projects / deliverable / linux.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Bluetooth: Remove debug statement for features complete event
[deliverable/linux.git] / net / bluetooth / hci_event.c
... / ...
CommitLineData
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
31#include <net/bluetooth/mgmt.h>
32
33#include "a2mp.h"
34#include "amp.h"
35
36/* Handle HCI Event packets */
37
38static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
39{
40 __u8 status = *((__u8 *) skb->data);
41
42 BT_DBG("%s status 0x%2.2x", hdev->name, status);
43
44 if (status)
45 return;
46
47 clear_bit(HCI_INQUIRY, &hdev->flags);
48 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
49 wake_up_bit(&hdev->flags, HCI_INQUIRY);
50
51 hci_conn_check_pending(hdev);
52}
53
54static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
55{
56 __u8 status = *((__u8 *) skb->data);
57
58 BT_DBG("%s status 0x%2.2x", hdev->name, status);
59
60 if (status)
61 return;
62
63 set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
64}
65
66static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
67{
68 __u8 status = *((__u8 *) skb->data);
69
70 BT_DBG("%s status 0x%2.2x", hdev->name, status);
71
72 if (status)
73 return;
74
75 clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
76
77 hci_conn_check_pending(hdev);
78}
79
80static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
81 struct sk_buff *skb)
82{
83 BT_DBG("%s", hdev->name);
84}
85
86static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
87{
88 struct hci_rp_role_discovery *rp = (void *) skb->data;
89 struct hci_conn *conn;
90
91 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
92
93 if (rp->status)
94 return;
95
96 hci_dev_lock(hdev);
97
98 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
99 if (conn) {
100 if (rp->role)
101 conn->link_mode &= ~HCI_LM_MASTER;
102 else
103 conn->link_mode |= HCI_LM_MASTER;
104 }
105
106 hci_dev_unlock(hdev);
107}
108
109static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
110{
111 struct hci_rp_read_link_policy *rp = (void *) skb->data;
112 struct hci_conn *conn;
113
114 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
115
116 if (rp->status)
117 return;
118
119 hci_dev_lock(hdev);
120
121 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
122 if (conn)
123 conn->link_policy = __le16_to_cpu(rp->policy);
124
125 hci_dev_unlock(hdev);
126}
127
128static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
129{
130 struct hci_rp_write_link_policy *rp = (void *) skb->data;
131 struct hci_conn *conn;
132 void *sent;
133
134 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
135
136 if (rp->status)
137 return;
138
139 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
140 if (!sent)
141 return;
142
143 hci_dev_lock(hdev);
144
145 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
146 if (conn)
147 conn->link_policy = get_unaligned_le16(sent + 2);
148
149 hci_dev_unlock(hdev);
150}
151
152static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
153 struct sk_buff *skb)
154{
155 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
156
157 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
158
159 if (rp->status)
160 return;
161
162 hdev->link_policy = __le16_to_cpu(rp->policy);
163}
164
165static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
166 struct sk_buff *skb)
167{
168 __u8 status = *((__u8 *) skb->data);
169 void *sent;
170
171 BT_DBG("%s status 0x%2.2x", hdev->name, status);
172
173 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
174 if (!sent)
175 return;
176
177 if (!status)
178 hdev->link_policy = get_unaligned_le16(sent);
179}
180
181static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
182{
183 __u8 status = *((__u8 *) skb->data);
184
185 BT_DBG("%s status 0x%2.2x", hdev->name, status);
186
187 clear_bit(HCI_RESET, &hdev->flags);
188
189 /* Reset all non-persistent flags */
190 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
191
192 hdev->discovery.state = DISCOVERY_STOPPED;
193 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
194 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
195
196 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
197 hdev->adv_data_len = 0;
198
199 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
200 hdev->scan_rsp_data_len = 0;
201
202 hdev->ssp_debug_mode = 0;
203}
204
205static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
206{
207 __u8 status = *((__u8 *) skb->data);
208 void *sent;
209
210 BT_DBG("%s status 0x%2.2x", hdev->name, status);
211
212 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
213 if (!sent)
214 return;
215
216 hci_dev_lock(hdev);
217
218 if (test_bit(HCI_MGMT, &hdev->dev_flags))
219 mgmt_set_local_name_complete(hdev, sent, status);
220 else if (!status)
221 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
222
223 hci_dev_unlock(hdev);
224}
225
226static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
227{
228 struct hci_rp_read_local_name *rp = (void *) skb->data;
229
230 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
231
232 if (rp->status)
233 return;
234
235 if (test_bit(HCI_SETUP, &hdev->dev_flags))
236 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
237}
238
239static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
240{
241 __u8 status = *((__u8 *) skb->data);
242 void *sent;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, status);
245
246 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
247 if (!sent)
248 return;
249
250 if (!status) {
251 __u8 param = *((__u8 *) sent);
252
253 if (param == AUTH_ENABLED)
254 set_bit(HCI_AUTH, &hdev->flags);
255 else
256 clear_bit(HCI_AUTH, &hdev->flags);
257 }
258
259 if (test_bit(HCI_MGMT, &hdev->dev_flags))
260 mgmt_auth_enable_complete(hdev, status);
261}
262
263static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
264{
265 __u8 status = *((__u8 *) skb->data);
266 void *sent;
267
268 BT_DBG("%s status 0x%2.2x", hdev->name, status);
269
270 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
271 if (!sent)
272 return;
273
274 if (!status) {
275 __u8 param = *((__u8 *) sent);
276
277 if (param)
278 set_bit(HCI_ENCRYPT, &hdev->flags);
279 else
280 clear_bit(HCI_ENCRYPT, &hdev->flags);
281 }
282}
283
284static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
285{
286 __u8 param, status = *((__u8 *) skb->data);
287 int old_pscan, old_iscan;
288 void *sent;
289
290 BT_DBG("%s status 0x%2.2x", hdev->name, status);
291
292 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
293 if (!sent)
294 return;
295
296 param = *((__u8 *) sent);
297
298 hci_dev_lock(hdev);
299
300 if (status) {
301 mgmt_write_scan_failed(hdev, param, status);
302 hdev->discov_timeout = 0;
303 goto done;
304 }
305
306 /* We need to ensure that we set this back on if someone changed
307 * the scan mode through a raw HCI socket.
308 */
309 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
310
311 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
312 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
313
314 if (param & SCAN_INQUIRY) {
315 set_bit(HCI_ISCAN, &hdev->flags);
316 if (!old_iscan)
317 mgmt_discoverable(hdev, 1);
318 } else if (old_iscan)
319 mgmt_discoverable(hdev, 0);
320
321 if (param & SCAN_PAGE) {
322 set_bit(HCI_PSCAN, &hdev->flags);
323 if (!old_pscan)
324 mgmt_connectable(hdev, 1);
325 } else if (old_pscan)
326 mgmt_connectable(hdev, 0);
327
328done:
329 hci_dev_unlock(hdev);
330}
331
332static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
333{
334 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
335
336 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
337
338 if (rp->status)
339 return;
340
341 memcpy(hdev->dev_class, rp->dev_class, 3);
342
343 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
344 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
345}
346
347static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
348{
349 __u8 status = *((__u8 *) skb->data);
350 void *sent;
351
352 BT_DBG("%s status 0x%2.2x", hdev->name, status);
353
354 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
355 if (!sent)
356 return;
357
358 hci_dev_lock(hdev);
359
360 if (status == 0)
361 memcpy(hdev->dev_class, sent, 3);
362
363 if (test_bit(HCI_MGMT, &hdev->dev_flags))
364 mgmt_set_class_of_dev_complete(hdev, sent, status);
365
366 hci_dev_unlock(hdev);
367}
368
369static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
370{
371 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
372 __u16 setting;
373
374 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
375
376 if (rp->status)
377 return;
378
379 setting = __le16_to_cpu(rp->voice_setting);
380
381 if (hdev->voice_setting == setting)
382 return;
383
384 hdev->voice_setting = setting;
385
386 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
387
388 if (hdev->notify)
389 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
390}
391
392static void hci_cc_write_voice_setting(struct hci_dev *hdev,
393 struct sk_buff *skb)
394{
395 __u8 status = *((__u8 *) skb->data);
396 __u16 setting;
397 void *sent;
398
399 BT_DBG("%s status 0x%2.2x", hdev->name, status);
400
401 if (status)
402 return;
403
404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
405 if (!sent)
406 return;
407
408 setting = get_unaligned_le16(sent);
409
410 if (hdev->voice_setting == setting)
411 return;
412
413 hdev->voice_setting = setting;
414
415 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
416
417 if (hdev->notify)
418 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
419}
420
421static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
422 struct sk_buff *skb)
423{
424 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
425
426 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
427
428 if (rp->status)
429 return;
430
431 hdev->num_iac = rp->num_iac;
432
433 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
434}
435
436static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
437{
438 __u8 status = *((__u8 *) skb->data);
439 struct hci_cp_write_ssp_mode *sent;
440
441 BT_DBG("%s status 0x%2.2x", hdev->name, status);
442
443 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
444 if (!sent)
445 return;
446
447 if (!status) {
448 if (sent->mode)
449 hdev->features[1][0] |= LMP_HOST_SSP;
450 else
451 hdev->features[1][0] &= ~LMP_HOST_SSP;
452 }
453
454 if (test_bit(HCI_MGMT, &hdev->dev_flags))
455 mgmt_ssp_enable_complete(hdev, sent->mode, status);
456 else if (!status) {
457 if (sent->mode)
458 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
459 else
460 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
461 }
462}
463
464static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
465{
466 struct hci_rp_read_local_version *rp = (void *) skb->data;
467
468 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
469
470 if (rp->status)
471 return;
472
473 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
474 hdev->hci_ver = rp->hci_ver;
475 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
476 hdev->lmp_ver = rp->lmp_ver;
477 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
478 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
479 }
480}
481
482static void hci_cc_read_local_commands(struct hci_dev *hdev,
483 struct sk_buff *skb)
484{
485 struct hci_rp_read_local_commands *rp = (void *) skb->data;
486
487 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
488
489 if (!rp->status)
490 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
491}
492
493static void hci_cc_read_local_features(struct hci_dev *hdev,
494 struct sk_buff *skb)
495{
496 struct hci_rp_read_local_features *rp = (void *) skb->data;
497
498 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
499
500 if (rp->status)
501 return;
502
503 memcpy(hdev->features, rp->features, 8);
504
505 /* Adjust default settings according to features
506 * supported by device. */
507
508 if (hdev->features[0][0] & LMP_3SLOT)
509 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
510
511 if (hdev->features[0][0] & LMP_5SLOT)
512 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
513
514 if (hdev->features[0][1] & LMP_HV2) {
515 hdev->pkt_type |= (HCI_HV2);
516 hdev->esco_type |= (ESCO_HV2);
517 }
518
519 if (hdev->features[0][1] & LMP_HV3) {
520 hdev->pkt_type |= (HCI_HV3);
521 hdev->esco_type |= (ESCO_HV3);
522 }
523
524 if (lmp_esco_capable(hdev))
525 hdev->esco_type |= (ESCO_EV3);
526
527 if (hdev->features[0][4] & LMP_EV4)
528 hdev->esco_type |= (ESCO_EV4);
529
530 if (hdev->features[0][4] & LMP_EV5)
531 hdev->esco_type |= (ESCO_EV5);
532
533 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
534 hdev->esco_type |= (ESCO_2EV3);
535
536 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
537 hdev->esco_type |= (ESCO_3EV3);
538
539 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
540 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
541}
542
543static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
544 struct sk_buff *skb)
545{
546 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
547
548 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
549
550 if (rp->status)
551 return;
552
553 if (hdev->max_page < rp->max_page)
554 hdev->max_page = rp->max_page;
555
556 if (rp->page < HCI_MAX_PAGES)
557 memcpy(hdev->features[rp->page], rp->features, 8);
558}
559
560static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
