70c46425
JH		 2301static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2302{
2303 struct hci_cp_reject_conn_req cp;
2304
2305 bacpy(&cp.bdaddr, bdaddr);
2306 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2307 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2308}
2309
6039aa73 2310static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2311{
a9de9248
MH		 2312 struct hci_ev_conn_request *ev = (void *) skb->data;
2313 int mask = hdev->link_mode;
70c46425
JH		 2314 struct inquiry_entry *ie;
2315 struct hci_conn *conn;
20714bfe 2316 __u8 flags = 0;
1da177e4 2317
6ed93dc6 2318 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2319 ev->link_type);
1da177e4 2320
20714bfe
FD		 2321 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2322 &flags);
1da177e4 2323
70c46425
JH		 2324 if (!(mask & HCI_LM_ACCEPT)) {
2325 hci_reject_conn(hdev, &ev->bdaddr);
2326 return;
2327 }
2328
46c4c941
JH		 2329 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2330 BDADDR_BREDR)) {
2331 hci_reject_conn(hdev, &ev->bdaddr);
2332 return;
2333 }
2334
6a8fc95c
JH		 2335 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2336 * connection. These features are only touched through mgmt so
2337 * only do the checks if HCI_MGMT is set.
2338 */
d7a5a11d
MH		 2339 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2340 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
46c4c941
JH		 2341 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2342 BDADDR_BREDR)) {
2343 hci_reject_conn(hdev, &ev->bdaddr);
2344 return;
70c46425 2345 }
1da177e4 2346
70c46425 2347 /* Connection accepted */
b6a0dc82 2348
70c46425
JH		 2349 hci_dev_lock(hdev);
2350
2351 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2352 if (ie)
2353 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2354
70c46425
JH		 2355 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2356 &ev->bdaddr);
2357 if (!conn) {
a5c4e309
JH		 2358 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2359 HCI_ROLE_SLAVE);
a9de9248 2360 if (!conn) {
70c46425
JH		 2361 BT_ERR("No memory for new connection");
2362 hci_dev_unlock(hdev);
2363 return;
1da177e4 2364 }
70c46425 2365 }
b6a0dc82 2366
70c46425 2367 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2368
70c46425 2369 hci_dev_unlock(hdev);
1da177e4 2370
70c46425
JH		 2371 if (ev->link_type == ACL_LINK ||
2372 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2373 struct hci_cp_accept_conn_req cp;
2374 conn->state = BT_CONNECT;
1da177e4 2375
70c46425 2376 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2377
70c46425
JH		 2378 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2379 cp.role = 0x00; /* Become master */
2380 else
2381 cp.role = 0x01; /* Remain slave */
b6a0dc82 2382
70c46425
JH		 2383 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2384 } else if (!(flags & HCI_PROTO_DEFER)) {
2385 struct hci_cp_accept_sync_conn_req cp;
2386 conn->state = BT_CONNECT;
b6a0dc82 2387
70c46425
JH		 2388 bacpy(&cp.bdaddr, &ev->bdaddr);
2389 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2390
70c46425
JH		 2391 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2392 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2393 cp.max_latency = cpu_to_le16(0xffff);
2394 cp.content_format = cpu_to_le16(hdev->voice_setting);
2395 cp.retrans_effort = 0xff;
1da177e4 2396
70c46425
JH		 2397 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2398 &cp);
a9de9248 2399 } else {
70c46425 2400 conn->state = BT_CONNECT2;
539c496d 2401 hci_connect_cfm(conn, 0);
1da177e4 2402 }
1da177e4
LT		 2403}
2404
f0d6a0ea
MA		 2405static u8 hci_to_mgmt_reason(u8 err)
2406{
2407 switch (err) {
2408 case HCI_ERROR_CONNECTION_TIMEOUT:
2409 return MGMT_DEV_DISCONN_TIMEOUT;
2410 case HCI_ERROR_REMOTE_USER_TERM:
2411 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2412 case HCI_ERROR_REMOTE_POWER_OFF:
2413 return MGMT_DEV_DISCONN_REMOTE;
2414 case HCI_ERROR_LOCAL_HOST_TERM:
2415 return MGMT_DEV_DISCONN_LOCAL_HOST;
2416 default:
2417 return MGMT_DEV_DISCONN_UNKNOWN;
2418 }
2419}
2420
6039aa73 2421static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2422{
a9de9248 2423 struct hci_ev_disconn_complete *ev = (void *) skb->data;
abf54a50 2424 u8 reason = hci_to_mgmt_reason(ev->reason);
9fcb18ef 2425 struct hci_conn_params *params;
04837f64 2426 struct hci_conn *conn;
12d4a3b2 2427 bool mgmt_connected;
3846220b 2428 u8 type;
04837f64 2429
9f1db00c 2430 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2431
2432 hci_dev_lock(hdev);
2433
2434 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2435 if (!conn)
2436 goto unlock;
7d0db0a3 2437
abf54a50
AG		 2438 if (ev->status) {
2439 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2440 conn->dst_type, ev->status);
2441 goto unlock;
37d9ef76 2442 }
f7520543 2443
3846220b
AG		 2444 conn->state = BT_CLOSED;
2445
12d4a3b2
JH		 2446 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2447 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2448 reason, mgmt_connected);
abf54a50 2449
22f433dc
JH		 2450 if (conn->type == ACL_LINK) {
2451 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2452 hci_remove_link_key(hdev, &conn->dst);
2453
1d2dc5b7 2454 hci_update_page_scan(hdev);
22f433dc 2455 }
2210246c 2456
9fcb18ef
AG		 2457 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2458 if (params) {
2459 switch (params->auto_connect) {
2460 case HCI_AUTO_CONN_LINK_LOSS:
2461 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2462 break;
2463 /* Fall through */
2464
4b9e7e75 2465 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2466 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2467 list_del_init(&params->action);
2468 list_add(&params->action, &hdev->pend_le_conns);
2469 hci_update_background_scan(hdev);
9fcb18ef
AG		 2470 break;
2471
2472 default:
2473 break;
2474 }
2475 }
2476
3846220b 2477 type = conn->type;
2210246c 2478
3a6d576b 2479 hci_disconn_cfm(conn, ev->reason);
3846220b
AG		 2480 hci_conn_del(conn);
2481
2482 /* Re-enable advertising if necessary, since it might
2483 * have been disabled by the connection. From the
2484 * HCI_LE_Set_Advertise_Enable command description in
2485 * the core specification (v4.0):
2486 * "The Controller shall continue advertising until the Host
2487 * issues an LE_Set_Advertise_Enable command with
2488 * Advertising_Enable set to 0x00 (Advertising is disabled)
2489 * or until a connection is created or until the Advertising
2490 * is timed out due to Directed Advertising."
2491 */
2492 if (type == LE_LINK)
2493 mgmt_reenable_advertising(hdev);
f7520543
JH		 2494
2495unlock:
04837f64
MH		 2496 hci_dev_unlock(hdev);
2497}
2498
6039aa73 2499static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2500{
a9de9248 2501 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2502 struct hci_conn *conn;
1da177e4 2503
9f1db00c 2504 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2505
2506 hci_dev_lock(hdev);
2507
04837f64 2508 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2509 if (!conn)
2510 goto unlock;
2511
2512 if (!ev->status) {
aa64a8b5 2513 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2514 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
d7556e20 2515 BT_INFO("re-auth of legacy device is not possible.");
2a611692 2516 } else {
4dae2798 2517 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2518 conn->sec_level = conn->pending_sec_level;
2a611692 2519 }
d7556e20 2520 } else {
e1e930f5 2521 mgmt_auth_failed(conn, ev->status);
d7556e20 2522 }
1da177e4 2523
51a8efd7
JH		 2524 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2525 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2526
d7556e20 2527 if (conn->state == BT_CONFIG) {
aa64a8b5 2528 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2529 struct hci_cp_set_conn_encrypt cp;
2530 cp.handle = ev->handle;
2531 cp.encrypt = 0x01;
2532 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2533 &cp);
052b30b0 2534 } else {
d7556e20 2535 conn->state = BT_CONNECTED;
539c496d 2536 hci_connect_cfm(conn, ev->status);
76a68ba0 2537 hci_conn_drop(conn);
052b30b0 2538 }
d7556e20
WR		 2539 } else {
2540 hci_auth_cfm(conn, ev->status);
052b30b0 2541
d7556e20
WR		 2542 hci_conn_hold(conn);
2543 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2544 hci_conn_drop(conn);
d7556e20
WR		 2545 }
2546
51a8efd7 2547 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2548 if (!ev->status) {
2549 struct hci_cp_set_conn_encrypt cp;
2550 cp.handle = ev->handle;
2551 cp.encrypt = 0x01;
2552 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2553 &cp);
d7556e20 2554 } else {
51a8efd7 2555 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2556 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2557 }
2558 }
2559
d7556e20 2560unlock:
1da177e4
LT		 2561 hci_dev_unlock(hdev);
2562}
2563
6039aa73 2564static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2565{
127178d2
JH		 2566 struct hci_ev_remote_name *ev = (void *) skb->data;
2567 struct hci_conn *conn;
2568
a9de9248 2569 BT_DBG("%s", hdev->name);
1da177e4 2570
a9de9248 2571 hci_conn_check_pending(hdev);
127178d2
JH		 2572
2573 hci_dev_lock(hdev);
2574
b644ba33 2575 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2576
d7a5a11d 2577 if (!hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2578 goto check_auth;
a88a9652 2579
b644ba33
JH		 2580 if (ev->status == 0)
2581 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2582 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2583 else
2584 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2585
2586check_auth:
79c6c70c
JH		 2587 if (!conn)
2588 goto unlock;
2589
2590 if (!hci_outgoing_auth_needed(hdev, conn))
2591 goto unlock;
2592
51a8efd7 2593 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2594 struct hci_cp_auth_requested cp;
977f8fce
JH		 2595
2596 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2597
127178d2
JH		 2598 cp.handle = __cpu_to_le16(conn->handle);
2599 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2600 }
2601
79c6c70c 2602unlock:
127178d2 2603 hci_dev_unlock(hdev);
a9de9248
MH		 2604}
2605
6039aa73 2606static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2607{
2608 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2609 struct hci_conn *conn;
2610
9f1db00c 2611 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2612
2613 hci_dev_lock(hdev);
2614
04837f64 2615 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2616 if (!conn)
2617 goto unlock;
1da177e4 2618
dc8357cc
MH		 2619 if (!ev->status) {
2620 if (ev->encrypt) {
2621 /* Encryption implies authentication */
4dae2798
JH		 2622 set_bit(HCI_CONN_AUTH, &conn->flags);
2623 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2624 conn->sec_level = conn->pending_sec_level;
abf76bad 2625
914a6ffe
MH		 2626 /* P-256 authentication key implies FIPS */
2627 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2628 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2629
abf76bad
MH		 2630 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2631 conn->type == LE_LINK)
2632 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2633 } else {
4dae2798 2634 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2635 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2636 }
dc8357cc 2637 }
a7d7723a 2638
7ed3fa20
JH		 2639 /* We should disregard the current RPA and generate a new one
2640 * whenever the encryption procedure fails.
2641 */
2642 if (ev->status && conn->type == LE_LINK)
a1536da2 2643 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7ed3fa20 2644
dc8357cc 2645 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2646
dc8357cc
MH		 2647 if (ev->status && conn->state == BT_CONNECTED) {
2648 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2649 hci_conn_drop(conn);
2650 goto unlock;
1da177e4
LT		 2651 }
2652
dc8357cc
MH		 2653 if (conn->state == BT_CONFIG) {
2654 if (!ev->status)
2655 conn->state = BT_CONNECTED;
2656
40b552aa
MH		 2657 /* In Secure Connections Only mode, do not allow any
2658 * connections that are not encrypted with AES-CCM
2659 * using a P-256 authenticated combination key.
