projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: preparation for new connect procedure
[deliverable/linux.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
0857dd3b 33#include "hci_request.h"
23b9ceb7 34#include "hci_debugfs.h"
7024728e 35#include "a2mp.h"
7ef9fbf0 36#include "amp.h"
2ceba539 37#include "smp.h"
1da177e4 38
aa5b0345
MH		 39#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
1da177e4
LT		 42/* Handle HCI Event packets */
43
a9de9248 44static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 45{
a9de9248 46 __u8 status = *((__u8 *) skb->data);
1da177e4 47
9f1db00c 48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 49
82f4785c 50 if (status)
a9de9248 51 return;
1da177e4 52
89352e7d 53 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 56
50143a43
JH		 57 hci_dev_lock(hdev);
58 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
59 hci_dev_unlock(hdev);
60
a9de9248
MH		 61 hci_conn_check_pending(hdev);
62}
6bd57416 63
4d93483b
AG		 64static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
65{
66 __u8 status = *((__u8 *) skb->data);
67
9f1db00c 68 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 69
70 if (status)
71 return;
72
a1536da2 73 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
4d93483b
AG		 74}
75
a9de9248
MH		 76static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
77{
78 __u8 status = *((__u8 *) skb->data);
6bd57416 79
9f1db00c 80 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 81
a9de9248
MH		 82 if (status)
83 return;
1da177e4 84
a358dc11 85 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
ae854a70 86
a9de9248
MH		 87 hci_conn_check_pending(hdev);
88}
89
807deac2
GP		 90static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
91 struct sk_buff *skb)
a9de9248
MH		 92{
93 BT_DBG("%s", hdev->name);
94}
95
96static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
97{
98 struct hci_rp_role_discovery *rp = (void *) skb->data;
99 struct hci_conn *conn;
100
9f1db00c 101 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 102
103 if (rp->status)
104 return;
105
106 hci_dev_lock(hdev);
107
108 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 109 if (conn)
110 conn->role = rp->role;
a9de9248
MH		 111
112 hci_dev_unlock(hdev);
1da177e4
LT		 113}
114
e4e8e37c
MH		 115static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
116{
117 struct hci_rp_read_link_policy *rp = (void *) skb->data;
118 struct hci_conn *conn;
119
9f1db00c 120 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 121
122 if (rp->status)
123 return;
124
125 hci_dev_lock(hdev);
126
127 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
128 if (conn)
129 conn->link_policy = __le16_to_cpu(rp->policy);
130
131 hci_dev_unlock(hdev);
132}
133
a9de9248 134static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 135{
a9de9248 136 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 137 struct hci_conn *conn;
04837f64 138 void *sent;
1da177e4 139
9f1db00c 140 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 141
a9de9248
MH		 142 if (rp->status)
143 return;
1da177e4 144
a9de9248
MH		 145 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
146 if (!sent)
147 return;
1da177e4 148
a9de9248 149 hci_dev_lock(hdev);
1da177e4 150
a9de9248 151 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 152 if (conn)
83985319 153 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 154
a9de9248
MH		 155 hci_dev_unlock(hdev);
156}
1da177e4 157
807deac2
GP		 158static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
159 struct sk_buff *skb)
e4e8e37c
MH		 160{
161 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
162
9f1db00c 163 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 164
165 if (rp->status)
166 return;
167
168 hdev->link_policy = __le16_to_cpu(rp->policy);
169}
170
807deac2
GP		 171static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
172 struct sk_buff *skb)
e4e8e37c
MH		 173{
174 __u8 status = *((__u8 *) skb->data);
175 void *sent;
176
9f1db00c 177 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 178
45296acd
MH		 179 if (status)
180 return;
181
e4e8e37c
MH		 182 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
183 if (!sent)
184 return;
185
45296acd 186 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 187}
188
a9de9248
MH		 189static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
190{
191 __u8 status = *((__u8 *) skb->data);
04837f64 192
9f1db00c 193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 194
10572132
GP		 195 clear_bit(HCI_RESET, &hdev->flags);
196
8761f9d6
MH		 197 if (status)
198 return;
199
a297e97c 200 /* Reset all non-persistent flags */
eacb44df 201 hci_dev_clear_volatile_flags(hdev);
69775ff6 202
39c5d970
JH		 203 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
204
bbaf444a
JH		 205 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
206 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 207
208 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
209 hdev->adv_data_len = 0;
f8e808bd
MH		 210
211 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
212 hdev->scan_rsp_data_len = 0;
06f5b778 213
533553f8
MH		 214 hdev->le_scan_type = LE_SCAN_PASSIVE;
215
06f5b778 216 hdev->ssp_debug_mode = 0;
a4d5504d
MH		 217
218 hci_bdaddr_list_clear(&hdev->le_white_list);
a9de9248 219}
04837f64 220
c2f0f979
MH		 221static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
222 struct sk_buff *skb)
223{
224 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
225 struct hci_cp_read_stored_link_key *sent;
226
227 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
228
229 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
230 if (!sent)
231 return;
232
233 if (!rp->status && sent->read_all == 0x01) {
234 hdev->stored_max_keys = rp->max_keys;
235 hdev->stored_num_keys = rp->num_keys;
236 }
237}
238
a9366120
MH		 239static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
240 struct sk_buff *skb)
241{
242 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
245
246 if (rp->status)
247 return;
248
249 if (rp->num_keys <= hdev->stored_num_keys)
250 hdev->stored_num_keys -= rp->num_keys;
251 else
252 hdev->stored_num_keys = 0;
253}
254
a9de9248
MH		 255static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
256{
257 __u8 status = *((__u8 *) skb->data);
258 void *sent;
04837f64 259
9f1db00c 260 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 261
a9de9248
MH		 262 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
263 if (!sent)
264 return;
04837f64 265
56e5cb86
JH		 266 hci_dev_lock(hdev);
267
d7a5a11d 268 if (hci_dev_test_flag(hdev, HCI_MGMT))
f51d5b24 269 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 270 else if (!status)
271 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 272
56e5cb86 273 hci_dev_unlock(hdev);
a9de9248
MH		 274}
275
276static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
277{
278 struct hci_rp_read_local_name *rp = (void *) skb->data;
279
9f1db00c 280 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 281
282 if (rp->status)
283 return;
284
d7a5a11d
MH		 285 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
286 hci_dev_test_flag(hdev, HCI_CONFIG))
db99b5fc 287 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 288}
289
290static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
291{
292 __u8 status = *((__u8 *) skb->data);
293 void *sent;
294
9f1db00c 295 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 296
297 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
298 if (!sent)
299 return;
300
5c1a4c8f
JK		 301 hci_dev_lock(hdev);
302
a9de9248
MH		 303 if (!status) {
304 __u8 param = *((__u8 *) sent);
305
306 if (param == AUTH_ENABLED)
307 set_bit(HCI_AUTH, &hdev->flags);
308 else
309 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 310 }
a9de9248 311
d7a5a11d 312 if (hci_dev_test_flag(hdev, HCI_MGMT))
33ef95ed 313 mgmt_auth_enable_complete(hdev, status);
5c1a4c8f
JK		 314
315 hci_dev_unlock(hdev);
1da177e4
LT		 316}
317
a9de9248 318static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 319{
a9de9248 320 __u8 status = *((__u8 *) skb->data);
45296acd 321 __u8 param;
1da177e4
LT		 322 void *sent;
323
9f1db00c 324 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 325
45296acd
MH		 326 if (status)
327 return;
328
a9de9248
MH		 329 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
330 if (!sent)
331 return;
1da177e4 332
45296acd 333 param = *((__u8 *) sent);
a9de9248 334
45296acd
MH		 335 if (param)
336 set_bit(HCI_ENCRYPT, &hdev->flags);
337 else
338 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 339}
1da177e4 340
a9de9248
MH		 341static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
342{
45296acd
MH		 343 __u8 status = *((__u8 *) skb->data);
344 __u8 param;
a9de9248 345 void *sent;
1da177e4 346
9f1db00c 347 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 348
a9de9248
MH		 349 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
350 if (!sent)
351 return;
1da177e4 352
36f7fc7e
JH		 353 param = *((__u8 *) sent);
354
56e5cb86
JH		 355 hci_dev_lock(hdev);
356
fa1bd918 357 if (status) {
2d7cee58
JH		 358 hdev->discov_timeout = 0;
359 goto done;
360 }
361
bc6d2d04 362 if (param & SCAN_INQUIRY)
36f7fc7e 363 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 364 else
365 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 366
031547d8 367 if (param & SCAN_PAGE)
36f7fc7e 368 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 369 else
204e3990 370 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 371
36f7fc7e 372done:
56e5cb86 373 hci_dev_unlock(hdev);
a9de9248 374}
1da177e4 375
a9de9248
MH		 376static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
377{
378 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 379
9f1db00c 380 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 381
a9de9248
MH		 382 if (rp->status)
383 return;
1da177e4 384
a9de9248 385 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 386
a9de9248 387 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 388 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 389}
1da177e4 390
a9de9248
MH		 391static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
392{
393 __u8 status = *((__u8 *) skb->data);
394 void *sent;
1da177e4 395
9f1db00c 396 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 397
a9de9248
MH		 398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
399 if (!sent)
400 return;
1da177e4 401
7f9a903c
MH		 402 hci_dev_lock(hdev);
403
404 if (status == 0)
405 memcpy(hdev->dev_class, sent, 3);
406
d7a5a11d 407 if (hci_dev_test_flag(hdev, HCI_MGMT))
7f9a903c
MH		 408 mgmt_set_class_of_dev_complete(hdev, sent, status);
409
410 hci_dev_unlock(hdev);
a9de9248 411}
1da177e4 412
a9de9248
MH		 413static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
414{
415 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
416 __u16 setting;
417
9f1db00c 418 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 419
420 if (rp->status)
421 return;
422
423 setting = __le16_to_cpu(rp->voice_setting);
424
f383f275 425 if (hdev->voice_setting == setting)
a9de9248
MH		 426 return;
427
428 hdev->voice_setting = setting;
429
9f1db00c 430 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 431
3c54711c 432 if (hdev->notify)
a9de9248 433 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 434}
435
8fc9ced3
GP		 436static void hci_cc_write_voice_setting(struct hci_dev *hdev,
437 struct sk_buff *skb)
a9de9248
MH		 438{
439 __u8 status = *((__u8 *) skb->data);
f383f275 440 __u16 setting;
a9de9248
MH		 441 void *sent;
442
9f1db00c 443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 444
f383f275
MH		 445 if (status)
446 return;
447
a9de9248
MH		 448 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
449 if (!sent)
450 return;
1da177e4 451
f383f275 452 setting = get_unaligned_le16(sent);
1da177e4 453
f383f275
MH		 454 if (hdev->voice_setting == setting)
455 return;
456
457 hdev->voice_setting = setting;
1da177e4 458
9f1db00c 459 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 460
3c54711c 461 if (hdev->notify)
f383f275 462 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 463}
464
b4cb9fb2
MH		 465static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
466 struct sk_buff *skb)
467{
468 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
469
470 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
471
472 if (rp->status)
473 return;
474
475 hdev->num_iac = rp->num_iac;
476
477 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
478}
479
333140b5
MH		 480static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
481{
482 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 483 struct hci_cp_write_ssp_mode *sent;
333140b5 484
9f1db00c 485 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 486
333140b5
MH		 487 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
488 if (!sent)
489 return;
490
5c1a4c8f
JK		 491 hci_dev_lock(hdev);
492
5ed8eb2f
JH		 493 if (!status) {
494 if (sent->mode)
cad718ed 495 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 496 else
cad718ed 497 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 498 }
499
d7a5a11d 500 if (hci_dev_test_flag(hdev, HCI_MGMT))
5ed8eb2f 501 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 502 else if (!status) {
5ed8eb2f 503 if (sent->mode)
a1536da2 504 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 505 else
a358dc11 506 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 507 }
5c1a4c8f
JK		 508
509 hci_dev_unlock(hdev);
333140b5
MH		 510}
511
eac83dc6
MH		 512static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
513{
514 u8 status = *((u8 *) skb->data);
515 struct hci_cp_write_sc_support *sent;
516
517 BT_DBG("%s status 0x%2.2x", hdev->name, status);
518
519 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
520 if (!sent)
521 return;
522
5c1a4c8f
JK		 523 hci_dev_lock(hdev);
524
eac83dc6
MH		 525 if (!status) {
526 if (sent->support)
527 hdev->features[1][0] |= LMP_HOST_SC;
528 else
529 hdev->features[1][0] &= ~LMP_HOST_SC;
530 }
531
d7a5a11d 532 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
eac83dc6 533 if (sent->support)
a1536da2 534 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
eac83dc6 535 else
a358dc11 536 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
eac83dc6 537 }
5c1a4c8f
JK		 538
539 hci_dev_unlock(hdev);
eac83dc6
MH		 540}
541
a9de9248
MH		 542static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
543{
544 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 545
9f1db00c 546 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 547
a9de9248 548 if (rp->status)
42c6b129 549 return;
1143e5a6 550
d7a5a11d
MH		 551 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
552 hci_dev_test_flag(hdev, HCI_CONFIG)) {
0d5551f5
MH		 553 hdev->hci_ver = rp->hci_ver;
554 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
555 hdev->lmp_ver = rp->lmp_ver;
556 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
557 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
558 }
d5859e22
JH		 559}
560
8fc9ced3
GP		 561static void hci_cc_read_local_commands(struct hci_dev *hdev,
562 struct sk_buff *skb)
a9de9248
MH		 563{
564 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 565
9f1db00c 566 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 567
6a070e6e
MH		 568 if (rp->status)
569 return;
570
d7a5a11d
MH		 571 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
572 hci_dev_test_flag(hdev, HCI_CONFIG))
2177bab5 573 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 574}
1da177e4 575
8fc9ced3
GP		 576static void hci_cc_read_local_features(struct hci_dev *hdev,
577 struct sk_buff *skb)
a9de9248
MH		 578{
579 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 580
9f1db00c 581 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 582
a9de9248
MH		 583 if (rp->status)
584 return;
5b7f9909 585
a9de9248 586 memcpy(hdev->features, rp->features, 8);
5b7f9909 587
a9de9248
MH		 588 /* Adjust default settings according to features
589 * supported by device. */
1da177e4 590
cad718ed 591 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 592 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 593
cad718ed 594 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 595 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 596
cad718ed 597 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 598 hdev->pkt_type |= (HCI_HV2);
599 hdev->esco_type |= (ESCO_HV2);
600 }
1da177e4 601
cad718ed 602 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 603 hdev->pkt_type |= (HCI_HV3);
604 hdev->esco_type |= (ESCO_HV3);
605 }
1da177e4 606
45db810f 607 if (lmp_esco_capable(hdev))
a9de9248 608 hdev->esco_type |= (ESCO_EV3);
da1f5198 609
cad718ed 610 if (hdev->features[0][4] & LMP_EV4)
a9de9248 611 hdev->esco_type |= (ESCO_EV4);
da1f5198 612
cad718ed 613 if (hdev->features[0][4] & LMP_EV5)
a9de9248 614 hdev->esco_type |= (ESCO_EV5);
1da177e4 615
cad718ed 616 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 617 hdev->esco_type |= (ESCO_2EV3);
618
cad718ed 619 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 620 hdev->esco_type |= (ESCO_3EV3);
621
cad718ed 622 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 623 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 624}
1da177e4 625
971e3a4b 626static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 627 struct sk_buff *skb)
971e3a4b
AG		 628{
629 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
630
9f1db00c 631 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 632
633 if (rp->status)
42c6b129 634 return;
971e3a4b 635
57af75a8
MH		 636 if (hdev->max_page < rp->max_page)
637 hdev->max_page = rp->max_page;
d2c5d77f 638
cad718ed
JH		 639 if (rp->page < HCI_MAX_PAGES)
640 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 641}
642
1e89cffb 643static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 644 struct sk_buff *skb)
1e89cffb
AE		 645{
646 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
647
9f1db00c 648 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 649
45296acd
MH		 650 if (rp->status)
651 return;
652
653 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 654}
655
a9de9248
MH		 656static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
657{
658 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 659
9f1db00c 660 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 661
a9de9248
MH		 662 if (rp->status)
663 return;
1da177e4 664
a9de9248
MH		 665 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
666 hdev->sco_mtu = rp->sco_mtu;
667 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
668 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
669
670 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
671 hdev->sco_mtu = 64;
672 hdev->sco_pkts = 8;
1da177e4 673 }
a9de9248
MH		 674
675 hdev->acl_cnt = hdev->acl_pkts;
676 hdev->sco_cnt = hdev->sco_pkts;
677
807deac2
GP		 678 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
679 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 680}
681
682static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
683{
684 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
685
9f1db00c 686 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 687
e30d3f5f
MH		 688 if (rp->status)
689 return;
690
691 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 692 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f 693
d7a5a11d 694 if (hci_dev_test_flag(hdev, HCI_SETUP))
e30d3f5f 695 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 696}
697
f332ec66
JH		 698static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
699 struct sk_buff *skb)
700{
701 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
702
703 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
704
45296acd
MH		 705 if (rp->status)
706 return;
707
708 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 709 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
710 hdev->page_scan_window = __le16_to_cpu(rp->window);
711 }
712}
713
4a3ee763
JH		 714static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
715 struct sk_buff *skb)
716{
717 u8 status = *((u8 *) skb->data);
718 struct hci_cp_write_page_scan_activity *sent;
719
720 BT_DBG("%s status 0x%2.2x", hdev->name, status);
721
722 if (status)
723 return;
724
725 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
726 if (!sent)
727 return;
728
729 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
730 hdev->page_scan_window = __le16_to_cpu(sent->window);
731}
732
f332ec66
JH		 733static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
734 struct sk_buff *skb)
735{
736 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
737
738 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
739
45296acd
MH		 740 if (rp->status)
741 return;
742
743 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 744 hdev->page_scan_type = rp->type;
745}
746
4a3ee763
JH		 747static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
748 struct sk_buff *skb)
749{
750 u8 status = *((u8 *) skb->data);
751 u8 *type;
752
753 BT_DBG("%s status 0x%2.2x", hdev->name, status);
754
755 if (status)
756 return;
757
758 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
759 if (type)
760 hdev->page_scan_type = *type;
761}
762
350ee4cf 763static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 764 struct sk_buff *skb)
350ee4cf
AE		 765{
766 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
767
9f1db00c 768 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 769
770 if (rp->status)
771 return;
772
773 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
774 hdev->block_len = __le16_to_cpu(rp->block_len);
775 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
776
777 hdev->block_cnt = hdev->num_blocks;
778
779 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 780 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 781}
782
33f35721
JH		 783static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
784{
785 struct hci_rp_read_clock *rp = (void *) skb->data;
786 struct hci_cp_read_clock *cp;
787 struct hci_conn *conn;
788
789 BT_DBG("%s", hdev->name);
790
791 if (skb->len < sizeof(*rp))
792 return;
793
794 if (rp->status)
795 return;
796
797 hci_dev_lock(hdev);
798
799 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
800 if (!cp)
801 goto unlock;
802
803 if (cp->which == 0x00) {
804 hdev->clock = le32_to_cpu(rp->clock);
805 goto unlock;
806 }
807
808 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
809 if (conn) {
810 conn->clock = le32_to_cpu(rp->clock);
811 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
812 }
813
814unlock:
815 hci_dev_unlock(hdev);
816}
817
928abaa7 818static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 819 struct sk_buff *skb)
928abaa7
AE		 820{
821 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
822
9f1db00c 823 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 824
825 if (rp->status)
83927882 826 return;
928abaa7
AE		 827
828 hdev->amp_status = rp->amp_status;
829 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
830 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
831 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
832 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
833 hdev->amp_type = rp->amp_type;
834 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
835 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
836 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
837 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
928abaa7
AE		 838}
839
d5859e22 840static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 841 struct sk_buff *skb)
d5859e22 842{
91c4e9b1 843 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 844
9f1db00c 845 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 846
45296acd
MH		 847 if (rp->status)
848 return;
849
850 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 851}
852
980e1a53
JH		 853static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
854{
855 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
856 struct hci_cp_pin_code_reply *cp;
857 struct hci_conn *conn;
858
9f1db00c 859 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 860
56e5cb86
JH		 861 hci_dev_lock(hdev);
862
d7a5a11d 863 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 864 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 865
fa1bd918 866 if (rp->status)
56e5cb86 867 goto unlock;
980e1a53
JH		 868
869 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
870 if (!cp)
56e5cb86 871 goto unlock;
980e1a53
JH		 872
873 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
874 if (conn)
875 conn->pin_length = cp->pin_len;
56e5cb86
JH		 876
877unlock:
878 hci_dev_unlock(hdev);
980e1a53
JH		 879}
880
881static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
882{
883 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
884
9f1db00c 885 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 886
56e5cb86
JH		 887 hci_dev_lock(hdev);
888
d7a5a11d 889 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 890 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 891 rp->status);
56e5cb86
JH		 892
893 hci_dev_unlock(hdev);
980e1a53 894}
56e5cb86 895
6ed58ec5
VT		 896static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
897 struct sk_buff *skb)
898{
899 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
900
9f1db00c 901 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 902
903 if (rp->status)
904 return;
905
906 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
907 hdev->le_pkts = rp->le_max_pkt;
908
909 hdev->le_cnt = hdev->le_pkts;
910
911 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 912}
980e1a53 913
60e77321
JH		 914static void hci_cc_le_read_local_features(struct hci_dev *hdev,
915 struct sk_buff *skb)
916{
917 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
918
919 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
920
45296acd
MH		 921 if (rp->status)
922 return;
923
924 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 925}
926
8fa19098
JH		 927static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
928 struct sk_buff *skb)
929{
930 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
931
932 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
933
45296acd
MH		 934 if (rp->status)
935 return;
936
937 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 938}
939
a5c29683
JH		 940static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
941{
942 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
943
9f1db00c 944 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 945
56e5cb86
JH		 946 hci_dev_lock(hdev);
947
d7a5a11d 948 if (hci_dev_test_flag(hdev, HCI_MGMT))
04124681
GP		 949 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
950 rp->status);
56e5cb86
JH		 951
952 hci_dev_unlock(hdev);
a5c29683
JH		 953}
954
955static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 956 struct sk_buff *skb)
a5c29683
JH		 957{
958 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
959
9f1db00c 960 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 961
56e5cb86
JH		 962 hci_dev_lock(hdev);
963
d7a5a11d 964 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 965 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 966 ACL_LINK, 0, rp->status);
56e5cb86
JH		 967
968 hci_dev_unlock(hdev);
a5c29683
JH		 969}
970
1143d458
BG		 971static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
972{
973 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
974
9f1db00c 975 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 976
977 hci_dev_lock(hdev);
978
d7a5a11d 979 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 980 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 981 0, rp->status);
1143d458
BG		 982
983 hci_dev_unlock(hdev);
984}
985
986static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 987 struct sk_buff *skb)
1143d458
BG		 988{
989 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
990
9f1db00c 991 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 992
993 hci_dev_lock(hdev);
994
d7a5a11d 995 if (hci_dev_test_flag(hdev, HCI_MGMT))
1143d458 996 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 997 ACL_LINK, 0, rp->status);
1143d458
BG		 998
999 hci_dev_unlock(hdev);
1000}
1001
4d2d2796
MH		 1002static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1003 struct sk_buff *skb)
c35938b2
SJ		 1004{
1005 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1006
9f1db00c 1007 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
4d2d2796
MH		 1008}
1009
1010static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1011 struct sk_buff *skb)
1012{
1013 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1014
1015 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2
SJ		 1016}
1017
7a4cd51d
MH		 1018static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1019{
1020 __u8 status = *((__u8 *) skb->data);
1021 bdaddr_t *sent;
1022
1023 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1024
45296acd
MH		 1025 if (status)
1026 return;
1027
7a4cd51d
MH		 1028 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1029 if (!sent)
1030 return;
1031
1032 hci_dev_lock(hdev);
1033
45296acd 1034 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1035
1036 hci_dev_unlock(hdev);
1037}
1038
c1d5dc4a
JH		 1039static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1040{
1041 __u8 *sent, status = *((__u8 *) skb->data);
1042
1043 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1044
45296acd 1045 if (status)
c1d5dc4a
JH		 1046 return;
1047
45296acd
MH		 1048 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1049 if (!sent)
3c857757
JH		 1050 return;
1051
c1d5dc4a
JH		 1052 hci_dev_lock(hdev);
1053
49c922bb 1054 /* If we're doing connection initiation as peripheral. Set a
3c857757
JH		 1055 * timeout in case something goes wrong.