561 struct sk_buff *skb)
562{
563 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
564
565 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
566
567 if (!rp->status)
568 hdev->flow_ctl_mode = rp->mode;
569}
570
571static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
572{
573 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
574
575 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
576
577 if (rp->status)
578 return;
579
580 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
581 hdev->sco_mtu = rp->sco_mtu;
582 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
583 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
584
585 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
586 hdev->sco_mtu = 64;
587 hdev->sco_pkts = 8;
588 }
589
590 hdev->acl_cnt = hdev->acl_pkts;
591 hdev->sco_cnt = hdev->sco_pkts;
592
593 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
594 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
595}
596
597static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
598{
599 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
600
601 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
602
603 if (!rp->status)
604 bacpy(&hdev->bdaddr, &rp->bdaddr);
605}
606
607static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
608 struct sk_buff *skb)
609{
610 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
611
612 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
613
614 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
615 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
616 hdev->page_scan_window = __le16_to_cpu(rp->window);
617 }
618}
619
620static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
621 struct sk_buff *skb)
622{
623 u8 status = *((u8 *) skb->data);
624 struct hci_cp_write_page_scan_activity *sent;
625
626 BT_DBG("%s status 0x%2.2x", hdev->name, status);
627
628 if (status)
629 return;
630
631 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
632 if (!sent)
633 return;
634
635 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
636 hdev->page_scan_window = __le16_to_cpu(sent->window);
637}
638
639static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
640 struct sk_buff *skb)
641{
642 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
643
644 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
645
646 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
647 hdev->page_scan_type = rp->type;
648}
649
650static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
651 struct sk_buff *skb)
652{
653 u8 status = *((u8 *) skb->data);
654 u8 *type;
655
656 BT_DBG("%s status 0x%2.2x", hdev->name, status);
657
658 if (status)
659 return;
660
661 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
662 if (type)
663 hdev->page_scan_type = *type;
664}
665
666static void hci_cc_read_data_block_size(struct hci_dev *hdev,
667 struct sk_buff *skb)
668{
669 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
670
671 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
672
673 if (rp->status)
674 return;
675
676 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
677 hdev->block_len = __le16_to_cpu(rp->block_len);
678 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
679
680 hdev->block_cnt = hdev->num_blocks;
681
682 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
683 hdev->block_cnt, hdev->block_len);
684}
685
686static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
687 struct sk_buff *skb)
688{
689 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
690
691 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
692
693 if (rp->status)
694 goto a2mp_rsp;
695
696 hdev->amp_status = rp->amp_status;
697 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
698 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
699 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
700 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
701 hdev->amp_type = rp->amp_type;
702 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
703 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
704 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
705 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
706
707a2mp_rsp:
708 a2mp_send_getinfo_rsp(hdev);
709}
710
711static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
712 struct sk_buff *skb)
713{
714 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
715 struct amp_assoc *assoc = &hdev->loc_assoc;
716 size_t rem_len, frag_len;
717
718 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
719
720 if (rp->status)
721 goto a2mp_rsp;
722
723 frag_len = skb->len - sizeof(*rp);
724 rem_len = __le16_to_cpu(rp->rem_len);
725
726 if (rem_len > frag_len) {
727 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
728
729 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
730 assoc->offset += frag_len;
731
732 /* Read other fragments */
733 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
734
735 return;
736 }
737
738 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
739 assoc->len = assoc->offset + rem_len;
740 assoc->offset = 0;
741
742a2mp_rsp:
743 /* Send A2MP Rsp when all fragments are received */
744 a2mp_send_getampassoc_rsp(hdev, rp->status);
745 a2mp_send_create_phy_link_req(hdev, rp->status);
746}
747
748static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
749 struct sk_buff *skb)
750{
751 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
752
753 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
754
755 if (!rp->status)
756 hdev->inq_tx_power = rp->tx_power;
757}
758
759static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
760{
761 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
762 struct hci_cp_pin_code_reply *cp;
763 struct hci_conn *conn;
764
765 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
766
767 hci_dev_lock(hdev);
768
769 if (test_bit(HCI_MGMT, &hdev->dev_flags))
770 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
771
772 if (rp->status)
773 goto unlock;
774
775 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
776 if (!cp)
777 goto unlock;
778
779 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
780 if (conn)
781 conn->pin_length = cp->pin_len;
782
783unlock:
784 hci_dev_unlock(hdev);
785}
786
787static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
788{
789 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
790
791 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
792
793 hci_dev_lock(hdev);
794
795 if (test_bit(HCI_MGMT, &hdev->dev_flags))
796 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
797 rp->status);
798
799 hci_dev_unlock(hdev);
800}
801
802static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
803 struct sk_buff *skb)
804{
805 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
806
807 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
808
809 if (rp->status)
810 return;
811
812 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
813 hdev->le_pkts = rp->le_max_pkt;
814
815 hdev->le_cnt = hdev->le_pkts;
816
817 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
818}
819
820static void hci_cc_le_read_local_features(struct hci_dev *hdev,
821 struct sk_buff *skb)
822{
823 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
824
825 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
826
827 if (!rp->status)
828 memcpy(hdev->le_features, rp->features, 8);
829}
830
831static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
832 struct sk_buff *skb)
833{
834 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
835
836 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
837
838 if (!rp->status)
839 hdev->adv_tx_power = rp->tx_power;
840}
841
842static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
843{
844 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
845
846 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
847
848 hci_dev_lock(hdev);
849
850 if (test_bit(HCI_MGMT, &hdev->dev_flags))
851 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
852 rp->status);
853
854 hci_dev_unlock(hdev);
855}
856
857static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
858 struct sk_buff *skb)
859{
860 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
861
862 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
863
864 hci_dev_lock(hdev);
865
866 if (test_bit(HCI_MGMT, &hdev->dev_flags))
867 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
868 ACL_LINK, 0, rp->status);
869
870 hci_dev_unlock(hdev);
871}
872
873static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
874{
875 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
876
877 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
878
879 hci_dev_lock(hdev);
880
881 if (test_bit(HCI_MGMT, &hdev->dev_flags))
882 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
883 0, rp->status);
884
885 hci_dev_unlock(hdev);
886}
887
888static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
889 struct sk_buff *skb)
890{
891 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
892
893 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
894
895 hci_dev_lock(hdev);
896
897 if (test_bit(HCI_MGMT, &hdev->dev_flags))
898 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
899 ACL_LINK, 0, rp->status);
900
901 hci_dev_unlock(hdev);
902}
903
904static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
905 struct sk_buff *skb)
906{
907 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
908
909 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
910
911 hci_dev_lock(hdev);
912 mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
913 rp->randomizer, rp->status);
914 hci_dev_unlock(hdev);
915}
916
917static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
918{
919 __u8 *sent, status = *((__u8 *) skb->data);
920
921 BT_DBG("%s status 0x%2.2x", hdev->name, status);
922
923 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
924 if (!sent)
925 return;
926
927 hci_dev_lock(hdev);
928
929 if (!status) {
930 if (*sent)
931 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
932 else
933 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
934 }
935
936 hci_dev_unlock(hdev);
937}
938
939static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
940 struct sk_buff *skb)
941{
942 struct hci_cp_le_set_scan_enable *cp;
943 __u8 status = *((__u8 *) skb->data);
944
945 BT_DBG("%s status 0x%2.2x", hdev->name, status);
946
947 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
948 if (!cp)
949 return;
950
951 if (status)
952 return;
953
954 switch (cp->enable) {
955 case LE_SCAN_ENABLE:
956 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
957 break;
958
959 case LE_SCAN_DISABLE:
960 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
961 break;
962
963 default:
964 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
965 break;
966 }
967}
968
969static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
970 struct sk_buff *skb)
971{
972 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
973
974 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
975
976 if (!rp->status)
977 hdev->le_white_list_size = rp->size;
978}
979
980static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
981 struct sk_buff *skb)
982{
983 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
984
985 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
986
987 if (!rp->status)
988 memcpy(hdev->le_states, rp->le_states, 8);
989}
990
991static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
992 struct sk_buff *skb)
993{
994 struct hci_cp_write_le_host_supported *sent;
995 __u8 status = *((__u8 *) skb->data);
996
997 BT_DBG("%s status 0x%2.2x", hdev->name, status);
998
999 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1000 if (!sent)
1001 return;
1002
1003 if (!status) {
1004 if (sent->le) {
1005 hdev->features[1][0] |= LMP_HOST_LE;
1006 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1007 } else {
1008 hdev->features[1][0] &= ~LMP_HOST_LE;
1009 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1010 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1011 }
1012
1013 if (sent->simul)
1014 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1015 else
1016 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1017 }
1018}
1019
1020static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1021 struct sk_buff *skb)
1022{
1023 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1024
1025 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1026 hdev->name, rp->status, rp->phy_handle);
1027
1028 if (rp->status)
1029 return;
1030
1031 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1032}
1033
1034static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1035{
1036 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1037
1038 if (status) {
1039 hci_conn_check_pending(hdev);
1040 return;
1041 }
1042
1043 set_bit(HCI_INQUIRY, &hdev->flags);
1044}
1045
1046static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1047{
1048 struct hci_cp_create_conn *cp;
1049 struct hci_conn *conn;
1050
1051 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1052
1053 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1054 if (!cp)
1055 return;
1056
1057 hci_dev_lock(hdev);
1058
1059 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1060
1061 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1062
1063 if (status) {
1064 if (conn && conn->state == BT_CONNECT) {