2660 */
d7a5a11d 2661 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
40b552aa
MH		 2662 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2663 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
539c496d 2664 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
40b552aa
MH		 2665 hci_conn_drop(conn);
2666 goto unlock;
2667 }
2668
539c496d 2669 hci_connect_cfm(conn, ev->status);
dc8357cc
MH		 2670 hci_conn_drop(conn);
2671 } else
2672 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2673
a7d7723a 2674unlock:
1da177e4
LT		 2675 hci_dev_unlock(hdev);
2676}
2677
6039aa73
GP		 2678static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2679 struct sk_buff *skb)
1da177e4 2680{
a9de9248 2681 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2682 struct hci_conn *conn;
1da177e4 2683
9f1db00c 2684 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2685
2686 hci_dev_lock(hdev);
2687
04837f64 2688 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2689 if (conn) {
2690 if (!ev->status)
4dae2798 2691 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 2692
51a8efd7 2693 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 2694
2695 hci_key_change_cfm(conn, ev->status);
2696 }
2697
2698 hci_dev_unlock(hdev);
2699}
2700
6039aa73
GP		 2701static void hci_remote_features_evt(struct hci_dev *hdev,
2702 struct sk_buff *skb)
1da177e4 2703{
a9de9248
MH		 2704 struct hci_ev_remote_features *ev = (void *) skb->data;
2705 struct hci_conn *conn;
2706
9f1db00c 2707 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 2708
a9de9248
MH		 2709 hci_dev_lock(hdev);
2710
2711 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2712 if (!conn)
2713 goto unlock;
769be974 2714
ccd556fe 2715 if (!ev->status)
cad718ed 2716 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 2717
2718 if (conn->state != BT_CONFIG)
2719 goto unlock;
2720
ac363cf9
SJ		 2721 if (!ev->status && lmp_ext_feat_capable(hdev) &&
2722 lmp_ext_feat_capable(conn)) {
ccd556fe
JH		 2723 struct hci_cp_read_remote_ext_features cp;
2724 cp.handle = ev->handle;
2725 cp.page = 0x01;
2726 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 2727 sizeof(cp), &cp);
392599b9
JH		 2728 goto unlock;
2729 }
2730
671267bf 2731 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 2732 struct hci_cp_remote_name_req cp;
2733 memset(&cp, 0, sizeof(cp));
2734 bacpy(&cp.bdaddr, &conn->dst);
2735 cp.pscan_rep_mode = 0x02;
2736 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 2737 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 2738 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 2739
127178d2 2740 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 2741 conn->state = BT_CONNECTED;
539c496d 2742 hci_connect_cfm(conn, ev->status);
76a68ba0 2743 hci_conn_drop(conn);
769be974 2744 }
a9de9248 2745
ccd556fe 2746unlock:
a9de9248 2747 hci_dev_unlock(hdev);
1da177e4
LT		 2748}
2749
e6214487
JH		 2750static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2751 u16 *opcode, u8 *status,
2752 hci_req_complete_t *req_complete,
2753 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 2754{
2755 struct hci_ev_cmd_complete *ev = (void *) skb->data;
a9de9248 2756
e6214487
JH		 2757 *opcode = __le16_to_cpu(ev->opcode);
2758 *status = skb->data[sizeof(*ev)];
a9de9248 2759
e6214487 2760 skb_pull(skb, sizeof(*ev));
a9de9248 2761
e6214487 2762 switch (*opcode) {
a9de9248
MH		 2763 case HCI_OP_INQUIRY_CANCEL:
2764 hci_cc_inquiry_cancel(hdev, skb);
2765 break;
2766
4d93483b
AG		 2767 case HCI_OP_PERIODIC_INQ:
2768 hci_cc_periodic_inq(hdev, skb);
2769 break;
2770
a9de9248
MH		 2771 case HCI_OP_EXIT_PERIODIC_INQ:
2772 hci_cc_exit_periodic_inq(hdev, skb);
2773 break;
2774
2775 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2776 hci_cc_remote_name_req_cancel(hdev, skb);
2777 break;
2778
2779 case HCI_OP_ROLE_DISCOVERY:
2780 hci_cc_role_discovery(hdev, skb);
2781 break;
2782
e4e8e37c
MH		 2783 case HCI_OP_READ_LINK_POLICY:
2784 hci_cc_read_link_policy(hdev, skb);
2785 break;
2786
a9de9248
MH		 2787 case HCI_OP_WRITE_LINK_POLICY:
2788 hci_cc_write_link_policy(hdev, skb);
2789 break;
2790
e4e8e37c
MH		 2791 case HCI_OP_READ_DEF_LINK_POLICY:
2792 hci_cc_read_def_link_policy(hdev, skb);
2793 break;
2794
2795 case HCI_OP_WRITE_DEF_LINK_POLICY:
2796 hci_cc_write_def_link_policy(hdev, skb);
2797 break;
2798
a9de9248
MH		 2799 case HCI_OP_RESET:
2800 hci_cc_reset(hdev, skb);
2801 break;
2802
c2f0f979
MH		 2803 case HCI_OP_READ_STORED_LINK_KEY:
2804 hci_cc_read_stored_link_key(hdev, skb);
2805 break;
2806
a9366120
MH		 2807 case HCI_OP_DELETE_STORED_LINK_KEY:
2808 hci_cc_delete_stored_link_key(hdev, skb);
2809 break;
2810
a9de9248
MH		 2811 case HCI_OP_WRITE_LOCAL_NAME:
2812 hci_cc_write_local_name(hdev, skb);
2813 break;
2814
2815 case HCI_OP_READ_LOCAL_NAME:
2816 hci_cc_read_local_name(hdev, skb);
2817 break;
2818
2819 case HCI_OP_WRITE_AUTH_ENABLE:
2820 hci_cc_write_auth_enable(hdev, skb);
2821 break;
2822
2823 case HCI_OP_WRITE_ENCRYPT_MODE:
2824 hci_cc_write_encrypt_mode(hdev, skb);
2825 break;
2826
2827 case HCI_OP_WRITE_SCAN_ENABLE:
2828 hci_cc_write_scan_enable(hdev, skb);
2829 break;
2830
2831 case HCI_OP_READ_CLASS_OF_DEV:
2832 hci_cc_read_class_of_dev(hdev, skb);
2833 break;
2834
2835 case HCI_OP_WRITE_CLASS_OF_DEV:
2836 hci_cc_write_class_of_dev(hdev, skb);
2837 break;
2838
2839 case HCI_OP_READ_VOICE_SETTING:
2840 hci_cc_read_voice_setting(hdev, skb);
2841 break;
2842
2843 case HCI_OP_WRITE_VOICE_SETTING:
2844 hci_cc_write_voice_setting(hdev, skb);
2845 break;
2846
b4cb9fb2
MH		 2847 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2848 hci_cc_read_num_supported_iac(hdev, skb);
2849 break;
2850
333140b5
MH		 2851 case HCI_OP_WRITE_SSP_MODE:
2852 hci_cc_write_ssp_mode(hdev, skb);
2853 break;
2854
eac83dc6
MH		 2855 case HCI_OP_WRITE_SC_SUPPORT:
2856 hci_cc_write_sc_support(hdev, skb);
2857 break;
2858
a9de9248
MH		 2859 case HCI_OP_READ_LOCAL_VERSION:
2860 hci_cc_read_local_version(hdev, skb);
2861 break;
2862
2863 case HCI_OP_READ_LOCAL_COMMANDS:
2864 hci_cc_read_local_commands(hdev, skb);
2865 break;
2866
2867 case HCI_OP_READ_LOCAL_FEATURES:
2868 hci_cc_read_local_features(hdev, skb);
2869 break;
2870
971e3a4b
AG		 2871 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2872 hci_cc_read_local_ext_features(hdev, skb);
2873 break;
2874
a9de9248
MH		 2875 case HCI_OP_READ_BUFFER_SIZE:
2876 hci_cc_read_buffer_size(hdev, skb);
2877 break;
2878
2879 case HCI_OP_READ_BD_ADDR:
2880 hci_cc_read_bd_addr(hdev, skb);
2881 break;
2882
f332ec66
JH		 2883 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2884 hci_cc_read_page_scan_activity(hdev, skb);
2885 break;
2886
4a3ee763
JH		 2887 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2888 hci_cc_write_page_scan_activity(hdev, skb);
2889 break;
2890
f332ec66
JH		 2891 case HCI_OP_READ_PAGE_SCAN_TYPE:
2892 hci_cc_read_page_scan_type(hdev, skb);
2893 break;
2894
4a3ee763
JH		 2895 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2896 hci_cc_write_page_scan_type(hdev, skb);
2897 break;
2898
350ee4cf
AE		 2899 case HCI_OP_READ_DATA_BLOCK_SIZE:
2900 hci_cc_read_data_block_size(hdev, skb);
2901 break;
2902
1e89cffb
AE		 2903 case HCI_OP_READ_FLOW_CONTROL_MODE:
2904 hci_cc_read_flow_control_mode(hdev, skb);
2905 break;
2906
928abaa7
AE		 2907 case HCI_OP_READ_LOCAL_AMP_INFO:
2908 hci_cc_read_local_amp_info(hdev, skb);
2909 break;
2910
33f35721
JH		 2911 case HCI_OP_READ_CLOCK:
2912 hci_cc_read_clock(hdev, skb);
2913 break;
2914
903e4541
AE		 2915 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2916 hci_cc_read_local_amp_assoc(hdev, skb);
2917 break;
2918
d5859e22
JH		 2919 case HCI_OP_READ_INQ_RSP_TX_POWER:
2920 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2921 break;
2922
980e1a53
JH		 2923 case HCI_OP_PIN_CODE_REPLY:
2924 hci_cc_pin_code_reply(hdev, skb);
2925 break;
2926
2927 case HCI_OP_PIN_CODE_NEG_REPLY:
2928 hci_cc_pin_code_neg_reply(hdev, skb);
2929 break;
2930
c35938b2 2931 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 2932 hci_cc_read_local_oob_data(hdev, skb);
2933 break;
2934
2935 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2936 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 2937 break;
2938
6ed58ec5
VT		 2939 case HCI_OP_LE_READ_BUFFER_SIZE:
2940 hci_cc_le_read_buffer_size(hdev, skb);
2941 break;
2942
60e77321
JH		 2943 case HCI_OP_LE_READ_LOCAL_FEATURES:
2944 hci_cc_le_read_local_features(hdev, skb);
2945 break;
2946
8fa19098
JH		 2947 case HCI_OP_LE_READ_ADV_TX_POWER:
2948 hci_cc_le_read_adv_tx_power(hdev, skb);
2949 break;
2950
a5c29683
JH		 2951 case HCI_OP_USER_CONFIRM_REPLY:
2952 hci_cc_user_confirm_reply(hdev, skb);
2953 break;
2954
2955 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2956 hci_cc_user_confirm_neg_reply(hdev, skb);
2957 break;
2958
1143d458
BG		 2959 case HCI_OP_USER_PASSKEY_REPLY:
2960 hci_cc_user_passkey_reply(hdev, skb);
2961 break;
2962
2963 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2964 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 2965 break;
07f7fa5d 2966
7a4cd51d
MH		 2967 case HCI_OP_LE_SET_RANDOM_ADDR:
2968 hci_cc_le_set_random_addr(hdev, skb);
2969 break;
2970
c1d5dc4a
JH		 2971 case HCI_OP_LE_SET_ADV_ENABLE:
2972 hci_cc_le_set_adv_enable(hdev, skb);
2973 break;
2974
533553f8
MH		 2975 case HCI_OP_LE_SET_SCAN_PARAM:
2976 hci_cc_le_set_scan_param(hdev, skb);
2977 break;
2978
eb9d91f5
AG		 2979 case HCI_OP_LE_SET_SCAN_ENABLE:
2980 hci_cc_le_set_scan_enable(hdev, skb);
2981 break;
2982
cf1d081f
JH		 2983 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2984 hci_cc_le_read_white_list_size(hdev, skb);
2985 break;
2986
0f36b589
MH		 2987 case HCI_OP_LE_CLEAR_WHITE_LIST:
2988 hci_cc_le_clear_white_list(hdev, skb);
2989 break;
2990
2991 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2992 hci_cc_le_add_to_white_list(hdev, skb);
2993 break;
2994
2995 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2996 hci_cc_le_del_from_white_list(hdev, skb);
2997 break;
2998
9b008c04
JH		 2999 case HCI_OP_LE_READ_SUPPORTED_STATES:
3000 hci_cc_le_read_supported_states(hdev, skb);
3001 break;
3002
a8e1bfaa
MH		 3003 case HCI_OP_LE_READ_DEF_DATA_LEN:
3004 hci_cc_le_read_def_data_len(hdev, skb);
3005 break;
3006
3007 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3008 hci_cc_le_write_def_data_len(hdev, skb);
3009 break;
3010
3011 case HCI_OP_LE_READ_MAX_DATA_LEN:
3012 hci_cc_le_read_max_data_len(hdev, skb);
3013 break;
3014
f9b49306
AG		 3015 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3016 hci_cc_write_le_host_supported(hdev, skb);
3017 break;
3018
56ed2cb8
JH		 3019 case HCI_OP_LE_SET_ADV_PARAM:
3020 hci_cc_set_adv_param(hdev, skb);
3021 break;
3022
93c284ee
AE		 3023 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
3024 hci_cc_write_remote_amp_assoc(hdev, skb);
3025 break;
3026
5ae76a94
AK		 3027 case HCI_OP_READ_RSSI:
3028 hci_cc_read_rssi(hdev, skb);
3029 break;
3030
5a134fae
AK		 3031 case HCI_OP_READ_TX_POWER:
3032 hci_cc_read_tx_power(hdev, skb);
3033 break;
3034
c50b33c8
MH		 3035 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3036 hci_cc_write_ssp_debug_mode(hdev, skb);
3037 break;
3038
a9de9248 3039 default:
e6214487 3040 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3041 break;
3042 }
3043
e6214487 3044 if (*opcode != HCI_OP_NOP)
65cc2b49 3045 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3046
600b2150
JH		 3047 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3048 atomic_set(&hdev->cmd_cnt, 1);
3049
e6214487
JH		 3050 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3051 req_complete_skb);
9238f36a 3052
600b2150
JH		 3053 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3054 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3055}
3056
e6214487
JH		 3057static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3058 u16 *opcode, u8 *status,
3059 hci_req_complete_t *req_complete,
3060 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3061{
3062 struct hci_ev_cmd_status *ev = (void *) skb->data;
a9de9248
MH		 3063
3064 skb_pull(skb, sizeof(*ev));
3065
e6214487
JH		 3066 *opcode = __le16_to_cpu(ev->opcode);
3067 *status = ev->status;
a9de9248 3068
e6214487 3069 switch (*opcode) {
a9de9248
MH		 3070 case HCI_OP_INQUIRY:
3071 hci_cs_inquiry(hdev, ev->status);
3072 break;
3073
3074 case HCI_OP_CREATE_CONN:
3075 hci_cs_create_conn(hdev, ev->status);
3076 break;
3077
9645c76c
KP		 3078 case HCI_OP_DISCONNECT:
3079 hci_cs_disconnect(hdev, ev->status);
3080 break;
3081
a9de9248
MH		 3082 case HCI_OP_ADD_SCO:
3083 hci_cs_add_sco(hdev, ev->status);
3084 break;
3085
f8558555
MH		 3086 case HCI_OP_AUTH_REQUESTED:
3087 hci_cs_auth_requested(hdev, ev->status);
3088 break;
3089
3090 case HCI_OP_SET_CONN_ENCRYPT:
3091 hci_cs_set_conn_encrypt(hdev, ev->status);
3092 break;
3093
a9de9248
MH		 3094 case HCI_OP_REMOTE_NAME_REQ:
3095 hci_cs_remote_name_req(hdev, ev->status);
3096 break;
3097
769be974