1056 */
1057 if (*sent) {
1058 struct hci_conn *conn;
1059
a1536da2 1060 hci_dev_set_flag(hdev, HCI_LE_ADV);
66c417c1 1061
3c857757
JH		 1062 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1063 if (conn)
1064 queue_delayed_work(hdev->workqueue,
1065 &conn->le_conn_timeout,
09ae260b 1066 conn->conn_timeout);
66c417c1 1067 } else {
a358dc11 1068 hci_dev_clear_flag(hdev, HCI_LE_ADV);
3c857757
JH		 1069 }
1070
04b4edcb 1071 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1072}
1073
533553f8
MH		 1074static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1075{
1076 struct hci_cp_le_set_scan_param *cp;
1077 __u8 status = *((__u8 *) skb->data);
1078
1079 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1080
45296acd
MH		 1081 if (status)
1082 return;
1083
533553f8
MH		 1084 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1085 if (!cp)
1086 return;
1087
1088 hci_dev_lock(hdev);
1089
45296acd 1090 hdev->le_scan_type = cp->type;
533553f8
MH		 1091
1092 hci_dev_unlock(hdev);
1093}
1094
b9a6328f
JH		 1095static bool has_pending_adv_report(struct hci_dev *hdev)
1096{
1097 struct discovery_state *d = &hdev->discovery;
1098
1099 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1100}
1101
1102static void clear_pending_adv_report(struct hci_dev *hdev)
1103{
1104 struct discovery_state *d = &hdev->discovery;
1105
1106 bacpy(&d->last_adv_addr, BDADDR_ANY);
1107 d->last_adv_data_len = 0;
1108}
1109
1110static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1111 u8 bdaddr_type, s8 rssi, u32 flags,
1112 u8 *data, u8 len)
b9a6328f
JH		 1113{
1114 struct discovery_state *d = &hdev->discovery;
1115
1116 bacpy(&d->last_adv_addr, bdaddr);
1117 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1118 d->last_adv_rssi = rssi;
c70a7e4c 1119 d->last_adv_flags = flags;
b9a6328f
JH		 1120 memcpy(d->last_adv_data, data, len);
1121 d->last_adv_data_len = len;
1122}
1123
eb9d91f5 1124static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
807deac2 1125 struct sk_buff *skb)
eb9d91f5
AG		 1126{
1127 struct hci_cp_le_set_scan_enable *cp;
1128 __u8 status = *((__u8 *) skb->data);
1129
9f1db00c 1130 BT_DBG("%s status 0x%2.2x", hdev->name, status);
eb9d91f5 1131
45296acd 1132 if (status)
eb9d91f5
AG		 1133 return;
1134
45296acd
MH		 1135 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1136 if (!cp)
3fd319b8
AG		 1137 return;
1138
5c1a4c8f
JK		 1139 hci_dev_lock(hdev);
1140
68a8aea4 1141 switch (cp->enable) {
76a388be 1142 case LE_SCAN_ENABLE:
a1536da2 1143 hci_dev_set_flag(hdev, HCI_LE_SCAN);
b9a6328f
JH		 1144 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1145 clear_pending_adv_report(hdev);
68a8aea4
AE		 1146 break;
1147
76a388be 1148 case LE_SCAN_DISABLE:
b9a6328f
JH		 1149 /* We do this here instead of when setting DISCOVERY_STOPPED
1150 * since the latter would potentially require waiting for
1151 * inquiry to stop too.
1152 */
1153 if (has_pending_adv_report(hdev)) {
1154 struct discovery_state *d = &hdev->discovery;
1155
1156 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1157 d->last_adv_addr_type, NULL,
c70a7e4c 1158 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1159 d->last_adv_data,
b9a6328f
JH		 1160 d->last_adv_data_len, NULL, 0);
1161 }
1162
317ac8cb
JH		 1163 /* Cancel this timer so that we don't try to disable scanning
1164 * when it's already disabled.
1165 */
1166 cancel_delayed_work(&hdev->le_scan_disable);
1167
a358dc11 1168 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
e8bb6b97 1169
81ad6fd9
JH		 1170 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1171 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1172 * therefore discovery as stopped. If this was not
1173 * because of a connect request advertising might have
1174 * been disabled because of active scanning, so
1175 * re-enable it again if necessary.
81ad6fd9 1176 */
a69d8927 1177 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
81ad6fd9 1178 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
d7a5a11d 1179 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
34722277 1180 hdev->discovery.state == DISCOVERY_FINDING)
e8bb6b97
JH		 1181 mgmt_reenable_advertising(hdev);
1182
68a8aea4
AE		 1183 break;
1184
1185 default:
1186 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1187 break;
35815085 1188 }
5c1a4c8f
JK		 1189
1190 hci_dev_unlock(hdev);
eb9d91f5
AG		 1191}
1192
cf1d081f
JH		 1193static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1194 struct sk_buff *skb)
1195{
1196 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1197
1198 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1199
45296acd
MH		 1200 if (rp->status)
1201 return;
1202
1203 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1204}
1205
0f36b589
MH		 1206static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1207 struct sk_buff *skb)
1208{
1209 __u8 status = *((__u8 *) skb->data);
1210
1211 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1212
45296acd
MH		 1213 if (status)
1214 return;
1215
dcc36c16 1216 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1217}
1218
1219static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1220 struct sk_buff *skb)
1221{
1222 struct hci_cp_le_add_to_white_list *sent;
1223 __u8 status = *((__u8 *) skb->data);
1224
1225 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1226
45296acd
MH		 1227 if (status)
1228 return;
1229
0f36b589
MH		 1230 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1231 if (!sent)
1232 return;
1233
dcc36c16
JH		 1234 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1235 sent->bdaddr_type);
0f36b589
MH		 1236}
1237
1238static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1239 struct sk_buff *skb)
1240{
1241 struct hci_cp_le_del_from_white_list *sent;
1242 __u8 status = *((__u8 *) skb->data);
1243
1244 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1245
45296acd
MH		 1246 if (status)
1247 return;
1248
0f36b589
MH		 1249 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1250 if (!sent)
1251 return;
1252
dcc36c16
JH		 1253 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1254 sent->bdaddr_type);
0f36b589
MH		 1255}
1256
9b008c04
JH		 1257static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1258 struct sk_buff *skb)
1259{
1260 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1261
1262 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1263
45296acd
MH		 1264 if (rp->status)
1265 return;
1266
1267 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1268}
1269
a8e1bfaa
MH		 1270static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1271 struct sk_buff *skb)
1272{
1273 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1274
1275 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1276
1277 if (rp->status)
1278 return;
1279
1280 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1281 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1282}
1283
1284static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1285 struct sk_buff *skb)
1286{
1287 struct hci_cp_le_write_def_data_len *sent;
1288 __u8 status = *((__u8 *) skb->data);
1289
1290 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1291
1292 if (status)
1293 return;
1294
1295 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1296 if (!sent)
1297 return;
1298
1299 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1300 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1301}
1302
1303static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1304 struct sk_buff *skb)
1305{
1306 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1307
1308 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1309
1310 if (rp->status)
1311 return;
1312
1313 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1314 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1315 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1316 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1317}
1318
6039aa73
GP		 1319static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1320 struct sk_buff *skb)
f9b49306 1321{
06199cf8 1322 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1323 __u8 status = *((__u8 *) skb->data);
1324
9f1db00c 1325 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1326
45296acd
MH		 1327 if (status)
1328 return;
1329
06199cf8 1330 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1331 if (!sent)
f9b49306
AG		 1332 return;
1333
5c1a4c8f
JK		 1334 hci_dev_lock(hdev);
1335
45296acd
MH		 1336 if (sent->le) {
1337 hdev->features[1][0] |= LMP_HOST_LE;
a1536da2 1338 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
45296acd
MH		 1339 } else {
1340 hdev->features[1][0] &= ~LMP_HOST_LE;
a358dc11
MH		 1341 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1342 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
8f984dfa 1343 }
45296acd
MH		 1344
1345 if (sent->simul)
1346 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1347 else
1348 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
5c1a4c8f
JK		 1349
1350 hci_dev_unlock(hdev);
f9b49306
AG		 1351}
1352
56ed2cb8
JH		 1353static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1354{
1355 struct hci_cp_le_set_adv_param *cp;
1356 u8 status = *((u8 *) skb->data);
1357
1358 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1359
1360 if (status)
1361 return;
1362
1363 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1364 if (!cp)
1365 return;
1366
1367 hci_dev_lock(hdev);
1368 hdev->adv_addr_type = cp->own_address_type;
1369 hci_dev_unlock(hdev);
1370}
1371
5ae76a94
AK		 1372static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1373{
1374 struct hci_rp_read_rssi *rp = (void *) skb->data;
1375 struct hci_conn *conn;
1376
1377 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1378
1379 if (rp->status)
1380 return;
1381
1382 hci_dev_lock(hdev);
1383
1384 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1385 if (conn)
1386 conn->rssi = rp->rssi;
1387
1388 hci_dev_unlock(hdev);
1389}
1390
5a134fae
AK		 1391static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1392{
1393 struct hci_cp_read_tx_power *sent;
1394 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1395 struct hci_conn *conn;
1396
1397 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1398
1399 if (rp->status)
1400 return;
1401
1402 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1403 if (!sent)
1404 return;
1405
1406 hci_dev_lock(hdev);
1407
1408 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1409 if (!conn)
1410 goto unlock;
1411
1412 switch (sent->type) {
1413 case 0x00:
5a134fae 1414 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1415 break;
1416 case 0x01:
1417 conn->max_tx_power = rp->tx_power;
1418 break;
1419 }
5a134fae 1420
d0455ed9 1421unlock:
5a134fae
AK		 1422 hci_dev_unlock(hdev);
1423}
1424
c50b33c8
MH		 1425static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1426{
1427 u8 status = *((u8 *) skb->data);
1428 u8 *mode;
1429
1430 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1431
1432 if (status)
1433 return;
1434
1435 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1436 if (mode)
1437 hdev->ssp_debug_mode = *mode;
1438}
1439
6039aa73 1440static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1441{
9f1db00c 1442 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1443
1444 if (status) {
a9de9248 1445 hci_conn_check_pending(hdev);
314b2381
JH		 1446 return;
1447 }
1448
89352e7d 1449 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1450}
1451
6039aa73 1452static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1453{
a9de9248 1454 struct hci_cp_create_conn *cp;
1da177e4 1455 struct hci_conn *conn;
1da177e4 1456
9f1db00c 1457 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1458
1459 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1460 if (!cp)
1461 return;
1462
1463 hci_dev_lock(hdev);
1464
1465 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1466
6ed93dc6 1467 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1468
1469 if (status) {
1470 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1471 if (status != 0x0c || conn->attempt > 2) {
1472 conn->state = BT_CLOSED;
539c496d 1473 hci_connect_cfm(conn, status);
4c67bc74
MH		 1474 hci_conn_del(conn);
1475 } else
1476 conn->state = BT_CONNECT2;
1da177e4
LT		 1477 }
1478 } else {
1479 if (!conn) {
a5c4e309
JH		 1480 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1481 HCI_ROLE_MASTER);
1482 if (!conn)
893ef971 1483 BT_ERR("No memory for new connection");
1da177e4
LT		 1484 }
1485 }
1486
1487 hci_dev_unlock(hdev);
1488}
1489
a9de9248 1490static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1491{
a9de9248
MH		 1492 struct hci_cp_add_sco *cp;
1493 struct hci_conn *acl, *sco;
1494 __u16 handle;
1da177e4 1495
9f1db00c 1496 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1497
a9de9248
MH		 1498 if (!status)
1499 return;
1da177e4 1500
a9de9248
MH		 1501 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1502 if (!cp)
1503 return;
1da177e4 1504
a9de9248 1505 handle = __le16_to_cpu(cp->handle);
1da177e4 1506
9f1db00c 1507 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1508
a9de9248 1509 hci_dev_lock(hdev);
1da177e4 1510
a9de9248 1511 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1512 if (acl) {
1513 sco = acl->link;
1514 if (sco) {
1515 sco->state = BT_CLOSED;
1da177e4 1516
539c496d 1517 hci_connect_cfm(sco, status);
5a08ecce
AE		 1518 hci_conn_del(sco);
1519 }
a9de9248 1520 }
1da177e4 1521
a9de9248
MH		 1522 hci_dev_unlock(hdev);
1523}
1da177e4 1524
f8558555
MH		 1525static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1526{
1527 struct hci_cp_auth_requested *cp;
1528 struct hci_conn *conn;
1529
9f1db00c 1530 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1531
1532 if (!status)
1533 return;
1534
1535 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1536 if (!cp)
1537 return;
1538
1539 hci_dev_lock(hdev);
1540
1541 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1542 if (conn) {
1543 if (conn->state == BT_CONFIG) {
539c496d 1544 hci_connect_cfm(conn, status);
76a68ba0 1545 hci_conn_drop(conn);
f8558555
MH		 1546 }
1547 }
1548
1549 hci_dev_unlock(hdev);
1550}
1551
1552static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1553{
1554 struct hci_cp_set_conn_encrypt *cp;
1555 struct hci_conn *conn;
1556
9f1db00c 1557 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1558
1559 if (!status)
1560 return;
1561
1562 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1563 if (!cp)
1564 return;
1565
1566 hci_dev_lock(hdev);
1567
1568 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1569 if (conn) {
1570 if (conn->state == BT_CONFIG) {
539c496d 1571 hci_connect_cfm(conn, status);
76a68ba0 1572 hci_conn_drop(conn);
f8558555
MH		 1573 }
1574 }
1575
1576 hci_dev_unlock(hdev);
1577}
1578
127178d2 1579static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1580 struct hci_conn *conn)
392599b9 1581{
392599b9
JH		 1582 if (conn->state != BT_CONFIG || !conn->out)
1583 return 0;
1584
765c2a96 1585 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1586 return 0;
1587
1588 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1589 * devices with sec_level MEDIUM or HIGH or if MITM protection
1590 * is requested.