1065 if (status != 0x0c || conn->attempt > 2) {
1066 conn->state = BT_CLOSED;
1067 hci_proto_connect_cfm(conn, status);
1068 hci_conn_del(conn);
1069 } else
1070 conn->state = BT_CONNECT2;
1071 }
1072 } else {
1073 if (!conn) {
1074 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1075 if (conn) {
1076 conn->out = true;
1077 conn->link_mode |= HCI_LM_MASTER;
1078 } else
1079 BT_ERR("No memory for new connection");
1080 }
1081 }
1082
1083 hci_dev_unlock(hdev);
1084}
1085
1086static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1087{
1088 struct hci_cp_add_sco *cp;
1089 struct hci_conn *acl, *sco;
1090 __u16 handle;
1091
1092 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1093
1094 if (!status)
1095 return;
1096
1097 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1098 if (!cp)
1099 return;
1100
1101 handle = __le16_to_cpu(cp->handle);
1102
1103 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1104
1105 hci_dev_lock(hdev);
1106
1107 acl = hci_conn_hash_lookup_handle(hdev, handle);
1108 if (acl) {
1109 sco = acl->link;
1110 if (sco) {
1111 sco->state = BT_CLOSED;
1112
1113 hci_proto_connect_cfm(sco, status);
1114 hci_conn_del(sco);
1115 }
1116 }
1117
1118 hci_dev_unlock(hdev);
1119}
1120
1121static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1122{
1123 struct hci_cp_auth_requested *cp;
1124 struct hci_conn *conn;
1125
1126 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1127
1128 if (!status)
1129 return;
1130
1131 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1132 if (!cp)
1133 return;
1134
1135 hci_dev_lock(hdev);
1136
1137 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1138 if (conn) {
1139 if (conn->state == BT_CONFIG) {
1140 hci_proto_connect_cfm(conn, status);
1141 hci_conn_drop(conn);
1142 }
1143 }
1144
1145 hci_dev_unlock(hdev);
1146}
1147
1148static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1149{
1150 struct hci_cp_set_conn_encrypt *cp;
1151 struct hci_conn *conn;
1152
1153 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1154
1155 if (!status)
1156 return;
1157
1158 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1159 if (!cp)
1160 return;
1161
1162 hci_dev_lock(hdev);
1163
1164 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1165 if (conn) {
1166 if (conn->state == BT_CONFIG) {
1167 hci_proto_connect_cfm(conn, status);
1168 hci_conn_drop(conn);
1169 }
1170 }
1171
1172 hci_dev_unlock(hdev);
1173}
1174
1175static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1176 struct hci_conn *conn)
1177{
1178 if (conn->state != BT_CONFIG || !conn->out)
1179 return 0;
1180
1181 if (conn->pending_sec_level == BT_SECURITY_SDP)
1182 return 0;
1183
1184 /* Only request authentication for SSP connections or non-SSP
1185 * devices with sec_level HIGH or if MITM protection is requested */
1186 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1187 conn->pending_sec_level != BT_SECURITY_HIGH)
1188 return 0;
1189
1190 return 1;
1191}
1192
1193static int hci_resolve_name(struct hci_dev *hdev,
1194 struct inquiry_entry *e)
1195{
1196 struct hci_cp_remote_name_req cp;
1197
1198 memset(&cp, 0, sizeof(cp));
1199
1200 bacpy(&cp.bdaddr, &e->data.bdaddr);
1201 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1202 cp.pscan_mode = e->data.pscan_mode;
1203 cp.clock_offset = e->data.clock_offset;
1204
1205 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1206}
1207
1208static bool hci_resolve_next_name(struct hci_dev *hdev)
1209{
1210 struct discovery_state *discov = &hdev->discovery;
1211 struct inquiry_entry *e;
1212
1213 if (list_empty(&discov->resolve))
1214 return false;
1215
1216 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1217 if (!e)
1218 return false;
1219
1220 if (hci_resolve_name(hdev, e) == 0) {
1221 e->name_state = NAME_PENDING;
1222 return true;
1223 }
1224
1225 return false;
1226}
1227
1228static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1229 bdaddr_t *bdaddr, u8 *name, u8 name_len)
1230{
1231 struct discovery_state *discov = &hdev->discovery;
1232 struct inquiry_entry *e;
1233
1234 if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1235 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1236 name_len, conn->dev_class);
1237
1238 if (discov->state == DISCOVERY_STOPPED)
1239 return;
1240
1241 if (discov->state == DISCOVERY_STOPPING)
1242 goto discov_complete;
1243
1244 if (discov->state != DISCOVERY_RESOLVING)
1245 return;
1246
1247 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1248 /* If the device was not found in a list of found devices names of which
1249 * are pending. there is no need to continue resolving a next name as it
1250 * will be done upon receiving another Remote Name Request Complete
1251 * Event */
1252 if (!e)
1253 return;
1254
1255 list_del(&e->list);
1256 if (name) {
1257 e->name_state = NAME_KNOWN;
1258 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1259 e->data.rssi, name, name_len);
1260 } else {
1261 e->name_state = NAME_NOT_KNOWN;
1262 }
1263
1264 if (hci_resolve_next_name(hdev))
1265 return;
1266
1267discov_complete:
1268 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1269}
1270
1271static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1272{
1273 struct hci_cp_remote_name_req *cp;
1274 struct hci_conn *conn;
1275
1276 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1277
1278 /* If successful wait for the name req complete event before
1279 * checking for the need to do authentication */
1280 if (!status)
1281 return;
1282
1283 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1284 if (!cp)
1285 return;
1286
1287 hci_dev_lock(hdev);
1288
1289 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1290
1291 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1292 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1293
1294 if (!conn)
1295 goto unlock;
1296
1297 if (!hci_outgoing_auth_needed(hdev, conn))
1298 goto unlock;
1299
1300 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1301 struct hci_cp_auth_requested auth_cp;
1302
1303 auth_cp.handle = __cpu_to_le16(conn->handle);
1304 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1305 sizeof(auth_cp), &auth_cp);
1306 }
1307
1308unlock:
1309 hci_dev_unlock(hdev);
1310}
1311
1312static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1313{
1314 struct hci_cp_read_remote_features *cp;
1315 struct hci_conn *conn;
1316
1317 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1318
1319 if (!status)
1320 return;
1321
1322 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1323 if (!cp)
1324 return;
1325
1326 hci_dev_lock(hdev);
1327
1328 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1329 if (conn) {
1330 if (conn->state == BT_CONFIG) {
1331 hci_proto_connect_cfm(conn, status);
1332 hci_conn_drop(conn);
1333 }
1334 }
1335
1336 hci_dev_unlock(hdev);
1337}
1338
1339static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1340{
1341 struct hci_cp_read_remote_ext_features *cp;
1342 struct hci_conn *conn;
1343
1344 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1345
1346 if (!status)
1347 return;
1348
1349 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1350 if (!cp)
1351 return;
1352
1353 hci_dev_lock(hdev);
1354
1355 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1356 if (conn) {
1357 if (conn->state == BT_CONFIG) {
1358 hci_proto_connect_cfm(conn, status);
1359 hci_conn_drop(conn);
1360 }
1361 }
1362
1363 hci_dev_unlock(hdev);
1364}
1365
1366static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1367{
1368 struct hci_cp_setup_sync_conn *cp;
1369 struct hci_conn *acl, *sco;
1370 __u16 handle;
1371
1372 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1373
1374 if (!status)
1375 return;
1376
1377 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1378 if (!cp)
1379 return;
1380
1381 handle = __le16_to_cpu(cp->handle);
1382
1383 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1384
1385 hci_dev_lock(hdev);
1386
1387 acl = hci_conn_hash_lookup_handle(hdev, handle);
1388 if (acl) {
1389 sco = acl->link;
1390 if (sco) {
1391 sco->state = BT_CLOSED;
1392
1393 hci_proto_connect_cfm(sco, status);
1394 hci_conn_del(sco);
1395 }
1396 }
1397
1398 hci_dev_unlock(hdev);
1399}
1400
1401static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1402{
1403 struct hci_cp_sniff_mode *cp;
1404 struct hci_conn *conn;
1405
1406 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1407
1408 if (!status)
1409 return;
1410
1411 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1412 if (!cp)
1413 return;
1414
1415 hci_dev_lock(hdev);
1416
1417 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1418 if (conn) {
1419 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1420
1421 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1422 hci_sco_setup(conn, status);
1423 }
1424
1425 hci_dev_unlock(hdev);
1426}
1427
1428static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1429{
1430 struct hci_cp_exit_sniff_mode *cp;
1431 struct hci_conn *conn;
1432
1433 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1434
1435 if (!status)
1436 return;
1437
1438 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1439 if (!cp)
1440 return;
1441
1442 hci_dev_lock(hdev);
1443
1444 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1445 if (conn) {
1446 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1447
1448 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1449 hci_sco_setup(conn, status);
1450 }
1451
1452 hci_dev_unlock(hdev);
1453}
1454
1455static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1456{
1457 struct hci_cp_disconnect *cp;
1458 struct hci_conn *conn;
1459
1460 if (!status)
1461 return;
1462
1463 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1464 if (!cp)
1465 return;
1466
1467 hci_dev_lock(hdev);
1468
1469 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1470 if (conn)
1471 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1472 conn->dst_type, status);
1473
1474 hci_dev_unlock(hdev);
1475}
1476
1477static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1478{
1479 struct hci_cp_create_phy_link *cp;
1480
1481 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1482
1483 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1484 if (!cp)
1485 return;
1486
1487 hci_dev_lock(hdev);
1488
1489 if (status) {
1490 struct hci_conn *hcon;
1491
1492 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1493 if (hcon)
1494 hci_conn_del(hcon);
1495 } else {
1496 amp_write_remote_assoc(hdev, cp->phy_handle);
1497 }
1498
1499 hci_dev_unlock(hdev);
1500}
1501
1502static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1503{
1504 struct hci_cp_accept_phy_link *cp;
1505
1506 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1507
1508 if (status)
1509 return;
1510
1511 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1512 if (!cp)
1513 return;
1514
1515 amp_write_remote_assoc(hdev, cp->phy_handle);
1516}
1517
1518static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1519{
1520 __u8 status = *((__u8 *) skb->data);
1521 struct discovery_state *discov = &hdev->discovery;
1522 struct inquiry_entry *e;
1523
1524 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1525
1526 hci_conn_check_pending(hdev);
1527
1528 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1529 return;
1530
1531 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1532 wake_up_bit(&hdev->flags, HCI_INQUIRY);
1533
1534 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1535 return;
1536
1537 hci_dev_lock(hdev);
1538
1539 if (discov->state != DISCOVERY_FINDING)
1540 goto unlock;
1541
1542 if (list_empty(&discov->resolve)) {
1543 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1544 goto unlock;
1545 }
1546
1547 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1548 if (e && hci_resolve_name(hdev, e) == 0) {
1549 e->name_state = NAME_PENDING;
1550 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1551 } else {
1552 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1553 }
1554
1555unlock:
1556 hci_dev_unlock(hdev);
1557}
1558
1559static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1560{
1561 struct inquiry_data data;
1562 struct inquiry_info *info = (void *) (skb->data + 1);
1563 int num_rsp = *((__u8 *) skb->data);
1564
1565 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1566
1567 if (!num_rsp)
1568 return;
1569
1570 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1571 return;
1572
1573 hci_dev_lock(hdev);
1574
1575 for (; num_rsp; num_rsp--, info++) {
1576 bool name_known, ssp;
1577
1578 bacpy(&data.bdaddr, &info->bdaddr);
1579 data.pscan_rep_mode = info->pscan_rep_mode;
1580 data.pscan_period_mode = info->pscan_period_mode;
1581 data.pscan_mode = info->pscan_mode;
1582 memcpy(data.dev_class, info->dev_class, 3);
1583 data.clock_offset = info->clock_offset;
1584 data.rssi = 0x00;
1585 data.ssp_mode = 0x00;
1586
1587 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1588 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1589 info->dev_class, 0, !name_known, ssp, NULL,
1590 0);
1591 }
1592
1593 hci_dev_unlock(hdev);
1594}
1595
1596static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1597{
1598 struct hci_ev_conn_complete *ev = (void *) skb->data;
1599 struct hci_conn *conn;
1600
1601 BT_DBG("%s", hdev->name);
1602
1603 hci_dev_lock(hdev);
1604
1605 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1606 if (!conn) {
1607 if (ev->link_type != SCO_LINK)