MH		 3098 case HCI_OP_READ_REMOTE_FEATURES:
3099 hci_cs_read_remote_features(hdev, ev->status);
3100 break;
3101
3102 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3103 hci_cs_read_remote_ext_features(hdev, ev->status);
3104 break;
3105
a9de9248
MH		 3106 case HCI_OP_SETUP_SYNC_CONN:
3107 hci_cs_setup_sync_conn(hdev, ev->status);
3108 break;
3109
9645c76c
KP		 3110 case HCI_OP_CREATE_PHY_LINK:
3111 hci_cs_create_phylink(hdev, ev->status);
3112 break;
3113
3114 case HCI_OP_ACCEPT_PHY_LINK:
3115 hci_cs_accept_phylink(hdev, ev->status);
3116 break;
3117
a9de9248
MH		 3118 case HCI_OP_SNIFF_MODE:
3119 hci_cs_sniff_mode(hdev, ev->status);
3120 break;
3121
3122 case HCI_OP_EXIT_SNIFF_MODE:
3123 hci_cs_exit_sniff_mode(hdev, ev->status);
3124 break;
3125
50fc85f1
KP		 3126 case HCI_OP_SWITCH_ROLE:
3127 hci_cs_switch_role(hdev, ev->status);
3128 break;
3129
cb1d68f7
JH		 3130 case HCI_OP_LE_CREATE_CONN:
3131 hci_cs_le_create_conn(hdev, ev->status);
3132 break;
3133
0fe29fd1
MH		 3134 case HCI_OP_LE_READ_REMOTE_FEATURES:
3135 hci_cs_le_read_remote_features(hdev, ev->status);
3136 break;
3137
81d0c8ad
JH		 3138 case HCI_OP_LE_START_ENC:
3139 hci_cs_le_start_enc(hdev, ev->status);
3140 break;
3141
a9de9248 3142 default:
e6214487 3143 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3144 break;
3145 }
3146
e6214487 3147 if (*opcode != HCI_OP_NOP)
65cc2b49 3148 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3149
600b2150
JH		 3150 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3151 atomic_set(&hdev->cmd_cnt, 1);
3152
444c6dd5
JH		 3153 /* Indicate request completion if the command failed. Also, if
3154 * we're not waiting for a special event and we get a success
3155 * command status we should try to flag the request as completed
3156 * (since for this kind of commands there will not be a command
3157 * complete event).
3158 */
02350a72 3159 if (ev->status ||
db6e3e8d 3160 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
e6214487
JH		 3161 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3162 req_complete_skb);
9238f36a 3163
600b2150
JH		 3164 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3165 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3166}
3167
24dfa343
MH		 3168static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3169{
3170 struct hci_ev_hardware_error *ev = (void *) skb->data;
3171
c7741d16
MH		 3172 hdev->hw_error_code = ev->code;
3173
3174 queue_work(hdev->req_workqueue, &hdev->error_reset);
24dfa343
MH		 3175}
3176
6039aa73 3177static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3178{
3179 struct hci_ev_role_change *ev = (void *) skb->data;
3180 struct hci_conn *conn;
3181
9f1db00c 3182 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 3183
3184 hci_dev_lock(hdev);
3185
3186 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3187 if (conn) {
40bef302
JH		 3188 if (!ev->status)
3189 conn->role = ev->role;
a9de9248 3190
51a8efd7 3191 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 3192
3193 hci_role_switch_cfm(conn, ev->status, ev->role);
3194 }
3195
3196 hci_dev_unlock(hdev);
3197}
3198
6039aa73 3199static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3200{
3201 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 3202 int i;
3203
32ac5b9b
AE		 3204 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3205 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3206 return;
3207 }
3208
c5993de8 3209 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3210 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
a9de9248
MH		 3211 BT_DBG("%s bad parameters", hdev->name);
3212 return;
3213 }
3214
c5993de8
AE		 3215 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3216
613a1c0c
AE		 3217 for (i = 0; i < ev->num_hndl; i++) {
3218 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 3219 struct hci_conn *conn;
3220 __u16 handle, count;
3221
613a1c0c
AE		 3222 handle = __le16_to_cpu(info->handle);
3223 count = __le16_to_cpu(info->count);
a9de9248
MH		 3224
3225 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 3226 if (!conn)
3227 continue;
3228
3229 conn->sent -= count;
3230
3231 switch (conn->type) {
3232 case ACL_LINK:
3233 hdev->acl_cnt += count;
3234 if (hdev->acl_cnt > hdev->acl_pkts)
3235 hdev->acl_cnt = hdev->acl_pkts;
3236 break;
3237
3238 case LE_LINK:
3239 if (hdev->le_pkts) {
3240 hdev->le_cnt += count;
3241 if (hdev->le_cnt > hdev->le_pkts)
3242 hdev->le_cnt = hdev->le_pkts;
3243 } else {
70f23020
AE		 3244 hdev->acl_cnt += count;
3245 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 3246 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 3247 }
f4280918
AE		 3248 break;
3249
3250 case SCO_LINK:
3251 hdev->sco_cnt += count;
3252 if (hdev->sco_cnt > hdev->sco_pkts)
3253 hdev->sco_cnt = hdev->sco_pkts;
3254 break;
3255
3256 default:
3257 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3258 break;
a9de9248
MH		 3259 }
3260 }
3261
3eff45ea 3262 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3263}
3264
76ef7cf7
AE		 3265static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3266 __u16 handle)
3267{
3268 struct hci_chan *chan;
3269
3270 switch (hdev->dev_type) {
3271 case HCI_BREDR:
3272 return hci_conn_hash_lookup_handle(hdev, handle);
3273 case HCI_AMP:
3274 chan = hci_chan_lookup_handle(hdev, handle);
3275 if (chan)
3276 return chan->conn;
3277 break;
3278 default:
3279 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3280 break;
3281 }
3282
3283 return NULL;
3284}
3285
6039aa73 3286static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3287{
3288 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3289 int i;
3290
3291 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3292 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3293 return;
3294 }
3295
3296 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3297 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
25e89e99
AE		 3298 BT_DBG("%s bad parameters", hdev->name);
3299 return;
3300 }
3301
3302 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3303 ev->num_hndl);
25e89e99
AE		 3304
3305 for (i = 0; i < ev->num_hndl; i++) {
3306 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3307 struct hci_conn *conn = NULL;
25e89e99
AE		 3308 __u16 handle, block_count;
3309
3310 handle = __le16_to_cpu(info->handle);
3311 block_count = __le16_to_cpu(info->blocks);
3312
76ef7cf7 3313 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3314 if (!conn)
3315 continue;
3316
3317 conn->sent -= block_count;
3318
3319 switch (conn->type) {
3320 case ACL_LINK:
bd1eb66b 3321 case AMP_LINK:
25e89e99
AE		 3322 hdev->block_cnt += block_count;
3323 if (hdev->block_cnt > hdev->num_blocks)
3324 hdev->block_cnt = hdev->num_blocks;
3325 break;
3326
3327 default:
3328 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3329 break;
3330 }
3331 }
3332
3333 queue_work(hdev->workqueue, &hdev->tx_work);
3334}
3335
6039aa73 3336static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3337{
a9de9248 3338 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3339 struct hci_conn *conn;
3340
9f1db00c 3341 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3342
3343 hci_dev_lock(hdev);
3344
3345 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3346 if (conn) {
3347 conn->mode = ev->mode;
a9de9248 3348
8fc9ced3
GP		 3349 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3350 &conn->flags)) {
a9de9248 3351 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3352 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3353 else
58a681ef 3354 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3355 }
e73439d8 3356
51a8efd7 3357 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3358 hci_sco_setup(conn, ev->status);
04837f64
MH		 3359 }
3360
3361 hci_dev_unlock(hdev);
3362}
3363
6039aa73 3364static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3365{
052b30b0
MH		 3366 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3367 struct hci_conn *conn;
3368
a9de9248 3369 BT_DBG("%s", hdev->name);
052b30b0
MH		 3370
3371 hci_dev_lock(hdev);
3372
3373 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3374 if (!conn)
3375 goto unlock;
3376
3377 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3378 hci_conn_hold(conn);
3379 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3380 hci_conn_drop(conn);
052b30b0
MH		 3381 }
3382
d7a5a11d 3383 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2f407f0a 3384 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3385 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3386 sizeof(ev->bdaddr), &ev->bdaddr);
d7a5a11d 3387 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
a770bb5a
WR		 3388 u8 secure;
3389
3390 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3391 secure = 1;
3392 else
3393 secure = 0;
3394
744cf19e 3395 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3396 }
980e1a53 3397
b6f98044 3398unlock:
052b30b0 3399 hci_dev_unlock(hdev);
a9de9248
MH		 3400}
3401
cb6f3f7a
JH		 3402static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3403{
3404 if (key_type == HCI_LK_CHANGED_COMBINATION)
3405 return;
3406
3407 conn->pin_length = pin_len;
3408 conn->key_type = key_type;
3409
3410 switch (key_type) {
3411 case HCI_LK_LOCAL_UNIT:
3412 case HCI_LK_REMOTE_UNIT:
3413 case HCI_LK_DEBUG_COMBINATION:
3414 return;
3415 case HCI_LK_COMBINATION:
3416 if (pin_len == 16)
3417 conn->pending_sec_level = BT_SECURITY_HIGH;
3418 else
3419 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3420 break;
3421 case HCI_LK_UNAUTH_COMBINATION_P192:
3422 case HCI_LK_UNAUTH_COMBINATION_P256:
3423 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3424 break;
3425 case HCI_LK_AUTH_COMBINATION_P192:
3426 conn->pending_sec_level = BT_SECURITY_HIGH;
3427 break;
3428 case HCI_LK_AUTH_COMBINATION_P256:
3429 conn->pending_sec_level = BT_SECURITY_FIPS;
3430 break;
3431 }
3432}
3433
6039aa73 3434static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3435{
55ed8ca1
JH		 3436 struct hci_ev_link_key_req *ev = (void *) skb->data;
3437 struct hci_cp_link_key_reply cp;
3438 struct hci_conn *conn;
3439 struct link_key *key;
3440
a9de9248 3441 BT_DBG("%s", hdev->name);
55ed8ca1 3442
d7a5a11d 3443 if (!hci_dev_test_flag(hdev, HCI_MGMT))
55ed8ca1
JH		 3444 return;
3445
3446 hci_dev_lock(hdev);
3447
3448 key = hci_find_link_key(hdev, &ev->bdaddr);
3449 if (!key) {
6ed93dc6
AE		 3450 BT_DBG("%s link key not found for %pMR", hdev->name,
3451 &ev->bdaddr);
55ed8ca1
JH		 3452 goto not_found;
3453 }
3454
6ed93dc6
AE		 3455 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3456 &ev->bdaddr);
55ed8ca1 3457
55ed8ca1 3458 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3459 if (conn) {
fe8bc5ac
JH		 3460 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3461
66138ce8
MH		 3462 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3463 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3464 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3465 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3466 goto not_found;
3467 }
55ed8ca1 3468
60b83f57 3469 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3470 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3471 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3472 BT_DBG("%s ignoring key unauthenticated for high security",
3473 hdev->name);
60b83f57
WR		 3474 goto not_found;
3475 }
3476
cb6f3f7a 3477 conn_set_key(conn, key->type, key->pin_len);
55ed8ca1
JH		 3478 }
3479
3480 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3481 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3482
3483 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3484
3485 hci_dev_unlock(hdev);
3486
3487 return;
3488
3489not_found:
3490 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3491 hci_dev_unlock(hdev);
a9de9248
MH		 3492}
3493
6039aa73 3494static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3495{
052b30b0
MH		 3496 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3497 struct hci_conn *conn;
7652ff6a
JH		 3498 struct link_key *key;
3499 bool persistent;
55ed8ca1 3500 u8 pin_len = 0;
052b30b0 3501
a9de9248 3502 BT_DBG("%s", hdev->name);
052b30b0
MH		 3503
3504 hci_dev_lock(hdev);
3505
3506 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
82c13d42
JH		 3507 if (!conn)
3508 goto unlock;
3509
3510 hci_conn_hold(conn);
3511 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3512 hci_conn_drop(conn);
3513
fe8bc5ac 3514 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
82c13d42 3515 conn_set_key(conn, ev->key_type, conn->pin_length);
052b30b0 3516
d7a5a11d 3517 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7652ff6a
JH		 3518 goto unlock;
3519
3520 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3521 ev->key_type, pin_len, &persistent);
3522 if (!key)
3523 goto unlock;
3524
cb6f3f7a
JH		 3525 /* Update connection information since adding the key will have
3526 * fixed up the type in the case of changed combination keys.