1591 */
807deac2 1592 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1593 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1594 conn->pending_sec_level != BT_SECURITY_HIGH &&
1595 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1596 return 0;
1597
392599b9
JH		 1598 return 1;
1599}
1600
6039aa73 1601static int hci_resolve_name(struct hci_dev *hdev,
04124681 1602 struct inquiry_entry *e)
30dc78e1
JH		 1603{
1604 struct hci_cp_remote_name_req cp;
1605
1606 memset(&cp, 0, sizeof(cp));
1607
1608 bacpy(&cp.bdaddr, &e->data.bdaddr);
1609 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1610 cp.pscan_mode = e->data.pscan_mode;
1611 cp.clock_offset = e->data.clock_offset;
1612
1613 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1614}
1615
b644ba33 1616static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1617{
1618 struct discovery_state *discov = &hdev->discovery;
1619 struct inquiry_entry *e;
1620
b644ba33
JH		 1621 if (list_empty(&discov->resolve))
1622 return false;
1623
1624 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1625 if (!e)
1626 return false;
1627
b644ba33
JH		 1628 if (hci_resolve_name(hdev, e) == 0) {
1629 e->name_state = NAME_PENDING;
1630 return true;
1631 }
1632
1633 return false;
1634}
1635
1636static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1637 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1638{
1639 struct discovery_state *discov = &hdev->discovery;
1640 struct inquiry_entry *e;
1641
60cb49d2
JH		 1642 /* Update the mgmt connected state if necessary. Be careful with
1643 * conn objects that exist but are not (yet) connected however.
1644 * Only those in BT_CONFIG or BT_CONNECTED states can be
1645 * considered connected.
1646 */
1647 if (conn &&
1648 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
cb77c3ec 1649 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1650 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1651
1652 if (discov->state == DISCOVERY_STOPPED)
1653 return;
1654
30dc78e1
JH		 1655 if (discov->state == DISCOVERY_STOPPING)
1656 goto discov_complete;
1657
1658 if (discov->state != DISCOVERY_RESOLVING)
1659 return;
1660
1661 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1662 /* If the device was not found in a list of found devices names of which
1663 * are pending. there is no need to continue resolving a next name as it
1664 * will be done upon receiving another Remote Name Request Complete
1665 * Event */
1666 if (!e)
1667 return;
1668
1669 list_del(&e->list);
1670 if (name) {
30dc78e1 1671 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1672 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1673 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1674 } else {
1675 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1676 }
1677
b644ba33 1678 if (hci_resolve_next_name(hdev))
30dc78e1 1679 return;
30dc78e1
JH		 1680
1681discov_complete:
1682 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1683}
1684
a9de9248
MH		 1685static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1686{
127178d2
JH		 1687 struct hci_cp_remote_name_req *cp;
1688 struct hci_conn *conn;
1689
9f1db00c 1690 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1691
1692 /* If successful wait for the name req complete event before
1693 * checking for the need to do authentication */
1694 if (!status)
1695 return;
1696
1697 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1698 if (!cp)
1699 return;
1700
1701 hci_dev_lock(hdev);
1702
b644ba33
JH		 1703 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1704
d7a5a11d 1705 if (hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 1706 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1707
79c6c70c
JH		 1708 if (!conn)
1709 goto unlock;
1710
1711 if (!hci_outgoing_auth_needed(hdev, conn))
1712 goto unlock;
1713
51a8efd7 1714 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1715 struct hci_cp_auth_requested auth_cp;
1716
977f8fce
JH		 1717 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1718
c1f23a2b
JB		 1719 auth_cp.handle = __cpu_to_le16(conn->handle);
1720 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1721 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1722 }
1723
79c6c70c 1724unlock:
127178d2 1725 hci_dev_unlock(hdev);
a9de9248 1726}
1da177e4 1727
769be974
MH		 1728static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1729{
1730 struct hci_cp_read_remote_features *cp;
1731 struct hci_conn *conn;
1732
9f1db00c 1733 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1734
1735 if (!status)
1736 return;
1737
1738 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1739 if (!cp)
1740 return;
1741
1742 hci_dev_lock(hdev);
1743
1744 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1745 if (conn) {
1746 if (conn->state == BT_CONFIG) {
539c496d 1747 hci_connect_cfm(conn, status);
76a68ba0 1748 hci_conn_drop(conn);
769be974
MH		 1749 }
1750 }
1751
1752 hci_dev_unlock(hdev);
1753}
1754
1755static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1756{
1757 struct hci_cp_read_remote_ext_features *cp;
1758 struct hci_conn *conn;
1759
9f1db00c 1760 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1761
1762 if (!status)
1763 return;
1764
1765 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1766 if (!cp)
1767 return;
1768
1769 hci_dev_lock(hdev);
1770
1771 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1772 if (conn) {
1773 if (conn->state == BT_CONFIG) {
539c496d 1774 hci_connect_cfm(conn, status);
76a68ba0 1775 hci_conn_drop(conn);
769be974
MH		 1776 }
1777 }
1778
1779 hci_dev_unlock(hdev);
1780}
1781
a9de9248
MH		 1782static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1783{
b6a0dc82
MH		 1784 struct hci_cp_setup_sync_conn *cp;
1785 struct hci_conn *acl, *sco;
1786 __u16 handle;
1787
9f1db00c 1788 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 1789
1790 if (!status)
1791 return;
1792
1793 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1794 if (!cp)
1795 return;
1796
1797 handle = __le16_to_cpu(cp->handle);
1798
9f1db00c 1799 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 1800
1801 hci_dev_lock(hdev);
1802
1803 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1804 if (acl) {
1805 sco = acl->link;
1806 if (sco) {
1807 sco->state = BT_CLOSED;
b6a0dc82 1808
539c496d 1809 hci_connect_cfm(sco, status);
5a08ecce
AE		 1810 hci_conn_del(sco);
1811 }
b6a0dc82
MH		 1812 }
1813
1814 hci_dev_unlock(hdev);
1da177e4
LT		 1815}
1816
a9de9248 1817static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1818{
a9de9248
MH		 1819 struct hci_cp_sniff_mode *cp;
1820 struct hci_conn *conn;
1da177e4 1821
9f1db00c 1822 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1823
a9de9248
MH		 1824 if (!status)
1825 return;
04837f64 1826
a9de9248
MH		 1827 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1828 if (!cp)
1829 return;
04837f64 1830
a9de9248 1831 hci_dev_lock(hdev);
04837f64 1832
a9de9248 1833 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1834 if (conn) {
51a8efd7 1835 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 1836
51a8efd7 1837 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1838 hci_sco_setup(conn, status);
1839 }
1840
a9de9248
MH		 1841 hci_dev_unlock(hdev);
1842}
04837f64 1843
a9de9248
MH		 1844static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1845{
1846 struct hci_cp_exit_sniff_mode *cp;
1847 struct hci_conn *conn;
04837f64 1848
9f1db00c 1849 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1850
a9de9248
MH		 1851 if (!status)
1852 return;
04837f64 1853
a9de9248
MH		 1854 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1855 if (!cp)
1856 return;
04837f64 1857
a9de9248 1858 hci_dev_lock(hdev);
1da177e4 1859
a9de9248 1860 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1861 if (conn) {
51a8efd7 1862 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 1863
51a8efd7 1864 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1865 hci_sco_setup(conn, status);
1866 }
1867
a9de9248 1868 hci_dev_unlock(hdev);
1da177e4
LT		 1869}
1870
88c3df13
JH		 1871static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1872{
1873 struct hci_cp_disconnect *cp;
1874 struct hci_conn *conn;
1875
1876 if (!status)
1877 return;
1878
1879 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1880 if (!cp)
1881 return;
1882
1883 hci_dev_lock(hdev);
1884
1885 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1886 if (conn)
1887 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 1888 conn->dst_type, status);
88c3df13
JH		 1889
1890 hci_dev_unlock(hdev);
1891}
1892
cb1d68f7
JH		 1893static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1894{
1895 struct hci_cp_le_create_conn *cp;
1896 struct hci_conn *conn;
1897
1898 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1899
1900 /* All connection failure handling is taken care of by the
1901 * hci_le_conn_failed function which is triggered by the HCI
1902 * request completion callbacks used for connecting.
1903 */
1904 if (status)
1905 return;
1906
1907 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1908 if (!cp)
1909 return;
1910
1911 hci_dev_lock(hdev);
1912
1913 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1914 if (!conn)
1915 goto unlock;
1916
1917 /* Store the initiator and responder address information which
1918 * is needed for SMP. These values will not change during the
1919 * lifetime of the connection.
1920 */
1921 conn->init_addr_type = cp->own_address_type;
1922 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1923 bacpy(&conn->init_addr, &hdev->random_addr);
1924 else
1925 bacpy(&conn->init_addr, &hdev->bdaddr);
1926
1927 conn->resp_addr_type = cp->peer_addr_type;
1928 bacpy(&conn->resp_addr, &cp->peer_addr);
1929
9489eca4
JH		 1930 /* We don't want the connection attempt to stick around
1931 * indefinitely since LE doesn't have a page timeout concept
1932 * like BR/EDR. Set a timer for any connection that doesn't use
1933 * the white list for connecting.
1934 */
1935 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1936 queue_delayed_work(conn->hdev->workqueue,
1937 &conn->le_conn_timeout,
09ae260b 1938 conn->conn_timeout);
9489eca4 1939
cb1d68f7
JH		 1940unlock:
1941 hci_dev_unlock(hdev);
1942}
1943
0fe29fd1
MH		 1944static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
1945{
1946 struct hci_cp_le_read_remote_features *cp;
1947 struct hci_conn *conn;
1948
1949 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1950
1951 if (!status)
1952 return;
1953
1954 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
1955 if (!cp)
1956 return;
1957
1958 hci_dev_lock(hdev);
1959
1960 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1961 if (conn) {
1962 if (conn->state == BT_CONFIG) {
1963 hci_connect_cfm(conn, status);
1964 hci_conn_drop(conn);
1965 }
1966 }
1967
1968 hci_dev_unlock(hdev);
1969}
1970
81d0c8ad
JH		 1971static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1972{
1973 struct hci_cp_le_start_enc *cp;
1974 struct hci_conn *conn;
1975
1976 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1977
1978 if (!status)
1979 return;
1980
1981 hci_dev_lock(hdev);
1982
1983 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
1984 if (!cp)
1985 goto unlock;
1986
1987 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1988 if (!conn)
1989 goto unlock;
1990
1991 if (conn->state != BT_CONNECTED)
1992 goto unlock;
1993
1994 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1995 hci_conn_drop(conn);
1996
1997unlock:
1998 hci_dev_unlock(hdev);
1999}
2000
50fc85f1
KP		 2001static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2002{
2003 struct hci_cp_switch_role *cp;
2004 struct hci_conn *conn;
2005
2006 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2007
2008 if (!status)
2009 return;
2010
2011 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2012 if (!cp)
2013 return;
2014
2015 hci_dev_lock(hdev);
2016
2017 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2018 if (conn)
2019 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2020
2021 hci_dev_unlock(hdev);
2022}
2023
6039aa73 2024static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2025{
2026 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 2027 struct discovery_state *discov = &hdev->discovery;
2028 struct inquiry_entry *e;
1da177e4 2029
9f1db00c 2030 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 2031
a9de9248 2032 hci_conn_check_pending(hdev);
89352e7d
AG		 2033
2034 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2035 return;
2036
4e857c58 2037 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 2038 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2039
d7a5a11d 2040 if (!hci_dev_test_flag(hdev, HCI_MGMT))
30dc78e1
JH		 2041 return;
2042
56e5cb86 2043 hci_dev_lock(hdev);
30dc78e1 2044
343f935b 2045 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 2046 goto unlock;
2047
2048 if (list_empty(&discov->resolve)) {
07d2334a
JP		 2049 /* When BR/EDR inquiry is active and no LE scanning is in
2050 * progress, then change discovery state to indicate completion.
2051 *
2052 * When running LE scanning and BR/EDR inquiry simultaneously
2053 * and the LE scan already finished, then change the discovery
2054 * state to indicate completion.
2055 */
2056 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2057 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2058 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2059 goto unlock;
2060 }
2061
2062 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2063 if (e && hci_resolve_name(hdev, e) == 0) {
2064 e->name_state = NAME_PENDING;
2065 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2066 } else {
07d2334a
JP		 2067 /* When BR/EDR inquiry is active and no LE scanning is in
2068 * progress, then change discovery state to indicate completion.
2069 *
2070 * When running LE scanning and BR/EDR inquiry simultaneously
2071 * and the LE scan already finished, then change the discovery
2072 * state to indicate completion.
2073 */
2074 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2075 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2076 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2077 }
2078
2079unlock:
56e5cb86 2080 hci_dev_unlock(hdev);
1da177e4
LT		 2081}
2082
6039aa73 2083static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2084{
45bb4bf0 2085 struct inquiry_data data;
a9de9248 2086 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 2087 int num_rsp = *((__u8 *) skb->data);
2088
2089 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2090
45bb4bf0
MH		 2091 if (!num_rsp)
2092 return;
2093
d7a5a11d 2094 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 2095 return;
2096
1da177e4 2097 hci_dev_lock(hdev);
45bb4bf0 2098
e17acd40 2099 for (; num_rsp; num_rsp--, info++) {
af58925c 2100 u32 flags;
3175405b 2101
1da177e4
LT		 2102 bacpy(&data.bdaddr, &info->bdaddr);
2103 data.pscan_rep_mode = info->pscan_rep_mode;
2104 data.pscan_period_mode = info->pscan_period_mode;
2105 data.pscan_mode = info->pscan_mode;
2106 memcpy(data.dev_class, info->dev_class, 3);
2107 data.clock_offset = info->clock_offset;
efb2513f 2108 data.rssi = HCI_RSSI_INVALID;
41a96212 2109 data.ssp_mode = 0x00;
3175405b 2110
af58925c
MH		 2111 flags = hci_inquiry_cache_update(hdev, &data, false);
2112
48264f06 2113 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
efb2513f
MH		 2114 info->dev_class, HCI_RSSI_INVALID,
2115 flags, NULL, 0, NULL, 0);
1da177e4 2116 }
45bb4bf0 2117
1da177e4
LT		 2118 hci_dev_unlock(hdev);
2119}
2120
6039aa73 2121static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2122{
a9de9248
MH		 2123 struct hci_ev_conn_complete *ev = (void *) skb->data;
2124 struct hci_conn *conn;
1da177e4
LT		 2125
2126 BT_DBG("%s", hdev->name);
2127
2128 hci_dev_lock(hdev);
2129
2130 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2131 if (!conn) {
2132 if (ev->link_type != SCO_LINK)
2133 goto unlock;
2134
2135 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2136 if (!conn)
2137 goto unlock;
2138
2139 conn->type = SCO_LINK;
2140 }
1da177e4
LT		 2141
2142 if (!ev->status) {
2143 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2144
2145 if (conn->type == ACL_LINK) {
2146 conn->state = BT_CONFIG;
2147 hci_conn_hold(conn);
a9ea3ed9
SJ		 2148
2149 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2150 !hci_find_link_key(hdev, &ev->bdaddr))
2151 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2152 else
2153 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2154 } else
2155 conn->state = BT_CONNECTED;
1da177e4 2156
23b9ceb7 2157 hci_debugfs_create_conn(conn);
7d0db0a3
MH		 2158 hci_conn_add_sysfs(conn);
2159
1da177e4 2160 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2161 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2162
2163 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2164 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2165
04837f64
MH		 2166 /* Get remote features */
2167 if (conn->type == ACL_LINK) {
2168 struct hci_cp_read_remote_features cp;
2169 cp.handle = ev->handle;
769be974 2170 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2171 sizeof(cp), &cp);
22f433dc 2172
1d2dc5b7 2173 hci_update_page_scan(hdev);
04837f64
MH		 2174 }
2175
1da177e4 2176 /* Set packet type for incoming connection */
d095c1eb 2177 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2178 struct hci_cp_change_conn_ptype cp;
2179 cp.handle = ev->handle;
a8746417 2180 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2181 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2182 &cp);
1da177e4 2183 }
17d5c04c 2184 } else {
1da177e4 2185 conn->state = BT_CLOSED;
17d5c04c 2186 if (conn->type == ACL_LINK)
64c7b77c 2187 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2188 conn->dst_type, ev->status);
17d5c04c 2189 }
1da177e4 2190
e73439d8
MH		 2191 if (conn->type == ACL_LINK)
2192 hci_sco_setup(conn, ev->status);
1da177e4 2193
769be974 2194 if (ev->status) {
539c496d 2195 hci_connect_cfm(conn, ev->status);
1da177e4 2196 hci_conn_del(conn);
c89b6e6b 2197 } else if (ev->link_type != ACL_LINK)
539c496d 2198 hci_connect_cfm(conn, ev->status);
1da177e4 2199
a9de9248 2200unlock:
1da177e4 2201 hci_dev_unlock(hdev);
1da177e4 2202
a9de9248 2203 hci_conn_check_pending(hdev);
1da177e4
LT		 2204}
2205
70c46425
JH		 2206static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2207{
2208 struct hci_cp_reject_conn_req cp;
2209
2210 bacpy(&cp.bdaddr, bdaddr);
2211 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2212 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2213}
2214
6039aa73 2215static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2216{
a9de9248
MH		 2217 struct hci_ev_conn_request *ev = (void *) skb->data;
2218 int mask = hdev->link_mode;
70c46425
JH		 2219 struct inquiry_entry *ie;
2220 struct hci_conn *conn;
20714bfe 2221 __u8 flags = 0;
1da177e4 2222
6ed93dc6 2223 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2224 ev->link_type);
1da177e4 2225
20714bfe
FD		 2226 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2227 &flags);
1da177e4 2228
70c46425
JH		 2229 if (!(mask & HCI_LM_ACCEPT)) {
2230 hci_reject_conn(hdev, &ev->bdaddr);
2231 return;
2232 }
2233
46c4c941
JH		 2234 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2235 BDADDR_BREDR)) {
2236 hci_reject_conn(hdev, &ev->bdaddr);
2237 return;
2238 }
2239
6a8fc95c
JH		 2240 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2241 * connection. These features are only touched through mgmt so
2242 * only do the checks if HCI_MGMT is set.