1608 goto unlock;
1609
1610 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1611 if (!conn)
1612 goto unlock;
1613
1614 conn->type = SCO_LINK;
1615 }
1616
1617 if (!ev->status) {
1618 conn->handle = __le16_to_cpu(ev->handle);
1619
1620 if (conn->type == ACL_LINK) {
1621 conn->state = BT_CONFIG;
1622 hci_conn_hold(conn);
1623
1624 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1625 !hci_find_link_key(hdev, &ev->bdaddr))
1626 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1627 else
1628 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1629 } else
1630 conn->state = BT_CONNECTED;
1631
1632 hci_conn_add_sysfs(conn);
1633
1634 if (test_bit(HCI_AUTH, &hdev->flags))
1635 conn->link_mode |= HCI_LM_AUTH;
1636
1637 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1638 conn->link_mode |= HCI_LM_ENCRYPT;
1639
1640 /* Get remote features */
1641 if (conn->type == ACL_LINK) {
1642 struct hci_cp_read_remote_features cp;
1643 cp.handle = ev->handle;
1644 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1645 sizeof(cp), &cp);
1646 }
1647
1648 /* Set packet type for incoming connection */
1649 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1650 struct hci_cp_change_conn_ptype cp;
1651 cp.handle = ev->handle;
1652 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1653 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1654 &cp);
1655 }
1656 } else {
1657 conn->state = BT_CLOSED;
1658 if (conn->type == ACL_LINK)
1659 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1660 conn->dst_type, ev->status);
1661 }
1662
1663 if (conn->type == ACL_LINK)
1664 hci_sco_setup(conn, ev->status);
1665
1666 if (ev->status) {
1667 hci_proto_connect_cfm(conn, ev->status);
1668 hci_conn_del(conn);
1669 } else if (ev->link_type != ACL_LINK)
1670 hci_proto_connect_cfm(conn, ev->status);
1671
1672unlock:
1673 hci_dev_unlock(hdev);
1674
1675 hci_conn_check_pending(hdev);
1676}
1677
1678static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1679{
1680 struct hci_ev_conn_request *ev = (void *) skb->data;
1681 int mask = hdev->link_mode;
1682 __u8 flags = 0;
1683
1684 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1685 ev->link_type);
1686
1687 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1688 &flags);
1689
1690 if ((mask & HCI_LM_ACCEPT) &&
1691 !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1692 /* Connection accepted */
1693 struct inquiry_entry *ie;
1694 struct hci_conn *conn;
1695
1696 hci_dev_lock(hdev);
1697
1698 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1699 if (ie)
1700 memcpy(ie->data.dev_class, ev->dev_class, 3);
1701
1702 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1703 &ev->bdaddr);
1704 if (!conn) {
1705 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1706 if (!conn) {
1707 BT_ERR("No memory for new connection");
1708 hci_dev_unlock(hdev);
1709 return;
1710 }
1711 }
1712
1713 memcpy(conn->dev_class, ev->dev_class, 3);
1714
1715 hci_dev_unlock(hdev);
1716
1717 if (ev->link_type == ACL_LINK ||
1718 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1719 struct hci_cp_accept_conn_req cp;
1720 conn->state = BT_CONNECT;
1721
1722 bacpy(&cp.bdaddr, &ev->bdaddr);
1723
1724 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1725 cp.role = 0x00; /* Become master */
1726 else
1727 cp.role = 0x01; /* Remain slave */
1728
1729 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1730 &cp);
1731 } else if (!(flags & HCI_PROTO_DEFER)) {
1732 struct hci_cp_accept_sync_conn_req cp;
1733 conn->state = BT_CONNECT;
1734
1735 bacpy(&cp.bdaddr, &ev->bdaddr);
1736 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1737
1738 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1739 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1740 cp.max_latency = __constant_cpu_to_le16(0xffff);
1741 cp.content_format = cpu_to_le16(hdev->voice_setting);
1742 cp.retrans_effort = 0xff;
1743
1744 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1745 sizeof(cp), &cp);
1746 } else {
1747 conn->state = BT_CONNECT2;
1748 hci_proto_connect_cfm(conn, 0);
1749 }
1750 } else {
1751 /* Connection rejected */
1752 struct hci_cp_reject_conn_req cp;
1753
1754 bacpy(&cp.bdaddr, &ev->bdaddr);
1755 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1756 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1757 }
1758}
1759
1760static u8 hci_to_mgmt_reason(u8 err)
1761{
1762 switch (err) {
1763 case HCI_ERROR_CONNECTION_TIMEOUT:
1764 return MGMT_DEV_DISCONN_TIMEOUT;
1765 case HCI_ERROR_REMOTE_USER_TERM:
1766 case HCI_ERROR_REMOTE_LOW_RESOURCES:
1767 case HCI_ERROR_REMOTE_POWER_OFF:
1768 return MGMT_DEV_DISCONN_REMOTE;
1769 case HCI_ERROR_LOCAL_HOST_TERM:
1770 return MGMT_DEV_DISCONN_LOCAL_HOST;
1771 default:
1772 return MGMT_DEV_DISCONN_UNKNOWN;
1773 }
1774}
1775
1776static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1777{
1778 struct hci_ev_disconn_complete *ev = (void *) skb->data;
1779 struct hci_conn *conn;
1780
1781 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1782
1783 hci_dev_lock(hdev);
1784
1785 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1786 if (!conn)
1787 goto unlock;
1788
1789 if (ev->status == 0)
1790 conn->state = BT_CLOSED;
1791
1792 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
1793 (conn->type == ACL_LINK || conn->type == LE_LINK)) {
1794 if (ev->status) {
1795 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1796 conn->dst_type, ev->status);
1797 } else {
1798 u8 reason = hci_to_mgmt_reason(ev->reason);
1799
1800 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1801 conn->dst_type, reason);
1802 }
1803 }
1804
1805 if (ev->status == 0) {
1806 u8 type = conn->type;
1807
1808 if (type == ACL_LINK && conn->flush_key)
1809 hci_remove_link_key(hdev, &conn->dst);
1810 hci_proto_disconn_cfm(conn, ev->reason);
1811 hci_conn_del(conn);
1812
1813 /* Re-enable advertising if necessary, since it might
1814 * have been disabled by the connection. From the
1815 * HCI_LE_Set_Advertise_Enable command description in
1816 * the core specification (v4.0):
1817 * "The Controller shall continue advertising until the Host
1818 * issues an LE_Set_Advertise_Enable command with
1819 * Advertising_Enable set to 0x00 (Advertising is disabled)
1820 * or until a connection is created or until the Advertising
1821 * is timed out due to Directed Advertising."
1822 */
1823 if (type == LE_LINK)
1824 mgmt_reenable_advertising(hdev);
1825 }
1826
1827unlock:
1828 hci_dev_unlock(hdev);
1829}
1830
1831static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1832{
1833 struct hci_ev_auth_complete *ev = (void *) skb->data;
1834 struct hci_conn *conn;
1835
1836 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1837
1838 hci_dev_lock(hdev);
1839
1840 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1841 if (!conn)
1842 goto unlock;
1843
1844 if (!ev->status) {
1845 if (!hci_conn_ssp_enabled(conn) &&
1846 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1847 BT_INFO("re-auth of legacy device is not possible.");
1848 } else {
1849 conn->link_mode |= HCI_LM_AUTH;
1850 conn->sec_level = conn->pending_sec_level;
1851 }
1852 } else {
1853 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1854 ev->status);
1855 }
1856
1857 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1858 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1859
1860 if (conn->state == BT_CONFIG) {
1861 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1862 struct hci_cp_set_conn_encrypt cp;
1863 cp.handle = ev->handle;
1864 cp.encrypt = 0x01;
1865 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1866 &cp);
1867 } else {
1868 conn->state = BT_CONNECTED;
1869 hci_proto_connect_cfm(conn, ev->status);
1870 hci_conn_drop(conn);
1871 }
1872 } else {
1873 hci_auth_cfm(conn, ev->status);
1874
1875 hci_conn_hold(conn);
1876 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1877 hci_conn_drop(conn);
1878 }
1879
1880 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1881 if (!ev->status) {
1882 struct hci_cp_set_conn_encrypt cp;
1883 cp.handle = ev->handle;
1884 cp.encrypt = 0x01;
1885 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1886 &cp);
1887 } else {
1888 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1889 hci_encrypt_cfm(conn, ev->status, 0x00);
1890 }
1891 }
1892
1893unlock:
1894 hci_dev_unlock(hdev);
1895}
1896
1897static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1898{
1899 struct hci_ev_remote_name *ev = (void *) skb->data;
1900 struct hci_conn *conn;
1901
1902 BT_DBG("%s", hdev->name);
1903
1904 hci_conn_check_pending(hdev);
1905
1906 hci_dev_lock(hdev);
1907
1908 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1909
1910 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1911 goto check_auth;
1912
1913 if (ev->status == 0)
1914 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1915 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1916 else
1917 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1918
1919check_auth:
1920 if (!conn)
1921 goto unlock;
1922
1923 if (!hci_outgoing_auth_needed(hdev, conn))
1924 goto unlock;
1925
1926 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1927 struct hci_cp_auth_requested cp;
1928 cp.handle = __cpu_to_le16(conn->handle);
1929 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1930 }
1931
1932unlock:
1933 hci_dev_unlock(hdev);
1934}
1935
1936static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1937{
1938 struct hci_ev_encrypt_change *ev = (void *) skb->data;
1939 struct hci_conn *conn;
1940
1941 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1942
1943 hci_dev_lock(hdev);
1944
1945 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1946 if (conn) {
1947 if (!ev->status) {
1948 if (ev->encrypt) {
1949 /* Encryption implies authentication */
1950 conn->link_mode |= HCI_LM_AUTH;
1951 conn->link_mode |= HCI_LM_ENCRYPT;
1952 conn->sec_level = conn->pending_sec_level;
1953 } else
1954 conn->link_mode &= ~HCI_LM_ENCRYPT;
1955 }
1956
1957 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1958
1959 if (ev->status && conn->state == BT_CONNECTED) {
1960 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1961 hci_conn_drop(conn);
1962 goto unlock;
1963 }
1964
1965 if (conn->state == BT_CONFIG) {
1966 if (!ev->status)
1967 conn->state = BT_CONNECTED;
1968
1969 hci_proto_connect_cfm(conn, ev->status);
1970 hci_conn_drop(conn);
1971 } else
1972 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1973 }
1974
1975unlock:
1976 hci_dev_unlock(hdev);
1977}
1978
1979static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
1980 struct sk_buff *skb)
1981{
1982 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1983 struct hci_conn *conn;
1984
1985 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1986
1987 hci_dev_lock(hdev);
1988
1989 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1990 if (conn) {
1991 if (!ev->status)
1992 conn->link_mode |= HCI_LM_SECURE;
1993
1994 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1995
1996 hci_key_change_cfm(conn, ev->status);
1997 }
1998
1999 hci_dev_unlock(hdev);
2000}
2001
2002static void hci_remote_features_evt(struct hci_dev *hdev,
2003 struct sk_buff *skb)
2004{
2005 struct hci_ev_remote_features *ev = (void *) skb->data;
2006 struct hci_conn *conn;
2007
2008 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2009
2010 hci_dev_lock(hdev);
2011
2012 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2013 if (!conn)
2014 goto unlock;
2015
2016 if (!ev->status)
2017 memcpy(conn->features[0], ev->features, 8);
2018
2019 if (conn->state != BT_CONFIG)
2020 goto unlock;
2021
2022 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2023 struct hci_cp_read_remote_ext_features cp;
2024 cp.handle = ev->handle;
2025 cp.page = 0x01;
2026 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2027 sizeof(cp), &cp);
2028 goto unlock;
2029 }
2030
2031 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2032 struct hci_cp_remote_name_req cp;
2033 memset(&cp, 0, sizeof(cp));
2034 bacpy(&cp.bdaddr, &conn->dst);
2035 cp.pscan_rep_mode = 0x02;
2036 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2037 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2038 mgmt_device_connected(hdev, &conn->dst, conn->type,
2039 conn->dst_type, 0, NULL, 0,
2040 conn->dev_class);
2041
2042 if (!hci_outgoing_auth_needed(hdev, conn)) {
2043 conn->state = BT_CONNECTED;
2044 hci_proto_connect_cfm(conn, ev->status);
2045 hci_conn_drop(conn);
2046 }
2047
2048unlock:
2049 hci_dev_unlock(hdev);
2050}
2051
2052static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2053{
2054 struct hci_ev_cmd_complete *ev = (void *) skb->data;
2055 u8 status = skb->data[sizeof(*ev)];
2056 __u16 opcode;
2057
2058 skb_pull(skb, sizeof(*ev));
2059
2060 opcode = __le16_to_cpu(ev->opcode);
2061
2062 switch (opcode) {
2063 case HCI_OP_INQUIRY_CANCEL:
2064 hci_cc_inquiry_cancel(hdev, skb);
2065 break;
2066
2067 case HCI_OP_PERIODIC_INQ:
2068 hci_cc_periodic_inq(hdev, skb);
2069 break;
2070
2071 case HCI_OP_EXIT_PERIODIC_INQ:
2072 hci_cc_exit_periodic_inq(hdev, skb);
2073 break;
2074
2075 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2076 hci_cc_remote_name_req_cancel(hdev, skb);
2077 break;
2078
2079 case HCI_OP_ROLE_DISCOVERY:
2080 hci_cc_role_discovery(hdev, skb);
2081 break;
2082
2083 case HCI_OP_READ_LINK_POLICY:
2084 hci_cc_read_link_policy(hdev, skb);
2085 break;
2086