3527 */
3528 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3529 conn_set_key(conn, key->type, key->pin_len);
3530
7652ff6a 3531 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3532
6d5650c4
JH		 3533 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3534 * is set. If it's not set simply remove the key from the kernel
3535 * list (we've still notified user space about it but with
3536 * store_hint being 0).
3537 */
3538 if (key->type == HCI_LK_DEBUG_COMBINATION &&
d7a5a11d 3539 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
0378b597
JH		 3540 list_del_rcu(&key->list);
3541 kfree_rcu(key, rcu);
82c13d42 3542 goto unlock;
6d5650c4 3543 }
7652ff6a 3544
82c13d42
JH		 3545 if (persistent)
3546 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3547 else
3548 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3549
7652ff6a 3550unlock:
052b30b0 3551 hci_dev_unlock(hdev);
a9de9248
MH		 3552}
3553
6039aa73 3554static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3555{
a9de9248 3556 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3557 struct hci_conn *conn;
1da177e4 3558
9f1db00c 3559 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3560
3561 hci_dev_lock(hdev);
3562
04837f64 3563 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3564 if (conn && !ev->status) {
3565 struct inquiry_entry *ie;
3566
cc11b9c1
AE		 3567 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3568 if (ie) {
1da177e4
LT		 3569 ie->data.clock_offset = ev->clock_offset;
3570 ie->timestamp = jiffies;
3571 }
3572 }
3573
3574 hci_dev_unlock(hdev);
3575}
3576
6039aa73 3577static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 3578{
3579 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3580 struct hci_conn *conn;
3581
9f1db00c 3582 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 3583
3584 hci_dev_lock(hdev);
3585
3586 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3587 if (conn && !ev->status)
3588 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3589
3590 hci_dev_unlock(hdev);
3591}
3592
6039aa73 3593static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 3594{
a9de9248 3595 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 3596 struct inquiry_entry *ie;
3597
3598 BT_DBG("%s", hdev->name);
3599
3600 hci_dev_lock(hdev);
3601
cc11b9c1
AE		 3602 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3603 if (ie) {
85a1e930
MH		 3604 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3605 ie->timestamp = jiffies;
3606 }
3607
3608 hci_dev_unlock(hdev);
3609}
3610
6039aa73
GP		 3611static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3612 struct sk_buff *skb)
a9de9248
MH		 3613{
3614 struct inquiry_data data;
3615 int num_rsp = *((__u8 *) skb->data);
3616
3617 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3618
3619 if (!num_rsp)
3620 return;
3621
d7a5a11d 3622 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3623 return;
3624
a9de9248
MH		 3625 hci_dev_lock(hdev);
3626
3627 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3628 struct inquiry_info_with_rssi_and_pscan_mode *info;
3629 info = (void *) (skb->data + 1);
a9de9248 3630
e17acd40 3631 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3632 u32 flags;
3633
a9de9248
MH		 3634 bacpy(&data.bdaddr, &info->bdaddr);
3635 data.pscan_rep_mode = info->pscan_rep_mode;
3636 data.pscan_period_mode = info->pscan_period_mode;
3637 data.pscan_mode = info->pscan_mode;
3638 memcpy(data.dev_class, info->dev_class, 3);
3639 data.clock_offset = info->clock_offset;
3640 data.rssi = info->rssi;
41a96212 3641 data.ssp_mode = 0x00;
3175405b 3642
af58925c
MH		 3643 flags = hci_inquiry_cache_update(hdev, &data, false);
3644
48264f06 3645 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3646 info->dev_class, info->rssi,
af58925c 3647 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3648 }
3649 } else {
3650 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3651
e17acd40 3652 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3653 u32 flags;
3654
a9de9248
MH		 3655 bacpy(&data.bdaddr, &info->bdaddr);
3656 data.pscan_rep_mode = info->pscan_rep_mode;
3657 data.pscan_period_mode = info->pscan_period_mode;
3658 data.pscan_mode = 0x00;
3659 memcpy(data.dev_class, info->dev_class, 3);
3660 data.clock_offset = info->clock_offset;
3661 data.rssi = info->rssi;
41a96212 3662 data.ssp_mode = 0x00;
af58925c
MH		 3663
3664 flags = hci_inquiry_cache_update(hdev, &data, false);
3665
48264f06 3666 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3667 info->dev_class, info->rssi,
af58925c 3668 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3669 }
3670 }
3671
3672 hci_dev_unlock(hdev);
3673}
3674
6039aa73
GP		 3675static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3676 struct sk_buff *skb)
a9de9248 3677{
41a96212
MH		 3678 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3679 struct hci_conn *conn;
3680
a9de9248 3681 BT_DBG("%s", hdev->name);
41a96212 3682
41a96212
MH		 3683 hci_dev_lock(hdev);
3684
3685 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3686 if (!conn)
3687 goto unlock;
41a96212 3688
cad718ed
JH		 3689 if (ev->page < HCI_MAX_PAGES)
3690 memcpy(conn->features[ev->page], ev->features, 8);
3691
ccd556fe
JH		 3692 if (!ev->status && ev->page == 0x01) {
3693 struct inquiry_entry *ie;
41a96212 3694
cc11b9c1
AE		 3695 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3696 if (ie)
02b7cc62 3697 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 3698
bbb0eada 3699 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 3700 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 3701 } else {
3702 /* It is mandatory by the Bluetooth specification that
3703 * Extended Inquiry Results are only used when Secure
3704 * Simple Pairing is enabled, but some devices violate
3705 * this.
3706 *
3707 * To make these devices work, the internal SSP
3708 * enabled flag needs to be cleared if the remote host
3709 * features do not indicate SSP support */
3710 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3711 }
eb9a8f3f
MH		 3712
3713 if (ev->features[0] & LMP_HOST_SC)
3714 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 3715 }
3716
3717 if (conn->state != BT_CONFIG)
3718 goto unlock;
3719
671267bf 3720 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3721 struct hci_cp_remote_name_req cp;
3722 memset(&cp, 0, sizeof(cp));
3723 bacpy(&cp.bdaddr, &conn->dst);
3724 cp.pscan_rep_mode = 0x02;
3725 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3726 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3727 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3728
127178d2 3729 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 3730 conn->state = BT_CONNECTED;
539c496d 3731 hci_connect_cfm(conn, ev->status);
76a68ba0 3732 hci_conn_drop(conn);
41a96212
MH		 3733 }
3734
ccd556fe 3735unlock:
41a96212 3736 hci_dev_unlock(hdev);
a9de9248
MH		 3737}
3738
6039aa73
GP		 3739static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3740 struct sk_buff *skb)
a9de9248 3741{
b6a0dc82
MH		 3742 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3743 struct hci_conn *conn;
3744
9f1db00c 3745 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 3746
3747 hci_dev_lock(hdev);
3748
3749 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 3750 if (!conn) {
3751 if (ev->link_type == ESCO_LINK)
3752 goto unlock;
3753
3754 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3755 if (!conn)
3756 goto unlock;
3757
3758 conn->type = SCO_LINK;
3759 }
b6a0dc82 3760
732547f9
MH		 3761 switch (ev->status) {
3762 case 0x00:
b6a0dc82
MH		 3763 conn->handle = __le16_to_cpu(ev->handle);
3764 conn->state = BT_CONNECTED;
7d0db0a3 3765
23b9ceb7 3766 hci_debugfs_create_conn(conn);
7d0db0a3 3767 hci_conn_add_sysfs(conn);
732547f9
MH		 3768 break;
3769
81218d20 3770 case 0x10: /* Connection Accept Timeout */
1a4c958c 3771 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 3772 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 3773 case 0x1c: /* SCO interval rejected */
1038a00b 3774 case 0x1a: /* Unsupported Remote Feature */
732547f9 3775 case 0x1f: /* Unspecified error */
27539bc4 3776 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 3777 if (conn->out) {
732547f9
MH		 3778 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3779 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 3780 if (hci_setup_sync(conn, conn->link->handle))
3781 goto unlock;
732547f9
MH		 3782 }
3783 /* fall through */
3784
3785 default:
b6a0dc82 3786 conn->state = BT_CLOSED;
732547f9
MH		 3787 break;
3788 }
b6a0dc82 3789
539c496d 3790 hci_connect_cfm(conn, ev->status);
b6a0dc82
MH		 3791 if (ev->status)
3792 hci_conn_del(conn);
3793
3794unlock:
3795 hci_dev_unlock(hdev);
a9de9248
MH		 3796}
3797
efdcf8e3
MH		 3798static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3799{
3800 size_t parsed = 0;
3801
3802 while (parsed < eir_len) {
3803 u8 field_len = eir[0];
3804
3805 if (field_len == 0)
3806 return parsed;
3807
3808 parsed += field_len + 1;
3809 eir += field_len + 1;
3810 }
3811
3812 return eir_len;
3813}
3814
6039aa73
GP		 3815static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3816 struct sk_buff *skb)
1da177e4 3817{
a9de9248
MH		 3818 struct inquiry_data data;
3819 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3820 int num_rsp = *((__u8 *) skb->data);
9d939d94 3821 size_t eir_len;
1da177e4 3822
a9de9248 3823 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 3824
a9de9248
MH		 3825 if (!num_rsp)
3826 return;
1da177e4 3827
d7a5a11d 3828 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3829 return;
3830
a9de9248
MH		 3831 hci_dev_lock(hdev);
3832
e17acd40 3833 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3834 u32 flags;
3835 bool name_known;
561aafbc 3836
a9de9248 3837 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 3838 data.pscan_rep_mode = info->pscan_rep_mode;
3839 data.pscan_period_mode = info->pscan_period_mode;
3840 data.pscan_mode = 0x00;
a9de9248 3841 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 3842 data.clock_offset = info->clock_offset;
3843 data.rssi = info->rssi;
41a96212 3844 data.ssp_mode = 0x01;
561aafbc 3845
d7a5a11d 3846 if (hci_dev_test_flag(hdev, HCI_MGMT))
4ddb1930 3847 name_known = eir_has_data_type(info->data,
04124681
GP		 3848 sizeof(info->data),
3849 EIR_NAME_COMPLETE);
561aafbc
JH		 3850 else
3851 name_known = true;
3852
af58925c
MH		 3853 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3854
9d939d94 3855 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 3856
48264f06 3857 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 3858 info->dev_class, info->rssi,
3859 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 3860 }
3861
3862 hci_dev_unlock(hdev);
3863}
1da177e4 3864
1c2e0041
JH		 3865static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3866 struct sk_buff *skb)
3867{
3868 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3869 struct hci_conn *conn;
3870
9f1db00c 3871 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 3872 __le16_to_cpu(ev->handle));
3873
3874 hci_dev_lock(hdev);
3875
3876 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3877 if (!conn)
3878 goto unlock;
3879
9eb1fbfa
JH		 3880 /* For BR/EDR the necessary steps are taken through the
3881 * auth_complete event.