2243 */
d7a5a11d
MH		 2244 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2245 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
46c4c941
JH		 2246 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2247 BDADDR_BREDR)) {
2248 hci_reject_conn(hdev, &ev->bdaddr);
2249 return;
70c46425 2250 }
1da177e4 2251
70c46425 2252 /* Connection accepted */
b6a0dc82 2253
70c46425
JH		 2254 hci_dev_lock(hdev);
2255
2256 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2257 if (ie)
2258 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2259
70c46425
JH		 2260 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2261 &ev->bdaddr);
2262 if (!conn) {
a5c4e309
JH		 2263 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2264 HCI_ROLE_SLAVE);
a9de9248 2265 if (!conn) {
70c46425
JH		 2266 BT_ERR("No memory for new connection");
2267 hci_dev_unlock(hdev);
2268 return;
1da177e4 2269 }
70c46425 2270 }
b6a0dc82 2271
70c46425 2272 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2273
70c46425 2274 hci_dev_unlock(hdev);
1da177e4 2275
70c46425
JH		 2276 if (ev->link_type == ACL_LINK ||
2277 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2278 struct hci_cp_accept_conn_req cp;
2279 conn->state = BT_CONNECT;
1da177e4 2280
70c46425 2281 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2282
70c46425
JH		 2283 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2284 cp.role = 0x00; /* Become master */
2285 else
2286 cp.role = 0x01; /* Remain slave */
b6a0dc82 2287
70c46425
JH		 2288 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2289 } else if (!(flags & HCI_PROTO_DEFER)) {
2290 struct hci_cp_accept_sync_conn_req cp;
2291 conn->state = BT_CONNECT;
b6a0dc82 2292
70c46425
JH		 2293 bacpy(&cp.bdaddr, &ev->bdaddr);
2294 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2295
70c46425
JH		 2296 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2297 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2298 cp.max_latency = cpu_to_le16(0xffff);
2299 cp.content_format = cpu_to_le16(hdev->voice_setting);
2300 cp.retrans_effort = 0xff;
1da177e4 2301
70c46425
JH		 2302 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2303 &cp);
a9de9248 2304 } else {
70c46425 2305 conn->state = BT_CONNECT2;
539c496d 2306 hci_connect_cfm(conn, 0);
1da177e4 2307 }
1da177e4
LT		 2308}
2309
f0d6a0ea
MA		 2310static u8 hci_to_mgmt_reason(u8 err)
2311{
2312 switch (err) {
2313 case HCI_ERROR_CONNECTION_TIMEOUT:
2314 return MGMT_DEV_DISCONN_TIMEOUT;
2315 case HCI_ERROR_REMOTE_USER_TERM:
2316 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2317 case HCI_ERROR_REMOTE_POWER_OFF:
2318 return MGMT_DEV_DISCONN_REMOTE;
2319 case HCI_ERROR_LOCAL_HOST_TERM:
2320 return MGMT_DEV_DISCONN_LOCAL_HOST;
2321 default:
2322 return MGMT_DEV_DISCONN_UNKNOWN;
2323 }
2324}
2325
6039aa73 2326static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2327{
a9de9248 2328 struct hci_ev_disconn_complete *ev = (void *) skb->data;
abf54a50 2329 u8 reason = hci_to_mgmt_reason(ev->reason);
9fcb18ef 2330 struct hci_conn_params *params;
04837f64 2331 struct hci_conn *conn;
12d4a3b2 2332 bool mgmt_connected;
3846220b 2333 u8 type;
04837f64 2334
9f1db00c 2335 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2336
2337 hci_dev_lock(hdev);
2338
2339 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2340 if (!conn)
2341 goto unlock;
7d0db0a3 2342
abf54a50
AG		 2343 if (ev->status) {
2344 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2345 conn->dst_type, ev->status);
2346 goto unlock;
37d9ef76 2347 }
f7520543 2348
3846220b
AG		 2349 conn->state = BT_CLOSED;
2350
12d4a3b2
JH		 2351 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2352 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2353 reason, mgmt_connected);
abf54a50 2354
22f433dc
JH		 2355 if (conn->type == ACL_LINK) {
2356 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2357 hci_remove_link_key(hdev, &conn->dst);
2358
1d2dc5b7 2359 hci_update_page_scan(hdev);
22f433dc 2360 }
2210246c 2361
9fcb18ef
AG		 2362 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2363 if (params) {
2364 switch (params->auto_connect) {
2365 case HCI_AUTO_CONN_LINK_LOSS:
2366 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2367 break;
2368 /* Fall through */
2369
4b9e7e75 2370 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2371 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2372 list_del_init(&params->action);
2373 list_add(&params->action, &hdev->pend_le_conns);
2374 hci_update_background_scan(hdev);
9fcb18ef
AG		 2375 break;
2376
2377 default:
2378 break;
2379 }
2380 }
2381
3846220b 2382 type = conn->type;
2210246c 2383
3a6d576b 2384 hci_disconn_cfm(conn, ev->reason);
3846220b
AG		 2385 hci_conn_del(conn);
2386
2387 /* Re-enable advertising if necessary, since it might
2388 * have been disabled by the connection. From the
2389 * HCI_LE_Set_Advertise_Enable command description in
2390 * the core specification (v4.0):
2391 * "The Controller shall continue advertising until the Host
2392 * issues an LE_Set_Advertise_Enable command with
2393 * Advertising_Enable set to 0x00 (Advertising is disabled)
2394 * or until a connection is created or until the Advertising
2395 * is timed out due to Directed Advertising."
2396 */
2397 if (type == LE_LINK)
2398 mgmt_reenable_advertising(hdev);
f7520543
JH		 2399
2400unlock:
04837f64
MH		 2401 hci_dev_unlock(hdev);
2402}
2403
6039aa73 2404static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2405{
a9de9248 2406 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2407 struct hci_conn *conn;
1da177e4 2408
9f1db00c 2409 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2410
2411 hci_dev_lock(hdev);
2412
04837f64 2413 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2414 if (!conn)
2415 goto unlock;
2416
2417 if (!ev->status) {
aa64a8b5 2418 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2419 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
d7556e20 2420 BT_INFO("re-auth of legacy device is not possible.");
2a611692 2421 } else {
4dae2798 2422 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2423 conn->sec_level = conn->pending_sec_level;
2a611692 2424 }
d7556e20 2425 } else {
e1e930f5 2426 mgmt_auth_failed(conn, ev->status);
d7556e20 2427 }
1da177e4 2428
51a8efd7
JH		 2429 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2430 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2431
d7556e20 2432 if (conn->state == BT_CONFIG) {
aa64a8b5 2433 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2434 struct hci_cp_set_conn_encrypt cp;
2435 cp.handle = ev->handle;
2436 cp.encrypt = 0x01;
2437 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2438 &cp);
052b30b0 2439 } else {
d7556e20 2440 conn->state = BT_CONNECTED;
539c496d 2441 hci_connect_cfm(conn, ev->status);
76a68ba0 2442 hci_conn_drop(conn);
052b30b0 2443 }
d7556e20
WR		 2444 } else {
2445 hci_auth_cfm(conn, ev->status);
052b30b0 2446
d7556e20
WR		 2447 hci_conn_hold(conn);
2448 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2449 hci_conn_drop(conn);
d7556e20
WR		 2450 }
2451
51a8efd7 2452 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2453 if (!ev->status) {
2454 struct hci_cp_set_conn_encrypt cp;
2455 cp.handle = ev->handle;
2456 cp.encrypt = 0x01;
2457 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2458 &cp);
d7556e20 2459 } else {
51a8efd7 2460 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2461 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2462 }
2463 }
2464
d7556e20 2465unlock:
1da177e4
LT		 2466 hci_dev_unlock(hdev);
2467}
2468
6039aa73 2469static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2470{
127178d2
JH		 2471 struct hci_ev_remote_name *ev = (void *) skb->data;
2472 struct hci_conn *conn;
2473
a9de9248 2474 BT_DBG("%s", hdev->name);
1da177e4 2475
a9de9248 2476 hci_conn_check_pending(hdev);
127178d2
JH		 2477
2478 hci_dev_lock(hdev);
2479
b644ba33 2480 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2481
d7a5a11d 2482 if (!hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2483 goto check_auth;
a88a9652 2484
b644ba33
JH		 2485 if (ev->status == 0)
2486 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2487 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2488 else
2489 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2490
2491check_auth:
79c6c70c
JH		 2492 if (!conn)
2493 goto unlock;
2494
2495 if (!hci_outgoing_auth_needed(hdev, conn))
2496 goto unlock;
2497
51a8efd7 2498 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2499 struct hci_cp_auth_requested cp;
977f8fce
JH		 2500
2501 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2502
127178d2
JH		 2503 cp.handle = __cpu_to_le16(conn->handle);
2504 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2505 }
2506
79c6c70c 2507unlock:
127178d2 2508 hci_dev_unlock(hdev);
a9de9248
MH		 2509}
2510
821f3766
JH		 2511static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2512 u16 opcode, struct sk_buff *skb)
2513{
2514 const struct hci_rp_read_enc_key_size *rp;
2515 struct hci_conn *conn;
2516 u16 handle;
2517
2518 BT_DBG("%s status 0x%02x", hdev->name, status);
2519
2520 if (!skb || skb->len < sizeof(*rp)) {
2521 BT_ERR("%s invalid HCI Read Encryption Key Size response",
2522 hdev->name);
2523 return;
2524 }
2525
2526 rp = (void *)skb->data;
2527 handle = le16_to_cpu(rp->handle);
2528
2529 hci_dev_lock(hdev);
2530
2531 conn = hci_conn_hash_lookup_handle(hdev, handle);
2532 if (!conn)
2533 goto unlock;
2534
2535 /* If we fail to read the encryption key size, assume maximum
2536 * (which is the same we do also when this HCI command isn't
2537 * supported.
2538 */
2539 if (rp->status) {
2540 BT_ERR("%s failed to read key size for handle %u", hdev->name,
2541 handle);
2542 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2543 } else {
2544 conn->enc_key_size = rp->key_size;
2545 }
2546
2547 if (conn->state == BT_CONFIG) {
2548 conn->state = BT_CONNECTED;
2549 hci_connect_cfm(conn, 0);
2550 hci_conn_drop(conn);
2551 } else {
2552 u8 encrypt;
2553
2554 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2555 encrypt = 0x00;
5d667ef6 2556 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
821f3766
JH		 2557 encrypt = 0x02;
2558 else
2559 encrypt = 0x01;
2560
2561 hci_encrypt_cfm(conn, 0, encrypt);
2562 }
2563
2564unlock:
2565 hci_dev_unlock(hdev);
2566}
2567
6039aa73 2568static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2569{
2570 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2571 struct hci_conn *conn;
2572
9f1db00c 2573 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2574
2575 hci_dev_lock(hdev);
2576
04837f64 2577 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2578 if (!conn)
2579 goto unlock;
1da177e4 2580
dc8357cc
MH		 2581 if (!ev->status) {
2582 if (ev->encrypt) {
2583 /* Encryption implies authentication */
4dae2798
JH		 2584 set_bit(HCI_CONN_AUTH, &conn->flags);
2585 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2586 conn->sec_level = conn->pending_sec_level;
abf76bad 2587
914a6ffe
MH		 2588 /* P-256 authentication key implies FIPS */
2589 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2590 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2591
abf76bad
MH		 2592 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2593 conn->type == LE_LINK)
2594 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2595 } else {
4dae2798 2596 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2597 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2598 }
dc8357cc 2599 }
a7d7723a 2600
7ed3fa20
JH		 2601 /* We should disregard the current RPA and generate a new one
2602 * whenever the encryption procedure fails.
2603 */
2604 if (ev->status && conn->type == LE_LINK)
a1536da2 2605 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7ed3fa20 2606
dc8357cc 2607 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2608
dc8357cc
MH		 2609 if (ev->status && conn->state == BT_CONNECTED) {
2610 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2611 hci_conn_drop(conn);
2612 goto unlock;
1da177e4
LT		 2613 }
2614
035ad621
JH		 2615 /* In Secure Connections Only mode, do not allow any connections
2616 * that are not encrypted with AES-CCM using a P-256 authenticated
2617 * combination key.
2618 */
2619 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2620 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2621 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2622 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2623 hci_conn_drop(conn);
2624 goto unlock;
2625 }
2626
821f3766
JH		 2627 /* Try reading the encryption key size for encrypted ACL links */
2628 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2629 struct hci_cp_read_enc_key_size cp;
2630 struct hci_request req;
2631
2632 /* Only send HCI_Read_Encryption_Key_Size if the
2633 * controller really supports it. If it doesn't, assume
2634 * the default size (16).
2635 */
2636 if (!(hdev->commands[20] & 0x10)) {
2637 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2638 goto notify;
2639 }
2640
2641 hci_req_init(&req, hdev);
2642
2643 cp.handle = cpu_to_le16(conn->handle);
2644 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2645
2646 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2647 BT_ERR("Sending HCI Read Encryption Key Size failed");
2648 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2649 goto notify;
2650 }
2651
2652 goto unlock;
2653 }
2654
2655notify:
dc8357cc
MH		 2656 if (conn->state == BT_CONFIG) {
2657 if (!ev->status)
2658 conn->state = BT_CONNECTED;
2659
539c496d 2660 hci_connect_cfm(conn, ev->status);
dc8357cc
MH		 2661 hci_conn_drop(conn);
2662 } else
2663 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2664
a7d7723a 2665unlock:
1da177e4
LT		 2666 hci_dev_unlock(hdev);
2667}
2668
6039aa73
GP		 2669static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2670 struct sk_buff *skb)
1da177e4 2671{
a9de9248 2672 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2673 struct hci_conn *conn;
1da177e4 2674
9f1db00c 2675 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2676
2677 hci_dev_lock(hdev);
2678
04837f64 2679 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2680 if (conn) {
2681 if (!ev->status)
4dae2798 2682 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 2683
51a8efd7 2684 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 2685
2686 hci_key_change_cfm(conn, ev->status);
2687 }
2688
2689 hci_dev_unlock(hdev);
2690}
2691
6039aa73
GP		 2692static void hci_remote_features_evt(struct hci_dev *hdev,
2693 struct sk_buff *skb)
1da177e4 2694{
a9de9248
MH		 2695 struct hci_ev_remote_features *ev = (void *) skb->data;
2696 struct hci_conn *conn;
2697
9f1db00c 2698 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 2699
a9de9248
MH		 2700 hci_dev_lock(hdev);
2701
2702 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2703 if (!conn)
2704 goto unlock;
769be974 2705
ccd556fe 2706 if (!ev->status)
cad718ed 2707 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 2708
2709 if (conn->state != BT_CONFIG)
2710 goto unlock;
2711
ac363cf9
SJ		 2712 if (!ev->status && lmp_ext_feat_capable(hdev) &&
2713 lmp_ext_feat_capable(conn)) {
ccd556fe
JH		 2714 struct hci_cp_read_remote_ext_features cp;
2715 cp.handle = ev->handle;
2716 cp.page = 0x01;
2717 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 2718 sizeof(cp), &cp);
392599b9
JH		 2719 goto unlock;
2720 }
2721
671267bf 2722 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 2723 struct hci_cp_remote_name_req cp;
2724 memset(&cp, 0, sizeof(cp));
2725 bacpy(&cp.bdaddr, &conn->dst);
2726 cp.pscan_rep_mode = 0x02;
2727 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 2728 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 2729 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 2730
127178d2 2731 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 2732 conn->state = BT_CONNECTED;
539c496d 2733 hci_connect_cfm(conn, ev->status);
76a68ba0 2734 hci_conn_drop(conn);
769be974 2735 }
a9de9248 2736
ccd556fe 2737unlock:
a9de9248 2738 hci_dev_unlock(hdev);
1da177e4
LT		 2739}
2740
e6214487
JH		 2741static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2742 u16 *opcode, u8 *status,
2743 hci_req_complete_t *req_complete,
2744 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 2745{
2746 struct hci_ev_cmd_complete *ev = (void *) skb->data;
a9de9248 2747
e6214487
JH		 2748 *opcode = __le16_to_cpu(ev->opcode);
2749 *status = skb->data[sizeof(*ev)];
a9de9248 2750
e6214487 2751 skb_pull(skb, sizeof(*ev));
a9de9248 2752
e6214487 2753 switch (*opcode) {
a9de9248
MH		 2754 case HCI_OP_INQUIRY_CANCEL:
2755 hci_cc_inquiry_cancel(hdev, skb);
2756 break;
2757
4d93483b
AG		 2758 case HCI_OP_PERIODIC_INQ:
2759 hci_cc_periodic_inq(hdev, skb);
2760 break;
2761
a9de9248
MH		 2762 case HCI_OP_EXIT_PERIODIC_INQ:
2763 hci_cc_exit_periodic_inq(hdev, skb);
2764 break;
2765
2766 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2767 hci_cc_remote_name_req_cancel(hdev, skb);
2768 break;
2769
2770 case HCI_OP_ROLE_DISCOVERY:
2771 hci_cc_role_discovery(hdev, skb);
2772 break;
2773
e4e8e37c
MH		 2774 case HCI_OP_READ_LINK_POLICY:
2775 hci_cc_read_link_policy(hdev, skb);
2776 break;
2777
a9de9248
MH		 2778 case HCI_OP_WRITE_LINK_POLICY:
2779 hci_cc_write_link_policy(hdev, skb);
2780 break;
2781
e4e8e37c
MH		 2782 case HCI_OP_READ_DEF_LINK_POLICY:
2783 hci_cc_read_def_link_policy(hdev, skb);
2784 break;
2785
2786 case HCI_OP_WRITE_DEF_LINK_POLICY:
2787 hci_cc_write_def_link_policy(hdev, skb);
2788 break;
2789
a9de9248
MH		 2790 case HCI_OP_RESET:
2791 hci_cc_reset(hdev, skb);
2792 break;
2793
c2f0f979
MH		 2794 case HCI_OP_READ_STORED_LINK_KEY:
2795 hci_cc_read_stored_link_key(hdev, skb);
2796 break;
2797
a9366120
MH		 2798 case HCI_OP_DELETE_STORED_LINK_KEY:
2799 hci_cc_delete_stored_link_key(hdev, skb);
2800 break;
2801
a9de9248
MH		 2802 case HCI_OP_WRITE_LOCAL_NAME:
2803 hci_cc_write_local_name(hdev, skb);
2804 break;
2805
2806 case HCI_OP_READ_LOCAL_NAME:
2807 hci_cc_read_local_name(hdev, skb);
2808 break;
2809
2810 case HCI_OP_WRITE_AUTH_ENABLE:
2811 hci_cc_write_auth_enable(hdev, skb);
2812 break;
2813
2814 case HCI_OP_WRITE_ENCRYPT_MODE:
2815 hci_cc_write_encrypt_mode(hdev, skb);
2816 break;
2817
2818 case HCI_OP_WRITE_SCAN_ENABLE:
2819 hci_cc_write_scan_enable(hdev, skb);
2820 break;
2821
2822 case HCI_OP_READ_CLASS_OF_DEV:
2823 hci_cc_read_class_of_dev(hdev, skb);
2824 break;
2825
2826 case HCI_OP_WRITE_CLASS_OF_DEV:
2827 hci_cc_write_class_of_dev(hdev, skb);
2828 break;
2829
2830 case HCI_OP_READ_VOICE_SETTING:
2831 hci_cc_read_voice_setting(hdev, skb);
2832 break;
2833
2834 case HCI_OP_WRITE_VOICE_SETTING:
2835 hci_cc_write_voice_setting(hdev, skb);
2836 break;
2837
b4cb9fb2
MH		 2838 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2839 hci_cc_read_num_supported_iac(hdev, skb);
2840 break;
2841
333140b5
MH		 2842 case HCI_OP_WRITE_SSP_MODE:
2843 hci_cc_write_ssp_mode(hdev, skb);
2844 break;
2845
eac83dc6
MH		 2846 case HCI_OP_WRITE_SC_SUPPORT:
2847 hci_cc_write_sc_support(hdev, skb);
2848 break;
2849
a9de9248
MH		 2850 case HCI_OP_READ_LOCAL_VERSION:
2851 hci_cc_read_local_version(hdev, skb);
2852 break;
2853
2854 case HCI_OP_READ_LOCAL_COMMANDS:
2855 hci_cc_read_local_commands(hdev, skb);
2856 break;
2857
2858 case HCI_OP_READ_LOCAL_FEATURES:
2859 hci_cc_read_local_features(hdev, skb);
2860 break;
2861
971e3a4b
AG		 2862 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2863 hci_cc_read_local_ext_features(hdev, skb);