2087 case HCI_OP_WRITE_LINK_POLICY:
2088 hci_cc_write_link_policy(hdev, skb);
2089 break;
2090
2091 case HCI_OP_READ_DEF_LINK_POLICY:
2092 hci_cc_read_def_link_policy(hdev, skb);
2093 break;
2094
2095 case HCI_OP_WRITE_DEF_LINK_POLICY:
2096 hci_cc_write_def_link_policy(hdev, skb);
2097 break;
2098
2099 case HCI_OP_RESET:
2100 hci_cc_reset(hdev, skb);
2101 break;
2102
2103 case HCI_OP_WRITE_LOCAL_NAME:
2104 hci_cc_write_local_name(hdev, skb);
2105 break;
2106
2107 case HCI_OP_READ_LOCAL_NAME:
2108 hci_cc_read_local_name(hdev, skb);
2109 break;
2110
2111 case HCI_OP_WRITE_AUTH_ENABLE:
2112 hci_cc_write_auth_enable(hdev, skb);
2113 break;
2114
2115 case HCI_OP_WRITE_ENCRYPT_MODE:
2116 hci_cc_write_encrypt_mode(hdev, skb);
2117 break;
2118
2119 case HCI_OP_WRITE_SCAN_ENABLE:
2120 hci_cc_write_scan_enable(hdev, skb);
2121 break;
2122
2123 case HCI_OP_READ_CLASS_OF_DEV:
2124 hci_cc_read_class_of_dev(hdev, skb);
2125 break;
2126
2127 case HCI_OP_WRITE_CLASS_OF_DEV:
2128 hci_cc_write_class_of_dev(hdev, skb);
2129 break;
2130
2131 case HCI_OP_READ_VOICE_SETTING:
2132 hci_cc_read_voice_setting(hdev, skb);
2133 break;
2134
2135 case HCI_OP_WRITE_VOICE_SETTING:
2136 hci_cc_write_voice_setting(hdev, skb);
2137 break;
2138
2139 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2140 hci_cc_read_num_supported_iac(hdev, skb);
2141 break;
2142
2143 case HCI_OP_WRITE_SSP_MODE:
2144 hci_cc_write_ssp_mode(hdev, skb);
2145 break;
2146
2147 case HCI_OP_READ_LOCAL_VERSION:
2148 hci_cc_read_local_version(hdev, skb);
2149 break;
2150
2151 case HCI_OP_READ_LOCAL_COMMANDS:
2152 hci_cc_read_local_commands(hdev, skb);
2153 break;
2154
2155 case HCI_OP_READ_LOCAL_FEATURES:
2156 hci_cc_read_local_features(hdev, skb);
2157 break;
2158
2159 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2160 hci_cc_read_local_ext_features(hdev, skb);
2161 break;
2162
2163 case HCI_OP_READ_BUFFER_SIZE:
2164 hci_cc_read_buffer_size(hdev, skb);
2165 break;
2166
2167 case HCI_OP_READ_BD_ADDR:
2168 hci_cc_read_bd_addr(hdev, skb);
2169 break;
2170
2171 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2172 hci_cc_read_page_scan_activity(hdev, skb);
2173 break;
2174
2175 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2176 hci_cc_write_page_scan_activity(hdev, skb);
2177 break;
2178
2179 case HCI_OP_READ_PAGE_SCAN_TYPE:
2180 hci_cc_read_page_scan_type(hdev, skb);
2181 break;
2182
2183 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2184 hci_cc_write_page_scan_type(hdev, skb);
2185 break;
2186
2187 case HCI_OP_READ_DATA_BLOCK_SIZE:
2188 hci_cc_read_data_block_size(hdev, skb);
2189 break;
2190
2191 case HCI_OP_READ_FLOW_CONTROL_MODE:
2192 hci_cc_read_flow_control_mode(hdev, skb);
2193 break;
2194
2195 case HCI_OP_READ_LOCAL_AMP_INFO:
2196 hci_cc_read_local_amp_info(hdev, skb);
2197 break;
2198
2199 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2200 hci_cc_read_local_amp_assoc(hdev, skb);
2201 break;
2202
2203 case HCI_OP_READ_INQ_RSP_TX_POWER:
2204 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2205 break;
2206
2207 case HCI_OP_PIN_CODE_REPLY:
2208 hci_cc_pin_code_reply(hdev, skb);
2209 break;
2210
2211 case HCI_OP_PIN_CODE_NEG_REPLY:
2212 hci_cc_pin_code_neg_reply(hdev, skb);
2213 break;
2214
2215 case HCI_OP_READ_LOCAL_OOB_DATA:
2216 hci_cc_read_local_oob_data_reply(hdev, skb);
2217 break;
2218
2219 case HCI_OP_LE_READ_BUFFER_SIZE:
2220 hci_cc_le_read_buffer_size(hdev, skb);
2221 break;
2222
2223 case HCI_OP_LE_READ_LOCAL_FEATURES:
2224 hci_cc_le_read_local_features(hdev, skb);
2225 break;
2226
2227 case HCI_OP_LE_READ_ADV_TX_POWER:
2228 hci_cc_le_read_adv_tx_power(hdev, skb);
2229 break;
2230
2231 case HCI_OP_USER_CONFIRM_REPLY:
2232 hci_cc_user_confirm_reply(hdev, skb);
2233 break;
2234
2235 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2236 hci_cc_user_confirm_neg_reply(hdev, skb);
2237 break;
2238
2239 case HCI_OP_USER_PASSKEY_REPLY:
2240 hci_cc_user_passkey_reply(hdev, skb);
2241 break;
2242
2243 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2244 hci_cc_user_passkey_neg_reply(hdev, skb);
2245 break;
2246
2247 case HCI_OP_LE_SET_ADV_ENABLE:
2248 hci_cc_le_set_adv_enable(hdev, skb);
2249 break;
2250
2251 case HCI_OP_LE_SET_SCAN_ENABLE:
2252 hci_cc_le_set_scan_enable(hdev, skb);
2253 break;
2254
2255 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2256 hci_cc_le_read_white_list_size(hdev, skb);
2257 break;
2258
2259 case HCI_OP_LE_READ_SUPPORTED_STATES:
2260 hci_cc_le_read_supported_states(hdev, skb);
2261 break;
2262
2263 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2264 hci_cc_write_le_host_supported(hdev, skb);
2265 break;
2266
2267 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2268 hci_cc_write_remote_amp_assoc(hdev, skb);
2269 break;
2270
2271 default:
2272 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2273 break;
2274 }
2275
2276 if (opcode != HCI_OP_NOP)
2277 del_timer(&hdev->cmd_timer);
2278
2279 hci_req_cmd_complete(hdev, opcode, status);
2280
2281 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2282 atomic_set(&hdev->cmd_cnt, 1);
2283 if (!skb_queue_empty(&hdev->cmd_q))
2284 queue_work(hdev->workqueue, &hdev->cmd_work);
2285 }
2286}
2287
2288static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2289{
2290 struct hci_ev_cmd_status *ev = (void *) skb->data;
2291 __u16 opcode;
2292
2293 skb_pull(skb, sizeof(*ev));
2294
2295 opcode = __le16_to_cpu(ev->opcode);
2296
2297 switch (opcode) {
2298 case HCI_OP_INQUIRY:
2299 hci_cs_inquiry(hdev, ev->status);
2300 break;
2301
2302 case HCI_OP_CREATE_CONN:
2303 hci_cs_create_conn(hdev, ev->status);
2304 break;
2305
2306 case HCI_OP_ADD_SCO:
2307 hci_cs_add_sco(hdev, ev->status);
2308 break;
2309
2310 case HCI_OP_AUTH_REQUESTED:
2311 hci_cs_auth_requested(hdev, ev->status);
2312 break;
2313
2314 case HCI_OP_SET_CONN_ENCRYPT:
2315 hci_cs_set_conn_encrypt(hdev, ev->status);
2316 break;
2317
2318 case HCI_OP_REMOTE_NAME_REQ:
2319 hci_cs_remote_name_req(hdev, ev->status);
2320 break;
2321
2322 case HCI_OP_READ_REMOTE_FEATURES:
2323 hci_cs_read_remote_features(hdev, ev->status);
2324 break;
2325
2326 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2327 hci_cs_read_remote_ext_features(hdev, ev->status);
2328 break;
2329
2330 case HCI_OP_SETUP_SYNC_CONN:
2331 hci_cs_setup_sync_conn(hdev, ev->status);
2332 break;
2333
2334 case HCI_OP_SNIFF_MODE:
2335 hci_cs_sniff_mode(hdev, ev->status);
2336 break;
2337
2338 case HCI_OP_EXIT_SNIFF_MODE:
2339 hci_cs_exit_sniff_mode(hdev, ev->status);
2340 break;
2341
2342 case HCI_OP_DISCONNECT:
2343 hci_cs_disconnect(hdev, ev->status);
2344 break;
2345
2346 case HCI_OP_CREATE_PHY_LINK:
2347 hci_cs_create_phylink(hdev, ev->status);
2348 break;
2349
2350 case HCI_OP_ACCEPT_PHY_LINK:
2351 hci_cs_accept_phylink(hdev, ev->status);
2352 break;
2353
2354 default:
2355 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2356 break;
2357 }
2358
2359 if (opcode != HCI_OP_NOP)
2360 del_timer(&hdev->cmd_timer);
2361
2362 if (ev->status ||
2363 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2364 hci_req_cmd_complete(hdev, opcode, ev->status);
2365
2366 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2367 atomic_set(&hdev->cmd_cnt, 1);
2368 if (!skb_queue_empty(&hdev->cmd_q))
2369 queue_work(hdev->workqueue, &hdev->cmd_work);
2370 }
2371}
2372
2373static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374{
2375 struct hci_ev_role_change *ev = (void *) skb->data;
2376 struct hci_conn *conn;
2377
2378 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2379
2380 hci_dev_lock(hdev);
2381
2382 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2383 if (conn) {
2384 if (!ev->status) {
2385 if (ev->role)
2386 conn->link_mode &= ~HCI_LM_MASTER;
2387 else
2388 conn->link_mode |= HCI_LM_MASTER;
2389 }
2390
2391 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2392
2393 hci_role_switch_cfm(conn, ev->status, ev->role);
2394 }
2395
2396 hci_dev_unlock(hdev);
2397}
2398
2399static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2400{
2401 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2402 int i;
2403
2404 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2405 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2406 return;
2407 }
2408
2409 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2410 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2411 BT_DBG("%s bad parameters", hdev->name);
2412 return;
2413 }
2414
2415 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2416
2417 for (i = 0; i < ev->num_hndl; i++) {
2418 struct hci_comp_pkts_info *info = &ev->handles[i];
2419 struct hci_conn *conn;
2420 __u16 handle, count;
2421
2422 handle = __le16_to_cpu(info->handle);
2423 count = __le16_to_cpu(info->count);
2424
2425 conn = hci_conn_hash_lookup_handle(hdev, handle);
2426 if (!conn)
2427 continue;
2428
2429 conn->sent -= count;
2430
2431 switch (conn->type) {
2432 case ACL_LINK:
2433 hdev->acl_cnt += count;
2434 if (hdev->acl_cnt > hdev->acl_pkts)
2435 hdev->acl_cnt = hdev->acl_pkts;
2436 break;
2437
2438 case LE_LINK:
2439 if (hdev->le_pkts) {
2440 hdev->le_cnt += count;
2441 if (hdev->le_cnt > hdev->le_pkts)
2442 hdev->le_cnt = hdev->le_pkts;
2443 } else {
2444 hdev->acl_cnt += count;
2445 if (hdev->acl_cnt > hdev->acl_pkts)
2446 hdev->acl_cnt = hdev->acl_pkts;
2447 }
2448 break;
2449
2450 case SCO_LINK:
2451 hdev->sco_cnt += count;
2452 if (hdev->sco_cnt > hdev->sco_pkts)
2453 hdev->sco_cnt = hdev->sco_pkts;
2454 break;
2455
2456 default:
2457 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2458 break;
2459 }
2460 }
2461
2462 queue_work(hdev->workqueue, &hdev->tx_work);
2463}
2464
2465static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2466 __u16 handle)
2467{
2468 struct hci_chan *chan;
2469
2470 switch (hdev->dev_type) {
2471 case HCI_BREDR:
2472 return hci_conn_hash_lookup_handle(hdev, handle);
2473 case HCI_AMP:
2474 chan = hci_chan_lookup_handle(hdev, handle);
2475 if (chan)
2476 return chan->conn;
2477 break;
2478 default:
2479 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2480 break;
2481 }
2482
2483 return NULL;
2484}
2485
2486static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2487{
2488 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2489 int i;
2490
2491 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2492 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2493 return;
2494 }
2495
2496 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2497 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2498 BT_DBG("%s bad parameters", hdev->name);
2499 return;
2500 }
2501
2502 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2503 ev->num_hndl);
2504
2505 for (i = 0; i < ev->num_hndl; i++) {
2506 struct hci_comp_blocks_info *info = &ev->handles[i];
2507 struct hci_conn *conn = NULL;
2508 __u16 handle, block_count;
2509
2510 handle = __le16_to_cpu(info->handle);
2511 block_count = __le16_to_cpu(info->blocks);
2512
2513 conn = __hci_conn_lookup_handle(hdev, handle);
2514 if (!conn)
2515 continue;
2516
2517 conn->sent -= block_count;
2518
2519 switch (conn->type) {
2520 case ACL_LINK:
2521 case AMP_LINK:
2522 hdev->block_cnt += block_count;
2523 if (hdev->block_cnt > hdev->num_blocks)
2524 hdev->block_cnt = hdev->num_blocks;
2525 break;
2526
2527 default:
2528 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2529 break;
2530 }
2531 }
2532
2533 queue_work(hdev->workqueue, &hdev->tx_work);
2534}
2535
2536static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2537{
2538 struct hci_ev_mode_change *ev = (void *) skb->data;
2539 struct hci_conn *conn;
2540
2541 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2542
2543 hci_dev_lock(hdev);
2544
2545 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2546 if (conn) {
2547 conn->mode = ev->mode;
2548
2549 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2550 &conn->flags)) {
2551 if (conn->mode == HCI_CM_ACTIVE)
2552 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2553 else
2554 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2555 }
2556
2557 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2558 hci_sco_setup(conn, ev->status);
2559 }
2560
2561 hci_dev_unlock(hdev);
2562}
2563
2564static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2565{
2566 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2567 struct hci_conn *conn;
2568
2569 BT_DBG("%s", hdev->name);
2570
2571 hci_dev_lock(hdev);
2572
2573 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2574 if (!conn)
2575 goto unlock;
2576
2577 if (conn->state == BT_CONNECTED) {
2578 hci_conn_hold(conn);
2579 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2580 hci_conn_drop(conn);
2581 }
2582
2583 if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2584 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2585 sizeof(ev->bdaddr), &ev->bdaddr);
2586 else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2587 u8 secure;
2588
2589 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2590 secure = 1;
2591 else
2592 secure = 0;
2593
2594 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2595 }
2596
2597unlock:
2598 hci_dev_unlock(hdev);
2599}
2600
2601static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2602{
2603 struct hci_ev_link_key_req *ev = (void *) skb->data;
2604 struct hci_cp_link_key_reply cp;
2605 struct hci_conn *conn;
2606 struct link_key *key;
2607
2608 BT_DBG("%s", hdev->name);
2609