3882 */
3883 if (conn->type != LE_LINK)
3884 goto unlock;
3885
1c2e0041
JH		 3886 if (!ev->status)
3887 conn->sec_level = conn->pending_sec_level;
3888
3889 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3890
3891 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 3892 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 3893 hci_conn_drop(conn);
1c2e0041
JH		 3894 goto unlock;
3895 }
3896
3897 if (conn->state == BT_CONFIG) {
3898 if (!ev->status)
3899 conn->state = BT_CONNECTED;
3900
539c496d 3901 hci_connect_cfm(conn, ev->status);
76a68ba0 3902 hci_conn_drop(conn);
1c2e0041
JH		 3903 } else {
3904 hci_auth_cfm(conn, ev->status);
3905
3906 hci_conn_hold(conn);
3907 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3908 hci_conn_drop(conn);
1c2e0041
JH		 3909 }
3910
3911unlock:
3912 hci_dev_unlock(hdev);
3913}
3914
6039aa73 3915static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 3916{
17fa4b9d 3917 /* If remote requests no-bonding follow that lead */
acabae96
MA		 3918 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3919 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 3920 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 3921
b7f94c88
MA		 3922 /* If both remote and local have enough IO capabilities, require
3923 * MITM protection
3924 */
3925 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3926 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3927 return conn->remote_auth | 0x01;
3928
7e74170a
TM		 3929 /* No MITM protection possible so ignore remote requirement */
3930 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 3931}
3932
a83ed81e
MH		 3933static u8 bredr_oob_data_present(struct hci_conn *conn)
3934{
3935 struct hci_dev *hdev = conn->hdev;
3936 struct oob_data *data;
3937
3938 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3939 if (!data)
3940 return 0x00;
3941
455c2ff0
MH		 3942 if (bredr_sc_enabled(hdev)) {
3943 /* When Secure Connections is enabled, then just
3944 * return the present value stored with the OOB
3945 * data. The stored value contains the right present
3946 * information. However it can only be trusted when
3947 * not in Secure Connection Only mode.
3948 */
3949 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3950 return data->present;
659c7fb0 3951
455c2ff0
MH		 3952 /* When Secure Connections Only mode is enabled, then
3953 * the P-256 values are required. If they are not
3954 * available, then do not declare that OOB data is
3955 * present.
659c7fb0 3956 */
455c2ff0
MH		 3957 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3958 !memcmp(data->hash256, ZERO_KEY, 16))
659c7fb0
MH		 3959 return 0x00;
3960
455c2ff0 3961 return 0x02;
659c7fb0 3962 }
a83ed81e 3963
455c2ff0
MH		 3964 /* When Secure Connections is not enabled or actually
3965 * not supported by the hardware, then check that if
3966 * P-192 data values are present.
3967 */
3968 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3969 !memcmp(data->hash192, ZERO_KEY, 16))
3970 return 0x00;
3971
3972 return 0x01;
a83ed81e
MH		 3973}
3974
6039aa73 3975static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 3976{
3977 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3978 struct hci_conn *conn;
3979
3980 BT_DBG("%s", hdev->name);
3981
3982 hci_dev_lock(hdev);
3983
3984 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 3985 if (!conn)
3986 goto unlock;
3987
3988 hci_conn_hold(conn);
3989
d7a5a11d 3990 if (!hci_dev_test_flag(hdev, HCI_MGMT))
03b555e1
JH		 3991 goto unlock;
3992
2f407f0a
JH		 3993 /* Allow pairing if we're pairable, the initiators of the
3994 * pairing or if the remote is not requesting bonding.
3995 */
d7a5a11d 3996 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
2f407f0a 3997 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 3998 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 3999 struct hci_cp_io_capability_reply cp;
4000
4001 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 4002 /* Change the IO capability from KeyboardDisplay
4003 * to DisplayYesNo as it is not supported by BT spec. */
4004 cp.capability = (conn->io_capability == 0x04) ?
a767631a 4005 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 4006
4007 /* If we are initiators, there is no remote information yet */
4008 if (conn->remote_auth == 0xff) {
b16c6604 4009 /* Request MITM protection if our IO caps allow it
4ad51a75 4010 * except for the no-bonding case.
b16c6604 4011 */
6fd6b915 4012 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 4013 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 4014 conn->auth_type |= 0x01;
b7f94c88
MA		 4015 } else {
4016 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 4017 }
17fa4b9d 4018
82c295b1
JH		 4019 /* If we're not bondable, force one of the non-bondable
4020 * authentication requirement values.
4021 */
d7a5a11d 4022 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
82c295b1
JH		 4023 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4024
4025 cp.authentication = conn->auth_type;
a83ed81e 4026 cp.oob_data = bredr_oob_data_present(conn);
ce85ee13 4027
17fa4b9d 4028 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 4029 sizeof(cp), &cp);
03b555e1
JH		 4030 } else {
4031 struct hci_cp_io_capability_neg_reply cp;
4032
4033 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 4034 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 4035
03b555e1 4036 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 4037 sizeof(cp), &cp);
03b555e1
JH		 4038 }
4039
4040unlock:
4041 hci_dev_unlock(hdev);
4042}
4043
6039aa73 4044static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 4045{
4046 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4047 struct hci_conn *conn;
4048
4049 BT_DBG("%s", hdev->name);
4050
4051 hci_dev_lock(hdev);
4052
4053 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4054 if (!conn)
4055 goto unlock;
4056
03b555e1 4057 conn->remote_cap = ev->capability;
03b555e1
JH		 4058 conn->remote_auth = ev->authentication;
4059
4060unlock:
0493684e
MH		 4061 hci_dev_unlock(hdev);
4062}
4063
6039aa73
GP		 4064static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4065 struct sk_buff *skb)
a5c29683
JH		 4066{
4067 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 4068 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 4069 struct hci_conn *conn;
a5c29683
JH		 4070
4071 BT_DBG("%s", hdev->name);
4072
4073 hci_dev_lock(hdev);
4074
d7a5a11d 4075 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7a828908 4076 goto unlock;
a5c29683 4077
7a828908
JH		 4078 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4079 if (!conn)
4080 goto unlock;
4081
4082 loc_mitm = (conn->auth_type & 0x01);
4083 rem_mitm = (conn->remote_auth & 0x01);
4084
4085 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 4086 * (it has NoInputNoOutput) then reject the confirmation
4087 * request. We check the security level here since it doesn't
4088 * necessarily match conn->auth_type.
6fd6b915 4089 */
6c53823a
JH		 4090 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4091 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 4092 BT_DBG("Rejecting request: remote device can't provide MITM");
4093 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 4094 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4095 goto unlock;
4096 }
4097
4098 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 4099 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4100 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 4101
4102 /* If we're not the initiators request authorization to
4103 * proceed from user space (mgmt_user_confirm with
ba15a58b 4104 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 4105 * side had MITM or if the local IO capability is
4106 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 4107 */
4108 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 4109 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 4110 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 4111 BT_DBG("Confirming auto-accept as acceptor");
4112 confirm_hint = 1;
4113 goto confirm;
4114 }
4115
9f61656a 4116 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 4117 hdev->auto_accept_delay);
9f61656a
JH		 4118
4119 if (hdev->auto_accept_delay > 0) {
4120 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 4121 queue_delayed_work(conn->hdev->workqueue,
4122 &conn->auto_accept_work, delay);
9f61656a
JH		 4123 goto unlock;
4124 }
4125
7a828908 4126 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 4127 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4128 goto unlock;
4129 }
4130
55bc1a37 4131confirm:
39adbffe
JH		 4132 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4133 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 4134
4135unlock:
a5c29683
JH		 4136 hci_dev_unlock(hdev);
4137}
4138
6039aa73
GP		 4139static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4140 struct sk_buff *skb)
1143d458
BG		 4141{
4142 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4143
4144 BT_DBG("%s", hdev->name);
4145
d7a5a11d 4146 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 4147 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 4148}
4149
92a25256
JH		 4150static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4151 struct sk_buff *skb)
4152{
4153 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4154 struct hci_conn *conn;
4155
4156 BT_DBG("%s", hdev->name);
4157
4158 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4159 if (!conn)
4160 return;
4161
4162 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4163 conn->passkey_entered = 0;
4164
d7a5a11d 4165 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4166 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4167 conn->dst_type, conn->passkey_notify,
4168 conn->passkey_entered);
4169}
4170
4171static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4172{
4173 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4174 struct hci_conn *conn;
4175
4176 BT_DBG("%s", hdev->name);
4177
4178 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4179 if (!conn)
4180 return;
4181
4182 switch (ev->type) {
4183 case HCI_KEYPRESS_STARTED:
4184 conn->passkey_entered = 0;
4185 return;
4186
4187 case HCI_KEYPRESS_ENTERED:
4188 conn->passkey_entered++;
4189 break;
4190
4191 case HCI_KEYPRESS_ERASED:
4192 conn->passkey_entered--;
4193 break;
4194
4195 case HCI_KEYPRESS_CLEARED:
4196 conn->passkey_entered = 0;
4197 break;
4198
4199 case HCI_KEYPRESS_COMPLETED:
4200 return;
4201 }
4202
d7a5a11d 4203 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4204 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4205 conn->dst_type, conn->passkey_notify,
4206 conn->passkey_entered);
4207}
4208
6039aa73
GP		 4209static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4210 struct sk_buff *skb)
0493684e
MH		 4211{
4212 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4213 struct hci_conn *conn;
4214
4215 BT_DBG("%s", hdev->name);
4216
4217 hci_dev_lock(hdev);
4218
4219 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 4220 if (!conn)
4221 goto unlock;
4222
c1d4fa7a
JH		 4223 /* Reset the authentication requirement to unknown */
4224 conn->remote_auth = 0xff;
4225
2a611692
JH		 4226 /* To avoid duplicate auth_failed events to user space we check
4227 * the HCI_CONN_AUTH_PEND flag which will be set if we
4228 * initiated the authentication. A traditional auth_complete
4229 * event gets always produced as initiator and is also mapped to
4230 * the mgmt_auth_failed event */
fa1bd918 4231 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 4232 mgmt_auth_failed(conn, ev->status);
0493684e 4233
76a68ba0 4234 hci_conn_drop(conn);
2a611692
JH		 4235
4236unlock:
0493684e
MH		 4237 hci_dev_unlock(hdev);
4238}
4239
6039aa73
GP		 4240static void hci_remote_host_features_evt(struct hci_dev *hdev,
4241 struct sk_buff *skb)
41a96212
MH		 4242{
4243 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4244 struct inquiry_entry *ie;
cad718ed 4245 struct hci_conn *conn;
41a96212
MH		 4246
4247 BT_DBG("%s", hdev->name);
4248
4249 hci_dev_lock(hdev);
4250
cad718ed
JH		 4251 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4252 if (conn)
4253 memcpy(conn->features[1], ev->features, 8);
4254
cc11b9c1
AE		 4255 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4256 if (ie)
02b7cc62 4257 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 4258
4259 hci_dev_unlock(hdev);
4260}