2864 break;
2865
a9de9248
MH		 2866 case HCI_OP_READ_BUFFER_SIZE:
2867 hci_cc_read_buffer_size(hdev, skb);
2868 break;
2869
2870 case HCI_OP_READ_BD_ADDR:
2871 hci_cc_read_bd_addr(hdev, skb);
2872 break;
2873
f332ec66
JH		 2874 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2875 hci_cc_read_page_scan_activity(hdev, skb);
2876 break;
2877
4a3ee763
JH		 2878 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2879 hci_cc_write_page_scan_activity(hdev, skb);
2880 break;
2881
f332ec66
JH		 2882 case HCI_OP_READ_PAGE_SCAN_TYPE:
2883 hci_cc_read_page_scan_type(hdev, skb);
2884 break;
2885
4a3ee763
JH		 2886 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2887 hci_cc_write_page_scan_type(hdev, skb);
2888 break;
2889
350ee4cf
AE		 2890 case HCI_OP_READ_DATA_BLOCK_SIZE:
2891 hci_cc_read_data_block_size(hdev, skb);
2892 break;
2893
1e89cffb
AE		 2894 case HCI_OP_READ_FLOW_CONTROL_MODE:
2895 hci_cc_read_flow_control_mode(hdev, skb);
2896 break;
2897
928abaa7
AE		 2898 case HCI_OP_READ_LOCAL_AMP_INFO:
2899 hci_cc_read_local_amp_info(hdev, skb);
2900 break;
2901
33f35721
JH		 2902 case HCI_OP_READ_CLOCK:
2903 hci_cc_read_clock(hdev, skb);
2904 break;
2905
d5859e22
JH		 2906 case HCI_OP_READ_INQ_RSP_TX_POWER:
2907 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2908 break;
2909
980e1a53
JH		 2910 case HCI_OP_PIN_CODE_REPLY:
2911 hci_cc_pin_code_reply(hdev, skb);
2912 break;
2913
2914 case HCI_OP_PIN_CODE_NEG_REPLY:
2915 hci_cc_pin_code_neg_reply(hdev, skb);
2916 break;
2917
c35938b2 2918 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 2919 hci_cc_read_local_oob_data(hdev, skb);
2920 break;
2921
2922 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2923 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 2924 break;
2925
6ed58ec5
VT		 2926 case HCI_OP_LE_READ_BUFFER_SIZE:
2927 hci_cc_le_read_buffer_size(hdev, skb);
2928 break;
2929
60e77321
JH		 2930 case HCI_OP_LE_READ_LOCAL_FEATURES:
2931 hci_cc_le_read_local_features(hdev, skb);
2932 break;
2933
8fa19098
JH		 2934 case HCI_OP_LE_READ_ADV_TX_POWER:
2935 hci_cc_le_read_adv_tx_power(hdev, skb);
2936 break;
2937
a5c29683
JH		 2938 case HCI_OP_USER_CONFIRM_REPLY:
2939 hci_cc_user_confirm_reply(hdev, skb);
2940 break;
2941
2942 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2943 hci_cc_user_confirm_neg_reply(hdev, skb);
2944 break;
2945
1143d458
BG		 2946 case HCI_OP_USER_PASSKEY_REPLY:
2947 hci_cc_user_passkey_reply(hdev, skb);
2948 break;
2949
2950 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2951 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 2952 break;
07f7fa5d 2953
7a4cd51d
MH		 2954 case HCI_OP_LE_SET_RANDOM_ADDR:
2955 hci_cc_le_set_random_addr(hdev, skb);
2956 break;
2957
c1d5dc4a
JH		 2958 case HCI_OP_LE_SET_ADV_ENABLE:
2959 hci_cc_le_set_adv_enable(hdev, skb);
2960 break;
2961
533553f8
MH		 2962 case HCI_OP_LE_SET_SCAN_PARAM:
2963 hci_cc_le_set_scan_param(hdev, skb);
2964 break;
2965
eb9d91f5
AG		 2966 case HCI_OP_LE_SET_SCAN_ENABLE:
2967 hci_cc_le_set_scan_enable(hdev, skb);
2968 break;
2969
cf1d081f
JH		 2970 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2971 hci_cc_le_read_white_list_size(hdev, skb);
2972 break;
2973
0f36b589
MH		 2974 case HCI_OP_LE_CLEAR_WHITE_LIST:
2975 hci_cc_le_clear_white_list(hdev, skb);
2976 break;
2977
2978 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2979 hci_cc_le_add_to_white_list(hdev, skb);
2980 break;
2981
2982 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2983 hci_cc_le_del_from_white_list(hdev, skb);
2984 break;
2985
9b008c04
JH		 2986 case HCI_OP_LE_READ_SUPPORTED_STATES:
2987 hci_cc_le_read_supported_states(hdev, skb);
2988 break;
2989
a8e1bfaa
MH		 2990 case HCI_OP_LE_READ_DEF_DATA_LEN:
2991 hci_cc_le_read_def_data_len(hdev, skb);
2992 break;
2993
2994 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
2995 hci_cc_le_write_def_data_len(hdev, skb);
2996 break;
2997
2998 case HCI_OP_LE_READ_MAX_DATA_LEN:
2999 hci_cc_le_read_max_data_len(hdev, skb);
3000 break;
3001
f9b49306
AG		 3002 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3003 hci_cc_write_le_host_supported(hdev, skb);
3004 break;
3005
56ed2cb8
JH		 3006 case HCI_OP_LE_SET_ADV_PARAM:
3007 hci_cc_set_adv_param(hdev, skb);
3008 break;
3009
5ae76a94
AK		 3010 case HCI_OP_READ_RSSI:
3011 hci_cc_read_rssi(hdev, skb);
3012 break;
3013
5a134fae
AK		 3014 case HCI_OP_READ_TX_POWER:
3015 hci_cc_read_tx_power(hdev, skb);
3016 break;
3017
c50b33c8
MH		 3018 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3019 hci_cc_write_ssp_debug_mode(hdev, skb);
3020 break;
3021
a9de9248 3022 default:
e6214487 3023 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3024 break;
3025 }
3026
e6214487 3027 if (*opcode != HCI_OP_NOP)
65cc2b49 3028 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3029
600b2150
JH		 3030 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3031 atomic_set(&hdev->cmd_cnt, 1);
3032
e6214487
JH		 3033 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3034 req_complete_skb);
9238f36a 3035
600b2150
JH		 3036 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3037 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3038}
3039
e6214487
JH		 3040static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3041 u16 *opcode, u8 *status,
3042 hci_req_complete_t *req_complete,
3043 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3044{
3045 struct hci_ev_cmd_status *ev = (void *) skb->data;
a9de9248
MH		 3046
3047 skb_pull(skb, sizeof(*ev));
3048
e6214487
JH		 3049 *opcode = __le16_to_cpu(ev->opcode);
3050 *status = ev->status;
a9de9248 3051
e6214487 3052 switch (*opcode) {
a9de9248
MH		 3053 case HCI_OP_INQUIRY:
3054 hci_cs_inquiry(hdev, ev->status);
3055 break;
3056
3057 case HCI_OP_CREATE_CONN:
3058 hci_cs_create_conn(hdev, ev->status);
3059 break;
3060
9645c76c
KP		 3061 case HCI_OP_DISCONNECT:
3062 hci_cs_disconnect(hdev, ev->status);
3063 break;
3064
a9de9248
MH		 3065 case HCI_OP_ADD_SCO:
3066 hci_cs_add_sco(hdev, ev->status);
3067 break;
3068
f8558555
MH		 3069 case HCI_OP_AUTH_REQUESTED:
3070 hci_cs_auth_requested(hdev, ev->status);
3071 break;
3072
3073 case HCI_OP_SET_CONN_ENCRYPT:
3074 hci_cs_set_conn_encrypt(hdev, ev->status);
3075 break;
3076
a9de9248
MH		 3077 case HCI_OP_REMOTE_NAME_REQ:
3078 hci_cs_remote_name_req(hdev, ev->status);
3079 break;
3080
769be974
MH		 3081 case HCI_OP_READ_REMOTE_FEATURES:
3082 hci_cs_read_remote_features(hdev, ev->status);
3083 break;
3084
3085 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3086 hci_cs_read_remote_ext_features(hdev, ev->status);
3087 break;
3088
a9de9248
MH		 3089 case HCI_OP_SETUP_SYNC_CONN:
3090 hci_cs_setup_sync_conn(hdev, ev->status);
3091 break;
3092
3093 case HCI_OP_SNIFF_MODE:
3094 hci_cs_sniff_mode(hdev, ev->status);
3095 break;
3096
3097 case HCI_OP_EXIT_SNIFF_MODE:
3098 hci_cs_exit_sniff_mode(hdev, ev->status);
3099 break;
3100
50fc85f1
KP		 3101 case HCI_OP_SWITCH_ROLE:
3102 hci_cs_switch_role(hdev, ev->status);
3103 break;
3104
cb1d68f7
JH		 3105 case HCI_OP_LE_CREATE_CONN:
3106 hci_cs_le_create_conn(hdev, ev->status);
3107 break;
3108
0fe29fd1
MH		 3109 case HCI_OP_LE_READ_REMOTE_FEATURES:
3110 hci_cs_le_read_remote_features(hdev, ev->status);
3111 break;
3112
81d0c8ad
JH		 3113 case HCI_OP_LE_START_ENC:
3114 hci_cs_le_start_enc(hdev, ev->status);
3115 break;
3116
a9de9248 3117 default:
e6214487 3118 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3119 break;
3120 }
3121
e6214487 3122 if (*opcode != HCI_OP_NOP)
65cc2b49 3123 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3124
600b2150
JH		 3125 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3126 atomic_set(&hdev->cmd_cnt, 1);
3127
444c6dd5
JH		 3128 /* Indicate request completion if the command failed. Also, if
3129 * we're not waiting for a special event and we get a success
3130 * command status we should try to flag the request as completed
3131 * (since for this kind of commands there will not be a command
3132 * complete event).
3133 */
02350a72 3134 if (ev->status ||
db6e3e8d 3135 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
e6214487
JH		 3136 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3137 req_complete_skb);
9238f36a 3138
600b2150
JH		 3139 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3140 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3141}
3142
24dfa343
MH		 3143static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3144{
3145 struct hci_ev_hardware_error *ev = (void *) skb->data;
3146
c7741d16
MH		 3147 hdev->hw_error_code = ev->code;
3148
3149 queue_work(hdev->req_workqueue, &hdev->error_reset);
24dfa343
MH		 3150}
3151
6039aa73 3152static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3153{
3154 struct hci_ev_role_change *ev = (void *) skb->data;
3155 struct hci_conn *conn;
3156
9f1db00c 3157 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 3158
3159 hci_dev_lock(hdev);
3160
3161 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3162 if (conn) {
40bef302
JH		 3163 if (!ev->status)
3164 conn->role = ev->role;
a9de9248 3165
51a8efd7 3166 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 3167
3168 hci_role_switch_cfm(conn, ev->status, ev->role);
3169 }
3170
3171 hci_dev_unlock(hdev);
3172}
3173
6039aa73 3174static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3175{
3176 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 3177 int i;
3178
32ac5b9b
AE		 3179 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3180 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3181 return;
3182 }
3183
c5993de8 3184 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3185 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
a9de9248
MH		 3186 BT_DBG("%s bad parameters", hdev->name);
3187 return;
3188 }
3189
c5993de8
AE		 3190 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3191
613a1c0c
AE		 3192 for (i = 0; i < ev->num_hndl; i++) {
3193 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 3194 struct hci_conn *conn;
3195 __u16 handle, count;
3196
613a1c0c
AE		 3197 handle = __le16_to_cpu(info->handle);
3198 count = __le16_to_cpu(info->count);
a9de9248
MH		 3199
3200 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 3201 if (!conn)
3202 continue;
3203
3204 conn->sent -= count;
3205
3206 switch (conn->type) {
3207 case ACL_LINK:
3208 hdev->acl_cnt += count;
3209 if (hdev->acl_cnt > hdev->acl_pkts)
3210 hdev->acl_cnt = hdev->acl_pkts;
3211 break;
3212
3213 case LE_LINK:
3214 if (hdev->le_pkts) {
3215 hdev->le_cnt += count;
3216 if (hdev->le_cnt > hdev->le_pkts)
3217 hdev->le_cnt = hdev->le_pkts;
3218 } else {
70f23020
AE		 3219 hdev->acl_cnt += count;
3220 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 3221 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 3222 }
f4280918
AE		 3223 break;
3224
3225 case SCO_LINK:
3226 hdev->sco_cnt += count;
3227 if (hdev->sco_cnt > hdev->sco_pkts)
3228 hdev->sco_cnt = hdev->sco_pkts;
3229 break;
3230
3231 default:
3232 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3233 break;
a9de9248
MH		 3234 }
3235 }
3236
3eff45ea 3237 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3238}
3239
76ef7cf7
AE		 3240static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3241 __u16 handle)
3242{
3243 struct hci_chan *chan;
3244
3245 switch (hdev->dev_type) {
3246 case HCI_BREDR:
3247 return hci_conn_hash_lookup_handle(hdev, handle);
3248 case HCI_AMP:
3249 chan = hci_chan_lookup_handle(hdev, handle);
3250 if (chan)
3251 return chan->conn;
3252 break;
3253 default:
3254 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3255 break;
3256 }
3257
3258 return NULL;
3259}
3260
6039aa73 3261static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3262{
3263 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3264 int i;
3265
3266 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3267 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3268 return;
3269 }
3270
3271 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3272 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
25e89e99
AE		 3273 BT_DBG("%s bad parameters", hdev->name);
3274 return;
3275 }
3276
3277 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3278 ev->num_hndl);
25e89e99
AE		 3279
3280 for (i = 0; i < ev->num_hndl; i++) {
3281 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3282 struct hci_conn *conn = NULL;
25e89e99
AE		 3283 __u16 handle, block_count;
3284
3285 handle = __le16_to_cpu(info->handle);
3286 block_count = __le16_to_cpu(info->blocks);
3287
76ef7cf7 3288 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3289 if (!conn)
3290 continue;
3291
3292 conn->sent -= block_count;
3293
3294 switch (conn->type) {
3295 case ACL_LINK:
bd1eb66b 3296 case AMP_LINK:
25e89e99
AE		 3297 hdev->block_cnt += block_count;
3298 if (hdev->block_cnt > hdev->num_blocks)
3299 hdev->block_cnt = hdev->num_blocks;
3300 break;
3301
3302 default:
3303 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3304 break;
3305 }
3306 }
3307
3308 queue_work(hdev->workqueue, &hdev->tx_work);
3309}
3310
6039aa73 3311static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3312{
a9de9248 3313 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3314 struct hci_conn *conn;
3315
9f1db00c 3316 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3317
3318 hci_dev_lock(hdev);
3319
3320 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3321 if (conn) {
3322 conn->mode = ev->mode;
a9de9248 3323
8fc9ced3
GP		 3324 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3325 &conn->flags)) {
a9de9248 3326 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3327 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3328 else
58a681ef 3329 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3330 }
e73439d8 3331
51a8efd7 3332 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3333 hci_sco_setup(conn, ev->status);
04837f64
MH		 3334 }
3335
3336 hci_dev_unlock(hdev);
3337}
3338
6039aa73 3339static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3340{
052b30b0
MH		 3341 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3342 struct hci_conn *conn;
3343
a9de9248 3344 BT_DBG("%s", hdev->name);
052b30b0
MH		 3345
3346 hci_dev_lock(hdev);
3347
3348 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3349 if (!conn)
3350 goto unlock;
3351
3352 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3353 hci_conn_hold(conn);
3354 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3355 hci_conn_drop(conn);
052b30b0
MH		 3356 }
3357
d7a5a11d 3358 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2f407f0a 3359 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3360 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3361 sizeof(ev->bdaddr), &ev->bdaddr);
d7a5a11d 3362 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
a770bb5a
WR		 3363 u8 secure;
3364
3365 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3366 secure = 1;
3367 else
3368 secure = 0;
3369
744cf19e 3370 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3371 }
980e1a53 3372
b6f98044 3373unlock:
052b30b0 3374 hci_dev_unlock(hdev);
a9de9248
MH		 3375}
3376
cb6f3f7a
JH		 3377static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3378{
3379 if (key_type == HCI_LK_CHANGED_COMBINATION)
3380 return;
3381
3382 conn->pin_length = pin_len;
3383 conn->key_type = key_type;
3384
3385 switch (key_type) {
3386 case HCI_LK_LOCAL_UNIT:
3387 case HCI_LK_REMOTE_UNIT:
3388 case HCI_LK_DEBUG_COMBINATION:
3389 return;
3390 case HCI_LK_COMBINATION:
3391 if (pin_len == 16)
3392 conn->pending_sec_level = BT_SECURITY_HIGH;
3393 else
3394 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3395 break;
3396 case HCI_LK_UNAUTH_COMBINATION_P192:
3397 case HCI_LK_UNAUTH_COMBINATION_P256:
3398 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3399 break;
3400 case HCI_LK_AUTH_COMBINATION_P192:
3401 conn->pending_sec_level = BT_SECURITY_HIGH;
3402 break;
3403 case HCI_LK_AUTH_COMBINATION_P256:
3404 conn->pending_sec_level = BT_SECURITY_FIPS;
3405 break;
3406 }
3407}
3408
6039aa73 3409static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3410{
55ed8ca1
JH		 3411 struct hci_ev_link_key_req *ev = (void *) skb->data;
3412 struct hci_cp_link_key_reply cp;
3413 struct hci_conn *conn;
3414 struct link_key *key;
3415
a9de9248 3416 BT_DBG("%s", hdev->name);
55ed8ca1 3417
d7a5a11d 3418 if (!hci_dev_test_flag(hdev, HCI_MGMT))
55ed8ca1
JH		 3419 return;
3420
3421 hci_dev_lock(hdev);
3422
3423 key = hci_find_link_key(hdev, &ev->bdaddr);
3424 if (!key) {
6ed93dc6
AE		 3425 BT_DBG("%s link key not found for %pMR", hdev->name,
3426 &ev->bdaddr);
55ed8ca1
JH		 3427 goto not_found;
3428 }
3429
6ed93dc6
AE		 3430 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3431 &ev->bdaddr);
55ed8ca1 3432
55ed8ca1 3433 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3434 if (conn) {
fe8bc5ac
JH		 3435 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3436
66138ce8
MH		 3437 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3438 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3439 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3440 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3441 goto not_found;
3442 }
55ed8ca1 3443
60b83f57 3444 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3445 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3446 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3447 BT_DBG("%s ignoring key unauthenticated for high security",
3448 hdev->name);
60b83f57
WR		 3449 goto not_found;
3450 }
3451
cb6f3f7a 3452 conn_set_key(conn, key->type, key->pin_len);
55ed8ca1
JH		 3453 }
3454
3455 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3456 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3457
3458 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3459
3460 hci_dev_unlock(hdev);
3461
3462 return;
3463
3464not_found:
3465 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3466 hci_dev_unlock(hdev);
a9de9248
MH		 3467}
3468
6039aa73 3469static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3470{
052b30b0
MH		 3471 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3472 struct hci_conn *conn;
7652ff6a
JH		 3473 struct link_key *key;
3474 bool persistent;
55ed8ca1 3475 u8 pin_len = 0;
052b30b0 3476
a9de9248 3477 BT_DBG("%s", hdev->name);
052b30b0
MH		 3478
3479 hci_dev_lock(hdev);
3480
3481 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
82c13d42
JH		 3482 if (!conn)
3483 goto unlock;
3484
3485 hci_conn_hold(conn);
3486 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3487 hci_conn_drop(conn);
3488
fe8bc5ac 3489 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
82c13d42 3490 conn_set_key(conn, ev->key_type, conn->pin_length);
052b30b0 3491
d7a5a11d 3492 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7652ff6a
JH		 3493 goto unlock;
3494
3495 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3496 ev->key_type, pin_len, &persistent);
3497 if (!key)
3498 goto unlock;
3499
cb6f3f7a
JH		 3500 /* Update connection information since adding the key will have
3501 * fixed up the type in the case of changed combination keys.
3502 */
3503 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3504 conn_set_key(conn, key->type, key->pin_len);
3505
7652ff6a 3506 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3507
6d5650c4
JH		 3508 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3509 * is set. If it's not set simply remove the key from the kernel
3510 * list (we've still notified user space about it but with
3511 * store_hint being 0).