2610 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2611 return;
2612
2613 hci_dev_lock(hdev);
2614
2615 key = hci_find_link_key(hdev, &ev->bdaddr);
2616 if (!key) {
2617 BT_DBG("%s link key not found for %pMR", hdev->name,
2618 &ev->bdaddr);
2619 goto not_found;
2620 }
2621
2622 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2623 &ev->bdaddr);
2624
2625 if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2626 key->type == HCI_LK_DEBUG_COMBINATION) {
2627 BT_DBG("%s ignoring debug key", hdev->name);
2628 goto not_found;
2629 }
2630
2631 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2632 if (conn) {
2633 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2634 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2635 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2636 goto not_found;
2637 }
2638
2639 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2640 conn->pending_sec_level == BT_SECURITY_HIGH) {
2641 BT_DBG("%s ignoring key unauthenticated for high security",
2642 hdev->name);
2643 goto not_found;
2644 }
2645
2646 conn->key_type = key->type;
2647 conn->pin_length = key->pin_len;
2648 }
2649
2650 bacpy(&cp.bdaddr, &ev->bdaddr);
2651 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2652
2653 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2654
2655 hci_dev_unlock(hdev);
2656
2657 return;
2658
2659not_found:
2660 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2661 hci_dev_unlock(hdev);
2662}
2663
2664static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2665{
2666 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2667 struct hci_conn *conn;
2668 u8 pin_len = 0;
2669
2670 BT_DBG("%s", hdev->name);
2671
2672 hci_dev_lock(hdev);
2673
2674 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2675 if (conn) {
2676 hci_conn_hold(conn);
2677 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2678 pin_len = conn->pin_length;
2679
2680 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2681 conn->key_type = ev->key_type;
2682
2683 hci_conn_drop(conn);
2684 }
2685
2686 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2687 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2688 ev->key_type, pin_len);
2689
2690 hci_dev_unlock(hdev);
2691}
2692
2693static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2694{
2695 struct hci_ev_clock_offset *ev = (void *) skb->data;
2696 struct hci_conn *conn;
2697
2698 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2699
2700 hci_dev_lock(hdev);
2701
2702 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2703 if (conn && !ev->status) {
2704 struct inquiry_entry *ie;
2705
2706 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2707 if (ie) {
2708 ie->data.clock_offset = ev->clock_offset;
2709 ie->timestamp = jiffies;
2710 }
2711 }
2712
2713 hci_dev_unlock(hdev);
2714}
2715
2716static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2717{
2718 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2719 struct hci_conn *conn;
2720
2721 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2722
2723 hci_dev_lock(hdev);
2724
2725 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2726 if (conn && !ev->status)
2727 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2728
2729 hci_dev_unlock(hdev);
2730}
2731
2732static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2733{
2734 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2735 struct inquiry_entry *ie;
2736
2737 BT_DBG("%s", hdev->name);
2738
2739 hci_dev_lock(hdev);
2740
2741 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2742 if (ie) {
2743 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2744 ie->timestamp = jiffies;
2745 }
2746
2747 hci_dev_unlock(hdev);
2748}
2749
2750static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2751 struct sk_buff *skb)
2752{
2753 struct inquiry_data data;
2754 int num_rsp = *((__u8 *) skb->data);
2755 bool name_known, ssp;
2756
2757 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2758
2759 if (!num_rsp)
2760 return;
2761
2762 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2763 return;
2764
2765 hci_dev_lock(hdev);
2766
2767 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2768 struct inquiry_info_with_rssi_and_pscan_mode *info;
2769 info = (void *) (skb->data + 1);
2770
2771 for (; num_rsp; num_rsp--, info++) {
2772 bacpy(&data.bdaddr, &info->bdaddr);
2773 data.pscan_rep_mode = info->pscan_rep_mode;
2774 data.pscan_period_mode = info->pscan_period_mode;
2775 data.pscan_mode = info->pscan_mode;
2776 memcpy(data.dev_class, info->dev_class, 3);
2777 data.clock_offset = info->clock_offset;
2778 data.rssi = info->rssi;
2779 data.ssp_mode = 0x00;
2780
2781 name_known = hci_inquiry_cache_update(hdev, &data,
2782 false, &ssp);
2783 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2784 info->dev_class, info->rssi,
2785 !name_known, ssp, NULL, 0);
2786 }
2787 } else {
2788 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2789
2790 for (; num_rsp; num_rsp--, info++) {
2791 bacpy(&data.bdaddr, &info->bdaddr);
2792 data.pscan_rep_mode = info->pscan_rep_mode;
2793 data.pscan_period_mode = info->pscan_period_mode;
2794 data.pscan_mode = 0x00;
2795 memcpy(data.dev_class, info->dev_class, 3);
2796 data.clock_offset = info->clock_offset;
2797 data.rssi = info->rssi;
2798 data.ssp_mode = 0x00;
2799 name_known = hci_inquiry_cache_update(hdev, &data,
2800 false, &ssp);
2801 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2802 info->dev_class, info->rssi,
2803 !name_known, ssp, NULL, 0);
2804 }
2805 }
2806
2807 hci_dev_unlock(hdev);
2808}
2809
2810static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2811 struct sk_buff *skb)
2812{
2813 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2814 struct hci_conn *conn;
2815
2816 BT_DBG("%s", hdev->name);
2817
2818 hci_dev_lock(hdev);
2819
2820 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2821 if (!conn)
2822 goto unlock;
2823
2824 if (ev->page < HCI_MAX_PAGES)
2825 memcpy(conn->features[ev->page], ev->features, 8);
2826
2827 if (!ev->status && ev->page == 0x01) {
2828 struct inquiry_entry *ie;
2829
2830 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2831 if (ie)
2832 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2833
2834 if (ev->features[0] & LMP_HOST_SSP) {
2835 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2836 } else {
2837 /* It is mandatory by the Bluetooth specification that
2838 * Extended Inquiry Results are only used when Secure
2839 * Simple Pairing is enabled, but some devices violate
2840 * this.
2841 *
2842 * To make these devices work, the internal SSP
2843 * enabled flag needs to be cleared if the remote host
2844 * features do not indicate SSP support */
2845 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2846 }
2847 }
2848
2849 if (conn->state != BT_CONFIG)
2850 goto unlock;
2851
2852 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2853 struct hci_cp_remote_name_req cp;
2854 memset(&cp, 0, sizeof(cp));
2855 bacpy(&cp.bdaddr, &conn->dst);
2856 cp.pscan_rep_mode = 0x02;
2857 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2858 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2859 mgmt_device_connected(hdev, &conn->dst, conn->type,
2860 conn->dst_type, 0, NULL, 0,
2861 conn->dev_class);
2862
2863 if (!hci_outgoing_auth_needed(hdev, conn)) {
2864 conn->state = BT_CONNECTED;
2865 hci_proto_connect_cfm(conn, ev->status);
2866 hci_conn_drop(conn);
2867 }
2868
2869unlock:
2870 hci_dev_unlock(hdev);
2871}
2872
2873static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2874 struct sk_buff *skb)
2875{
2876 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2877 struct hci_conn *conn;
2878
2879 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2880
2881 hci_dev_lock(hdev);
2882
2883 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2884 if (!conn) {
2885 if (ev->link_type == ESCO_LINK)
2886 goto unlock;
2887
2888 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2889 if (!conn)
2890 goto unlock;
2891
2892 conn->type = SCO_LINK;
2893 }
2894
2895 switch (ev->status) {
2896 case 0x00:
2897 conn->handle = __le16_to_cpu(ev->handle);
2898 conn->state = BT_CONNECTED;
2899
2900 hci_conn_add_sysfs(conn);
2901 break;
2902
2903 case 0x0d: /* Connection Rejected due to Limited Resources */
2904 case 0x11: /* Unsupported Feature or Parameter Value */
2905 case 0x1c: /* SCO interval rejected */
2906 case 0x1a: /* Unsupported Remote Feature */
2907 case 0x1f: /* Unspecified error */
2908 if (conn->out) {
2909 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2910 (hdev->esco_type & EDR_ESCO_MASK);
2911 if (hci_setup_sync(conn, conn->link->handle))
2912 goto unlock;
2913 }
2914 /* fall through */
2915
2916 default:
2917 conn->state = BT_CLOSED;
2918 break;
2919 }
2920
2921 hci_proto_connect_cfm(conn, ev->status);
2922 if (ev->status)
2923 hci_conn_del(conn);
2924
2925unlock:
2926 hci_dev_unlock(hdev);
2927}
2928
2929static inline size_t eir_get_length(u8 *eir, size_t eir_len)
2930{
2931 size_t parsed = 0;
2932
2933 while (parsed < eir_len) {
2934 u8 field_len = eir[0];
2935
2936 if (field_len == 0)
2937 return parsed;
2938
2939 parsed += field_len + 1;
2940 eir += field_len + 1;
2941 }
2942
2943 return eir_len;
2944}
2945
2946static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
2947 struct sk_buff *skb)
2948{
2949 struct inquiry_data data;
2950 struct extended_inquiry_info *info = (void *) (skb->data + 1);
2951 int num_rsp = *((__u8 *) skb->data);
2952 size_t eir_len;
2953
2954 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2955
2956 if (!num_rsp)
2957 return;
2958
2959 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2960 return;
2961
2962 hci_dev_lock(hdev);
2963
2964 for (; num_rsp; num_rsp--, info++) {
2965 bool name_known, ssp;
2966
2967 bacpy(&data.bdaddr, &info->bdaddr);
2968 data.pscan_rep_mode = info->pscan_rep_mode;
2969 data.pscan_period_mode = info->pscan_period_mode;
2970 data.pscan_mode = 0x00;
2971 memcpy(data.dev_class, info->dev_class, 3);
2972 data.clock_offset = info->clock_offset;
2973 data.rssi = info->rssi;
2974 data.ssp_mode = 0x01;
2975
2976 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2977 name_known = eir_has_data_type(info->data,
2978 sizeof(info->data),
2979 EIR_NAME_COMPLETE);
2980 else
2981 name_known = true;
2982
2983 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2984 &ssp);
2985 eir_len = eir_get_length(info->data, sizeof(info->data));
2986 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2987 info->dev_class, info->rssi, !name_known,
2988 ssp, info->data, eir_len);
2989 }
2990
2991 hci_dev_unlock(hdev);
2992}
2993
2994static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
2995 struct sk_buff *skb)
2996{
2997 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
2998 struct hci_conn *conn;
2999
3000 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3001 __le16_to_cpu(ev->handle));
3002
3003 hci_dev_lock(hdev);
3004
3005 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3006 if (!conn)
3007 goto unlock;
3008
3009 if (!ev->status)
3010 conn->sec_level = conn->pending_sec_level;
3011
3012 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3013
3014 if (ev->status && conn->state == BT_CONNECTED) {
3015 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3016 hci_conn_drop(conn);
3017 goto unlock;
3018 }
3019
3020 if (conn->state == BT_CONFIG) {
3021 if (!ev->status)
3022 conn->state = BT_CONNECTED;
3023
3024 hci_proto_connect_cfm(conn, ev->status);
3025 hci_conn_drop(conn);
3026 } else {
3027 hci_auth_cfm(conn, ev->status);
3028
3029 hci_conn_hold(conn);
3030 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3031 hci_conn_drop(conn);
3032 }
3033
3034unlock:
3035 hci_dev_unlock(hdev);
3036}
3037
3038static u8 hci_get_auth_req(struct hci_conn *conn)
3039{
3040 /* If remote requests dedicated bonding follow that lead */
3041 if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3042 conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3043 /* If both remote and local IO capabilities allow MITM
3044 * protection then require it, otherwise don't */
3045 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3046 conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3047 return HCI_AT_DEDICATED_BONDING;
3048 else
3049 return HCI_AT_DEDICATED_BONDING_MITM;
3050 }
3051
3052 /* If remote requests no-bonding follow that lead */
3053 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3054 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3055 return conn->remote_auth | (conn->auth_type & 0x01);
3056
3057 return conn->auth_type;
3058}
3059
3060static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3061{
3062 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3063 struct hci_conn *conn;
3064
3065 BT_DBG("%s", hdev->name);
3066
3067 hci_dev_lock(hdev);
3068
3069 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3070 if (!conn)
3071 goto unlock;
3072
3073 hci_conn_hold(conn);
3074
3075 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3076 goto unlock;
3077
3078 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3079 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3080 struct hci_cp_io_capability_reply cp;
3081
3082 bacpy(&cp.bdaddr, &ev->bdaddr);
3083 /* Change the IO capability from KeyboardDisplay
3084 * to DisplayYesNo as it is not supported by BT spec. */
3085 cp.capability = (conn->io_capability == 0x04) ?