4261
6039aa73
GP		 4262static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4263 struct sk_buff *skb)
2763eda6
SJ		 4264{
4265 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4266 struct oob_data *data;
4267
4268 BT_DBG("%s", hdev->name);
4269
4270 hci_dev_lock(hdev);
4271
d7a5a11d 4272 if (!hci_dev_test_flag(hdev, HCI_MGMT))
e1ba1f15
SJ		 4273 goto unlock;
4274
6928a924 4275 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
6665d057
MH		 4276 if (!data) {
4277 struct hci_cp_remote_oob_data_neg_reply cp;
519ca9d0 4278
6665d057
MH		 4279 bacpy(&cp.bdaddr, &ev->bdaddr);
4280 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4281 sizeof(cp), &cp);
4282 goto unlock;
4283 }
2763eda6 4284
6665d057
MH		 4285 if (bredr_sc_enabled(hdev)) {
4286 struct hci_cp_remote_oob_ext_data_reply cp;
519ca9d0 4287
6665d057 4288 bacpy(&cp.bdaddr, &ev->bdaddr);
d7a5a11d 4289 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6665d057
MH		 4290 memset(cp.hash192, 0, sizeof(cp.hash192));
4291 memset(cp.rand192, 0, sizeof(cp.rand192));
4292 } else {
4293 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4294 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
519ca9d0 4295 }
6665d057
MH		 4296 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4297 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4298
4299 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4300 sizeof(cp), &cp);
2763eda6 4301 } else {
6665d057 4302 struct hci_cp_remote_oob_data_reply cp;
2763eda6
SJ		 4303
4304 bacpy(&cp.bdaddr, &ev->bdaddr);
6665d057
MH		 4305 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4306 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4307
4308 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
519ca9d0 4309 sizeof(cp), &cp);
2763eda6
SJ		 4310 }
4311
e1ba1f15 4312unlock:
2763eda6
SJ		 4313 hci_dev_unlock(hdev);
4314}
4315
d5e91192
AE		 4316static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4317 struct sk_buff *skb)
4318{
4319 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4320 struct hci_conn *hcon, *bredr_hcon;
4321
4322 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4323 ev->status);
4324
4325 hci_dev_lock(hdev);
4326
4327 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4328 if (!hcon) {
4329 hci_dev_unlock(hdev);
4330 return;
4331 }
4332
4333 if (ev->status) {
4334 hci_conn_del(hcon);
4335 hci_dev_unlock(hdev);
4336 return;
4337 }
4338
4339 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4340
4341 hcon->state = BT_CONNECTED;
4342 bacpy(&hcon->dst, &bredr_hcon->dst);
4343
4344 hci_conn_hold(hcon);
4345 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4346 hci_conn_drop(hcon);
d5e91192 4347
23b9ceb7 4348 hci_debugfs_create_conn(hcon);
d5e91192
AE		 4349 hci_conn_add_sysfs(hcon);
4350
cf70ff22 4351 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4352
cf70ff22 4353 hci_dev_unlock(hdev);
d5e91192
AE		 4354}
4355
27695fb4
AE		 4356static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4357{
4358 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4359 struct hci_conn *hcon;
4360 struct hci_chan *hchan;
4361 struct amp_mgr *mgr;
4362
4363 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4364 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4365 ev->status);
4366
4367 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4368 if (!hcon)
4369 return;
4370
4371 /* Create AMP hchan */
4372 hchan = hci_chan_create(hcon);
4373 if (!hchan)
4374 return;
4375
4376 hchan->handle = le16_to_cpu(ev->handle);
4377
4378 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4379
4380 mgr = hcon->amp_mgr;
4381 if (mgr && mgr->bredr_chan) {
4382 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4383
4384 l2cap_chan_lock(bredr_chan);
4385
4386 bredr_chan->conn->mtu = hdev->block_mtu;
4387 l2cap_logical_cfm(bredr_chan, hchan, 0);
4388 hci_conn_hold(hcon);
4389
4390 l2cap_chan_unlock(bredr_chan);
4391 }
4392}
4393
606e2a10
AE		 4394static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4395 struct sk_buff *skb)
4396{
4397 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4398 struct hci_chan *hchan;
4399
4400 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4401 le16_to_cpu(ev->handle), ev->status);
4402
4403 if (ev->status)
4404 return;
4405
4406 hci_dev_lock(hdev);
4407
4408 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4409 if (!hchan)
4410 goto unlock;
4411
4412 amp_destroy_logical_link(hchan, ev->reason);
4413
4414unlock:
4415 hci_dev_unlock(hdev);
4416}
4417
9eef6b3a
AE		 4418static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4419 struct sk_buff *skb)
4420{
4421 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4422 struct hci_conn *hcon;
4423
4424 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4425
4426 if (ev->status)
4427 return;
4428
4429 hci_dev_lock(hdev);
4430
4431 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4432 if (hcon) {
4433 hcon->state = BT_CLOSED;
4434 hci_conn_del(hcon);
4435 }
4436
4437 hci_dev_unlock(hdev);
4438}
4439
6039aa73 4440static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4441{
4442 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
912b42ef 4443 struct hci_conn_params *params;
fcd89c09 4444 struct hci_conn *conn;
68d6f6de 4445 struct smp_irk *irk;
837d502e 4446 u8 addr_type;
fcd89c09 4447
9f1db00c 4448 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
fcd89c09
VT		 4449
4450 hci_dev_lock(hdev);
4451
fbd96c15
JH		 4452 /* All controllers implicitly stop advertising in the event of a
4453 * connection, so ensure that the state bit is cleared.
4454 */
a358dc11 4455 hci_dev_clear_flag(hdev, HCI_LE_ADV);
fbd96c15 4456
b47a09b3 4457 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
b62f328b 4458 if (!conn) {
a5c4e309 4459 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
b62f328b
VT		 4460 if (!conn) {
4461 BT_ERR("No memory for new connection");
230fd16a 4462 goto unlock;
b62f328b 4463 }
29b7988a
AG		 4464
4465 conn->dst_type = ev->bdaddr_type;
b9b343d2 4466
cb1d68f7
JH		 4467 /* If we didn't have a hci_conn object previously
4468 * but we're in master role this must be something
4469 * initiated using a white list. Since white list based
4470 * connections are not "first class citizens" we don't
4471 * have full tracking of them. Therefore, we go ahead
4472 * with a "best effort" approach of determining the
4473 * initiator address based on the HCI_PRIVACY flag.
4474 */
4475 if (conn->out) {
4476 conn->resp_addr_type = ev->bdaddr_type;
4477 bacpy(&conn->resp_addr, &ev->bdaddr);
d7a5a11d 4478 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
cb1d68f7
JH		 4479 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4480 bacpy(&conn->init_addr, &hdev->rpa);
4481 } else {
4482 hci_copy_identity_address(hdev,
4483 &conn->init_addr,
4484 &conn->init_addr_type);
4485 }
cb1d68f7 4486 }
9489eca4
JH		 4487 } else {
4488 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4489 }
fcd89c09 4490
80c24ab8
JH		 4491 if (!conn->out) {
4492 /* Set the responder (our side) address type based on
4493 * the advertising address type.
4494 */
4495 conn->resp_addr_type = hdev->adv_addr_type;
4496 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4497 bacpy(&conn->resp_addr, &hdev->random_addr);
4498 else
4499 bacpy(&conn->resp_addr, &hdev->bdaddr);
4500
4501 conn->init_addr_type = ev->bdaddr_type;
4502 bacpy(&conn->init_addr, &ev->bdaddr);
a720d735
MH		 4503
4504 /* For incoming connections, set the default minimum
4505 * and maximum connection interval. They will be used
4506 * to check if the parameters are in range and if not
4507 * trigger the connection update procedure.
4508 */
4509 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4510 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4511 }
7be2edbb 4512
edb4b466
MH		 4513 /* Lookup the identity address from the stored connection
4514 * address and address type.
4515 *
4516 * When establishing connections to an identity address, the
4517 * connection procedure will store the resolvable random
4518 * address first. Now if it can be converted back into the
4519 * identity address, start using the identity address from
4520 * now on.
4521 */
4522 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4523 if (irk) {
4524 bacpy(&conn->dst, &irk->bdaddr);
4525 conn->dst_type = irk->addr_type;
4526 }
4527
2d3c2260
JH		 4528 if (ev->status) {
4529 hci_le_conn_failed(conn, ev->status);
837d502e
JH		 4530 goto unlock;
4531 }
4532
08853f18
JH		 4533 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4534 addr_type = BDADDR_LE_PUBLIC;
4535 else
4536 addr_type = BDADDR_LE_RANDOM;
4537
2d3c2260
JH		 4538 /* Drop the connection if the device is blocked */
4539 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4540 hci_conn_drop(conn);
cd17decb
AG		 4541 goto unlock;
4542 }
4543
b644ba33 4544 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4545 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 4546
7b5c0d52 4547 conn->sec_level = BT_SECURITY_LOW;
fcd89c09 4548 conn->handle = __le16_to_cpu(ev->handle);
0fe29fd1 4549 conn->state = BT_CONFIG;
fcd89c09 4550
e04fde60
MH		 4551 conn->le_conn_interval = le16_to_cpu(ev->interval);
4552 conn->le_conn_latency = le16_to_cpu(ev->latency);
4553 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4554
23b9ceb7 4555 hci_debugfs_create_conn(conn);
fcd89c09
VT		 4556 hci_conn_add_sysfs(conn);
4557
0fe29fd1
MH		 4558 if (!ev->status) {
4559 /* The remote features procedure is defined for master
4560 * role only. So only in case of an initiated connection
4561 * request the remote features.
4562 *
4563 * If the local controller supports slave-initiated features
4564 * exchange, then requesting the remote features in slave
4565 * role is possible. Otherwise just transition into the
4566 * connected state without requesting the remote features.
4567 */
4568 if (conn->out ||
4569 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4570 struct hci_cp_le_read_remote_features cp;
4571
4572 cp.handle = __cpu_to_le16(conn->handle);
4573
4574 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4575 sizeof(cp), &cp);
4576
4577 hci_conn_hold(conn);
4578 } else {
4579 conn->state = BT_CONNECTED;
4580 hci_connect_cfm(conn, ev->status);
4581 }
4582 } else {
4583 hci_connect_cfm(conn, ev->status);
4584 }
fcd89c09 4585
5477610f
JH		 4586 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4587 conn->dst_type);
f161dd41 4588 if (params) {
95305baa 4589 list_del_init(&params->action);
f161dd41
JH		 4590 if (params->conn) {
4591 hci_conn_drop(params->conn);
f8aaf9b6 4592 hci_conn_put(params->conn);
f161dd41
JH		 4593 params->conn = NULL;
4594 }
4595 }
a4790dbd 4596
fcd89c09 4597unlock:
223683a5 4598 hci_update_background_scan(hdev);
fcd89c09
VT		 4599 hci_dev_unlock(hdev);
4600}
4601
1855d92d
MH		 4602static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4603 struct sk_buff *skb)
4604{
4605 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4606 struct hci_conn *conn;
4607
4608 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4609
4610 if (ev->status)
4611 return;
4612
4613 hci_dev_lock(hdev);
4614
4615 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4616 if (conn) {
4617 conn->le_conn_interval = le16_to_cpu(ev->interval);
4618 conn->le_conn_latency = le16_to_cpu(ev->latency);
4619 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4620 }
4621
4622 hci_dev_unlock(hdev);
4623}
4624
a4790dbd 4625/* This function requires the caller holds hdev->lock */
fd45ada9
AA		 4626static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4627 bdaddr_t *addr,
4628 u8 addr_type, u8 adv_type)
a4790dbd
AG		 4629{
4630 struct hci_conn *conn;
4b9e7e75 4631 struct hci_conn_params *params;
a4790dbd 4632
1c1abcab
JH		 4633 /* If the event is not connectable don't proceed further */
4634 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4635 return NULL;
1c1abcab
JH		 4636
4637 /* Ignore if the device is blocked */
dcc36c16 4638 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
fd45ada9 4639 return NULL;
1c1abcab 4640
f99353cf
JH		 4641 /* Most controller will fail if we try to create new connections
4642 * while we have an existing one in slave role.
4643 */
4644 if (hdev->conn_hash.le_num_slave > 0)
fd45ada9 4645 return NULL;
f99353cf 4646
1c1abcab
JH		 4647 /* If we're not connectable only connect devices that we have in
4648 * our pend_le_conns list.