3512 */
3513 if (key->type == HCI_LK_DEBUG_COMBINATION &&
d7a5a11d 3514 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
0378b597
JH		 3515 list_del_rcu(&key->list);
3516 kfree_rcu(key, rcu);
82c13d42 3517 goto unlock;
6d5650c4 3518 }
7652ff6a 3519
82c13d42
JH		 3520 if (persistent)
3521 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3522 else
3523 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3524
7652ff6a 3525unlock:
052b30b0 3526 hci_dev_unlock(hdev);
a9de9248
MH		 3527}
3528
6039aa73 3529static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3530{
a9de9248 3531 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3532 struct hci_conn *conn;
1da177e4 3533
9f1db00c 3534 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3535
3536 hci_dev_lock(hdev);
3537
04837f64 3538 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3539 if (conn && !ev->status) {
3540 struct inquiry_entry *ie;
3541
cc11b9c1
AE		 3542 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3543 if (ie) {
1da177e4
LT		 3544 ie->data.clock_offset = ev->clock_offset;
3545 ie->timestamp = jiffies;
3546 }
3547 }
3548
3549 hci_dev_unlock(hdev);
3550}
3551
6039aa73 3552static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 3553{
3554 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3555 struct hci_conn *conn;
3556
9f1db00c 3557 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 3558
3559 hci_dev_lock(hdev);
3560
3561 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3562 if (conn && !ev->status)
3563 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3564
3565 hci_dev_unlock(hdev);
3566}
3567
6039aa73 3568static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 3569{
a9de9248 3570 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 3571 struct inquiry_entry *ie;
3572
3573 BT_DBG("%s", hdev->name);
3574
3575 hci_dev_lock(hdev);
3576
cc11b9c1
AE		 3577 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3578 if (ie) {
85a1e930
MH		 3579 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3580 ie->timestamp = jiffies;
3581 }
3582
3583 hci_dev_unlock(hdev);
3584}
3585
6039aa73
GP		 3586static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3587 struct sk_buff *skb)
a9de9248
MH		 3588{
3589 struct inquiry_data data;
3590 int num_rsp = *((__u8 *) skb->data);
3591
3592 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3593
3594 if (!num_rsp)
3595 return;
3596
d7a5a11d 3597 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3598 return;
3599
a9de9248
MH		 3600 hci_dev_lock(hdev);
3601
3602 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3603 struct inquiry_info_with_rssi_and_pscan_mode *info;
3604 info = (void *) (skb->data + 1);
a9de9248 3605
e17acd40 3606 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3607 u32 flags;
3608
a9de9248
MH		 3609 bacpy(&data.bdaddr, &info->bdaddr);
3610 data.pscan_rep_mode = info->pscan_rep_mode;
3611 data.pscan_period_mode = info->pscan_period_mode;
3612 data.pscan_mode = info->pscan_mode;
3613 memcpy(data.dev_class, info->dev_class, 3);
3614 data.clock_offset = info->clock_offset;
3615 data.rssi = info->rssi;
41a96212 3616 data.ssp_mode = 0x00;
3175405b 3617
af58925c
MH		 3618 flags = hci_inquiry_cache_update(hdev, &data, false);
3619
48264f06 3620 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3621 info->dev_class, info->rssi,
af58925c 3622 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3623 }
3624 } else {
3625 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3626
e17acd40 3627 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3628 u32 flags;
3629
a9de9248
MH		 3630 bacpy(&data.bdaddr, &info->bdaddr);
3631 data.pscan_rep_mode = info->pscan_rep_mode;
3632 data.pscan_period_mode = info->pscan_period_mode;
3633 data.pscan_mode = 0x00;
3634 memcpy(data.dev_class, info->dev_class, 3);
3635 data.clock_offset = info->clock_offset;
3636 data.rssi = info->rssi;
41a96212 3637 data.ssp_mode = 0x00;
af58925c
MH		 3638
3639 flags = hci_inquiry_cache_update(hdev, &data, false);
3640
48264f06 3641 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3642 info->dev_class, info->rssi,
af58925c 3643 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3644 }
3645 }
3646
3647 hci_dev_unlock(hdev);
3648}
3649
6039aa73
GP		 3650static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3651 struct sk_buff *skb)
a9de9248 3652{
41a96212
MH		 3653 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3654 struct hci_conn *conn;
3655
a9de9248 3656 BT_DBG("%s", hdev->name);
41a96212 3657
41a96212
MH		 3658 hci_dev_lock(hdev);
3659
3660 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3661 if (!conn)
3662 goto unlock;
41a96212 3663
cad718ed
JH		 3664 if (ev->page < HCI_MAX_PAGES)
3665 memcpy(conn->features[ev->page], ev->features, 8);
3666
ccd556fe
JH		 3667 if (!ev->status && ev->page == 0x01) {
3668 struct inquiry_entry *ie;
41a96212 3669
cc11b9c1
AE		 3670 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3671 if (ie)
02b7cc62 3672 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 3673
bbb0eada 3674 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 3675 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 3676 } else {
3677 /* It is mandatory by the Bluetooth specification that
3678 * Extended Inquiry Results are only used when Secure
3679 * Simple Pairing is enabled, but some devices violate
3680 * this.
3681 *
3682 * To make these devices work, the internal SSP
3683 * enabled flag needs to be cleared if the remote host
3684 * features do not indicate SSP support */
3685 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3686 }
eb9a8f3f
MH		 3687
3688 if (ev->features[0] & LMP_HOST_SC)
3689 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 3690 }
3691
3692 if (conn->state != BT_CONFIG)
3693 goto unlock;
3694
671267bf 3695 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3696 struct hci_cp_remote_name_req cp;
3697 memset(&cp, 0, sizeof(cp));
3698 bacpy(&cp.bdaddr, &conn->dst);
3699 cp.pscan_rep_mode = 0x02;
3700 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3701 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3702 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3703
127178d2 3704 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 3705 conn->state = BT_CONNECTED;
539c496d 3706 hci_connect_cfm(conn, ev->status);
76a68ba0 3707 hci_conn_drop(conn);
41a96212
MH		 3708 }
3709
ccd556fe 3710unlock:
41a96212 3711 hci_dev_unlock(hdev);
a9de9248
MH		 3712}
3713
6039aa73
GP		 3714static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3715 struct sk_buff *skb)
a9de9248 3716{
b6a0dc82
MH		 3717 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3718 struct hci_conn *conn;
3719
9f1db00c 3720 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 3721
3722 hci_dev_lock(hdev);
3723
3724 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 3725 if (!conn) {
3726 if (ev->link_type == ESCO_LINK)
3727 goto unlock;
3728
3729 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3730 if (!conn)
3731 goto unlock;
3732
3733 conn->type = SCO_LINK;
3734 }
b6a0dc82 3735
732547f9
MH		 3736 switch (ev->status) {
3737 case 0x00:
b6a0dc82
MH		 3738 conn->handle = __le16_to_cpu(ev->handle);
3739 conn->state = BT_CONNECTED;
7d0db0a3 3740
23b9ceb7 3741 hci_debugfs_create_conn(conn);
7d0db0a3 3742 hci_conn_add_sysfs(conn);
732547f9
MH		 3743 break;
3744
81218d20 3745 case 0x10: /* Connection Accept Timeout */
1a4c958c 3746 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 3747 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 3748 case 0x1c: /* SCO interval rejected */
1038a00b 3749 case 0x1a: /* Unsupported Remote Feature */
732547f9 3750 case 0x1f: /* Unspecified error */
27539bc4 3751 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 3752 if (conn->out) {
732547f9
MH		 3753 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3754 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 3755 if (hci_setup_sync(conn, conn->link->handle))
3756 goto unlock;
732547f9
MH		 3757 }
3758 /* fall through */
3759
3760 default:
b6a0dc82 3761 conn->state = BT_CLOSED;
732547f9
MH		 3762 break;
3763 }
b6a0dc82 3764
539c496d 3765 hci_connect_cfm(conn, ev->status);
b6a0dc82
MH		 3766 if (ev->status)
3767 hci_conn_del(conn);
3768
3769unlock:
3770 hci_dev_unlock(hdev);
a9de9248
MH		 3771}
3772
efdcf8e3
MH		 3773static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3774{
3775 size_t parsed = 0;
3776
3777 while (parsed < eir_len) {
3778 u8 field_len = eir[0];
3779
3780 if (field_len == 0)
3781 return parsed;
3782
3783 parsed += field_len + 1;
3784 eir += field_len + 1;
3785 }
3786
3787 return eir_len;
3788}
3789
6039aa73
GP		 3790static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3791 struct sk_buff *skb)
1da177e4 3792{
a9de9248
MH		 3793 struct inquiry_data data;
3794 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3795 int num_rsp = *((__u8 *) skb->data);
9d939d94 3796 size_t eir_len;
1da177e4 3797
a9de9248 3798 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 3799
a9de9248
MH		 3800 if (!num_rsp)
3801 return;
1da177e4 3802
d7a5a11d 3803 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3804 return;
3805
a9de9248
MH		 3806 hci_dev_lock(hdev);
3807
e17acd40 3808 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3809 u32 flags;
3810 bool name_known;
561aafbc 3811
a9de9248 3812 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 3813 data.pscan_rep_mode = info->pscan_rep_mode;
3814 data.pscan_period_mode = info->pscan_period_mode;
3815 data.pscan_mode = 0x00;
a9de9248 3816 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 3817 data.clock_offset = info->clock_offset;
3818 data.rssi = info->rssi;
41a96212 3819 data.ssp_mode = 0x01;
561aafbc 3820
d7a5a11d 3821 if (hci_dev_test_flag(hdev, HCI_MGMT))
4ddb1930 3822 name_known = eir_has_data_type(info->data,
04124681
GP		 3823 sizeof(info->data),
3824 EIR_NAME_COMPLETE);
561aafbc
JH		 3825 else
3826 name_known = true;
3827
af58925c
MH		 3828 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3829
9d939d94 3830 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 3831
48264f06 3832 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 3833 info->dev_class, info->rssi,
3834 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 3835 }
3836
3837 hci_dev_unlock(hdev);
3838}
1da177e4 3839
1c2e0041
JH		 3840static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3841 struct sk_buff *skb)
3842{
3843 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3844 struct hci_conn *conn;
3845
9f1db00c 3846 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 3847 __le16_to_cpu(ev->handle));
3848
3849 hci_dev_lock(hdev);
3850
3851 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3852 if (!conn)
3853 goto unlock;
3854
9eb1fbfa
JH		 3855 /* For BR/EDR the necessary steps are taken through the
3856 * auth_complete event.
3857 */
3858 if (conn->type != LE_LINK)
3859 goto unlock;
3860
1c2e0041
JH		 3861 if (!ev->status)
3862 conn->sec_level = conn->pending_sec_level;
3863
3864 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3865
3866 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 3867 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 3868 hci_conn_drop(conn);
1c2e0041
JH		 3869 goto unlock;
3870 }
3871
3872 if (conn->state == BT_CONFIG) {
3873 if (!ev->status)
3874 conn->state = BT_CONNECTED;
3875
539c496d 3876 hci_connect_cfm(conn, ev->status);
76a68ba0 3877 hci_conn_drop(conn);
1c2e0041
JH		 3878 } else {
3879 hci_auth_cfm(conn, ev->status);
3880
3881 hci_conn_hold(conn);
3882 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3883 hci_conn_drop(conn);
1c2e0041
JH		 3884 }
3885
3886unlock:
3887 hci_dev_unlock(hdev);
3888}
3889
6039aa73 3890static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 3891{
17fa4b9d 3892 /* If remote requests no-bonding follow that lead */
acabae96
MA		 3893 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3894 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 3895 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 3896
b7f94c88
MA		 3897 /* If both remote and local have enough IO capabilities, require
3898 * MITM protection
3899 */
3900 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3901 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3902 return conn->remote_auth | 0x01;
3903
7e74170a
TM		 3904 /* No MITM protection possible so ignore remote requirement */
3905 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 3906}
3907
a83ed81e
MH		 3908static u8 bredr_oob_data_present(struct hci_conn *conn)
3909{
3910 struct hci_dev *hdev = conn->hdev;
3911 struct oob_data *data;
3912
3913 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3914 if (!data)
3915 return 0x00;
3916
455c2ff0
MH		 3917 if (bredr_sc_enabled(hdev)) {
3918 /* When Secure Connections is enabled, then just
3919 * return the present value stored with the OOB
3920 * data. The stored value contains the right present
3921 * information. However it can only be trusted when
3922 * not in Secure Connection Only mode.
3923 */
3924 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3925 return data->present;
659c7fb0 3926
455c2ff0
MH		 3927 /* When Secure Connections Only mode is enabled, then
3928 * the P-256 values are required. If they are not
3929 * available, then do not declare that OOB data is
3930 * present.
659c7fb0 3931 */
455c2ff0
MH		 3932 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3933 !memcmp(data->hash256, ZERO_KEY, 16))
659c7fb0
MH		 3934 return 0x00;
3935
455c2ff0 3936 return 0x02;
659c7fb0 3937 }
a83ed81e 3938
455c2ff0
MH		 3939 /* When Secure Connections is not enabled or actually
3940 * not supported by the hardware, then check that if
3941 * P-192 data values are present.
3942 */
3943 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3944 !memcmp(data->hash192, ZERO_KEY, 16))
3945 return 0x00;
3946
3947 return 0x01;
a83ed81e
MH		 3948}
3949
6039aa73 3950static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 3951{
3952 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3953 struct hci_conn *conn;
3954
3955 BT_DBG("%s", hdev->name);
3956
3957 hci_dev_lock(hdev);
3958
3959 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 3960 if (!conn)
3961 goto unlock;
3962
3963 hci_conn_hold(conn);
3964
d7a5a11d 3965 if (!hci_dev_test_flag(hdev, HCI_MGMT))
03b555e1
JH		 3966 goto unlock;
3967
2f407f0a
JH		 3968 /* Allow pairing if we're pairable, the initiators of the
3969 * pairing or if the remote is not requesting bonding.
3970 */
d7a5a11d 3971 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
2f407f0a 3972 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 3973 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 3974 struct hci_cp_io_capability_reply cp;
3975
3976 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 3977 /* Change the IO capability from KeyboardDisplay
3978 * to DisplayYesNo as it is not supported by BT spec. */
3979 cp.capability = (conn->io_capability == 0x04) ?
a767631a 3980 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 3981
3982 /* If we are initiators, there is no remote information yet */
3983 if (conn->remote_auth == 0xff) {
b16c6604 3984 /* Request MITM protection if our IO caps allow it
4ad51a75 3985 * except for the no-bonding case.
b16c6604 3986 */
6fd6b915 3987 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 3988 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 3989 conn->auth_type |= 0x01;
b7f94c88
MA		 3990 } else {
3991 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 3992 }
17fa4b9d 3993
82c295b1
JH		 3994 /* If we're not bondable, force one of the non-bondable
3995 * authentication requirement values.
3996 */
d7a5a11d 3997 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
82c295b1
JH		 3998 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3999
4000 cp.authentication = conn->auth_type;
a83ed81e 4001 cp.oob_data = bredr_oob_data_present(conn);
ce85ee13 4002
17fa4b9d 4003 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 4004 sizeof(cp), &cp);
03b555e1
JH		 4005 } else {
4006 struct hci_cp_io_capability_neg_reply cp;
4007
4008 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 4009 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 4010
03b555e1 4011 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 4012 sizeof(cp), &cp);
03b555e1
JH		 4013 }
4014
4015unlock:
4016 hci_dev_unlock(hdev);
4017}
4018
6039aa73 4019static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 4020{
4021 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4022 struct hci_conn *conn;
4023
4024 BT_DBG("%s", hdev->name);
4025
4026 hci_dev_lock(hdev);
4027
4028 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4029 if (!conn)
4030 goto unlock;
4031
03b555e1 4032 conn->remote_cap = ev->capability;
03b555e1
JH		 4033 conn->remote_auth = ev->authentication;
4034
4035unlock:
0493684e
MH		 4036 hci_dev_unlock(hdev);
4037}
4038
6039aa73
GP		 4039static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4040 struct sk_buff *skb)
a5c29683
JH		 4041{
4042 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 4043 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 4044 struct hci_conn *conn;
a5c29683
JH		 4045
4046 BT_DBG("%s", hdev->name);
4047
4048 hci_dev_lock(hdev);
4049
d7a5a11d 4050 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7a828908 4051 goto unlock;
a5c29683 4052
7a828908
JH		 4053 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4054 if (!conn)
4055 goto unlock;
4056
4057 loc_mitm = (conn->auth_type & 0x01);
4058 rem_mitm = (conn->remote_auth & 0x01);
4059
4060 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 4061 * (it has NoInputNoOutput) then reject the confirmation
4062 * request. We check the security level here since it doesn't
4063 * necessarily match conn->auth_type.