3086 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3087 conn->auth_type = hci_get_auth_req(conn);
3088 cp.authentication = conn->auth_type;
3089
3090 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3091 (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3092 cp.oob_data = 0x01;
3093 else
3094 cp.oob_data = 0x00;
3095
3096 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3097 sizeof(cp), &cp);
3098 } else {
3099 struct hci_cp_io_capability_neg_reply cp;
3100
3101 bacpy(&cp.bdaddr, &ev->bdaddr);
3102 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3103
3104 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3105 sizeof(cp), &cp);
3106 }
3107
3108unlock:
3109 hci_dev_unlock(hdev);
3110}
3111
3112static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3113{
3114 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3115 struct hci_conn *conn;
3116
3117 BT_DBG("%s", hdev->name);
3118
3119 hci_dev_lock(hdev);
3120
3121 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3122 if (!conn)
3123 goto unlock;
3124
3125 conn->remote_cap = ev->capability;
3126 conn->remote_auth = ev->authentication;
3127 if (ev->oob_data)
3128 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3129
3130unlock:
3131 hci_dev_unlock(hdev);
3132}
3133
3134static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3135 struct sk_buff *skb)
3136{
3137 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3138 int loc_mitm, rem_mitm, confirm_hint = 0;
3139 struct hci_conn *conn;
3140
3141 BT_DBG("%s", hdev->name);
3142
3143 hci_dev_lock(hdev);
3144
3145 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3146 goto unlock;
3147
3148 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3149 if (!conn)
3150 goto unlock;
3151
3152 loc_mitm = (conn->auth_type & 0x01);
3153 rem_mitm = (conn->remote_auth & 0x01);
3154
3155 /* If we require MITM but the remote device can't provide that
3156 * (it has NoInputNoOutput) then reject the confirmation
3157 * request. The only exception is when we're dedicated bonding
3158 * initiators (connect_cfm_cb set) since then we always have the MITM
3159 * bit set. */
3160 if (!conn->connect_cfm_cb && loc_mitm &&
3161 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3162 BT_DBG("Rejecting request: remote device can't provide MITM");
3163 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3164 sizeof(ev->bdaddr), &ev->bdaddr);
3165 goto unlock;
3166 }
3167
3168 /* If no side requires MITM protection; auto-accept */
3169 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3170 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3171
3172 /* If we're not the initiators request authorization to
3173 * proceed from user space (mgmt_user_confirm with
3174 * confirm_hint set to 1). */
3175 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3176 BT_DBG("Confirming auto-accept as acceptor");
3177 confirm_hint = 1;
3178 goto confirm;
3179 }
3180
3181 BT_DBG("Auto-accept of user confirmation with %ums delay",
3182 hdev->auto_accept_delay);
3183
3184 if (hdev->auto_accept_delay > 0) {
3185 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3186 queue_delayed_work(conn->hdev->workqueue,
3187 &conn->auto_accept_work, delay);
3188 goto unlock;
3189 }
3190
3191 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3192 sizeof(ev->bdaddr), &ev->bdaddr);
3193 goto unlock;
3194 }
3195
3196confirm:
3197 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3198 confirm_hint);
3199
3200unlock:
3201 hci_dev_unlock(hdev);
3202}
3203
3204static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3205 struct sk_buff *skb)
3206{
3207 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3208
3209 BT_DBG("%s", hdev->name);
3210
3211 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3212 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3213}
3214
3215static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3216 struct sk_buff *skb)
3217{
3218 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3219 struct hci_conn *conn;
3220
3221 BT_DBG("%s", hdev->name);
3222
3223 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3224 if (!conn)
3225 return;
3226
3227 conn->passkey_notify = __le32_to_cpu(ev->passkey);
3228 conn->passkey_entered = 0;
3229
3230 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3231 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3232 conn->dst_type, conn->passkey_notify,
3233 conn->passkey_entered);
3234}
3235
3236static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3237{
3238 struct hci_ev_keypress_notify *ev = (void *) skb->data;
3239 struct hci_conn *conn;
3240
3241 BT_DBG("%s", hdev->name);
3242
3243 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3244 if (!conn)
3245 return;
3246
3247 switch (ev->type) {
3248 case HCI_KEYPRESS_STARTED:
3249 conn->passkey_entered = 0;
3250 return;
3251
3252 case HCI_KEYPRESS_ENTERED:
3253 conn->passkey_entered++;
3254 break;
3255
3256 case HCI_KEYPRESS_ERASED:
3257 conn->passkey_entered--;
3258 break;
3259
3260 case HCI_KEYPRESS_CLEARED:
3261 conn->passkey_entered = 0;
3262 break;
3263
3264 case HCI_KEYPRESS_COMPLETED:
3265 return;
3266 }
3267
3268 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3269 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3270 conn->dst_type, conn->passkey_notify,
3271 conn->passkey_entered);
3272}
3273
3274static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3275 struct sk_buff *skb)
3276{
3277 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3278 struct hci_conn *conn;
3279
3280 BT_DBG("%s", hdev->name);
3281
3282 hci_dev_lock(hdev);
3283
3284 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3285 if (!conn)
3286 goto unlock;
3287
3288 /* To avoid duplicate auth_failed events to user space we check
3289 * the HCI_CONN_AUTH_PEND flag which will be set if we
3290 * initiated the authentication. A traditional auth_complete
3291 * event gets always produced as initiator and is also mapped to
3292 * the mgmt_auth_failed event */
3293 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3294 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3295 ev->status);
3296
3297 hci_conn_drop(conn);
3298
3299unlock:
3300 hci_dev_unlock(hdev);
3301}
3302
3303static void hci_remote_host_features_evt(struct hci_dev *hdev,
3304 struct sk_buff *skb)
3305{
3306 struct hci_ev_remote_host_features *ev = (void *) skb->data;
3307 struct inquiry_entry *ie;
3308 struct hci_conn *conn;
3309
3310 BT_DBG("%s", hdev->name);
3311
3312 hci_dev_lock(hdev);
3313
3314 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3315 if (conn)
3316 memcpy(conn->features[1], ev->features, 8);
3317
3318 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3319 if (ie)
3320 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3321
3322 hci_dev_unlock(hdev);
3323}
3324
3325static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3326 struct sk_buff *skb)
3327{
3328 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3329 struct oob_data *data;
3330
3331 BT_DBG("%s", hdev->name);
3332
3333 hci_dev_lock(hdev);
3334
3335 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3336 goto unlock;
3337
3338 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3339 if (data) {
3340 struct hci_cp_remote_oob_data_reply cp;
3341
3342 bacpy(&cp.bdaddr, &ev->bdaddr);
3343 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3344 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3345
3346 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3347 &cp);
3348 } else {
3349 struct hci_cp_remote_oob_data_neg_reply cp;
3350
3351 bacpy(&cp.bdaddr, &ev->bdaddr);
3352 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3353 &cp);
3354 }
3355
3356unlock:
3357 hci_dev_unlock(hdev);
3358}
3359
3360static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3361 struct sk_buff *skb)
3362{
3363 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3364 struct hci_conn *hcon, *bredr_hcon;
3365
3366 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3367 ev->status);
3368
3369 hci_dev_lock(hdev);
3370
3371 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3372 if (!hcon) {
3373 hci_dev_unlock(hdev);
3374 return;
3375 }
3376
3377 if (ev->status) {
3378 hci_conn_del(hcon);
3379 hci_dev_unlock(hdev);
3380 return;
3381 }
3382
3383 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3384
3385 hcon->state = BT_CONNECTED;
3386 bacpy(&hcon->dst, &bredr_hcon->dst);
3387
3388 hci_conn_hold(hcon);
3389 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3390 hci_conn_drop(hcon);
3391
3392 hci_conn_add_sysfs(hcon);
3393
3394 amp_physical_cfm(bredr_hcon, hcon);
3395
3396 hci_dev_unlock(hdev);
3397}
3398
3399static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3400{
3401 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3402 struct hci_conn *hcon;
3403 struct hci_chan *hchan;
3404 struct amp_mgr *mgr;
3405
3406 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3407 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3408 ev->status);
3409
3410 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3411 if (!hcon)
3412 return;
3413
3414 /* Create AMP hchan */
3415 hchan = hci_chan_create(hcon);
3416 if (!hchan)
3417 return;
3418
3419 hchan->handle = le16_to_cpu(ev->handle);
3420
3421 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3422
3423 mgr = hcon->amp_mgr;
3424 if (mgr && mgr->bredr_chan) {
3425 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3426
3427 l2cap_chan_lock(bredr_chan);
3428
3429 bredr_chan->conn->mtu = hdev->block_mtu;
3430 l2cap_logical_cfm(bredr_chan, hchan, 0);
3431 hci_conn_hold(hcon);
3432
3433 l2cap_chan_unlock(bredr_chan);
3434 }
3435}
3436
3437static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3438 struct sk_buff *skb)
3439{
3440 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3441 struct hci_chan *hchan;
3442
3443 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3444 le16_to_cpu(ev->handle), ev->status);
3445
3446 if (ev->status)
3447 return;
3448
3449 hci_dev_lock(hdev);
3450
3451 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3452 if (!hchan)
3453 goto unlock;
3454
3455 amp_destroy_logical_link(hchan, ev->reason);
3456
3457unlock:
3458 hci_dev_unlock(hdev);
3459}
3460
3461static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3462 struct sk_buff *skb)
3463{
3464 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3465 struct hci_conn *hcon;
3466
3467 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3468
3469 if (ev->status)
3470 return;
3471
3472 hci_dev_lock(hdev);
3473
3474 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3475 if (hcon) {
3476 hcon->state = BT_CLOSED;
3477 hci_conn_del(hcon);
3478 }
3479
3480 hci_dev_unlock(hdev);
3481}
3482
3483static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3484{
3485 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3486 struct hci_conn *conn;
3487
3488 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3489
3490 hci_dev_lock(hdev);
3491
3492 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3493 if (!conn) {
3494 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3495 if (!conn) {
3496 BT_ERR("No memory for new connection");
3497 goto unlock;
3498 }
3499
3500 conn->dst_type = ev->bdaddr_type;
3501
3502 /* The advertising parameters for own address type
3503 * define which source address and source address
3504 * type this connections has.