4649 */
4b9e7e75
MH		 4650 params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4651 addr, addr_type);
4652 if (!params)
fd45ada9 4653 return NULL;
4b9e7e75
MH		 4654
4655 switch (params->auto_connect) {
4656 case HCI_AUTO_CONN_DIRECT:
4657 /* Only devices advertising with ADV_DIRECT_IND are
4658 * triggering a connection attempt. This is allowing
4659 * incoming connections from slave devices.
4660 */
4661 if (adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4662 return NULL;
4b9e7e75
MH		 4663 break;
4664 case HCI_AUTO_CONN_ALWAYS:
4665 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4666 * are triggering a connection attempt. This means
4667 * that incoming connectioms from slave device are
4668 * accepted and also outgoing connections to slave
4669 * devices are established when found.
4670 */
4671 break;
4672 default:
fd45ada9 4673 return NULL;
4b9e7e75 4674 }
a4790dbd
AG		 4675
4676 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
e804d25d 4677 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
f161dd41
JH		 4678 if (!IS_ERR(conn)) {
4679 /* Store the pointer since we don't really have any
4680 * other owner of the object besides the params that
4681 * triggered it. This way we can abort the connection if
4682 * the parameters get removed and keep the reference
4683 * count consistent once the connection is established.
4684 */
f8aaf9b6 4685 params->conn = hci_conn_get(conn);
fd45ada9 4686 return conn;
f161dd41 4687 }
a4790dbd
AG		 4688
4689 switch (PTR_ERR(conn)) {
4690 case -EBUSY:
4691 /* If hci_connect() returns -EBUSY it means there is already
4692 * an LE connection attempt going on. Since controllers don't
4693 * support more than one connection attempt at the time, we
4694 * don't consider this an error case.
4695 */
4696 break;
4697 default:
4698 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
fd45ada9 4699 return NULL;
a4790dbd 4700 }
fd45ada9
AA		 4701
4702 return NULL;
a4790dbd
AG		 4703}
4704
4af605d8 4705static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
2f010b55
MH		 4706 u8 bdaddr_type, bdaddr_t *direct_addr,
4707 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4af605d8 4708{
b9a6328f 4709 struct discovery_state *d = &hdev->discovery;
1c1abcab 4710 struct smp_irk *irk;
fd45ada9 4711 struct hci_conn *conn;
474ee066 4712 bool match;
c70a7e4c 4713 u32 flags;
b9a6328f 4714
2f010b55
MH		 4715 /* If the direct address is present, then this report is from
4716 * a LE Direct Advertising Report event. In that case it is
4717 * important to see if the address is matching the local
4718 * controller address.
4719 */
4720 if (direct_addr) {
4721 /* Only resolvable random addresses are valid for these
4722 * kind of reports and others can be ignored.
4723 */
4724 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4725 return;
4726
4727 /* If the controller is not using resolvable random
4728 * addresses, then this report can be ignored.
4729 */
d7a5a11d 4730 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2f010b55
MH		 4731 return;
4732
4733 /* If the local IRK of the controller does not match
4734 * with the resolvable random address provided, then
4735 * this report can be ignored.
4736 */
4737 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4738 return;
4739 }
4740
1c1abcab
JH		 4741 /* Check if we need to convert to identity address */
4742 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4743 if (irk) {
4744 bdaddr = &irk->bdaddr;
4745 bdaddr_type = irk->addr_type;
4746 }
4747
4748 /* Check if we have been requested to connect to this device */
fd45ada9
AA		 4749 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4750 if (conn && type == LE_ADV_IND) {
4751 /* Store report for later inclusion by
4752 * mgmt_device_connected
4753 */
4754 memcpy(conn->le_adv_data, data, len);
4755 conn->le_adv_data_len = len;
4756 }
1c1abcab 4757
0d2bf134
JH		 4758 /* Passive scanning shouldn't trigger any device found events,
4759 * except for devices marked as CONN_REPORT for which we do send
4760 * device found events.
4761 */
ca5c4be7 4762 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 4763 if (type == LE_ADV_DIRECT_IND)
4764 return;
4765
3a19b6fe
JH		 4766 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4767 bdaddr, bdaddr_type))
0d2bf134
JH		 4768 return;
4769
4770 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4771 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4772 else
4773 flags = 0;
4774 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4775 rssi, flags, data, len, NULL, 0);
97bf2e99 4776 return;
ca5c4be7 4777 }
4af605d8 4778
c70a7e4c
MH		 4779 /* When receiving non-connectable or scannable undirected
4780 * advertising reports, this means that the remote device is
4781 * not connectable and then clearly indicate this in the
4782 * device found event.
4783 *
4784 * When receiving a scan response, then there is no way to
4785 * know if the remote device is connectable or not. However
4786 * since scan responses are merged with a previously seen
4787 * advertising report, the flags field from that report
4788 * will be used.
4789 *
4790 * In the really unlikely case that a controller get confused
4791 * and just sends a scan response event, then it is marked as
4792 * not connectable as well.
4793 */
4794 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4795 type == LE_ADV_SCAN_RSP)
4796 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4797 else
4798 flags = 0;
4799
b9a6328f
JH		 4800 /* If there's nothing pending either store the data from this
4801 * event or send an immediate device found event if the data
4802 * should not be stored for later.
4803 */
4804 if (!has_pending_adv_report(hdev)) {
4805 /* If the report will trigger a SCAN_REQ store it for
4806 * later merging.
4807 */
4808 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4809 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4810 rssi, flags, data, len);
b9a6328f
JH		 4811 return;
4812 }
4813
4814 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4815 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4816 return;
4817 }
4818
474ee066
JH		 4819 /* Check if the pending report is for the same device as the new one */
4820 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4821 bdaddr_type == d->last_adv_addr_type);
4822
b9a6328f
JH		 4823 /* If the pending data doesn't match this report or this isn't a
4824 * scan response (e.g. we got a duplicate ADV_IND) then force
4825 * sending of the pending data.
4826 */
474ee066
JH		 4827 if (type != LE_ADV_SCAN_RSP || !match) {
4828 /* Send out whatever is in the cache, but skip duplicates */
4829 if (!match)
4830 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 4831 d->last_adv_addr_type, NULL,
c70a7e4c 4832 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 4833 d->last_adv_data,
474ee066 4834 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 4835
4836 /* If the new report will trigger a SCAN_REQ store it for
4837 * later merging.
4838 */
4839 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4840 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4841 rssi, flags, data, len);
b9a6328f
JH		 4842 return;
4843 }
4844
4845 /* The advertising reports cannot be merged, so clear
4846 * the pending report and send out a device found event.
4847 */
4848 clear_pending_adv_report(hdev);
5c5b93e4 4849 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4850 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4851 return;
4852 }
4853
4854 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4855 * the new event is a SCAN_RSP. We can therefore proceed with
4856 * sending a merged device found event.
4857 */
4858 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 4859 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 4860 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 4861 clear_pending_adv_report(hdev);
4af605d8
JH		 4862}
4863
6039aa73 4864static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 4865{
e95beb41
AG		 4866 u8 num_reports = skb->data[0];
4867 void *ptr = &skb->data[1];
9aa04c91 4868
a4790dbd
AG		 4869 hci_dev_lock(hdev);
4870
e95beb41
AG		 4871 while (num_reports--) {
4872 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 4873 s8 rssi;
a4790dbd 4874
3c9e9195 4875 rssi = ev->data[ev->length];
4af605d8 4876 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
2f010b55
MH		 4877 ev->bdaddr_type, NULL, 0, rssi,
4878 ev->data, ev->length);
3c9e9195 4879
e95beb41 4880 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 4881 }
a4790dbd
AG		 4882
4883 hci_dev_unlock(hdev);
9aa04c91
AG		 4884}
4885
0fe29fd1
MH		 4886static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4887 struct sk_buff *skb)
4888{
4889 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4890 struct hci_conn *conn;
4891
4892 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4893
4894 hci_dev_lock(hdev);
4895
4896 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4897 if (conn) {
4898 if (!ev->status)
4899 memcpy(conn->features[0], ev->features, 8);
4900
4901 if (conn->state == BT_CONFIG) {
4902 __u8 status;
4903
4904 /* If the local controller supports slave-initiated
4905 * features exchange, but the remote controller does
4906 * not, then it is possible that the error code 0x1a
4907 * for unsupported remote feature gets returned.
4908 *
4909 * In this specific case, allow the connection to
4910 * transition into connected state and mark it as
4911 * successful.
4912 */
4913 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
4914 !conn->out && ev->status == 0x1a)
4915 status = 0x00;
4916 else
4917 status = ev->status;
4918
4919 conn->state = BT_CONNECTED;
4920 hci_connect_cfm(conn, status);
4921 hci_conn_drop(conn);
4922 }
4923 }
4924
4925 hci_dev_unlock(hdev);
4926}
4927
6039aa73 4928static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 4929{
4930 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4931 struct hci_cp_le_ltk_reply cp;
bea710fe 4932 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 4933 struct hci_conn *conn;
c9839a11 4934 struct smp_ltk *ltk;
a7a595f6 4935
9f1db00c 4936 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 4937
4938 hci_dev_lock(hdev);
4939
4940 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 4941 if (conn == NULL)
4942 goto not_found;
a7a595f6 4943
f3a73d97 4944 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5378bc56 4945 if (!ltk)
bea710fe
VCG		 4946 goto not_found;
4947
5378bc56
JH		 4948 if (smp_ltk_is_sc(ltk)) {
4949 /* With SC both EDiv and Rand are set to zero */
4950 if (ev->ediv || ev->rand)
4951 goto not_found;
4952 } else {
4953 /* For non-SC keys check that EDiv and Rand match */
4954 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4955 goto not_found;
4956 }
4957
bea710fe 4958 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
a7a595f6 4959 cp.handle = cpu_to_le16(conn->handle);
c9839a11 4960
a6f7833c 4961 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 4962
89cbb4da 4963 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 4964
4965 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4966
5981a882
CT		 4967 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4968 * temporary key used to encrypt a connection following
4969 * pairing. It is used during the Encrypted Session Setup to
4970 * distribute the keys. Later, security can be re-established
4971 * using a distributed LTK.