6fd6b915 4064 */
6c53823a
JH		 4065 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4066 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 4067 BT_DBG("Rejecting request: remote device can't provide MITM");
4068 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 4069 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4070 goto unlock;
4071 }
4072
4073 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 4074 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4075 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 4076
4077 /* If we're not the initiators request authorization to
4078 * proceed from user space (mgmt_user_confirm with
ba15a58b 4079 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 4080 * side had MITM or if the local IO capability is
4081 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 4082 */
4083 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 4084 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 4085 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 4086 BT_DBG("Confirming auto-accept as acceptor");
4087 confirm_hint = 1;
4088 goto confirm;
4089 }
4090
9f61656a 4091 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 4092 hdev->auto_accept_delay);
9f61656a
JH		 4093
4094 if (hdev->auto_accept_delay > 0) {
4095 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 4096 queue_delayed_work(conn->hdev->workqueue,
4097 &conn->auto_accept_work, delay);
9f61656a
JH		 4098 goto unlock;
4099 }
4100
7a828908 4101 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 4102 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4103 goto unlock;
4104 }
4105
55bc1a37 4106confirm:
39adbffe
JH		 4107 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4108 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 4109
4110unlock:
a5c29683
JH		 4111 hci_dev_unlock(hdev);
4112}
4113
6039aa73
GP		 4114static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4115 struct sk_buff *skb)
1143d458
BG		 4116{
4117 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4118
4119 BT_DBG("%s", hdev->name);
4120
d7a5a11d 4121 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 4122 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 4123}
4124
92a25256
JH		 4125static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4126 struct sk_buff *skb)
4127{
4128 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4129 struct hci_conn *conn;
4130
4131 BT_DBG("%s", hdev->name);
4132
4133 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4134 if (!conn)
4135 return;
4136
4137 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4138 conn->passkey_entered = 0;
4139
d7a5a11d 4140 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4141 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4142 conn->dst_type, conn->passkey_notify,
4143 conn->passkey_entered);
4144}
4145
4146static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4147{
4148 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4149 struct hci_conn *conn;
4150
4151 BT_DBG("%s", hdev->name);
4152
4153 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4154 if (!conn)
4155 return;
4156
4157 switch (ev->type) {
4158 case HCI_KEYPRESS_STARTED:
4159 conn->passkey_entered = 0;
4160 return;
4161
4162 case HCI_KEYPRESS_ENTERED:
4163 conn->passkey_entered++;
4164 break;
4165
4166 case HCI_KEYPRESS_ERASED:
4167 conn->passkey_entered--;
4168 break;
4169
4170 case HCI_KEYPRESS_CLEARED:
4171 conn->passkey_entered = 0;
4172 break;
4173
4174 case HCI_KEYPRESS_COMPLETED:
4175 return;
4176 }
4177
d7a5a11d 4178 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4179 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4180 conn->dst_type, conn->passkey_notify,
4181 conn->passkey_entered);
4182}
4183
6039aa73
GP		 4184static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4185 struct sk_buff *skb)
0493684e
MH		 4186{
4187 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4188 struct hci_conn *conn;
4189
4190 BT_DBG("%s", hdev->name);
4191
4192 hci_dev_lock(hdev);
4193
4194 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 4195 if (!conn)
4196 goto unlock;
4197
c1d4fa7a
JH		 4198 /* Reset the authentication requirement to unknown */
4199 conn->remote_auth = 0xff;
4200
2a611692
JH		 4201 /* To avoid duplicate auth_failed events to user space we check
4202 * the HCI_CONN_AUTH_PEND flag which will be set if we
4203 * initiated the authentication. A traditional auth_complete
4204 * event gets always produced as initiator and is also mapped to
4205 * the mgmt_auth_failed event */
fa1bd918 4206 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 4207 mgmt_auth_failed(conn, ev->status);
0493684e 4208
76a68ba0 4209 hci_conn_drop(conn);
2a611692
JH		 4210
4211unlock:
0493684e
MH		 4212 hci_dev_unlock(hdev);
4213}
4214
6039aa73
GP		 4215static void hci_remote_host_features_evt(struct hci_dev *hdev,
4216 struct sk_buff *skb)
41a96212
MH		 4217{
4218 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4219 struct inquiry_entry *ie;
cad718ed 4220 struct hci_conn *conn;
41a96212
MH		 4221
4222 BT_DBG("%s", hdev->name);
4223
4224 hci_dev_lock(hdev);
4225
cad718ed
JH		 4226 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4227 if (conn)
4228 memcpy(conn->features[1], ev->features, 8);
4229
cc11b9c1
AE		 4230 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4231 if (ie)
02b7cc62 4232 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 4233
4234 hci_dev_unlock(hdev);
4235}
4236
6039aa73
GP		 4237static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4238 struct sk_buff *skb)
2763eda6
SJ		 4239{
4240 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4241 struct oob_data *data;
4242
4243 BT_DBG("%s", hdev->name);
4244
4245 hci_dev_lock(hdev);
4246
d7a5a11d 4247 if (!hci_dev_test_flag(hdev, HCI_MGMT))
e1ba1f15
SJ		 4248 goto unlock;
4249
6928a924 4250 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
6665d057
MH		 4251 if (!data) {
4252 struct hci_cp_remote_oob_data_neg_reply cp;
519ca9d0 4253
6665d057
MH		 4254 bacpy(&cp.bdaddr, &ev->bdaddr);
4255 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4256 sizeof(cp), &cp);
4257 goto unlock;
4258 }
2763eda6 4259
6665d057
MH		 4260 if (bredr_sc_enabled(hdev)) {
4261 struct hci_cp_remote_oob_ext_data_reply cp;
519ca9d0 4262
6665d057 4263 bacpy(&cp.bdaddr, &ev->bdaddr);
d7a5a11d 4264 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6665d057
MH		 4265 memset(cp.hash192, 0, sizeof(cp.hash192));
4266 memset(cp.rand192, 0, sizeof(cp.rand192));
4267 } else {
4268 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4269 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
519ca9d0 4270 }
6665d057
MH		 4271 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4272 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4273
4274 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4275 sizeof(cp), &cp);
2763eda6 4276 } else {
6665d057 4277 struct hci_cp_remote_oob_data_reply cp;
2763eda6
SJ		 4278
4279 bacpy(&cp.bdaddr, &ev->bdaddr);
6665d057
MH		 4280 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4281 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4282
4283 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
519ca9d0 4284 sizeof(cp), &cp);
2763eda6
SJ		 4285 }
4286
e1ba1f15 4287unlock:
2763eda6
SJ		 4288 hci_dev_unlock(hdev);
4289}
4290
a77a6a14
AW		 4291#if IS_ENABLED(CONFIG_BT_HS)
4292static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4293{
4294 struct hci_ev_channel_selected *ev = (void *)skb->data;
4295 struct hci_conn *hcon;
4296
4297 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4298
4299 skb_pull(skb, sizeof(*ev));
4300
4301 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4302 if (!hcon)
4303 return;
4304
4305 amp_read_loc_assoc_final_data(hdev, hcon);
4306}
4307
d5e91192
AE		 4308static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4309 struct sk_buff *skb)
4310{
4311 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4312 struct hci_conn *hcon, *bredr_hcon;
4313
4314 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4315 ev->status);
4316
4317 hci_dev_lock(hdev);
4318
4319 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4320 if (!hcon) {
4321 hci_dev_unlock(hdev);
4322 return;
4323 }
4324
4325 if (ev->status) {
4326 hci_conn_del(hcon);
4327 hci_dev_unlock(hdev);
4328 return;
4329 }
4330
4331 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4332
4333 hcon->state = BT_CONNECTED;
4334 bacpy(&hcon->dst, &bredr_hcon->dst);
4335
4336 hci_conn_hold(hcon);
4337 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4338 hci_conn_drop(hcon);
d5e91192 4339
23b9ceb7 4340 hci_debugfs_create_conn(hcon);
d5e91192
AE		 4341 hci_conn_add_sysfs(hcon);
4342
cf70ff22 4343 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4344
cf70ff22 4345 hci_dev_unlock(hdev);
d5e91192
AE		 4346}
4347
27695fb4
AE		 4348static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4349{
4350 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4351 struct hci_conn *hcon;
4352 struct hci_chan *hchan;
4353 struct amp_mgr *mgr;
4354
4355 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4356 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4357 ev->status);
4358
4359 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4360 if (!hcon)
4361 return;
4362
4363 /* Create AMP hchan */
4364 hchan = hci_chan_create(hcon);
4365 if (!hchan)
4366 return;
4367
4368 hchan->handle = le16_to_cpu(ev->handle);
4369
4370 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4371
4372 mgr = hcon->amp_mgr;
4373 if (mgr && mgr->bredr_chan) {
4374 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4375
4376 l2cap_chan_lock(bredr_chan);
4377
4378 bredr_chan->conn->mtu = hdev->block_mtu;
4379 l2cap_logical_cfm(bredr_chan, hchan, 0);
4380 hci_conn_hold(hcon);
4381
4382 l2cap_chan_unlock(bredr_chan);
4383 }
4384}
4385
606e2a10
AE		 4386static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4387 struct sk_buff *skb)
4388{
4389 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4390 struct hci_chan *hchan;
4391
4392 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4393 le16_to_cpu(ev->handle), ev->status);
4394
4395 if (ev->status)
4396 return;
4397
4398 hci_dev_lock(hdev);
4399
4400 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4401 if (!hchan)
4402 goto unlock;
4403
4404 amp_destroy_logical_link(hchan, ev->reason);
4405
4406unlock:
4407 hci_dev_unlock(hdev);
4408}
4409
9eef6b3a
AE		 4410static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4411 struct sk_buff *skb)
4412{
4413 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4414 struct hci_conn *hcon;
4415
4416 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4417
4418 if (ev->status)
4419 return;
4420
4421 hci_dev_lock(hdev);
4422
4423 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4424 if (hcon) {
4425 hcon->state = BT_CLOSED;
4426 hci_conn_del(hcon);
4427 }
4428
4429 hci_dev_unlock(hdev);
4430}
a77a6a14 4431#endif
9eef6b3a 4432
6039aa73 4433static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4434{
4435 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
912b42ef 4436 struct hci_conn_params *params;
fcd89c09 4437 struct hci_conn *conn;
68d6f6de 4438 struct smp_irk *irk;
837d502e 4439 u8 addr_type;
fcd89c09 4440
9f1db00c 4441 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
fcd89c09
VT		 4442
4443 hci_dev_lock(hdev);
4444
fbd96c15
JH		 4445 /* All controllers implicitly stop advertising in the event of a
4446 * connection, so ensure that the state bit is cleared.
4447 */
a358dc11 4448 hci_dev_clear_flag(hdev, HCI_LE_ADV);
fbd96c15 4449
b47a09b3 4450 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
b62f328b 4451 if (!conn) {
a5c4e309 4452 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
b62f328b
VT		 4453 if (!conn) {
4454 BT_ERR("No memory for new connection");
230fd16a 4455 goto unlock;
b62f328b 4456 }
29b7988a
AG		 4457
4458 conn->dst_type = ev->bdaddr_type;
b9b343d2 4459
cb1d68f7
JH		 4460 /* If we didn't have a hci_conn object previously
4461 * but we're in master role this must be something
4462 * initiated using a white list. Since white list based
4463 * connections are not "first class citizens" we don't
4464 * have full tracking of them. Therefore, we go ahead
4465 * with a "best effort" approach of determining the
4466 * initiator address based on the HCI_PRIVACY flag.
4467 */
4468 if (conn->out) {
4469 conn->resp_addr_type = ev->bdaddr_type;
4470 bacpy(&conn->resp_addr, &ev->bdaddr);
d7a5a11d 4471 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
cb1d68f7
JH		 4472 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4473 bacpy(&conn->init_addr, &hdev->rpa);
4474 } else {
4475 hci_copy_identity_address(hdev,
4476 &conn->init_addr,
4477 &conn->init_addr_type);
4478 }
cb1d68f7 4479 }
9489eca4
JH		 4480 } else {
4481 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4482 }
fcd89c09 4483
80c24ab8
JH		 4484 if (!conn->out) {
4485 /* Set the responder (our side) address type based on
4486 * the advertising address type.
4487 */
4488 conn->resp_addr_type = hdev->adv_addr_type;
4489 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4490 bacpy(&conn->resp_addr, &hdev->random_addr);
4491 else
4492 bacpy(&conn->resp_addr, &hdev->bdaddr);
4493
4494 conn->init_addr_type = ev->bdaddr_type;
4495 bacpy(&conn->init_addr, &ev->bdaddr);
a720d735
MH		 4496
4497 /* For incoming connections, set the default minimum
4498 * and maximum connection interval. They will be used
4499 * to check if the parameters are in range and if not
4500 * trigger the connection update procedure.
4501 */
4502 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4503 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4504 }
7be2edbb 4505
edb4b466
MH		 4506 /* Lookup the identity address from the stored connection
4507 * address and address type.
4508 *
4509 * When establishing connections to an identity address, the
4510 * connection procedure will store the resolvable random
4511 * address first. Now if it can be converted back into the
4512 * identity address, start using the identity address from
4513 * now on.
4514 */
4515 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4516 if (irk) {
4517 bacpy(&conn->dst, &irk->bdaddr);
4518 conn->dst_type = irk->addr_type;
4519 }
4520
2d3c2260
JH		 4521 if (ev->status) {
4522 hci_le_conn_failed(conn, ev->status);
837d502e
JH		 4523 goto unlock;
4524 }
4525
08853f18
JH		 4526 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4527 addr_type = BDADDR_LE_PUBLIC;
4528 else
4529 addr_type = BDADDR_LE_RANDOM;
4530
2d3c2260
JH		 4531 /* Drop the connection if the device is blocked */
4532 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4533 hci_conn_drop(conn);
cd17decb
AG		 4534 goto unlock;
4535 }
4536
b644ba33 4537 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4538 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 4539
7b5c0d52 4540 conn->sec_level = BT_SECURITY_LOW;
fcd89c09 4541 conn->handle = __le16_to_cpu(ev->handle);
0fe29fd1 4542 conn->state = BT_CONFIG;
fcd89c09 4543
e04fde60
MH		 4544 conn->le_conn_interval = le16_to_cpu(ev->interval);
4545 conn->le_conn_latency = le16_to_cpu(ev->latency);
4546 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4547
23b9ceb7 4548 hci_debugfs_create_conn(conn);
fcd89c09
VT		 4549 hci_conn_add_sysfs(conn);
4550
0fe29fd1
MH		 4551 if (!ev->status) {
4552 /* The remote features procedure is defined for master
4553 * role only. So only in case of an initiated connection
4554 * request the remote features.
4555 *
4556 * If the local controller supports slave-initiated features
4557 * exchange, then requesting the remote features in slave
4558 * role is possible. Otherwise just transition into the
4559 * connected state without requesting the remote features.
4560 */
4561 if (conn->out ||
4562 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4563 struct hci_cp_le_read_remote_features cp;
4564
4565 cp.handle = __cpu_to_le16(conn->handle);
4566
4567 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4568 sizeof(cp), &cp);
4569
4570 hci_conn_hold(conn);
4571 } else {
4572 conn->state = BT_CONNECTED;
4573 hci_connect_cfm(conn, ev->status);
4574 }
4575 } else {
4576 hci_connect_cfm(conn, ev->status);
4577 }
fcd89c09 4578
5477610f
JH		 4579 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4580 conn->dst_type);
f161dd41 4581 if (params) {
95305baa 4582 list_del_init(&params->action);
f161dd41
JH		 4583 if (params->conn) {
4584 hci_conn_drop(params->conn);
f8aaf9b6 4585 hci_conn_put(params->conn);
f161dd41
JH		 4586 params->conn = NULL;
4587 }
4588 }
a4790dbd 4589
fcd89c09 4590unlock:
223683a5 4591 hci_update_background_scan(hdev);
fcd89c09
VT		 4592 hci_dev_unlock(hdev);
4593}
4594
1855d92d
MH		 4595static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4596 struct sk_buff *skb)
4597{
4598 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4599 struct hci_conn *conn;
4600
4601 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4602
4603 if (ev->status)
4604 return;
4605
4606 hci_dev_lock(hdev);
4607
4608 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4609 if (conn) {
4610 conn->le_conn_interval = le16_to_cpu(ev->interval);
4611 conn->le_conn_latency = le16_to_cpu(ev->latency);
4612 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4613 }
4614
4615 hci_dev_unlock(hdev);
4616}
4617
a4790dbd 4618/* This function requires the caller holds hdev->lock */
fd45ada9
AA		 4619static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4620 bdaddr_t *addr,
4621 u8 addr_type, u8 adv_type)
a4790dbd
AG		 4622{
4623 struct hci_conn *conn;
4b9e7e75 4624 struct hci_conn_params *params;
a4790dbd 4625
1c1abcab
JH		 4626 /* If the event is not connectable don't proceed further */
4627 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4628 return NULL;
1c1abcab
JH		 4629
4630 /* Ignore if the device is blocked */
dcc36c16 4631 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
fd45ada9 4632 return NULL;
1c1abcab 4633
f99353cf
JH		 4634 /* Most controller will fail if we try to create new connections
4635 * while we have an existing one in slave role.
4636 */
4637 if (hdev->conn_hash.le_num_slave > 0)
fd45ada9 4638 return NULL;
f99353cf 4639
1c1abcab
JH		 4640 /* If we're not connectable only connect devices that we have in
4641 * our pend_le_conns list.
4642 */
4b9e7e75
MH		 4643 params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4644 addr, addr_type);
4645 if (!params)
fd45ada9 4646 return NULL;
4b9e7e75
MH		 4647
4648 switch (params->auto_connect) {
4649 case HCI_AUTO_CONN_DIRECT:
4650 /* Only devices advertising with ADV_DIRECT_IND are
4651 * triggering a connection attempt. This is allowing
4652 * incoming connections from slave devices.
4653 */
4654 if (adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4655 return NULL;
4b9e7e75
MH		 4656 break;
4657 case HCI_AUTO_CONN_ALWAYS:
4658 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4659 * are triggering a connection attempt. This means
4660 * that incoming connectioms from slave device are
4661 * accepted and also outgoing connections to slave
4662 * devices are established when found.
4663 */
4664 break;
4665 default:
fd45ada9 4666 return NULL;
4b9e7e75 4667 }
a4790dbd
AG		 4668
4669 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
e804d25d 4670 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
f161dd41
JH		 4671 if (!IS_ERR(conn)) {
4672 /* Store the pointer since we don't really have any
4673 * other owner of the object besides the params that
4674 * triggered it. This way we can abort the connection if
4675 * the parameters get removed and keep the reference
4676 * count consistent once the connection is established.
4677 */
f8aaf9b6 4678 params->conn = hci_conn_get(conn);
fd45ada9 4679 return conn;
f161dd41 4680 }
a4790dbd
AG		 4681
4682 switch (PTR_ERR(conn)) {
4683 case -EBUSY:
4684 /* If hci_connect() returns -EBUSY it means there is already
4685 * an LE connection attempt going on. Since controllers don't
4686 * support more than one connection attempt at the time, we
4687 * don't consider this an error case.
4688 */
4689 break;
4690 default:
4691 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
fd45ada9 4692 return NULL;
a4790dbd 4693 }
fd45ada9
AA		 4694
4695 return NULL;
a4790dbd
AG		 4696}
4697
4af605d8 4698static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
2f010b55
MH		 4699 u8 bdaddr_type, bdaddr_t *direct_addr,
4700 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4af605d8 4701{
b9a6328f 4702 struct discovery_state *d = &hdev->discovery;
1c1abcab 4703 struct smp_irk *irk;
fd45ada9 4704 struct hci_conn *conn;
474ee066 4705 bool match;
c70a7e4c 4706 u32 flags;
b9a6328f 4707
2f010b55
MH		 4708 /* If the direct address is present, then this report is from
4709 * a LE Direct Advertising Report event. In that case it is
4710 * important to see if the address is matching the local
4711 * controller address.
4712 */
4713 if (direct_addr) {
4714 /* Only resolvable random addresses are valid for these
4715 * kind of reports and others can be ignored.
4716 */
4717 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4718 return;
4719
4720 /* If the controller is not using resolvable random
4721 * addresses, then this report can be ignored.
4722 */
d7a5a11d 4723 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2f010b55
MH		 4724 return;
4725
4726 /* If the local IRK of the controller does not match
4727 * with the resolvable random address provided, then
4728 * this report can be ignored.
4729 */
4730 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4731 return;
4732 }
4733
1c1abcab
JH		 4734 /* Check if we need to convert to identity address */
4735 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4736 if (irk) {
4737 bdaddr = &irk->bdaddr;
4738 bdaddr_type = irk->addr_type;
4739 }
4740
4741 /* Check if we have been requested to connect to this device */
fd45ada9
AA		 4742 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4743 if (conn && type == LE_ADV_IND) {
4744 /* Store report for later inclusion by
4745 * mgmt_device_connected
4746 */
4747 memcpy(conn->le_adv_data, data, len);
4748 conn->le_adv_data_len = len;
4749 }
1c1abcab 4750
0d2bf134
JH		 4751 /* Passive scanning shouldn't trigger any device found events,
4752 * except for devices marked as CONN_REPORT for which we do send
4753 * device found events.
4754 */
ca5c4be7 4755 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 4756 if (type == LE_ADV_DIRECT_IND)
4757 return;
4758
3a19b6fe
JH		 4759 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4760 bdaddr, bdaddr_type))
0d2bf134
JH		 4761 return;
4762
4763 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4764 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4765 else
4766 flags = 0;
4767 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4768 rssi, flags, data, len, NULL, 0);
97bf2e99 4769 return;
ca5c4be7 4770 }
4af605d8 4771
c70a7e4c
MH		 4772 /* When receiving non-connectable or scannable undirected
4773 * advertising reports, this means that the remote device is
4774 * not connectable and then clearly indicate this in the
4775 * device found event.
4776 *
4777 * When receiving a scan response, then there is no way to
4778 * know if the remote device is connectable or not. However
4779 * since scan responses are merged with a previously seen
4780 * advertising report, the flags field from that report
4781 * will be used.
4782 *
4783 * In the really unlikely case that a controller get confused
4784 * and just sends a scan response event, then it is marked as
4785 * not connectable as well.
4786 */
4787 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4788 type == LE_ADV_SCAN_RSP)
4789 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4790 else
4791 flags = 0;
4792
b9a6328f
JH		 4793 /* If there's nothing pending either store the data from this
4794 * event or send an immediate device found event if the data
4795 * should not be stored for later.