3505 */
3506 if (bacmp(&conn->src, BDADDR_ANY)) {
3507 conn->src_type = ADDR_LE_DEV_PUBLIC;
3508 } else {
3509 bacpy(&conn->src, &hdev->static_addr);
3510 conn->src_type = ADDR_LE_DEV_RANDOM;
3511 }
3512
3513 if (ev->role == LE_CONN_ROLE_MASTER) {
3514 conn->out = true;
3515 conn->link_mode |= HCI_LM_MASTER;
3516 }
3517 }
3518
3519 if (ev->status) {
3520 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3521 conn->dst_type, ev->status);
3522 hci_proto_connect_cfm(conn, ev->status);
3523 conn->state = BT_CLOSED;
3524 hci_conn_del(conn);
3525 goto unlock;
3526 }
3527
3528 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3529 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3530 conn->dst_type, 0, NULL, 0, NULL);
3531
3532 conn->sec_level = BT_SECURITY_LOW;
3533 conn->handle = __le16_to_cpu(ev->handle);
3534 conn->state = BT_CONNECTED;
3535
3536 hci_conn_add_sysfs(conn);
3537
3538 hci_proto_connect_cfm(conn, ev->status);
3539
3540unlock:
3541 hci_dev_unlock(hdev);
3542}
3543
3544static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3545{
3546 u8 num_reports = skb->data[0];
3547 void *ptr = &skb->data[1];
3548 s8 rssi;
3549
3550 while (num_reports--) {
3551 struct hci_ev_le_advertising_info *ev = ptr;
3552
3553 rssi = ev->data[ev->length];
3554 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3555 NULL, rssi, 0, 1, ev->data, ev->length);
3556
3557 ptr += sizeof(*ev) + ev->length + 1;
3558 }
3559}
3560
3561static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3562{
3563 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3564 struct hci_cp_le_ltk_reply cp;
3565 struct hci_cp_le_ltk_neg_reply neg;
3566 struct hci_conn *conn;
3567 struct smp_ltk *ltk;
3568
3569 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3570
3571 hci_dev_lock(hdev);
3572
3573 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3574 if (conn == NULL)
3575 goto not_found;
3576
3577 ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3578 if (ltk == NULL)
3579 goto not_found;
3580
3581 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3582 cp.handle = cpu_to_le16(conn->handle);
3583
3584 if (ltk->authenticated)
3585 conn->pending_sec_level = BT_SECURITY_HIGH;
3586 else
3587 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3588
3589 conn->enc_key_size = ltk->enc_size;
3590
3591 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3592
3593 if (ltk->type & HCI_SMP_STK) {
3594 list_del(&ltk->list);
3595 kfree(ltk);
3596 }
3597
3598 hci_dev_unlock(hdev);
3599
3600 return;
3601
3602not_found:
3603 neg.handle = ev->handle;
3604 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3605 hci_dev_unlock(hdev);
3606}
3607
3608static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3609{
3610 struct hci_ev_le_meta *le_ev = (void *) skb->data;
3611
3612 skb_pull(skb, sizeof(*le_ev));
3613
3614 switch (le_ev->subevent) {
3615 case HCI_EV_LE_CONN_COMPLETE:
3616 hci_le_conn_complete_evt(hdev, skb);
3617 break;
3618
3619 case HCI_EV_LE_ADVERTISING_REPORT:
3620 hci_le_adv_report_evt(hdev, skb);
3621 break;
3622
3623 case HCI_EV_LE_LTK_REQ:
3624 hci_le_ltk_request_evt(hdev, skb);
3625 break;
3626
3627 default:
3628 break;
3629 }
3630}
3631
3632static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3633{
3634 struct hci_ev_channel_selected *ev = (void *) skb->data;
3635 struct hci_conn *hcon;
3636
3637 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3638
3639 skb_pull(skb, sizeof(*ev));
3640
3641 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3642 if (!hcon)
3643 return;
3644
3645 amp_read_loc_assoc_final_data(hdev, hcon);
3646}
3647
3648void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3649{
3650 struct hci_event_hdr *hdr = (void *) skb->data;
3651 __u8 event = hdr->evt;
3652
3653 hci_dev_lock(hdev);
3654
3655 /* Received events are (currently) only needed when a request is
3656 * ongoing so avoid unnecessary memory allocation.
3657 */
3658 if (hdev->req_status == HCI_REQ_PEND) {
3659 kfree_skb(hdev->recv_evt);
3660 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
3661 }
3662
3663 hci_dev_unlock(hdev);
3664
3665 skb_pull(skb, HCI_EVENT_HDR_SIZE);
3666
3667 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
3668 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
3669 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
3670
3671 hci_req_cmd_complete(hdev, opcode, 0);
3672 }
3673
3674 switch (event) {
3675 case HCI_EV_INQUIRY_COMPLETE:
3676 hci_inquiry_complete_evt(hdev, skb);
3677 break;
3678
3679 case HCI_EV_INQUIRY_RESULT:
3680 hci_inquiry_result_evt(hdev, skb);
3681 break;
3682
3683 case HCI_EV_CONN_COMPLETE:
3684 hci_conn_complete_evt(hdev, skb);
3685 break;
3686
3687 case HCI_EV_CONN_REQUEST:
3688 hci_conn_request_evt(hdev, skb);
3689 break;
3690
3691 case HCI_EV_DISCONN_COMPLETE:
3692 hci_disconn_complete_evt(hdev, skb);
3693 break;
3694
3695 case HCI_EV_AUTH_COMPLETE:
3696 hci_auth_complete_evt(hdev, skb);
3697 break;
3698
3699 case HCI_EV_REMOTE_NAME:
3700 hci_remote_name_evt(hdev, skb);
3701 break;
3702
3703 case HCI_EV_ENCRYPT_CHANGE:
3704 hci_encrypt_change_evt(hdev, skb);
3705 break;
3706
3707 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3708 hci_change_link_key_complete_evt(hdev, skb);
3709 break;
3710
3711 case HCI_EV_REMOTE_FEATURES:
3712 hci_remote_features_evt(hdev, skb);
3713 break;
3714
3715 case HCI_EV_CMD_COMPLETE:
3716 hci_cmd_complete_evt(hdev, skb);
3717 break;
3718
3719 case HCI_EV_CMD_STATUS:
3720 hci_cmd_status_evt(hdev, skb);
3721 break;
3722
3723 case HCI_EV_ROLE_CHANGE:
3724 hci_role_change_evt(hdev, skb);
3725 break;
3726
3727 case HCI_EV_NUM_COMP_PKTS:
3728 hci_num_comp_pkts_evt(hdev, skb);
3729 break;
3730
3731 case HCI_EV_MODE_CHANGE:
3732 hci_mode_change_evt(hdev, skb);
3733 break;
3734
3735 case HCI_EV_PIN_CODE_REQ:
3736 hci_pin_code_request_evt(hdev, skb);
3737 break;
3738
3739 case HCI_EV_LINK_KEY_REQ:
3740 hci_link_key_request_evt(hdev, skb);
3741 break;
3742
3743 case HCI_EV_LINK_KEY_NOTIFY:
3744 hci_link_key_notify_evt(hdev, skb);
3745 break;
3746
3747 case HCI_EV_CLOCK_OFFSET:
3748 hci_clock_offset_evt(hdev, skb);
3749 break;
3750
3751 case HCI_EV_PKT_TYPE_CHANGE:
3752 hci_pkt_type_change_evt(hdev, skb);
3753 break;
3754
3755 case HCI_EV_PSCAN_REP_MODE:
3756 hci_pscan_rep_mode_evt(hdev, skb);
3757 break;
3758
3759 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3760 hci_inquiry_result_with_rssi_evt(hdev, skb);
3761 break;
3762
3763 case HCI_EV_REMOTE_EXT_FEATURES:
3764 hci_remote_ext_features_evt(hdev, skb);
3765 break;
3766
3767 case HCI_EV_SYNC_CONN_COMPLETE:
3768 hci_sync_conn_complete_evt(hdev, skb);
3769 break;
3770
3771 case HCI_EV_EXTENDED_INQUIRY_RESULT:
3772 hci_extended_inquiry_result_evt(hdev, skb);
3773 break;
3774
3775 case HCI_EV_KEY_REFRESH_COMPLETE:
3776 hci_key_refresh_complete_evt(hdev, skb);
3777 break;
3778
3779 case HCI_EV_IO_CAPA_REQUEST:
3780 hci_io_capa_request_evt(hdev, skb);
3781 break;
3782
3783 case HCI_EV_IO_CAPA_REPLY:
3784 hci_io_capa_reply_evt(hdev, skb);
3785 break;
3786
3787 case HCI_EV_USER_CONFIRM_REQUEST:
3788 hci_user_confirm_request_evt(hdev, skb);
3789 break;
3790
3791 case HCI_EV_USER_PASSKEY_REQUEST:
3792 hci_user_passkey_request_evt(hdev, skb);
3793 break;
3794
3795 case HCI_EV_USER_PASSKEY_NOTIFY:
3796 hci_user_passkey_notify_evt(hdev, skb);
3797 break;
3798
3799 case HCI_EV_KEYPRESS_NOTIFY:
3800 hci_keypress_notify_evt(hdev, skb);
3801 break;
3802
3803 case HCI_EV_SIMPLE_PAIR_COMPLETE:
3804 hci_simple_pair_complete_evt(hdev, skb);
3805 break;
3806
3807 case HCI_EV_REMOTE_HOST_FEATURES:
3808 hci_remote_host_features_evt(hdev, skb);
3809 break;
3810
3811 case HCI_EV_LE_META:
3812 hci_le_meta_evt(hdev, skb);
3813 break;
3814
3815 case HCI_EV_CHANNEL_SELECTED:
3816 hci_chan_selected_evt(hdev, skb);
3817 break;
3818
3819 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3820 hci_remote_oob_data_request_evt(hdev, skb);
3821 break;
3822
3823 case HCI_EV_PHY_LINK_COMPLETE:
3824 hci_phy_link_complete_evt(hdev, skb);
3825 break;
3826
3827 case HCI_EV_LOGICAL_LINK_COMPLETE:
3828 hci_loglink_complete_evt(hdev, skb);
3829 break;
3830
3831 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3832 hci_disconn_loglink_complete_evt(hdev, skb);
3833 break;
3834
3835 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3836 hci_disconn_phylink_complete_evt(hdev, skb);
3837 break;
3838
3839 case HCI_EV_NUM_COMP_BLOCKS:
3840 hci_num_comp_blocks_evt(hdev, skb);
3841 break;
3842
3843 default:
3844 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3845 break;
3846 }
3847
3848 kfree_skb(skb);
3849 hdev->stat.evt_rx++;
3850}
Linux kernel - Deliverables
This page took 0.041251 seconds and 5 git commands to generate.