4972 */
2ceba539 4973 if (ltk->type == SMP_STK) {
fe59a05f 4974 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
970d0f1b
JH		 4975 list_del_rcu(&ltk->list);
4976 kfree_rcu(ltk, rcu);
fe59a05f
JH		 4977 } else {
4978 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 4979 }
4980
a7a595f6 4981 hci_dev_unlock(hdev);
bea710fe
VCG		 4982
4983 return;
4984
4985not_found:
4986 neg.handle = ev->handle;
4987 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4988 hci_dev_unlock(hdev);
a7a595f6
VCG		 4989}
4990
8e75b46a
AG		 4991static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4992 u8 reason)
4993{
4994 struct hci_cp_le_conn_param_req_neg_reply cp;
4995
4996 cp.handle = cpu_to_le16(handle);
4997 cp.reason = reason;
4998
4999 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5000 &cp);
5001}
5002
5003static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5004 struct sk_buff *skb)
5005{
5006 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5007 struct hci_cp_le_conn_param_req_reply cp;
5008 struct hci_conn *hcon;
5009 u16 handle, min, max, latency, timeout;
5010
5011 handle = le16_to_cpu(ev->handle);
5012 min = le16_to_cpu(ev->interval_min);
5013 max = le16_to_cpu(ev->interval_max);
5014 latency = le16_to_cpu(ev->latency);
5015 timeout = le16_to_cpu(ev->timeout);
5016
5017 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5018 if (!hcon || hcon->state != BT_CONNECTED)
5019 return send_conn_param_neg_reply(hdev, handle,
5020 HCI_ERROR_UNKNOWN_CONN_ID);
5021
5022 if (hci_check_conn_params(min, max, latency, timeout))
5023 return send_conn_param_neg_reply(hdev, handle,
5024 HCI_ERROR_INVALID_LL_PARAMS);
5025
40bef302 5026 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 5027 struct hci_conn_params *params;
f4869e2a 5028 u8 store_hint;
348d50b8
JH		 5029
5030 hci_dev_lock(hdev);
5031
5032 params = hci_conn_params_lookup(hdev, &hcon->dst,
5033 hcon->dst_type);
5034 if (params) {
5035 params->conn_min_interval = min;
5036 params->conn_max_interval = max;
5037 params->conn_latency = latency;
5038 params->supervision_timeout = timeout;
f4869e2a
JH		 5039 store_hint = 0x01;
5040 } else{
5041 store_hint = 0x00;
348d50b8
JH		 5042 }
5043
5044 hci_dev_unlock(hdev);
5045
f4869e2a
JH		 5046 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5047 store_hint, min, max, latency, timeout);
348d50b8 5048 }
ffb5a827 5049
8e75b46a
AG		 5050 cp.handle = ev->handle;
5051 cp.interval_min = ev->interval_min;
5052 cp.interval_max = ev->interval_max;
5053 cp.latency = ev->latency;
5054 cp.timeout = ev->timeout;
5055 cp.min_ce_len = 0;
5056 cp.max_ce_len = 0;
5057
5058 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5059}
5060
2f010b55
MH		 5061static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5062 struct sk_buff *skb)
5063{
5064 u8 num_reports = skb->data[0];
5065 void *ptr = &skb->data[1];
5066
5067 hci_dev_lock(hdev);
5068
5069 while (num_reports--) {
5070 struct hci_ev_le_direct_adv_info *ev = ptr;
5071
5072 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5073 ev->bdaddr_type, &ev->direct_addr,
5074 ev->direct_addr_type, ev->rssi, NULL, 0);
5075
5076 ptr += sizeof(*ev);
5077 }
5078
5079 hci_dev_unlock(hdev);
5080}
5081
6039aa73 5082static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 5083{
5084 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5085
5086 skb_pull(skb, sizeof(*le_ev));
5087
5088 switch (le_ev->subevent) {
5089 case HCI_EV_LE_CONN_COMPLETE:
5090 hci_le_conn_complete_evt(hdev, skb);
5091 break;
5092
1855d92d
MH		 5093 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5094 hci_le_conn_update_complete_evt(hdev, skb);
5095 break;
5096
9aa04c91
AG		 5097 case HCI_EV_LE_ADVERTISING_REPORT:
5098 hci_le_adv_report_evt(hdev, skb);
5099 break;
5100
0fe29fd1
MH		 5101 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5102 hci_le_remote_feat_complete_evt(hdev, skb);
5103 break;
5104
a7a595f6
VCG		 5105 case HCI_EV_LE_LTK_REQ:
5106 hci_le_ltk_request_evt(hdev, skb);
5107 break;
5108
8e75b46a
AG		 5109 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5110 hci_le_remote_conn_param_req_evt(hdev, skb);
5111 break;
5112
2f010b55
MH		 5113 case HCI_EV_LE_DIRECT_ADV_REPORT:
5114 hci_le_direct_adv_report_evt(hdev, skb);
5115 break;
5116
fcd89c09
VT		 5117 default:
5118 break;
5119 }
5120}
5121
9495b2ee
AE		 5122static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5123{
5124 struct hci_ev_channel_selected *ev = (void *) skb->data;
5125 struct hci_conn *hcon;
5126
5127 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5128
5129 skb_pull(skb, sizeof(*ev));
5130
5131 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5132 if (!hcon)
5133 return;
5134
5135 amp_read_loc_assoc_final_data(hdev, hcon);
5136}
5137
757aa0b5
JH		 5138static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5139 u8 event, struct sk_buff *skb)
5140{
5141 struct hci_ev_cmd_complete *ev;
5142 struct hci_event_hdr *hdr;
5143
5144 if (!skb)
5145 return false;
5146
5147 if (skb->len < sizeof(*hdr)) {
5148 BT_ERR("Too short HCI event");
5149 return false;
5150 }
5151
5152 hdr = (void *) skb->data;
5153 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5154
5155 if (event) {
5156 if (hdr->evt != event)
5157 return false;
5158 return true;
5159 }
5160
5161 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5162 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5163 return false;
5164 }
5165
5166 if (skb->len < sizeof(*ev)) {
5167 BT_ERR("Too short cmd_complete event");
5168 return false;
5169 }
5170
5171 ev = (void *) skb->data;
5172 skb_pull(skb, sizeof(*ev));
5173
5174 if (opcode != __le16_to_cpu(ev->opcode)) {
5175 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5176 __le16_to_cpu(ev->opcode));
5177 return false;
5178 }
5179
5180 return true;
5181}
5182
a9de9248
MH		 5183void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5184{
5185 struct hci_event_hdr *hdr = (void *) skb->data;
e6214487
JH		 5186 hci_req_complete_t req_complete = NULL;
5187 hci_req_complete_skb_t req_complete_skb = NULL;
5188 struct sk_buff *orig_skb = NULL;
757aa0b5 5189 u8 status = 0, event = hdr->evt, req_evt = 0;
e6214487 5190 u16 opcode = HCI_OP_NOP;
a9de9248 5191
db6e3e8d 5192 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
c1f23a2b 5193 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
e6214487
JH		 5194 opcode = __le16_to_cpu(cmd_hdr->opcode);
5195 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5196 &req_complete_skb);
757aa0b5 5197 req_evt = event;
02350a72
JH		 5198 }
5199
e6214487
JH		 5200 /* If it looks like we might end up having to call
5201 * req_complete_skb, store a pristine copy of the skb since the
5202 * various handlers may modify the original one through
5203 * skb_pull() calls, etc.
5204 */
5205 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5206 event == HCI_EV_CMD_COMPLETE)
5207 orig_skb = skb_clone(skb, GFP_KERNEL);
5208
5209 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5210
a9de9248 5211 switch (event) {
1da177e4
LT		 5212 case HCI_EV_INQUIRY_COMPLETE:
5213 hci_inquiry_complete_evt(hdev, skb);
5214 break;
5215
5216 case HCI_EV_INQUIRY_RESULT:
5217 hci_inquiry_result_evt(hdev, skb);
5218 break;
5219
a9de9248
MH		 5220 case HCI_EV_CONN_COMPLETE:
5221 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 5222 break;
5223
1da177e4
LT		 5224 case HCI_EV_CONN_REQUEST:
5225 hci_conn_request_evt(hdev, skb);
5226 break;
5227
1da177e4
LT		 5228 case HCI_EV_DISCONN_COMPLETE:
5229 hci_disconn_complete_evt(hdev, skb);
5230 break;
5231
1da177e4
LT		 5232 case HCI_EV_AUTH_COMPLETE:
5233 hci_auth_complete_evt(hdev, skb);
5234 break;
5235
a9de9248
MH		 5236 case HCI_EV_REMOTE_NAME:
5237 hci_remote_name_evt(hdev, skb);
5238 break;
5239
1da177e4
LT		 5240 case HCI_EV_ENCRYPT_CHANGE:
5241 hci_encrypt_change_evt(hdev, skb);
5242 break;
5243
a9de9248
MH		 5244 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5245 hci_change_link_key_complete_evt(hdev, skb);
5246 break;
5247
5248 case HCI_EV_REMOTE_FEATURES:
5249 hci_remote_features_evt(hdev, skb);
5250 break;
5251
a9de9248 5252 case HCI_EV_CMD_COMPLETE:
e6214487
JH		 5253 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5254 &req_complete, &req_complete_skb);
a9de9248
MH		 5255 break;
5256
5257 case HCI_EV_CMD_STATUS:
e6214487
JH		 5258 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5259 &req_complete_skb);
a9de9248
MH		 5260 break;
5261
24dfa343
MH		 5262 case HCI_EV_HARDWARE_ERROR:
5263 hci_hardware_error_evt(hdev, skb);
5264 break;
5265
a9de9248
MH		 5266 case HCI_EV_ROLE_CHANGE:
5267 hci_role_change_evt(hdev, skb);
5268 break;
5269
5270 case HCI_EV_NUM_COMP_PKTS:
5271 hci_num_comp_pkts_evt(hdev, skb);
5272 break;
5273
5274 case HCI_EV_MODE_CHANGE:
5275 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 5276 break;
5277
5278 case HCI_EV_PIN_CODE_REQ:
5279 hci_pin_code_request_evt(hdev, skb);
5280 break;
5281
5282 case HCI_EV_LINK_KEY_REQ:
5283 hci_link_key_request_evt(hdev, skb);
5284 break;
5285
5286 case HCI_EV_LINK_KEY_NOTIFY:
5287 hci_link_key_notify_evt(hdev, skb);
5288 break;
5289
5290 case HCI_EV_CLOCK_OFFSET:
5291 hci_clock_offset_evt(hdev, skb);
5292 break;
5293
a8746417
MH		 5294 case HCI_EV_PKT_TYPE_CHANGE:
5295 hci_pkt_type_change_evt(hdev, skb);
5296 break;
5297
85a1e930
MH		 5298 case HCI_EV_PSCAN_REP_MODE:
5299 hci_pscan_rep_mode_evt(hdev, skb);
5300 break;
5301
a9de9248
MH		 5302 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5303 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 5304 break;
5305
a9de9248
MH		 5306 case HCI_EV_REMOTE_EXT_FEATURES:
5307 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 5308 break;
5309
a9de9248
MH		 5310 case HCI_EV_SYNC_CONN_COMPLETE:
5311 hci_sync_conn_complete_evt(hdev, skb);
5312 break;
1da177e4 5313
a9de9248
MH		 5314 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5315 hci_extended_inquiry_result_evt(hdev, skb);
5316 break;
1da177e4 5317
1c2e0041
JH		 5318 case HCI_EV_KEY_REFRESH_COMPLETE:
5319 hci_key_refresh_complete_evt(hdev, skb);
5320 break;
5321
0493684e
MH		 5322 case HCI_EV_IO_CAPA_REQUEST:
5323 hci_io_capa_request_evt(hdev, skb);
5324 break;
5325
03b555e1
JH		 5326 case HCI_EV_IO_CAPA_REPLY:
5327 hci_io_capa_reply_evt(hdev, skb);
5328 break;
5329
a5c29683
JH		 5330 case HCI_EV_USER_CONFIRM_REQUEST:
5331 hci_user_confirm_request_evt(hdev, skb);
5332 break;
5333
1143d458
BG		 5334 case HCI_EV_USER_PASSKEY_REQUEST:
5335 hci_user_passkey_request_evt(hdev, skb);
5336 break;
5337
92a25256
JH		 5338 case HCI_EV_USER_PASSKEY_NOTIFY:
5339 hci_user_passkey_notify_evt(hdev, skb);
5340 break;
5341
5342 case HCI_EV_KEYPRESS_NOTIFY:
5343 hci_keypress_notify_evt(hdev, skb);
5344 break;
5345
0493684e
MH		 5346 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5347 hci_simple_pair_complete_evt(hdev, skb);
5348 break;
5349
41a96212
MH		 5350 case HCI_EV_REMOTE_HOST_FEATURES:
5351 hci_remote_host_features_evt(hdev, skb);
5352 break;
5353
fcd89c09
VT		 5354 case HCI_EV_LE_META:
5355 hci_le_meta_evt(hdev, skb);
5356 break;
5357
9495b2ee
AE		 5358 case HCI_EV_CHANNEL_SELECTED:
5359 hci_chan_selected_evt(hdev, skb);
5360 break;
5361
2763eda6
SJ		 5362 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5363 hci_remote_oob_data_request_evt(hdev, skb);
5364 break;
5365
d5e91192
AE		 5366 case HCI_EV_PHY_LINK_COMPLETE:
5367 hci_phy_link_complete_evt(hdev, skb);
5368 break;
5369
27695fb4
AE		 5370 case HCI_EV_LOGICAL_LINK_COMPLETE:
5371 hci_loglink_complete_evt(hdev, skb);
5372 break;
5373
606e2a10
AE		 5374 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5375 hci_disconn_loglink_complete_evt(hdev, skb);
5376 break;
5377
9eef6b3a
AE		 5378 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5379 hci_disconn_phylink_complete_evt(hdev, skb);
5380 break;
5381
25e89e99
AE		 5382 case HCI_EV_NUM_COMP_BLOCKS:
5383 hci_num_comp_blocks_evt(hdev, skb);
5384 break;
5385
a9de9248 5386 default:
9f1db00c 5387 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 5388 break;
5389 }
5390
757aa0b5 5391 if (req_complete) {
e6214487 5392 req_complete(hdev, status, opcode);
757aa0b5
JH		 5393 } else if (req_complete_skb) {
5394 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5395 kfree_skb(orig_skb);
5396 orig_skb = NULL;
5397 }
e6214487 5398 req_complete_skb(hdev, status, opcode, orig_skb);
757aa0b5 5399 }
e6214487
JH		 5400
5401 kfree_skb(orig_skb);
1da177e4
LT		 5402 kfree_skb(skb);
5403 hdev->stat.evt_rx++;
5404}
Linux kernel - Deliverables
This page took 1.48757 seconds and 5 git commands to generate.