4796 */
4797 if (!has_pending_adv_report(hdev)) {
4798 /* If the report will trigger a SCAN_REQ store it for
4799 * later merging.
4800 */
4801 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4802 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4803 rssi, flags, data, len);
b9a6328f
JH		 4804 return;
4805 }
4806
4807 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4808 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4809 return;
4810 }
4811
474ee066
JH		 4812 /* Check if the pending report is for the same device as the new one */
4813 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4814 bdaddr_type == d->last_adv_addr_type);
4815
b9a6328f
JH		 4816 /* If the pending data doesn't match this report or this isn't a
4817 * scan response (e.g. we got a duplicate ADV_IND) then force
4818 * sending of the pending data.
4819 */
474ee066
JH		 4820 if (type != LE_ADV_SCAN_RSP || !match) {
4821 /* Send out whatever is in the cache, but skip duplicates */
4822 if (!match)
4823 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 4824 d->last_adv_addr_type, NULL,
c70a7e4c 4825 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 4826 d->last_adv_data,
474ee066 4827 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 4828
4829 /* If the new report will trigger a SCAN_REQ store it for
4830 * later merging.
4831 */
4832 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4833 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4834 rssi, flags, data, len);
b9a6328f
JH		 4835 return;
4836 }
4837
4838 /* The advertising reports cannot be merged, so clear
4839 * the pending report and send out a device found event.
4840 */
4841 clear_pending_adv_report(hdev);
5c5b93e4 4842 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4843 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4844 return;
4845 }
4846
4847 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4848 * the new event is a SCAN_RSP. We can therefore proceed with
4849 * sending a merged device found event.
4850 */
4851 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 4852 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 4853 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 4854 clear_pending_adv_report(hdev);
4af605d8
JH		 4855}
4856
6039aa73 4857static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 4858{
e95beb41
AG		 4859 u8 num_reports = skb->data[0];
4860 void *ptr = &skb->data[1];
9aa04c91 4861
a4790dbd
AG		 4862 hci_dev_lock(hdev);
4863
e95beb41
AG		 4864 while (num_reports--) {
4865 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 4866 s8 rssi;
a4790dbd 4867
3c9e9195 4868 rssi = ev->data[ev->length];
4af605d8 4869 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
2f010b55
MH		 4870 ev->bdaddr_type, NULL, 0, rssi,
4871 ev->data, ev->length);
3c9e9195 4872
e95beb41 4873 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 4874 }
a4790dbd
AG		 4875
4876 hci_dev_unlock(hdev);
9aa04c91
AG		 4877}
4878
0fe29fd1
MH		 4879static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4880 struct sk_buff *skb)
4881{
4882 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4883 struct hci_conn *conn;
4884
4885 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4886
4887 hci_dev_lock(hdev);
4888
4889 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4890 if (conn) {
4891 if (!ev->status)
4892 memcpy(conn->features[0], ev->features, 8);
4893
4894 if (conn->state == BT_CONFIG) {
4895 __u8 status;
4896
4897 /* If the local controller supports slave-initiated
4898 * features exchange, but the remote controller does
4899 * not, then it is possible that the error code 0x1a
4900 * for unsupported remote feature gets returned.
4901 *
4902 * In this specific case, allow the connection to
4903 * transition into connected state and mark it as
4904 * successful.
4905 */
4906 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
4907 !conn->out && ev->status == 0x1a)
4908 status = 0x00;
4909 else
4910 status = ev->status;
4911
4912 conn->state = BT_CONNECTED;
4913 hci_connect_cfm(conn, status);
4914 hci_conn_drop(conn);
4915 }
4916 }
4917
4918 hci_dev_unlock(hdev);
4919}
4920
6039aa73 4921static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 4922{
4923 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4924 struct hci_cp_le_ltk_reply cp;
bea710fe 4925 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 4926 struct hci_conn *conn;
c9839a11 4927 struct smp_ltk *ltk;
a7a595f6 4928
9f1db00c 4929 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 4930
4931 hci_dev_lock(hdev);
4932
4933 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 4934 if (conn == NULL)
4935 goto not_found;
a7a595f6 4936
f3a73d97 4937 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5378bc56 4938 if (!ltk)
bea710fe
VCG		 4939 goto not_found;
4940
5378bc56
JH		 4941 if (smp_ltk_is_sc(ltk)) {
4942 /* With SC both EDiv and Rand are set to zero */
4943 if (ev->ediv || ev->rand)
4944 goto not_found;
4945 } else {
4946 /* For non-SC keys check that EDiv and Rand match */
4947 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4948 goto not_found;
4949 }
4950
8b76ce34
JH		 4951 memcpy(cp.ltk, ltk->val, ltk->enc_size);
4952 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
a7a595f6 4953 cp.handle = cpu_to_le16(conn->handle);
c9839a11 4954
a6f7833c 4955 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 4956
89cbb4da 4957 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 4958
4959 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4960
5981a882
CT		 4961 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4962 * temporary key used to encrypt a connection following
4963 * pairing. It is used during the Encrypted Session Setup to
4964 * distribute the keys. Later, security can be re-established
4965 * using a distributed LTK.
4966 */
2ceba539 4967 if (ltk->type == SMP_STK) {
fe59a05f 4968 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
970d0f1b
JH		 4969 list_del_rcu(&ltk->list);
4970 kfree_rcu(ltk, rcu);
fe59a05f
JH		 4971 } else {
4972 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 4973 }
4974
a7a595f6 4975 hci_dev_unlock(hdev);
bea710fe
VCG		 4976
4977 return;
4978
4979not_found:
4980 neg.handle = ev->handle;
4981 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4982 hci_dev_unlock(hdev);
a7a595f6
VCG		 4983}
4984
8e75b46a
AG		 4985static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4986 u8 reason)
4987{
4988 struct hci_cp_le_conn_param_req_neg_reply cp;
4989
4990 cp.handle = cpu_to_le16(handle);
4991 cp.reason = reason;
4992
4993 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4994 &cp);
4995}
4996
4997static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4998 struct sk_buff *skb)
4999{
5000 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5001 struct hci_cp_le_conn_param_req_reply cp;
5002 struct hci_conn *hcon;
5003 u16 handle, min, max, latency, timeout;
5004
5005 handle = le16_to_cpu(ev->handle);
5006 min = le16_to_cpu(ev->interval_min);
5007 max = le16_to_cpu(ev->interval_max);
5008 latency = le16_to_cpu(ev->latency);
5009 timeout = le16_to_cpu(ev->timeout);
5010
5011 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5012 if (!hcon || hcon->state != BT_CONNECTED)
5013 return send_conn_param_neg_reply(hdev, handle,
5014 HCI_ERROR_UNKNOWN_CONN_ID);
5015
5016 if (hci_check_conn_params(min, max, latency, timeout))
5017 return send_conn_param_neg_reply(hdev, handle,
5018 HCI_ERROR_INVALID_LL_PARAMS);
5019
40bef302 5020 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 5021 struct hci_conn_params *params;
f4869e2a 5022 u8 store_hint;
348d50b8
JH		 5023
5024 hci_dev_lock(hdev);
5025
5026 params = hci_conn_params_lookup(hdev, &hcon->dst,
5027 hcon->dst_type);
5028 if (params) {
5029 params->conn_min_interval = min;
5030 params->conn_max_interval = max;
5031 params->conn_latency = latency;
5032 params->supervision_timeout = timeout;
f4869e2a
JH		 5033 store_hint = 0x01;
5034 } else{
5035 store_hint = 0x00;
348d50b8
JH		 5036 }
5037
5038 hci_dev_unlock(hdev);
5039
f4869e2a
JH		 5040 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5041 store_hint, min, max, latency, timeout);
348d50b8 5042 }
ffb5a827 5043
8e75b46a
AG		 5044 cp.handle = ev->handle;
5045 cp.interval_min = ev->interval_min;
5046 cp.interval_max = ev->interval_max;
5047 cp.latency = ev->latency;
5048 cp.timeout = ev->timeout;
5049 cp.min_ce_len = 0;
5050 cp.max_ce_len = 0;
5051
5052 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5053}
5054
2f010b55
MH		 5055static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5056 struct sk_buff *skb)
5057{
5058 u8 num_reports = skb->data[0];
5059 void *ptr = &skb->data[1];
5060
5061 hci_dev_lock(hdev);
5062
5063 while (num_reports--) {
5064 struct hci_ev_le_direct_adv_info *ev = ptr;
5065
5066 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5067 ev->bdaddr_type, &ev->direct_addr,
5068 ev->direct_addr_type, ev->rssi, NULL, 0);
5069
5070 ptr += sizeof(*ev);
5071 }
5072
5073 hci_dev_unlock(hdev);
5074}
5075
6039aa73 5076static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 5077{
5078 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5079
5080 skb_pull(skb, sizeof(*le_ev));
5081
5082 switch (le_ev->subevent) {
5083 case HCI_EV_LE_CONN_COMPLETE:
5084 hci_le_conn_complete_evt(hdev, skb);
5085 break;
5086
1855d92d
MH		 5087 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5088 hci_le_conn_update_complete_evt(hdev, skb);
5089 break;
5090
9aa04c91
AG		 5091 case HCI_EV_LE_ADVERTISING_REPORT:
5092 hci_le_adv_report_evt(hdev, skb);
5093 break;
5094
0fe29fd1
MH		 5095 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5096 hci_le_remote_feat_complete_evt(hdev, skb);
5097 break;
5098
a7a595f6
VCG		 5099 case HCI_EV_LE_LTK_REQ:
5100 hci_le_ltk_request_evt(hdev, skb);
5101 break;
5102
8e75b46a
AG		 5103 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5104 hci_le_remote_conn_param_req_evt(hdev, skb);
5105 break;
5106
2f010b55
MH		 5107 case HCI_EV_LE_DIRECT_ADV_REPORT:
5108 hci_le_direct_adv_report_evt(hdev, skb);
5109 break;
5110
fcd89c09
VT		 5111 default:
5112 break;
5113 }
5114}
5115
757aa0b5
JH		 5116static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5117 u8 event, struct sk_buff *skb)
5118{
5119 struct hci_ev_cmd_complete *ev;
5120 struct hci_event_hdr *hdr;
5121
5122 if (!skb)
5123 return false;
5124
5125 if (skb->len < sizeof(*hdr)) {
5126 BT_ERR("Too short HCI event");
5127 return false;
5128 }
5129
5130 hdr = (void *) skb->data;
5131 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5132
5133 if (event) {
5134 if (hdr->evt != event)
5135 return false;
5136 return true;
5137 }
5138
5139 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5140 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5141 return false;
5142 }
5143
5144 if (skb->len < sizeof(*ev)) {
5145 BT_ERR("Too short cmd_complete event");
5146 return false;
5147 }
5148
5149 ev = (void *) skb->data;
5150 skb_pull(skb, sizeof(*ev));
5151
5152 if (opcode != __le16_to_cpu(ev->opcode)) {
5153 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5154 __le16_to_cpu(ev->opcode));
5155 return false;
5156 }
5157
5158 return true;
5159}
5160
a9de9248
MH		 5161void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5162{
5163 struct hci_event_hdr *hdr = (void *) skb->data;
e6214487
JH		 5164 hci_req_complete_t req_complete = NULL;
5165 hci_req_complete_skb_t req_complete_skb = NULL;
5166 struct sk_buff *orig_skb = NULL;
757aa0b5 5167 u8 status = 0, event = hdr->evt, req_evt = 0;
e6214487 5168 u16 opcode = HCI_OP_NOP;
a9de9248 5169
db6e3e8d 5170 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
c1f23a2b 5171 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
e6214487
JH		 5172 opcode = __le16_to_cpu(cmd_hdr->opcode);
5173 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5174 &req_complete_skb);
757aa0b5 5175 req_evt = event;
02350a72
JH		 5176 }
5177
e6214487
JH		 5178 /* If it looks like we might end up having to call
5179 * req_complete_skb, store a pristine copy of the skb since the
5180 * various handlers may modify the original one through
5181 * skb_pull() calls, etc.
5182 */
5183 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5184 event == HCI_EV_CMD_COMPLETE)
5185 orig_skb = skb_clone(skb, GFP_KERNEL);
5186
5187 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5188
a9de9248 5189 switch (event) {
1da177e4
LT		 5190 case HCI_EV_INQUIRY_COMPLETE:
5191 hci_inquiry_complete_evt(hdev, skb);
5192 break;
5193
5194 case HCI_EV_INQUIRY_RESULT:
5195 hci_inquiry_result_evt(hdev, skb);
5196 break;
5197
a9de9248
MH		 5198 case HCI_EV_CONN_COMPLETE:
5199 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 5200 break;
5201
1da177e4
LT		 5202 case HCI_EV_CONN_REQUEST:
5203 hci_conn_request_evt(hdev, skb);
5204 break;
5205
1da177e4
LT		 5206 case HCI_EV_DISCONN_COMPLETE:
5207 hci_disconn_complete_evt(hdev, skb);
5208 break;
5209
1da177e4
LT		 5210 case HCI_EV_AUTH_COMPLETE:
5211 hci_auth_complete_evt(hdev, skb);
5212 break;
5213
a9de9248
MH		 5214 case HCI_EV_REMOTE_NAME:
5215 hci_remote_name_evt(hdev, skb);
5216 break;
5217
1da177e4
LT		 5218 case HCI_EV_ENCRYPT_CHANGE:
5219 hci_encrypt_change_evt(hdev, skb);
5220 break;
5221
a9de9248
MH		 5222 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5223 hci_change_link_key_complete_evt(hdev, skb);
5224 break;
5225
5226 case HCI_EV_REMOTE_FEATURES:
5227 hci_remote_features_evt(hdev, skb);
5228 break;
5229
a9de9248 5230 case HCI_EV_CMD_COMPLETE:
e6214487
JH		 5231 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5232 &req_complete, &req_complete_skb);
a9de9248
MH		 5233 break;
5234
5235 case HCI_EV_CMD_STATUS:
e6214487
JH		 5236 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5237 &req_complete_skb);
a9de9248
MH		 5238 break;
5239
24dfa343
MH		 5240 case HCI_EV_HARDWARE_ERROR:
5241 hci_hardware_error_evt(hdev, skb);
5242 break;
5243
a9de9248
MH		 5244 case HCI_EV_ROLE_CHANGE:
5245 hci_role_change_evt(hdev, skb);
5246 break;
5247
5248 case HCI_EV_NUM_COMP_PKTS:
5249 hci_num_comp_pkts_evt(hdev, skb);
5250 break;
5251
5252 case HCI_EV_MODE_CHANGE:
5253 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 5254 break;
5255
5256 case HCI_EV_PIN_CODE_REQ:
5257 hci_pin_code_request_evt(hdev, skb);
5258 break;
5259
5260 case HCI_EV_LINK_KEY_REQ:
5261 hci_link_key_request_evt(hdev, skb);
5262 break;
5263
5264 case HCI_EV_LINK_KEY_NOTIFY:
5265 hci_link_key_notify_evt(hdev, skb);
5266 break;
5267
5268 case HCI_EV_CLOCK_OFFSET:
5269 hci_clock_offset_evt(hdev, skb);
5270 break;
5271
a8746417
MH		 5272 case HCI_EV_PKT_TYPE_CHANGE:
5273 hci_pkt_type_change_evt(hdev, skb);
5274 break;
5275
85a1e930
MH		 5276 case HCI_EV_PSCAN_REP_MODE:
5277 hci_pscan_rep_mode_evt(hdev, skb);
5278 break;
5279
a9de9248
MH		 5280 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5281 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 5282 break;
5283
a9de9248
MH		 5284 case HCI_EV_REMOTE_EXT_FEATURES:
5285 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 5286 break;
5287
a9de9248
MH		 5288 case HCI_EV_SYNC_CONN_COMPLETE:
5289 hci_sync_conn_complete_evt(hdev, skb);
5290 break;
1da177e4 5291
a9de9248
MH		 5292 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5293 hci_extended_inquiry_result_evt(hdev, skb);
5294 break;
1da177e4 5295
1c2e0041
JH		 5296 case HCI_EV_KEY_REFRESH_COMPLETE:
5297 hci_key_refresh_complete_evt(hdev, skb);
5298 break;
5299
0493684e
MH		 5300 case HCI_EV_IO_CAPA_REQUEST:
5301 hci_io_capa_request_evt(hdev, skb);
5302 break;
5303
03b555e1
JH		 5304 case HCI_EV_IO_CAPA_REPLY:
5305 hci_io_capa_reply_evt(hdev, skb);
5306 break;
5307
a5c29683
JH		 5308 case HCI_EV_USER_CONFIRM_REQUEST:
5309 hci_user_confirm_request_evt(hdev, skb);
5310 break;
5311
1143d458
BG		 5312 case HCI_EV_USER_PASSKEY_REQUEST:
5313 hci_user_passkey_request_evt(hdev, skb);
5314 break;
5315
92a25256
JH		 5316 case HCI_EV_USER_PASSKEY_NOTIFY:
5317 hci_user_passkey_notify_evt(hdev, skb);
5318 break;
5319
5320 case HCI_EV_KEYPRESS_NOTIFY:
5321 hci_keypress_notify_evt(hdev, skb);
5322 break;
5323
0493684e
MH		 5324 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5325 hci_simple_pair_complete_evt(hdev, skb);
5326 break;
5327
41a96212
MH		 5328 case HCI_EV_REMOTE_HOST_FEATURES:
5329 hci_remote_host_features_evt(hdev, skb);
5330 break;
5331
fcd89c09
VT		 5332 case HCI_EV_LE_META:
5333 hci_le_meta_evt(hdev, skb);
5334 break;
5335
2763eda6
SJ		 5336 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5337 hci_remote_oob_data_request_evt(hdev, skb);
5338 break;
5339
a77a6a14
AW		 5340#if IS_ENABLED(CONFIG_BT_HS)
5341 case HCI_EV_CHANNEL_SELECTED:
5342 hci_chan_selected_evt(hdev, skb);
5343 break;
5344
d5e91192
AE		 5345 case HCI_EV_PHY_LINK_COMPLETE:
5346 hci_phy_link_complete_evt(hdev, skb);
5347 break;
5348
27695fb4
AE		 5349 case HCI_EV_LOGICAL_LINK_COMPLETE:
5350 hci_loglink_complete_evt(hdev, skb);
5351 break;
5352
606e2a10
AE		 5353 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5354 hci_disconn_loglink_complete_evt(hdev, skb);
5355 break;
5356
9eef6b3a
AE		 5357 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5358 hci_disconn_phylink_complete_evt(hdev, skb);
5359 break;
a77a6a14 5360#endif
9eef6b3a 5361
25e89e99
AE		 5362 case HCI_EV_NUM_COMP_BLOCKS:
5363 hci_num_comp_blocks_evt(hdev, skb);
5364 break;
5365
a9de9248 5366 default:
9f1db00c 5367 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 5368 break;
5369 }
5370
757aa0b5 5371 if (req_complete) {
e6214487 5372 req_complete(hdev, status, opcode);
757aa0b5
JH		 5373 } else if (req_complete_skb) {
5374 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5375 kfree_skb(orig_skb);
5376 orig_skb = NULL;
5377 }
e6214487 5378 req_complete_skb(hdev, status, opcode, orig_skb);
757aa0b5 5379 }
e6214487
JH		 5380
5381 kfree_skb(orig_skb);
1da177e4
LT		 5382 kfree_skb(skb);
5383 hdev->stat.evt_rx++;
5384}
Linux kernel - Deliverables
This page took 1.171192 seconds and 5 git commands to generate.